diff --git a/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch b/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch deleted file mode 100644 index eabc8b77fb..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.58-59.patch +++ /dev/null @@ -1,9141 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio -index 680451695422..c3767d4d01a6 100644 ---- a/Documentation/ABI/testing/sysfs-bus-iio -+++ b/Documentation/ABI/testing/sysfs-bus-iio -@@ -1566,7 +1566,8 @@ What: /sys/bus/iio/devices/iio:deviceX/in_concentrationX_voc_raw - KernelVersion: 4.3 - Contact: linux-iio@vger.kernel.org - Description: -- Raw (unscaled no offset etc.) percentage reading of a substance. -+ Raw (unscaled no offset etc.) reading of a substance. Units -+ after application of scale and offset are percents. - - What: /sys/bus/iio/devices/iio:deviceX/in_resistance_raw - What: /sys/bus/iio/devices/iio:deviceX/in_resistanceX_raw -diff --git a/Makefile b/Makefile -index 29948bc4a0d2..cc72b8472f24 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 58 -+SUBLEVEL = 59 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/r8a7793-gose.dts b/arch/arm/boot/dts/r8a7793-gose.dts -index 42f3313e6988..9f507393c375 100644 ---- a/arch/arm/boot/dts/r8a7793-gose.dts -+++ b/arch/arm/boot/dts/r8a7793-gose.dts -@@ -339,7 +339,7 @@ - reg = <0x20>; - remote = <&vin1>; - -- port { -+ ports { - #address-cells = <1>; - #size-cells = <0>; - -@@ -399,7 +399,7 @@ - interrupts = <2 IRQ_TYPE_LEVEL_LOW>; - default-input = <0>; - -- port { -+ ports { - #address-cells = <1>; - #size-cells = <0>; - -diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi -index 22466afd38a3..235994a4a2eb 100644 ---- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi -+++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus-v1.2.dtsi -@@ -16,15 +16,27 @@ - regulator-type = "voltage"; - regulator-boot-on; - regulator-always-on; -- regulator-min-microvolt = <1100000>; -- regulator-max-microvolt = <1300000>; -+ regulator-min-microvolt = <1108475>; -+ regulator-max-microvolt = <1308475>; - regulator-ramp-delay = <50>; /* 4ms */ - gpios = <&r_pio 0 1 GPIO_ACTIVE_HIGH>; /* PL1 */ - gpios-states = <0x1>; -- states = <1100000 0>, <1300000 1>; -+ states = <1108475 0>, <1308475 1>; - }; - }; - - &cpu0 { - cpu-supply = <®_vdd_cpux>; - }; -+ -+&cpu1 { -+ cpu-supply = <®_vdd_cpux>; -+}; -+ -+&cpu2 { -+ cpu-supply = <®_vdd_cpux>; -+}; -+ -+&cpu3 { -+ cpu-supply = <®_vdd_cpux>; -+}; -diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c -index 71778bb0475b..a082f6e4f0f4 100644 ---- a/arch/arm/kernel/stacktrace.c -+++ b/arch/arm/kernel/stacktrace.c -@@ -22,6 +22,19 @@ - * A simple function epilogue looks like this: - * ldm sp, {fp, sp, pc} - * -+ * When compiled with clang, pc and sp are not pushed. A simple function -+ * prologue looks like this when built with clang: -+ * -+ * stmdb {..., fp, lr} -+ * add fp, sp, #x -+ * sub sp, sp, #y -+ * -+ * A simple function epilogue looks like this when built with clang: -+ * -+ * sub sp, fp, #x -+ * ldm {..., fp, pc} -+ * -+ * - * Note that with framepointer enabled, even the leaf functions have the same - * prologue and epilogue, therefore we can ignore the LR value in this case. - */ -@@ -34,6 +47,16 @@ int notrace unwind_frame(struct stackframe *frame) - low = frame->sp; - high = ALIGN(low, THREAD_SIZE); - -+#ifdef CONFIG_CC_IS_CLANG -+ /* check current frame pointer is within bounds */ -+ if (fp < low + 4 || fp > high - 4) -+ return -EINVAL; -+ -+ frame->sp = frame->fp; -+ frame->fp = *(unsigned long *)(fp); -+ frame->pc = frame->lr; -+ frame->lr = *(unsigned long *)(fp + 4); -+#else - /* check current frame pointer is within bounds */ - if (fp < low + 12 || fp > high - 4) - return -EINVAL; -@@ -42,6 +65,7 @@ int notrace unwind_frame(struct stackframe *frame) - frame->fp = *(unsigned long *)(fp - 12); - frame->sp = *(unsigned long *)(fp - 8); - frame->pc = *(unsigned long *)(fp - 4); -+#endif - - return 0; - } -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index 52665f30d236..6bc3000deb86 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -592,13 +592,13 @@ static void __init at91_pm_sram_init(void) - sram_pool = gen_pool_get(&pdev->dev, NULL); - if (!sram_pool) { - pr_warn("%s: sram pool unavailable!\n", __func__); -- return; -+ goto out_put_device; - } - - sram_base = gen_pool_alloc(sram_pool, at91_pm_suspend_in_sram_sz); - if (!sram_base) { - pr_warn("%s: unable to alloc sram!\n", __func__); -- return; -+ goto out_put_device; - } - - sram_pbase = gen_pool_virt_to_phys(sram_pool, sram_base); -@@ -606,12 +606,17 @@ static void __init at91_pm_sram_init(void) - at91_pm_suspend_in_sram_sz, false); - if (!at91_suspend_sram_fn) { - pr_warn("SRAM: Could not map\n"); -- return; -+ goto out_put_device; - } - - /* Copy the pm suspend handler to SRAM */ - at91_suspend_sram_fn = fncpy(at91_suspend_sram_fn, - &at91_pm_suspend_in_sram, at91_pm_suspend_in_sram_sz); -+ return; -+ -+out_put_device: -+ put_device(&pdev->dev); -+ return; - } - - static bool __init at91_is_pm_mode_active(int pm_mode) -diff --git a/arch/arm/mach-exynos/mcpm-exynos.c b/arch/arm/mach-exynos/mcpm-exynos.c -index 9a681b421ae1..cd861c57d5ad 100644 ---- a/arch/arm/mach-exynos/mcpm-exynos.c -+++ b/arch/arm/mach-exynos/mcpm-exynos.c -@@ -26,6 +26,7 @@ - #define EXYNOS5420_USE_L2_COMMON_UP_STATE BIT(30) - - static void __iomem *ns_sram_base_addr __ro_after_init; -+static bool secure_firmware __ro_after_init; - - /* - * The common v7_exit_coherency_flush API could not be used because of the -@@ -58,15 +59,16 @@ static void __iomem *ns_sram_base_addr __ro_after_init; - static int exynos_cpu_powerup(unsigned int cpu, unsigned int cluster) - { - unsigned int cpunr = cpu + (cluster * EXYNOS5420_CPUS_PER_CLUSTER); -+ bool state; - - pr_debug("%s: cpu %u cluster %u\n", __func__, cpu, cluster); - if (cpu >= EXYNOS5420_CPUS_PER_CLUSTER || - cluster >= EXYNOS5420_NR_CLUSTERS) - return -EINVAL; - -- if (!exynos_cpu_power_state(cpunr)) { -- exynos_cpu_power_up(cpunr); -- -+ state = exynos_cpu_power_state(cpunr); -+ exynos_cpu_power_up(cpunr); -+ if (!state && secure_firmware) { - /* - * This assumes the cluster number of the big cores(Cortex A15) - * is 0 and the Little cores(Cortex A7) is 1. -@@ -258,6 +260,8 @@ static int __init exynos_mcpm_init(void) - return -ENOMEM; - } - -+ secure_firmware = exynos_secure_firmware_available(); -+ - /* - * To increase the stability of KFC reset we need to program - * the PMU SPARE3 register -diff --git a/arch/arm/mach-socfpga/pm.c b/arch/arm/mach-socfpga/pm.c -index 6ed887cf8dc9..365c0428b21b 100644 ---- a/arch/arm/mach-socfpga/pm.c -+++ b/arch/arm/mach-socfpga/pm.c -@@ -49,14 +49,14 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!ocram_pool) { - pr_warn("%s: ocram pool unavailable!\n", __func__); - ret = -ENODEV; -- goto put_node; -+ goto put_device; - } - - ocram_base = gen_pool_alloc(ocram_pool, socfpga_sdram_self_refresh_sz); - if (!ocram_base) { - pr_warn("%s: unable to alloc ocram!\n", __func__); - ret = -ENOMEM; -- goto put_node; -+ goto put_device; - } - - ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); -@@ -67,7 +67,7 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!suspend_ocram_base) { - pr_warn("%s: __arm_ioremap_exec failed!\n", __func__); - ret = -ENOMEM; -- goto put_node; -+ goto put_device; - } - - /* Copy the code that puts DDR in self refresh to ocram */ -@@ -81,6 +81,8 @@ static int socfpga_setup_ocram_self_refresh(void) - if (!socfpga_sdram_self_refresh_in_ocram) - ret = -EFAULT; - -+put_device: -+ put_device(&pdev->dev); - put_node: - of_node_put(np); - -diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts -index 080e0f56e108..61ee7b6a3159 100644 ---- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts -+++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts -@@ -157,6 +157,7 @@ - regulator-min-microvolt = <700000>; - regulator-max-microvolt = <1150000>; - regulator-enable-ramp-delay = <125>; -+ regulator-always-on; - }; - - ldo8_reg: LDO8 { -diff --git a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts -index e035cf195b19..8c4bfbaf3a80 100644 ---- a/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts -+++ b/arch/arm64/boot/dts/hisilicon/hi3660-hikey960.dts -@@ -530,6 +530,17 @@ - status = "ok"; - compatible = "adi,adv7533"; - reg = <0x39>; -+ adi,dsi-lanes = <4>; -+ ports { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ port@0 { -+ reg = <0>; -+ }; -+ port@1 { -+ reg = <1>; -+ }; -+ }; - }; - }; - -diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts -index c14205cd6bf5..3e47150c05ec 100644 ---- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts -+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts -@@ -516,7 +516,7 @@ - reg = <0x39>; - interrupt-parent = <&gpio1>; - interrupts = <1 2>; -- pd-gpio = <&gpio0 4 0>; -+ pd-gpios = <&gpio0 4 0>; - adi,dsi-lanes = <4>; - #sound-dai-cells = <0>; - -diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -index 242aaea68804..1235830ffd0b 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -@@ -508,7 +508,7 @@ - pins = "gpio63", "gpio64", "gpio65", "gpio66", - "gpio67", "gpio68"; - drive-strength = <8>; -- bias-pull-none; -+ bias-disable; - }; - }; - cdc_pdm_lines_sus: pdm_lines_off { -@@ -537,7 +537,7 @@ - pins = "gpio113", "gpio114", "gpio115", - "gpio116"; - drive-strength = <8>; -- bias-pull-none; -+ bias-disable; - }; - }; - -@@ -565,7 +565,7 @@ - pinconf { - pins = "gpio110"; - drive-strength = <8>; -- bias-pull-none; -+ bias-disable; - }; - }; - -@@ -591,7 +591,7 @@ - pinconf { - pins = "gpio116"; - drive-strength = <8>; -- bias-pull-none; -+ bias-disable; - }; - }; - ext_mclk_tlmm_lines_sus: mclk_lines_off { -@@ -619,7 +619,7 @@ - pins = "gpio112", "gpio117", "gpio118", - "gpio119"; - drive-strength = <8>; -- bias-pull-none; -+ bias-disable; - }; - }; - ext_sec_tlmm_lines_sus: tlmm_lines_off { -diff --git a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi -index e17311e09082..216aafd90e7f 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3368-lion.dtsi -@@ -156,7 +156,7 @@ - pinctrl-0 = <&rgmii_pins>; - snps,reset-active-low; - snps,reset-delays-us = <0 10000 50000>; -- snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_HIGH>; -+ snps,reset-gpio = <&gpio3 RK_PB3 GPIO_ACTIVE_LOW>; - tx_delay = <0x10>; - rx_delay = <0x10>; - status = "okay"; -diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -index 62ea288a1a70..45b86933c6ea 100644 ---- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi -@@ -101,7 +101,7 @@ - - vcc5v0_host: vcc5v0-host-regulator { - compatible = "regulator-fixed"; -- gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_HIGH>; -+ gpio = <&gpio4 RK_PA3 GPIO_ACTIVE_LOW>; - enable-active-low; - pinctrl-names = "default"; - pinctrl-0 = <&vcc5v0_host_en>; -@@ -157,7 +157,7 @@ - phy-mode = "rgmii"; - pinctrl-names = "default"; - pinctrl-0 = <&rgmii_pins>; -- snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_HIGH>; -+ snps,reset-gpio = <&gpio3 RK_PC0 GPIO_ACTIVE_LOW>; - snps,reset-active-low; - snps,reset-delays-us = <0 10000 50000>; - tx_delay = <0x10>; -diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c -index 9bfa17015768..c432bfafe63e 100644 ---- a/arch/m68k/mac/iop.c -+++ b/arch/m68k/mac/iop.c -@@ -183,7 +183,7 @@ static __inline__ void iop_writeb(volatile struct mac_iop *iop, __u16 addr, __u8 - - static __inline__ void iop_stop(volatile struct mac_iop *iop) - { -- iop->status_ctrl &= ~IOP_RUN; -+ iop->status_ctrl = IOP_AUTOINC; - } - - static __inline__ void iop_start(volatile struct mac_iop *iop) -@@ -191,14 +191,9 @@ static __inline__ void iop_start(volatile struct mac_iop *iop) - iop->status_ctrl = IOP_RUN | IOP_AUTOINC; - } - --static __inline__ void iop_bypass(volatile struct mac_iop *iop) --{ -- iop->status_ctrl |= IOP_BYPASS; --} -- - static __inline__ void iop_interrupt(volatile struct mac_iop *iop) - { -- iop->status_ctrl |= IOP_IRQ; -+ iop->status_ctrl = IOP_IRQ | IOP_RUN | IOP_AUTOINC; - } - - static int iop_alive(volatile struct mac_iop *iop) -@@ -244,7 +239,6 @@ void __init iop_preinit(void) - } else { - iop_base[IOP_NUM_SCC] = (struct mac_iop *) SCC_IOP_BASE_QUADRA; - } -- iop_base[IOP_NUM_SCC]->status_ctrl = 0x87; - iop_scc_present = 1; - } else { - iop_base[IOP_NUM_SCC] = NULL; -@@ -256,7 +250,7 @@ void __init iop_preinit(void) - } else { - iop_base[IOP_NUM_ISM] = (struct mac_iop *) ISM_IOP_BASE_QUADRA; - } -- iop_base[IOP_NUM_ISM]->status_ctrl = 0; -+ iop_stop(iop_base[IOP_NUM_ISM]); - iop_ism_present = 1; - } else { - iop_base[IOP_NUM_ISM] = NULL; -@@ -416,7 +410,8 @@ static void iop_handle_send(uint iop_num, uint chan) - msg->status = IOP_MSGSTATUS_UNUSED; - msg = msg->next; - iop_send_queue[iop_num][chan] = msg; -- if (msg) iop_do_send(msg); -+ if (msg && iop_readb(iop, IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) -+ iop_do_send(msg); - } - - /* -@@ -490,16 +485,12 @@ int iop_send_message(uint iop_num, uint chan, void *privdata, - - if (!(q = iop_send_queue[iop_num][chan])) { - iop_send_queue[iop_num][chan] = msg; -+ iop_do_send(msg); - } else { - while (q->next) q = q->next; - q->next = msg; - } - -- if (iop_readb(iop_base[iop_num], -- IOP_ADDR_SEND_STATE + chan) == IOP_MSG_IDLE) { -- iop_do_send(msg); -- } -- - return 0; - } - -diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c -index cc88a08bc1f7..4017398519cf 100644 ---- a/arch/mips/cavium-octeon/octeon-usb.c -+++ b/arch/mips/cavium-octeon/octeon-usb.c -@@ -518,6 +518,7 @@ static int __init dwc3_octeon_device_init(void) - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (res == NULL) { -+ put_device(&pdev->dev); - dev_err(&pdev->dev, "No memory resources\n"); - return -ENXIO; - } -@@ -529,8 +530,10 @@ static int __init dwc3_octeon_device_init(void) - * know the difference. - */ - base = devm_ioremap_resource(&pdev->dev, res); -- if (IS_ERR(base)) -+ if (IS_ERR(base)) { -+ put_device(&pdev->dev); - return PTR_ERR(base); -+ } - - mutex_lock(&dwc3_octeon_clocks_mutex); - dwc3_octeon_clocks_start(&pdev->dev, (u64)base); -diff --git a/arch/mips/pci/pci-xtalk-bridge.c b/arch/mips/pci/pci-xtalk-bridge.c -index 6ce76b18186e..c4b1c6cf2660 100644 ---- a/arch/mips/pci/pci-xtalk-bridge.c -+++ b/arch/mips/pci/pci-xtalk-bridge.c -@@ -539,6 +539,7 @@ err_free_resource: - pci_free_resource_list(&host->windows); - err_remove_domain: - irq_domain_remove(domain); -+ irq_domain_free_fwnode(fn); - return err; - } - -@@ -546,8 +547,10 @@ static int bridge_remove(struct platform_device *pdev) - { - struct pci_bus *bus = platform_get_drvdata(pdev); - struct bridge_controller *bc = BRIDGE_CONTROLLER(bus); -+ struct fwnode_handle *fn = bc->domain->fwnode; - - irq_domain_remove(bc->domain); -+ irq_domain_free_fwnode(fn); - pci_lock_rescan_remove(); - pci_stop_root_bus(bus); - pci_remove_root_bus(bus); -diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h -index dbaaca84f27f..640d46edf32e 100644 ---- a/arch/parisc/include/asm/barrier.h -+++ b/arch/parisc/include/asm/barrier.h -@@ -26,6 +26,67 @@ - #define __smp_rmb() mb() - #define __smp_wmb() mb() - -+#define __smp_store_release(p, v) \ -+do { \ -+ typeof(p) __p = (p); \ -+ union { typeof(*p) __val; char __c[1]; } __u = \ -+ { .__val = (__force typeof(*p)) (v) }; \ -+ compiletime_assert_atomic_type(*p); \ -+ switch (sizeof(*p)) { \ -+ case 1: \ -+ asm volatile("stb,ma %0,0(%1)" \ -+ : : "r"(*(__u8 *)__u.__c), "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 2: \ -+ asm volatile("sth,ma %0,0(%1)" \ -+ : : "r"(*(__u16 *)__u.__c), "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 4: \ -+ asm volatile("stw,ma %0,0(%1)" \ -+ : : "r"(*(__u32 *)__u.__c), "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 8: \ -+ if (IS_ENABLED(CONFIG_64BIT)) \ -+ asm volatile("std,ma %0,0(%1)" \ -+ : : "r"(*(__u64 *)__u.__c), "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ } \ -+} while (0) -+ -+#define __smp_load_acquire(p) \ -+({ \ -+ union { typeof(*p) __val; char __c[1]; } __u; \ -+ typeof(p) __p = (p); \ -+ compiletime_assert_atomic_type(*p); \ -+ switch (sizeof(*p)) { \ -+ case 1: \ -+ asm volatile("ldb,ma 0(%1),%0" \ -+ : "=r"(*(__u8 *)__u.__c) : "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 2: \ -+ asm volatile("ldh,ma 0(%1),%0" \ -+ : "=r"(*(__u16 *)__u.__c) : "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 4: \ -+ asm volatile("ldw,ma 0(%1),%0" \ -+ : "=r"(*(__u32 *)__u.__c) : "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ case 8: \ -+ if (IS_ENABLED(CONFIG_64BIT)) \ -+ asm volatile("ldd,ma 0(%1),%0" \ -+ : "=r"(*(__u64 *)__u.__c) : "r"(__p) \ -+ : "memory"); \ -+ break; \ -+ } \ -+ __u.__val; \ -+}) - #include - - #endif /* !__ASSEMBLY__ */ -diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h -index 197d2247e4db..16aec9ba2580 100644 ---- a/arch/parisc/include/asm/spinlock.h -+++ b/arch/parisc/include/asm/spinlock.h -@@ -37,12 +37,8 @@ static inline void arch_spin_unlock(arch_spinlock_t *x) - volatile unsigned int *a; - - a = __ldcw_align(x); --#ifdef CONFIG_SMP -- (void) __ldcw(a); --#else -- mb(); --#endif -- *a = 1; -+ /* Release with ordered store. */ -+ __asm__ __volatile__("stw,ma %0,0(%1)" : : "r"(1), "r"(a) : "memory"); - } - - static inline int arch_spin_trylock(arch_spinlock_t *x) -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index b96d74496977..873bf3434da9 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -454,7 +454,6 @@ - nop - LDREG 0(\ptp),\pte - bb,<,n \pte,_PAGE_PRESENT_BIT,3f -- LDCW 0(\tmp),\tmp1 - b \fault - stw \spc,0(\tmp) - 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) -@@ -464,23 +463,26 @@ - 3: - .endm - -- /* Release pa_tlb_lock lock without reloading lock address. */ -- .macro tlb_unlock0 spc,tmp,tmp1 -+ /* Release pa_tlb_lock lock without reloading lock address. -+ Note that the values in the register spc are limited to -+ NR_SPACE_IDS (262144). Thus, the stw instruction always -+ stores a nonzero value even when register spc is 64 bits. -+ We use an ordered store to ensure all prior accesses are -+ performed prior to releasing the lock. */ -+ .macro tlb_unlock0 spc,tmp - #ifdef CONFIG_SMP - 98: or,COND(=) %r0,\spc,%r0 -- LDCW 0(\tmp),\tmp1 -- or,COND(=) %r0,\spc,%r0 -- stw \spc,0(\tmp) -+ stw,ma \spc,0(\tmp) - 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) - #endif - .endm - - /* Release pa_tlb_lock lock. */ -- .macro tlb_unlock1 spc,tmp,tmp1 -+ .macro tlb_unlock1 spc,tmp - #ifdef CONFIG_SMP - 98: load_pa_tlb_lock \tmp - 99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) -- tlb_unlock0 \spc,\tmp,\tmp1 -+ tlb_unlock0 \spc,\tmp - #endif - .endm - -@@ -1163,7 +1165,7 @@ dtlb_miss_20w: - - idtlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1189,7 +1191,7 @@ nadtlb_miss_20w: - - idtlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1223,7 +1225,7 @@ dtlb_miss_11: - - mtsp t1, %sr1 /* Restore sr1 */ - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1256,7 +1258,7 @@ nadtlb_miss_11: - - mtsp t1, %sr1 /* Restore sr1 */ - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1285,7 +1287,7 @@ dtlb_miss_20: - - idtlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1313,7 +1315,7 @@ nadtlb_miss_20: - - idtlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1420,7 +1422,7 @@ itlb_miss_20w: - - iitlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1444,7 +1446,7 @@ naitlb_miss_20w: - - iitlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1478,7 +1480,7 @@ itlb_miss_11: - - mtsp t1, %sr1 /* Restore sr1 */ - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1502,7 +1504,7 @@ naitlb_miss_11: - - mtsp t1, %sr1 /* Restore sr1 */ - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1532,7 +1534,7 @@ itlb_miss_20: - - iitlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1552,7 +1554,7 @@ naitlb_miss_20: - - iitlbt pte,prot - -- tlb_unlock1 spc,t0,t1 -+ tlb_unlock1 spc,t0 - rfir - nop - -@@ -1582,7 +1584,7 @@ dbit_trap_20w: - - idtlbt pte,prot - -- tlb_unlock0 spc,t0,t1 -+ tlb_unlock0 spc,t0 - rfir - nop - #else -@@ -1608,7 +1610,7 @@ dbit_trap_11: - - mtsp t1, %sr1 /* Restore sr1 */ - -- tlb_unlock0 spc,t0,t1 -+ tlb_unlock0 spc,t0 - rfir - nop - -@@ -1628,7 +1630,7 @@ dbit_trap_20: - - idtlbt pte,prot - -- tlb_unlock0 spc,t0,t1 -+ tlb_unlock0 spc,t0 - rfir - nop - #endif -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index 97ac707c6bff..a37814cb66c7 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -640,11 +640,7 @@ cas_action: - sub,<> %r28, %r25, %r0 - 2: stw %r24, 0(%r26) - /* Free lock */ --#ifdef CONFIG_SMP --98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ --99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) --#endif -- stw %r20, 0(%sr2,%r20) -+ stw,ma %r20, 0(%sr2,%r20) - #if ENABLE_LWS_DEBUG - /* Clear thread register indicator */ - stw %r0, 4(%sr2,%r20) -@@ -658,11 +654,7 @@ cas_action: - 3: - /* Error occurred on load or store */ - /* Free lock */ --#ifdef CONFIG_SMP --98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ --99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) --#endif -- stw %r20, 0(%sr2,%r20) -+ stw,ma %r20, 0(%sr2,%r20) - #if ENABLE_LWS_DEBUG - stw %r0, 4(%sr2,%r20) - #endif -@@ -863,11 +855,7 @@ cas2_action: - - cas2_end: - /* Free lock */ --#ifdef CONFIG_SMP --98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ --99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) --#endif -- stw %r20, 0(%sr2,%r20) -+ stw,ma %r20, 0(%sr2,%r20) - /* Enable interrupts */ - ssm PSW_SM_I, %r0 - /* Return to userspace, set no error */ -@@ -877,11 +865,7 @@ cas2_end: - 22: - /* Error occurred on load or store */ - /* Free lock */ --#ifdef CONFIG_SMP --98: LDCW 0(%sr2,%r20), %r1 /* Barrier */ --99: ALTERNATIVE(98b, 99b, ALT_COND_NO_SMP, INSN_NOP) --#endif -- stw %r20, 0(%sr2,%r20) -+ stw,ma %r20, 0(%sr2,%r20) - ssm PSW_SM_I, %r0 - ldo 1(%r0),%r28 - b lws_exit -diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile -index dfbd7f22eef5..8c69bd07ada6 100644 ---- a/arch/powerpc/boot/Makefile -+++ b/arch/powerpc/boot/Makefile -@@ -119,7 +119,7 @@ src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \ - elf_util.c $(zlib-y) devtree.c stdlib.c \ - oflib.c ofconsole.c cuboot.c - --src-wlib-$(CONFIG_PPC_MPC52XX) += mpc52xx-psc.c -+src-wlib-$(CONFIG_PPC_MPC52xx) += mpc52xx-psc.c - src-wlib-$(CONFIG_PPC64_BOOT_WRAPPER) += opal-calls.S opal.c - ifndef CONFIG_PPC64_BOOT_WRAPPER - src-wlib-y += crtsavres.S -diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c -index 9457863147f9..00179cd6bdd0 100644 ---- a/arch/powerpc/boot/serial.c -+++ b/arch/powerpc/boot/serial.c -@@ -128,7 +128,7 @@ int serial_console_init(void) - dt_is_compatible(devp, "fsl,cpm2-smc-uart")) - rc = cpm_console_init(devp, &serial_cd); - #endif --#ifdef CONFIG_PPC_MPC52XX -+#ifdef CONFIG_PPC_MPC52xx - else if (dt_is_compatible(devp, "fsl,mpc5200-psc-uart")) - rc = mpc5200_psc_console_init(devp, &serial_cd); - #endif -diff --git a/arch/powerpc/include/asm/perf_event.h b/arch/powerpc/include/asm/perf_event.h -index 7426d7a90e1e..7aba3c7ea25c 100644 ---- a/arch/powerpc/include/asm/perf_event.h -+++ b/arch/powerpc/include/asm/perf_event.h -@@ -12,6 +12,8 @@ - - #ifdef CONFIG_PPC_PERF_CTRS - #include -+#else -+static inline bool is_sier_available(void) { return false; } - #endif - - #ifdef CONFIG_FSL_EMB_PERF_EVENT -diff --git a/arch/powerpc/include/asm/ptrace.h b/arch/powerpc/include/asm/ptrace.h -index ee3ada66deb5..c41220f4aad9 100644 ---- a/arch/powerpc/include/asm/ptrace.h -+++ b/arch/powerpc/include/asm/ptrace.h -@@ -203,7 +203,7 @@ do { \ - #endif /* __powerpc64__ */ - - #define arch_has_single_step() (1) --#ifndef CONFIG_BOOK3S_601 -+#ifndef CONFIG_PPC_BOOK3S_601 - #define arch_has_block_step() (true) - #else - #define arch_has_block_step() (false) -diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h -index 3c1887351c71..bd227e0eab07 100644 ---- a/arch/powerpc/include/asm/rtas.h -+++ b/arch/powerpc/include/asm/rtas.h -@@ -368,8 +368,6 @@ extern int rtas_set_indicator_fast(int indicator, int index, int new_value); - extern void rtas_progress(char *s, unsigned short hex); - extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data); - extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data); --extern int rtas_online_cpus_mask(cpumask_var_t cpus); --extern int rtas_offline_cpus_mask(cpumask_var_t cpus); - extern int rtas_ibm_suspend_me(u64 handle); - - struct rtc_time; -diff --git a/arch/powerpc/include/asm/timex.h b/arch/powerpc/include/asm/timex.h -index d2d2c4bd8435..6047402b0a4d 100644 ---- a/arch/powerpc/include/asm/timex.h -+++ b/arch/powerpc/include/asm/timex.h -@@ -17,7 +17,7 @@ typedef unsigned long cycles_t; - - static inline cycles_t get_cycles(void) - { -- if (IS_ENABLED(CONFIG_BOOK3S_601)) -+ if (IS_ENABLED(CONFIG_PPC_BOOK3S_601)) - return 0; - - return mftb(); -diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c -index c5fa251b8950..01210593d60c 100644 ---- a/arch/powerpc/kernel/rtas.c -+++ b/arch/powerpc/kernel/rtas.c -@@ -842,96 +842,6 @@ static void rtas_percpu_suspend_me(void *info) - __rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1); - } - --enum rtas_cpu_state { -- DOWN, -- UP, --}; -- --#ifndef CONFIG_SMP --static int rtas_cpu_state_change_mask(enum rtas_cpu_state state, -- cpumask_var_t cpus) --{ -- if (!cpumask_empty(cpus)) { -- cpumask_clear(cpus); -- return -EINVAL; -- } else -- return 0; --} --#else --/* On return cpumask will be altered to indicate CPUs changed. -- * CPUs with states changed will be set in the mask, -- * CPUs with status unchanged will be unset in the mask. */ --static int rtas_cpu_state_change_mask(enum rtas_cpu_state state, -- cpumask_var_t cpus) --{ -- int cpu; -- int cpuret = 0; -- int ret = 0; -- -- if (cpumask_empty(cpus)) -- return 0; -- -- for_each_cpu(cpu, cpus) { -- struct device *dev = get_cpu_device(cpu); -- -- switch (state) { -- case DOWN: -- cpuret = device_offline(dev); -- break; -- case UP: -- cpuret = device_online(dev); -- break; -- } -- if (cpuret < 0) { -- pr_debug("%s: cpu_%s for cpu#%d returned %d.\n", -- __func__, -- ((state == UP) ? "up" : "down"), -- cpu, cpuret); -- if (!ret) -- ret = cpuret; -- if (state == UP) { -- /* clear bits for unchanged cpus, return */ -- cpumask_shift_right(cpus, cpus, cpu); -- cpumask_shift_left(cpus, cpus, cpu); -- break; -- } else { -- /* clear bit for unchanged cpu, continue */ -- cpumask_clear_cpu(cpu, cpus); -- } -- } -- cond_resched(); -- } -- -- return ret; --} --#endif -- --int rtas_online_cpus_mask(cpumask_var_t cpus) --{ -- int ret; -- -- ret = rtas_cpu_state_change_mask(UP, cpus); -- -- if (ret) { -- cpumask_var_t tmp_mask; -- -- if (!alloc_cpumask_var(&tmp_mask, GFP_KERNEL)) -- return ret; -- -- /* Use tmp_mask to preserve cpus mask from first failure */ -- cpumask_copy(tmp_mask, cpus); -- rtas_offline_cpus_mask(tmp_mask); -- free_cpumask_var(tmp_mask); -- } -- -- return ret; --} -- --int rtas_offline_cpus_mask(cpumask_var_t cpus) --{ -- return rtas_cpu_state_change_mask(DOWN, cpus); --} -- - int rtas_ibm_suspend_me(u64 handle) - { - long state; -@@ -939,8 +849,6 @@ int rtas_ibm_suspend_me(u64 handle) - unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; - struct rtas_suspend_me_data data; - DECLARE_COMPLETION_ONSTACK(done); -- cpumask_var_t offline_mask; -- int cpuret; - - if (!rtas_service_present("ibm,suspend-me")) - return -ENOSYS; -@@ -961,9 +869,6 @@ int rtas_ibm_suspend_me(u64 handle) - return -EIO; - } - -- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL)) -- return -ENOMEM; -- - atomic_set(&data.working, 0); - atomic_set(&data.done, 0); - atomic_set(&data.error, 0); -@@ -972,24 +877,8 @@ int rtas_ibm_suspend_me(u64 handle) - - lock_device_hotplug(); - -- /* All present CPUs must be online */ -- cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask); -- cpuret = rtas_online_cpus_mask(offline_mask); -- if (cpuret) { -- pr_err("%s: Could not bring present CPUs online.\n", __func__); -- atomic_set(&data.error, cpuret); -- goto out; -- } -- - cpu_hotplug_disable(); - -- /* Check if we raced with a CPU-Offline Operation */ -- if (!cpumask_equal(cpu_present_mask, cpu_online_mask)) { -- pr_info("%s: Raced against a concurrent CPU-Offline\n", __func__); -- atomic_set(&data.error, -EAGAIN); -- goto out_hotplug_enable; -- } -- - /* Call function on all CPUs. One of us will make the - * rtas call - */ -@@ -1000,18 +889,11 @@ int rtas_ibm_suspend_me(u64 handle) - if (atomic_read(&data.error) != 0) - printk(KERN_ERR "Error doing global join\n"); - --out_hotplug_enable: -- cpu_hotplug_enable(); - -- /* Take down CPUs not online prior to suspend */ -- cpuret = rtas_offline_cpus_mask(offline_mask); -- if (cpuret) -- pr_warn("%s: Could not restore CPUs to offline state.\n", -- __func__); -+ cpu_hotplug_enable(); - --out: - unlock_device_hotplug(); -- free_cpumask_var(offline_mask); -+ - return atomic_read(&data.error); - } - #else /* CONFIG_PPC_PSERIES */ -diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c -index eae9ddaecbcf..efb1ba40274a 100644 ---- a/arch/powerpc/kernel/vdso.c -+++ b/arch/powerpc/kernel/vdso.c -@@ -682,7 +682,7 @@ int vdso_getcpu_init(void) - node = cpu_to_node(cpu); - WARN_ON_ONCE(node > 0xffff); - -- val = (cpu & 0xfff) | ((node & 0xffff) << 16); -+ val = (cpu & 0xffff) | ((node & 0xffff) << 16); - mtspr(SPRN_SPRG_VDSO_WRITE, val); - get_paca()->sprg_vdso = val; - -diff --git a/arch/powerpc/mm/book3s64/pkeys.c b/arch/powerpc/mm/book3s64/pkeys.c -index 66f307e873dc..432fd9fa8c3f 100644 ---- a/arch/powerpc/mm/book3s64/pkeys.c -+++ b/arch/powerpc/mm/book3s64/pkeys.c -@@ -83,13 +83,17 @@ static int pkey_initialize(void) - scan_pkey_feature(); - - /* -- * Let's assume 32 pkeys on P8 bare metal, if its not defined by device -- * tree. We make this exception since skiboot forgot to expose this -- * property on power8. -+ * Let's assume 32 pkeys on P8/P9 bare metal, if its not defined by device -+ * tree. We make this exception since some version of skiboot forgot to -+ * expose this property on power8/9. - */ -- if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR) && -- cpu_has_feature(CPU_FTRS_POWER8)) -- pkeys_total = 32; -+ if (!pkeys_devtree_defined && !firmware_has_feature(FW_FEATURE_LPAR)) { -+ unsigned long pvr = mfspr(SPRN_PVR); -+ -+ if (PVR_VER(pvr) == PVR_POWER8 || PVR_VER(pvr) == PVR_POWER8E || -+ PVR_VER(pvr) == PVR_POWER8NVL || PVR_VER(pvr) == PVR_POWER9) -+ pkeys_total = 32; -+ } - - /* - * Adjust the upper limit, based on the number of bits supported by -diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c -index 0a24a5a185f0..f789693f61f4 100644 ---- a/arch/powerpc/platforms/pseries/suspend.c -+++ b/arch/powerpc/platforms/pseries/suspend.c -@@ -132,15 +132,11 @@ static ssize_t store_hibernate(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) - { -- cpumask_var_t offline_mask; - int rc; - - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - -- if (!alloc_cpumask_var(&offline_mask, GFP_KERNEL)) -- return -ENOMEM; -- - stream_id = simple_strtoul(buf, NULL, 16); - - do { -@@ -150,32 +146,16 @@ static ssize_t store_hibernate(struct device *dev, - } while (rc == -EAGAIN); - - if (!rc) { -- /* All present CPUs must be online */ -- cpumask_andnot(offline_mask, cpu_present_mask, -- cpu_online_mask); -- rc = rtas_online_cpus_mask(offline_mask); -- if (rc) { -- pr_err("%s: Could not bring present CPUs online.\n", -- __func__); -- goto out; -- } -- - stop_topology_update(); - rc = pm_suspend(PM_SUSPEND_MEM); - start_topology_update(); -- -- /* Take down CPUs not online prior to suspend */ -- if (!rtas_offline_cpus_mask(offline_mask)) -- pr_warn("%s: Could not restore CPUs to offline " -- "state.\n", __func__); - } - - stream_id = 0; - - if (!rc) - rc = count; --out: -- free_cpumask_var(offline_mask); -+ - return rc; - } - -diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c -index 364e3a89c096..4fa7a562c6fc 100644 ---- a/arch/s390/mm/gmap.c -+++ b/arch/s390/mm/gmap.c -@@ -2485,23 +2485,36 @@ void gmap_sync_dirty_log_pmd(struct gmap *gmap, unsigned long bitmap[4], - } - EXPORT_SYMBOL_GPL(gmap_sync_dirty_log_pmd); - -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE -+static int thp_split_walk_pmd_entry(pmd_t *pmd, unsigned long addr, -+ unsigned long end, struct mm_walk *walk) -+{ -+ struct vm_area_struct *vma = walk->vma; -+ -+ split_huge_pmd(vma, pmd, addr); -+ return 0; -+} -+ -+static const struct mm_walk_ops thp_split_walk_ops = { -+ .pmd_entry = thp_split_walk_pmd_entry, -+}; -+ - static inline void thp_split_mm(struct mm_struct *mm) - { --#ifdef CONFIG_TRANSPARENT_HUGEPAGE - struct vm_area_struct *vma; -- unsigned long addr; - - for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) { -- for (addr = vma->vm_start; -- addr < vma->vm_end; -- addr += PAGE_SIZE) -- follow_page(vma, addr, FOLL_SPLIT); - vma->vm_flags &= ~VM_HUGEPAGE; - vma->vm_flags |= VM_NOHUGEPAGE; -+ walk_page_vma(vma, &thp_split_walk_ops, NULL); - } - mm->def_flags |= VM_NOHUGEPAGE; --#endif - } -+#else -+static inline void thp_split_mm(struct mm_struct *mm) -+{ -+} -+#endif /* CONFIG_TRANSPARENT_HUGEPAGE */ - - /* - * Remove all empty zero pages from the mapping for lazy refaulting -diff --git a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S -index 5f6a5af9c489..77043a82da51 100644 ---- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S -+++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S -@@ -127,10 +127,6 @@ ddq_add_8: - - /* generate a unique variable for ddq_add_x */ - --.macro setddq n -- var_ddq_add = ddq_add_\n --.endm -- - /* generate a unique variable for xmm register */ - .macro setxdata n - var_xdata = %xmm\n -@@ -140,9 +136,7 @@ ddq_add_8: - - .macro club name, id - .altmacro -- .if \name == DDQ_DATA -- setddq %\id -- .elseif \name == XDATA -+ .if \name == XDATA - setxdata %\id - .endif - .noaltmacro -@@ -165,9 +159,8 @@ ddq_add_8: - - .set i, 1 - .rept (by - 1) -- club DDQ_DATA, i - club XDATA, i -- vpaddq var_ddq_add(%rip), xcounter, var_xdata -+ vpaddq (ddq_add_1 + 16 * (i - 1))(%rip), xcounter, var_xdata - vptest ddq_low_msk(%rip), var_xdata - jnz 1f - vpaddq ddq_high_add_1(%rip), var_xdata, var_xdata -@@ -180,8 +173,7 @@ ddq_add_8: - vmovdqa 1*16(p_keys), xkeyA - - vpxor xkey0, xdata0, xdata0 -- club DDQ_DATA, by -- vpaddq var_ddq_add(%rip), xcounter, xcounter -+ vpaddq (ddq_add_1 + 16 * (by - 1))(%rip), xcounter, xcounter - vptest ddq_low_msk(%rip), xcounter - jnz 1f - vpaddq ddq_high_add_1(%rip), xcounter, xcounter -diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S -index e40bdf024ba7..9afeb58c910e 100644 ---- a/arch/x86/crypto/aesni-intel_asm.S -+++ b/arch/x86/crypto/aesni-intel_asm.S -@@ -266,7 +266,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff - PSHUFB_XMM %xmm2, %xmm0 - movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv - -- PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7, -+ PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7 - movdqu HashKey(%arg2), %xmm13 - - CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \ -@@ -978,7 +978,7 @@ _initial_blocks_done\@: - * arg1, %arg3, %arg4 are used as pointers only, not modified - * %r11 is the data offset value - */ --.macro GHASH_4_ENCRYPT_4_PARALLEL_ENC TMP1 TMP2 TMP3 TMP4 TMP5 \ -+.macro GHASH_4_ENCRYPT_4_PARALLEL_enc TMP1 TMP2 TMP3 TMP4 TMP5 \ - TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation - - movdqa \XMM1, \XMM5 -@@ -1186,7 +1186,7 @@ aes_loop_par_enc_done\@: - * arg1, %arg3, %arg4 are used as pointers only, not modified - * %r11 is the data offset value - */ --.macro GHASH_4_ENCRYPT_4_PARALLEL_DEC TMP1 TMP2 TMP3 TMP4 TMP5 \ -+.macro GHASH_4_ENCRYPT_4_PARALLEL_dec TMP1 TMP2 TMP3 TMP4 TMP5 \ - TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation - - movdqa \XMM1, \XMM5 -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 16699101fd2f..ea6d9da9b094 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2348,8 +2348,13 @@ static int mp_irqdomain_create(int ioapic) - - static void ioapic_destroy_irqdomain(int idx) - { -+ struct ioapic_domain_cfg *cfg = &ioapics[idx].irqdomain_cfg; -+ struct fwnode_handle *fn = ioapics[idx].irqdomain->fwnode; -+ - if (ioapics[idx].irqdomain) { - irq_domain_remove(ioapics[idx].irqdomain); -+ if (!cfg->dev) -+ irq_domain_free_fwnode(fn); - ioapics[idx].irqdomain = NULL; - } - } -diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c -index 1f30117b24ba..eb2d41c1816d 100644 ---- a/arch/x86/kernel/cpu/mce/inject.c -+++ b/arch/x86/kernel/cpu/mce/inject.c -@@ -511,7 +511,7 @@ static void do_inject(void) - */ - if (inj_type == DFR_INT_INJ) { - i_mce.status |= MCI_STATUS_DEFERRED; -- i_mce.status |= (i_mce.status & ~MCI_STATUS_UC); -+ i_mce.status &= ~MCI_STATUS_UC; - } - - /* -diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c -index af64519b2695..da3cc3a10d63 100644 ---- a/arch/x86/kernel/process_64.c -+++ b/arch/x86/kernel/process_64.c -@@ -316,7 +316,7 @@ static unsigned long x86_fsgsbase_read_task(struct task_struct *task, - */ - mutex_lock(&task->mm->context.lock); - ldt = task->mm->context.ldt; -- if (unlikely(idx >= ldt->nr_entries)) -+ if (unlikely(!ldt || idx >= ldt->nr_entries)) - base = 0; - else - base = get_desc_base(ldt->entries + idx); -diff --git a/block/blk-iocost.c b/block/blk-iocost.c -index 4d2bda812d9b..dcc6685d5bec 100644 ---- a/block/blk-iocost.c -+++ b/block/blk-iocost.c -@@ -1377,7 +1377,7 @@ static void ioc_timer_fn(struct timer_list *timer) - * should have woken up in the last period and expire idle iocgs. - */ - list_for_each_entry_safe(iocg, tiocg, &ioc->active_iocgs, active_list) { -- if (!waitqueue_active(&iocg->waitq) && iocg->abs_vdebt && -+ if (!waitqueue_active(&iocg->waitq) && !iocg->abs_vdebt && - !iocg_is_idle(iocg)) - continue; - -diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c -index 728d752f7adc..85f799c9c25c 100644 ---- a/drivers/acpi/acpica/exprep.c -+++ b/drivers/acpi/acpica/exprep.c -@@ -473,10 +473,6 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info) - (u8)access_byte_width; - } - } -- /* An additional reference for the container */ -- -- acpi_ut_add_reference(obj_desc->field.region_obj); -- - ACPI_DEBUG_PRINT((ACPI_DB_BFIELD, - "RegionField: BitOff %X, Off %X, Gran %X, Region %p\n", - obj_desc->field.start_field_bit_offset, -diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c -index c365faf4e6cd..4c0d4e434196 100644 ---- a/drivers/acpi/acpica/utdelete.c -+++ b/drivers/acpi/acpica/utdelete.c -@@ -568,11 +568,6 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) - next_object = object->buffer_field.buffer_obj; - break; - -- case ACPI_TYPE_LOCAL_REGION_FIELD: -- -- next_object = object->field.region_obj; -- break; -- - case ACPI_TYPE_LOCAL_BANK_FIELD: - - next_object = object->bank_field.bank_obj; -@@ -613,6 +608,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) - } - break; - -+ case ACPI_TYPE_LOCAL_REGION_FIELD: - case ACPI_TYPE_REGION: - default: - -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 565e35e69f24..bddbbf5b3dda 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -2325,6 +2325,8 @@ static void __exit loop_exit(void) - - range = max_loop ? max_loop << part_shift : 1UL << MINORBITS; - -+ mutex_lock(&loop_ctl_mutex); -+ - idr_for_each(&loop_index_idr, &loop_exit_cb, NULL); - idr_destroy(&loop_index_idr); - -@@ -2332,6 +2334,8 @@ static void __exit loop_exit(void) - unregister_blkdev(LOOP_MAJOR, "loop"); - - misc_deregister(&loop_misc); -+ -+ mutex_unlock(&loop_ctl_mutex); - } - - module_init(loop_init); -diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c -index 0f3a020703ab..4c7978cb1786 100644 ---- a/drivers/bluetooth/btmrvl_sdio.c -+++ b/drivers/bluetooth/btmrvl_sdio.c -@@ -328,7 +328,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8897 = { - - static const struct btmrvl_sdio_device btmrvl_sdio_sd8977 = { - .helper = NULL, -- .firmware = "mrvl/sd8977_uapsta.bin", -+ .firmware = "mrvl/sdsd8977_combo_v2.bin", - .reg = &btmrvl_reg_8977, - .support_pscan_win_report = true, - .sd_blksz_fw_dl = 256, -@@ -346,7 +346,7 @@ static const struct btmrvl_sdio_device btmrvl_sdio_sd8987 = { - - static const struct btmrvl_sdio_device btmrvl_sdio_sd8997 = { - .helper = NULL, -- .firmware = "mrvl/sd8997_uapsta.bin", -+ .firmware = "mrvl/sdsd8997_combo_v4.bin", - .reg = &btmrvl_reg_8997, - .support_pscan_win_report = true, - .sd_blksz_fw_dl = 256, -@@ -1831,6 +1831,6 @@ MODULE_FIRMWARE("mrvl/sd8787_uapsta.bin"); - MODULE_FIRMWARE("mrvl/sd8797_uapsta.bin"); - MODULE_FIRMWARE("mrvl/sd8887_uapsta.bin"); - MODULE_FIRMWARE("mrvl/sd8897_uapsta.bin"); --MODULE_FIRMWARE("mrvl/sd8977_uapsta.bin"); -+MODULE_FIRMWARE("mrvl/sdsd8977_combo_v2.bin"); - MODULE_FIRMWARE("mrvl/sd8987_uapsta.bin"); --MODULE_FIRMWARE("mrvl/sd8997_uapsta.bin"); -+MODULE_FIRMWARE("mrvl/sdsd8997_combo_v4.bin"); -diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c -index 813338288453..b7de7cb8cca9 100644 ---- a/drivers/bluetooth/btmtksdio.c -+++ b/drivers/bluetooth/btmtksdio.c -@@ -684,7 +684,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) - const u8 *fw_ptr; - size_t fw_size; - int err, dlen; -- u8 flag; -+ u8 flag, param; - - err = request_firmware(&fw, fwname, &hdev->dev); - if (err < 0) { -@@ -692,6 +692,20 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) - return err; - } - -+ /* Power on data RAM the firmware relies on. */ -+ param = 1; -+ wmt_params.op = MTK_WMT_FUNC_CTRL; -+ wmt_params.flag = 3; -+ wmt_params.dlen = sizeof(param); -+ wmt_params.data = ¶m; -+ wmt_params.status = NULL; -+ -+ err = mtk_hci_wmt_sync(hdev, &wmt_params); -+ if (err < 0) { -+ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); -+ return err; -+ } -+ - fw_ptr = fw->data; - fw_size = fw->size; - -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 9c3b063e1a1f..f3f0529564da 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -2792,7 +2792,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) - const u8 *fw_ptr; - size_t fw_size; - int err, dlen; -- u8 flag; -+ u8 flag, param; - - err = request_firmware(&fw, fwname, &hdev->dev); - if (err < 0) { -@@ -2800,6 +2800,20 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) - return err; - } - -+ /* Power on data RAM the firmware relies on. */ -+ param = 1; -+ wmt_params.op = BTMTK_WMT_FUNC_CTRL; -+ wmt_params.flag = 3; -+ wmt_params.dlen = sizeof(param); -+ wmt_params.data = ¶m; -+ wmt_params.status = NULL; -+ -+ err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); -+ if (err < 0) { -+ bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); -+ return err; -+ } -+ - fw_ptr = fw->data; - fw_size = fw->size; - -diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c -index dacf297baf59..5df0651b6cd5 100644 ---- a/drivers/bluetooth/hci_h5.c -+++ b/drivers/bluetooth/hci_h5.c -@@ -790,7 +790,7 @@ static int h5_serdev_probe(struct serdev_device *serdev) - if (!h5) - return -ENOMEM; - -- set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.flags); -+ set_bit(HCI_UART_RESET_ON_INIT, &h5->serdev_hu.hdev_flags); - - h5->hu = &h5->serdev_hu; - h5->serdev_hu.serdev = serdev; -diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c -index 4652896d4990..ad2f26cb2622 100644 ---- a/drivers/bluetooth/hci_serdev.c -+++ b/drivers/bluetooth/hci_serdev.c -@@ -357,7 +357,8 @@ void hci_uart_unregister_device(struct hci_uart *hu) - struct hci_dev *hdev = hu->hdev; - - clear_bit(HCI_UART_PROTO_READY, &hu->flags); -- hci_unregister_dev(hdev); -+ if (test_bit(HCI_UART_REGISTERED, &hu->flags)) -+ hci_unregister_dev(hdev); - hci_free_dev(hdev); - - cancel_work_sync(&hu->write_work); -diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c -index f8bc052cd853..770a780dfa54 100644 ---- a/drivers/bus/ti-sysc.c -+++ b/drivers/bus/ti-sysc.c -@@ -1371,6 +1371,10 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { - SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), - SYSC_QUIRK("tptc", 0, 0, -ENODEV, -ENODEV, 0x40007c00, 0xffffffff, - SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), -+ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff, -+ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), -+ SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff, -+ SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), - SYSC_QUIRK("usb_otg_hs", 0, 0x400, 0x404, 0x408, 0x00000050, - 0xffffffff, SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_SWSUP_MSTANDBY), - SYSC_QUIRK("usb_otg_hs", 0, 0, 0x10, -ENODEV, 0x4ea2080d, 0xffffffff, -@@ -1440,8 +1444,6 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { - SYSC_QUIRK("tpcc", 0, 0, -ENODEV, -ENODEV, 0x40014c00, 0xffffffff, 0), - SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000004, 0xffffffff, 0), - SYSC_QUIRK("usbhstll", 0, 0, 0x10, 0x14, 0x00000008, 0xffffffff, 0), -- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, 0x14, 0x50700100, 0xffffffff, 0), -- SYSC_QUIRK("usb_host_hs", 0, 0, 0x10, -ENODEV, 0x50700101, 0xffffffff, 0), - SYSC_QUIRK("venc", 0x58003000, 0, -ENODEV, -ENODEV, 0x00000002, 0xffffffff, 0), - SYSC_QUIRK("vfpe", 0, 0, 0x104, -ENODEV, 0x4d001200, 0xffffffff, 0), - #endif -diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c -index b161bdf60000..0941d38b2d32 100644 ---- a/drivers/char/agp/intel-gtt.c -+++ b/drivers/char/agp/intel-gtt.c -@@ -304,8 +304,10 @@ static int intel_gtt_setup_scratch_page(void) - if (intel_private.needs_dmar) { - dma_addr = pci_map_page(intel_private.pcidev, page, 0, - PAGE_SIZE, PCI_DMA_BIDIRECTIONAL); -- if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) -+ if (pci_dma_mapping_error(intel_private.pcidev, dma_addr)) { -+ __free_page(page); - return -EINVAL; -+ } - - intel_private.scratch_page_dma = dma_addr; - } else -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 58073836b555..1838039b0333 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -386,13 +386,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, - chip->cdev.owner = THIS_MODULE; - chip->cdevs.owner = THIS_MODULE; - -- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); -- if (!chip->work_space.context_buf) { -- rc = -ENOMEM; -- goto out; -- } -- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); -- if (!chip->work_space.session_buf) { -+ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); -+ if (rc) { - rc = -ENOMEM; - goto out; - } -diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h -index 218cb496222a..37f010421a36 100644 ---- a/drivers/char/tpm/tpm.h -+++ b/drivers/char/tpm/tpm.h -@@ -177,6 +177,9 @@ struct tpm_header { - - #define TPM_TAG_RQU_COMMAND 193 - -+/* TPM2 specific constants. */ -+#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */ -+ - struct stclear_flags_t { - __be16 tag; - u8 deactivated; -@@ -456,7 +459,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type); - unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal); - int tpm2_probe(struct tpm_chip *chip); - int tpm2_find_cc(struct tpm_chip *chip, u32 cc); --int tpm2_init_space(struct tpm_space *space); -+int tpm2_init_space(struct tpm_space *space, unsigned int buf_size); - void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space); - void tpm2_flush_space(struct tpm_chip *chip); - int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, -diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c -index 982d341d8837..784b8b3cb903 100644 ---- a/drivers/char/tpm/tpm2-space.c -+++ b/drivers/char/tpm/tpm2-space.c -@@ -38,18 +38,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) - } - } - --int tpm2_init_space(struct tpm_space *space) -+int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) - { -- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); -+ space->context_buf = kzalloc(buf_size, GFP_KERNEL); - if (!space->context_buf) - return -ENOMEM; - -- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); -+ space->session_buf = kzalloc(buf_size, GFP_KERNEL); - if (space->session_buf == NULL) { - kfree(space->context_buf); -+ /* Prevent caller getting a dangling pointer. */ -+ space->context_buf = NULL; - return -ENOMEM; - } - -+ space->buf_size = buf_size; - return 0; - } - -@@ -311,8 +314,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, - sizeof(space->context_tbl)); - memcpy(&chip->work_space.session_tbl, &space->session_tbl, - sizeof(space->session_tbl)); -- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE); -- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE); -+ memcpy(chip->work_space.context_buf, space->context_buf, -+ space->buf_size); -+ memcpy(chip->work_space.session_buf, space->session_buf, -+ space->buf_size); - - rc = tpm2_load_space(chip); - if (rc) { -@@ -492,7 +497,7 @@ static int tpm2_save_space(struct tpm_chip *chip) - continue; - - rc = tpm2_save_context(chip, space->context_tbl[i], -- space->context_buf, PAGE_SIZE, -+ space->context_buf, space->buf_size, - &offset); - if (rc == -ENOENT) { - space->context_tbl[i] = 0; -@@ -509,9 +514,8 @@ static int tpm2_save_space(struct tpm_chip *chip) - continue; - - rc = tpm2_save_context(chip, space->session_tbl[i], -- space->session_buf, PAGE_SIZE, -+ space->session_buf, space->buf_size, - &offset); -- - if (rc == -ENOENT) { - /* handle error saving session, just forget it */ - space->session_tbl[i] = 0; -@@ -557,8 +561,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, - sizeof(space->context_tbl)); - memcpy(&space->session_tbl, &chip->work_space.session_tbl, - sizeof(space->session_tbl)); -- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE); -- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE); -+ memcpy(space->context_buf, chip->work_space.context_buf, -+ space->buf_size); -+ memcpy(space->session_buf, chip->work_space.session_buf, -+ space->buf_size); - - return 0; - out: -diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c -index 7a0a7051a06f..eef0fb06ea83 100644 ---- a/drivers/char/tpm/tpmrm-dev.c -+++ b/drivers/char/tpm/tpmrm-dev.c -@@ -21,7 +21,7 @@ static int tpmrm_open(struct inode *inode, struct file *file) - if (priv == NULL) - return -ENOMEM; - -- rc = tpm2_init_space(&priv->space); -+ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE); - if (rc) { - kfree(priv); - return -ENOMEM; -diff --git a/drivers/clk/bcm/clk-bcm63xx-gate.c b/drivers/clk/bcm/clk-bcm63xx-gate.c -index 98e884957db8..911a29bd744e 100644 ---- a/drivers/clk/bcm/clk-bcm63xx-gate.c -+++ b/drivers/clk/bcm/clk-bcm63xx-gate.c -@@ -155,6 +155,7 @@ static int clk_bcm63xx_probe(struct platform_device *pdev) - - for (entry = table; entry->name; entry++) - maxbit = max_t(u8, maxbit, entry->bit); -+ maxbit++; - - hw = devm_kzalloc(&pdev->dev, struct_size(hw, data.hws, maxbit), - GFP_KERNEL); -diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c -index 886f7c5df51a..e3cdb4a282fe 100644 ---- a/drivers/clk/clk-scmi.c -+++ b/drivers/clk/clk-scmi.c -@@ -103,6 +103,8 @@ static const struct clk_ops scmi_clk_ops = { - static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk) - { - int ret; -+ unsigned long min_rate, max_rate; -+ - struct clk_init_data init = { - .flags = CLK_GET_RATE_NOCACHE, - .num_parents = 0, -@@ -112,9 +114,23 @@ static int scmi_clk_ops_init(struct device *dev, struct scmi_clk *sclk) - - sclk->hw.init = &init; - ret = devm_clk_hw_register(dev, &sclk->hw); -- if (!ret) -- clk_hw_set_rate_range(&sclk->hw, sclk->info->range.min_rate, -- sclk->info->range.max_rate); -+ if (ret) -+ return ret; -+ -+ if (sclk->info->rate_discrete) { -+ int num_rates = sclk->info->list.num_rates; -+ -+ if (num_rates <= 0) -+ return -EINVAL; -+ -+ min_rate = sclk->info->list.rates[0]; -+ max_rate = sclk->info->list.rates[num_rates - 1]; -+ } else { -+ min_rate = sclk->info->range.min_rate; -+ max_rate = sclk->info->range.max_rate; -+ } -+ -+ clk_hw_set_rate_range(&sclk->hw, min_rate, max_rate); - return ret; - } - -diff --git a/drivers/clk/qcom/clk-rpmh.c b/drivers/clk/qcom/clk-rpmh.c -index 96a36f6ff667..d7586e26acd8 100644 ---- a/drivers/clk/qcom/clk-rpmh.c -+++ b/drivers/clk/qcom/clk-rpmh.c -@@ -143,12 +143,22 @@ static inline bool has_state_changed(struct clk_rpmh *c, u32 state) - != (c->aggr_state & BIT(state)); - } - -+static int clk_rpmh_send(struct clk_rpmh *c, enum rpmh_state state, -+ struct tcs_cmd *cmd, bool wait) -+{ -+ if (wait) -+ return rpmh_write(c->dev, state, cmd, 1); -+ -+ return rpmh_write_async(c->dev, state, cmd, 1); -+} -+ - static int clk_rpmh_send_aggregate_command(struct clk_rpmh *c) - { - struct tcs_cmd cmd = { 0 }; - u32 cmd_state, on_val; - enum rpmh_state state = RPMH_SLEEP_STATE; - int ret; -+ bool wait; - - cmd.addr = c->res_addr; - cmd_state = c->aggr_state; -@@ -159,7 +169,8 @@ static int clk_rpmh_send_aggregate_command(struct clk_rpmh *c) - if (cmd_state & BIT(state)) - cmd.data = on_val; - -- ret = rpmh_write_async(c->dev, state, &cmd, 1); -+ wait = cmd_state && state == RPMH_ACTIVE_ONLY_STATE; -+ ret = clk_rpmh_send(c, state, &cmd, wait); - if (ret) { - dev_err(c->dev, "set %s state of %s failed: (%d)\n", - !state ? "sleep" : -@@ -267,7 +278,7 @@ static int clk_rpmh_bcm_send_cmd(struct clk_rpmh *c, bool enable) - cmd.addr = c->res_addr; - cmd.data = BCM_TCS_CMD(1, enable, 0, cmd_state); - -- ret = rpmh_write_async(c->dev, RPMH_ACTIVE_ONLY_STATE, &cmd, 1); -+ ret = clk_rpmh_send(c, RPMH_ACTIVE_ONLY_STATE, &cmd, enable); - if (ret) { - dev_err(c->dev, "set active state of %s failed: (%d)\n", - c->res_name, ret); -diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm -index a905796f7f85..25f11e9ec358 100644 ---- a/drivers/cpufreq/Kconfig.arm -+++ b/drivers/cpufreq/Kconfig.arm -@@ -41,6 +41,7 @@ config ARM_ARMADA_37XX_CPUFREQ - config ARM_ARMADA_8K_CPUFREQ - tristate "Armada 8K CPUFreq driver" - depends on ARCH_MVEBU && CPUFREQ_DT -+ select ARMADA_AP_CPU_CLK - help - This enables the CPUFreq driver support for Marvell - Armada8k SOCs. -diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c -index aa0f06dec959..df1c941260d1 100644 ---- a/drivers/cpufreq/armada-37xx-cpufreq.c -+++ b/drivers/cpufreq/armada-37xx-cpufreq.c -@@ -456,6 +456,7 @@ static int __init armada37xx_cpufreq_driver_init(void) - /* Now that everything is setup, enable the DVFS at hardware level */ - armada37xx_cpufreq_enable_dvfs(nb_pm_base); - -+ memset(&pdata, 0, sizeof(pdata)); - pdata.suspend = armada37xx_cpufreq_suspend; - pdata.resume = armada37xx_cpufreq_resume; - -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index fa988bd1e606..194a6587a1de 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -616,6 +616,24 @@ static struct cpufreq_governor *find_governor(const char *str_governor) - return NULL; - } - -+static struct cpufreq_governor *get_governor(const char *str_governor) -+{ -+ struct cpufreq_governor *t; -+ -+ mutex_lock(&cpufreq_governor_mutex); -+ t = find_governor(str_governor); -+ if (!t) -+ goto unlock; -+ -+ if (!try_module_get(t->owner)) -+ t = NULL; -+ -+unlock: -+ mutex_unlock(&cpufreq_governor_mutex); -+ -+ return t; -+} -+ - static unsigned int cpufreq_parse_policy(char *str_governor) - { - if (!strncasecmp(str_governor, "performance", CPUFREQ_NAME_LEN)) -@@ -635,28 +653,14 @@ static struct cpufreq_governor *cpufreq_parse_governor(char *str_governor) - { - struct cpufreq_governor *t; - -- mutex_lock(&cpufreq_governor_mutex); -+ t = get_governor(str_governor); -+ if (t) -+ return t; - -- t = find_governor(str_governor); -- if (!t) { -- int ret; -- -- mutex_unlock(&cpufreq_governor_mutex); -- -- ret = request_module("cpufreq_%s", str_governor); -- if (ret) -- return NULL; -- -- mutex_lock(&cpufreq_governor_mutex); -- -- t = find_governor(str_governor); -- } -- if (t && !try_module_get(t->owner)) -- t = NULL; -- -- mutex_unlock(&cpufreq_governor_mutex); -+ if (request_module("cpufreq_%s", str_governor)) -+ return NULL; - -- return t; -+ return get_governor(str_governor); - } - - /** -@@ -810,12 +814,14 @@ static ssize_t show_scaling_available_governors(struct cpufreq_policy *policy, - goto out; - } - -+ mutex_lock(&cpufreq_governor_mutex); - for_each_governor(t) { - if (i >= (ssize_t) ((PAGE_SIZE / sizeof(char)) - - (CPUFREQ_NAME_LEN + 2))) -- goto out; -+ break; - i += scnprintf(&buf[i], CPUFREQ_NAME_PLEN, "%s ", t->name); - } -+ mutex_unlock(&cpufreq_governor_mutex); - out: - i += sprintf(&buf[i], "\n"); - return i; -@@ -1053,15 +1059,17 @@ static int cpufreq_init_policy(struct cpufreq_policy *policy) - struct cpufreq_governor *def_gov = cpufreq_default_governor(); - struct cpufreq_governor *gov = NULL; - unsigned int pol = CPUFREQ_POLICY_UNKNOWN; -+ int ret; - - if (has_target()) { - /* Update policy governor to the one used before hotplug. */ -- gov = find_governor(policy->last_governor); -+ gov = get_governor(policy->last_governor); - if (gov) { - pr_debug("Restoring governor %s for cpu %d\n", - policy->governor->name, policy->cpu); - } else if (def_gov) { - gov = def_gov; -+ __module_get(gov->owner); - } else { - return -ENODATA; - } -@@ -1084,7 +1092,11 @@ static int cpufreq_init_policy(struct cpufreq_policy *policy) - return -ENODATA; - } - -- return cpufreq_set_policy(policy, gov, pol); -+ ret = cpufreq_set_policy(policy, gov, pol); -+ if (gov) -+ module_put(gov->owner); -+ -+ return ret; - } - - static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, unsigned int cpu) -diff --git a/drivers/crypto/cavium/cpt/cptvf_algs.c b/drivers/crypto/cavium/cpt/cptvf_algs.c -index 596ce28b957d..2410b23aa609 100644 ---- a/drivers/crypto/cavium/cpt/cptvf_algs.c -+++ b/drivers/crypto/cavium/cpt/cptvf_algs.c -@@ -200,6 +200,7 @@ static inline int cvm_enc_dec(struct ablkcipher_request *req, u32 enc) - int status; - - memset(req_info, 0, sizeof(struct cpt_request_info)); -+ req_info->may_sleep = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) != 0; - memset(fctx, 0, sizeof(struct fc_context)); - create_input_list(req, enc, enc_iv_len); - create_output_list(req, enc_iv_len); -diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c -index 7a24019356b5..e343249c8d05 100644 ---- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c -+++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c -@@ -133,7 +133,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, - - /* Setup gather (input) components */ - g_sz_bytes = ((req->incnt + 3) / 4) * sizeof(struct sglist_component); -- info->gather_components = kzalloc(g_sz_bytes, GFP_KERNEL); -+ info->gather_components = kzalloc(g_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (!info->gather_components) { - ret = -ENOMEM; - goto scatter_gather_clean; -@@ -150,7 +150,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, - - /* Setup scatter (output) components */ - s_sz_bytes = ((req->outcnt + 3) / 4) * sizeof(struct sglist_component); -- info->scatter_components = kzalloc(s_sz_bytes, GFP_KERNEL); -+ info->scatter_components = kzalloc(s_sz_bytes, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (!info->scatter_components) { - ret = -ENOMEM; - goto scatter_gather_clean; -@@ -167,7 +167,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, - - /* Create and initialize DPTR */ - info->dlen = g_sz_bytes + s_sz_bytes + SG_LIST_HDR_SIZE; -- info->in_buffer = kzalloc(info->dlen, GFP_KERNEL); -+ info->in_buffer = kzalloc(info->dlen, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (!info->in_buffer) { - ret = -ENOMEM; - goto scatter_gather_clean; -@@ -195,7 +195,7 @@ static inline int setup_sgio_list(struct cpt_vf *cptvf, - } - - /* Create and initialize RPTR */ -- info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, GFP_KERNEL); -+ info->out_buffer = kzalloc(COMPLETION_CODE_SIZE, req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (!info->out_buffer) { - ret = -ENOMEM; - goto scatter_gather_clean; -@@ -421,7 +421,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) - struct cpt_vq_command vq_cmd; - union cpt_inst_s cptinst; - -- info = kzalloc(sizeof(*info), GFP_KERNEL); -+ info = kzalloc(sizeof(*info), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (unlikely(!info)) { - dev_err(&pdev->dev, "Unable to allocate memory for info_buffer\n"); - return -ENOMEM; -@@ -443,7 +443,7 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) - * Get buffer for union cpt_res_s response - * structure and its physical address - */ -- info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL); -+ info->completion_addr = kzalloc(sizeof(union cpt_res_s), req->may_sleep ? GFP_KERNEL : GFP_ATOMIC); - if (unlikely(!info->completion_addr)) { - dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n"); - ret = -ENOMEM; -diff --git a/drivers/crypto/cavium/cpt/request_manager.h b/drivers/crypto/cavium/cpt/request_manager.h -index 3514b082eca7..1e8dd9ebcc17 100644 ---- a/drivers/crypto/cavium/cpt/request_manager.h -+++ b/drivers/crypto/cavium/cpt/request_manager.h -@@ -62,6 +62,8 @@ struct cpt_request_info { - union ctrl_info ctrl; /* User control information */ - struct cptvf_request req; /* Request Information (Core specific) */ - -+ bool may_sleep; -+ - struct buf_ptr in[MAX_BUF_CNT]; - struct buf_ptr out[MAX_BUF_CNT]; - -diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h -index 3f68262d9ab4..87a34d91fdf7 100644 ---- a/drivers/crypto/ccp/ccp-dev.h -+++ b/drivers/crypto/ccp/ccp-dev.h -@@ -469,6 +469,7 @@ struct ccp_sg_workarea { - unsigned int sg_used; - - struct scatterlist *dma_sg; -+ struct scatterlist *dma_sg_head; - struct device *dma_dev; - unsigned int dma_count; - enum dma_data_direction dma_dir; -diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c -index 422193690fd4..64112c736810 100644 ---- a/drivers/crypto/ccp/ccp-ops.c -+++ b/drivers/crypto/ccp/ccp-ops.c -@@ -63,7 +63,7 @@ static u32 ccp_gen_jobid(struct ccp_device *ccp) - static void ccp_sg_free(struct ccp_sg_workarea *wa) - { - if (wa->dma_count) -- dma_unmap_sg(wa->dma_dev, wa->dma_sg, wa->nents, wa->dma_dir); -+ dma_unmap_sg(wa->dma_dev, wa->dma_sg_head, wa->nents, wa->dma_dir); - - wa->dma_count = 0; - } -@@ -92,6 +92,7 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, - return 0; - - wa->dma_sg = sg; -+ wa->dma_sg_head = sg; - wa->dma_dev = dev; - wa->dma_dir = dma_dir; - wa->dma_count = dma_map_sg(dev, sg, wa->nents, dma_dir); -@@ -104,14 +105,28 @@ static int ccp_init_sg_workarea(struct ccp_sg_workarea *wa, struct device *dev, - static void ccp_update_sg_workarea(struct ccp_sg_workarea *wa, unsigned int len) - { - unsigned int nbytes = min_t(u64, len, wa->bytes_left); -+ unsigned int sg_combined_len = 0; - - if (!wa->sg) - return; - - wa->sg_used += nbytes; - wa->bytes_left -= nbytes; -- if (wa->sg_used == wa->sg->length) { -- wa->sg = sg_next(wa->sg); -+ if (wa->sg_used == sg_dma_len(wa->dma_sg)) { -+ /* Advance to the next DMA scatterlist entry */ -+ wa->dma_sg = sg_next(wa->dma_sg); -+ -+ /* In the case that the DMA mapped scatterlist has entries -+ * that have been merged, the non-DMA mapped scatterlist -+ * must be advanced multiple times for each merged entry. -+ * This ensures that the current non-DMA mapped entry -+ * corresponds to the current DMA mapped entry. -+ */ -+ do { -+ sg_combined_len += wa->sg->length; -+ wa->sg = sg_next(wa->sg); -+ } while (wa->sg_used > sg_combined_len); -+ - wa->sg_used = 0; - } - } -@@ -299,7 +314,7 @@ static unsigned int ccp_queue_buf(struct ccp_data *data, unsigned int from) - /* Update the structures and generate the count */ - buf_count = 0; - while (sg_wa->bytes_left && (buf_count < dm_wa->length)) { -- nbytes = min(sg_wa->sg->length - sg_wa->sg_used, -+ nbytes = min(sg_dma_len(sg_wa->dma_sg) - sg_wa->sg_used, - dm_wa->length - buf_count); - nbytes = min_t(u64, sg_wa->bytes_left, nbytes); - -@@ -331,11 +346,11 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, - * and destination. The resulting len values will always be <= UINT_MAX - * because the dma length is an unsigned int. - */ -- sg_src_len = sg_dma_len(src->sg_wa.sg) - src->sg_wa.sg_used; -+ sg_src_len = sg_dma_len(src->sg_wa.dma_sg) - src->sg_wa.sg_used; - sg_src_len = min_t(u64, src->sg_wa.bytes_left, sg_src_len); - - if (dst) { -- sg_dst_len = sg_dma_len(dst->sg_wa.sg) - dst->sg_wa.sg_used; -+ sg_dst_len = sg_dma_len(dst->sg_wa.dma_sg) - dst->sg_wa.sg_used; - sg_dst_len = min_t(u64, src->sg_wa.bytes_left, sg_dst_len); - op_len = min(sg_src_len, sg_dst_len); - } else { -@@ -365,7 +380,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, - /* Enough data in the sg element, but we need to - * adjust for any previously copied data - */ -- op->src.u.dma.address = sg_dma_address(src->sg_wa.sg); -+ op->src.u.dma.address = sg_dma_address(src->sg_wa.dma_sg); - op->src.u.dma.offset = src->sg_wa.sg_used; - op->src.u.dma.length = op_len & ~(block_size - 1); - -@@ -386,7 +401,7 @@ static void ccp_prepare_data(struct ccp_data *src, struct ccp_data *dst, - /* Enough room in the sg element, but we need to - * adjust for any previously used area - */ -- op->dst.u.dma.address = sg_dma_address(dst->sg_wa.sg); -+ op->dst.u.dma.address = sg_dma_address(dst->sg_wa.dma_sg); - op->dst.u.dma.offset = dst->sg_wa.sg_used; - op->dst.u.dma.length = op->src.u.dma.length; - } -@@ -2028,7 +2043,7 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) - dst.sg_wa.sg_used = 0; - for (i = 1; i <= src.sg_wa.dma_count; i++) { - if (!dst.sg_wa.sg || -- (dst.sg_wa.sg->length < src.sg_wa.sg->length)) { -+ (sg_dma_len(dst.sg_wa.sg) < sg_dma_len(src.sg_wa.sg))) { - ret = -EINVAL; - goto e_dst; - } -@@ -2054,8 +2069,8 @@ ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) - goto e_dst; - } - -- dst.sg_wa.sg_used += src.sg_wa.sg->length; -- if (dst.sg_wa.sg_used == dst.sg_wa.sg->length) { -+ dst.sg_wa.sg_used += sg_dma_len(src.sg_wa.sg); -+ if (dst.sg_wa.sg_used == sg_dma_len(dst.sg_wa.sg)) { - dst.sg_wa.sg = sg_next(dst.sg_wa.sg); - dst.sg_wa.sg_used = 0; - } -diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c -index cd9c60268bf8..9bf0cce578f0 100644 ---- a/drivers/crypto/ccree/cc_cipher.c -+++ b/drivers/crypto/ccree/cc_cipher.c -@@ -163,7 +163,6 @@ static int cc_cipher_init(struct crypto_tfm *tfm) - skcipher_alg.base); - struct device *dev = drvdata_to_dev(cc_alg->drvdata); - unsigned int max_key_buf_size = cc_alg->skcipher_alg.max_keysize; -- int rc = 0; - - dev_dbg(dev, "Initializing context @%p for %s\n", ctx_p, - crypto_tfm_alg_name(tfm)); -@@ -175,10 +174,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm) - ctx_p->flow_mode = cc_alg->flow_mode; - ctx_p->drvdata = cc_alg->drvdata; - -+ if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) { -+ /* Alloc hash tfm for essiv */ -+ ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0); -+ if (IS_ERR(ctx_p->shash_tfm)) { -+ dev_err(dev, "Error allocating hash tfm for ESSIV.\n"); -+ return PTR_ERR(ctx_p->shash_tfm); -+ } -+ } -+ - /* Allocate key buffer, cache line aligned */ - ctx_p->user.key = kmalloc(max_key_buf_size, GFP_KERNEL); - if (!ctx_p->user.key) -- return -ENOMEM; -+ goto free_shash; - - dev_dbg(dev, "Allocated key buffer in context. key=@%p\n", - ctx_p->user.key); -@@ -190,21 +198,19 @@ static int cc_cipher_init(struct crypto_tfm *tfm) - if (dma_mapping_error(dev, ctx_p->user.key_dma_addr)) { - dev_err(dev, "Mapping Key %u B at va=%pK for DMA failed\n", - max_key_buf_size, ctx_p->user.key); -- return -ENOMEM; -+ goto free_key; - } - dev_dbg(dev, "Mapped key %u B at va=%pK to dma=%pad\n", - max_key_buf_size, ctx_p->user.key, &ctx_p->user.key_dma_addr); - -- if (ctx_p->cipher_mode == DRV_CIPHER_ESSIV) { -- /* Alloc hash tfm for essiv */ -- ctx_p->shash_tfm = crypto_alloc_shash("sha256-generic", 0, 0); -- if (IS_ERR(ctx_p->shash_tfm)) { -- dev_err(dev, "Error allocating hash tfm for ESSIV.\n"); -- return PTR_ERR(ctx_p->shash_tfm); -- } -- } -+ return 0; - -- return rc; -+free_key: -+ kfree(ctx_p->user.key); -+free_shash: -+ crypto_free_shash(ctx_p->shash_tfm); -+ -+ return -ENOMEM; - } - - static void cc_cipher_exit(struct crypto_tfm *tfm) -diff --git a/drivers/crypto/hisilicon/sec/sec_algs.c b/drivers/crypto/hisilicon/sec/sec_algs.c -index c27e7160d2df..4ad4ffd90cee 100644 ---- a/drivers/crypto/hisilicon/sec/sec_algs.c -+++ b/drivers/crypto/hisilicon/sec/sec_algs.c -@@ -175,7 +175,8 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl, - dma_addr_t *psec_sgl, - struct scatterlist *sgl, - int count, -- struct sec_dev_info *info) -+ struct sec_dev_info *info, -+ gfp_t gfp) - { - struct sec_hw_sgl *sgl_current = NULL; - struct sec_hw_sgl *sgl_next; -@@ -190,7 +191,7 @@ static int sec_alloc_and_fill_hw_sgl(struct sec_hw_sgl **sec_sgl, - sge_index = i % SEC_MAX_SGE_NUM; - if (sge_index == 0) { - sgl_next = dma_pool_zalloc(info->hw_sgl_pool, -- GFP_KERNEL, &sgl_next_dma); -+ gfp, &sgl_next_dma); - if (!sgl_next) { - ret = -ENOMEM; - goto err_free_hw_sgls; -@@ -545,14 +546,14 @@ void sec_alg_callback(struct sec_bd_info *resp, void *shadow) - } - - static int sec_alg_alloc_and_calc_split_sizes(int length, size_t **split_sizes, -- int *steps) -+ int *steps, gfp_t gfp) - { - size_t *sizes; - int i; - - /* Split into suitable sized blocks */ - *steps = roundup(length, SEC_REQ_LIMIT) / SEC_REQ_LIMIT; -- sizes = kcalloc(*steps, sizeof(*sizes), GFP_KERNEL); -+ sizes = kcalloc(*steps, sizeof(*sizes), gfp); - if (!sizes) - return -ENOMEM; - -@@ -568,7 +569,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, - int steps, struct scatterlist ***splits, - int **splits_nents, - int sgl_len_in, -- struct device *dev) -+ struct device *dev, gfp_t gfp) - { - int ret, count; - -@@ -576,12 +577,12 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, - if (!count) - return -EINVAL; - -- *splits = kcalloc(steps, sizeof(struct scatterlist *), GFP_KERNEL); -+ *splits = kcalloc(steps, sizeof(struct scatterlist *), gfp); - if (!*splits) { - ret = -ENOMEM; - goto err_unmap_sg; - } -- *splits_nents = kcalloc(steps, sizeof(int), GFP_KERNEL); -+ *splits_nents = kcalloc(steps, sizeof(int), gfp); - if (!*splits_nents) { - ret = -ENOMEM; - goto err_free_splits; -@@ -589,7 +590,7 @@ static int sec_map_and_split_sg(struct scatterlist *sgl, size_t *split_sizes, - - /* output the scatter list before and after this */ - ret = sg_split(sgl, count, 0, steps, split_sizes, -- *splits, *splits_nents, GFP_KERNEL); -+ *splits, *splits_nents, gfp); - if (ret) { - ret = -ENOMEM; - goto err_free_splits_nents; -@@ -630,13 +631,13 @@ static struct sec_request_el - int el_size, bool different_dest, - struct scatterlist *sgl_in, int n_ents_in, - struct scatterlist *sgl_out, int n_ents_out, -- struct sec_dev_info *info) -+ struct sec_dev_info *info, gfp_t gfp) - { - struct sec_request_el *el; - struct sec_bd_info *req; - int ret; - -- el = kzalloc(sizeof(*el), GFP_KERNEL); -+ el = kzalloc(sizeof(*el), gfp); - if (!el) - return ERR_PTR(-ENOMEM); - el->el_length = el_size; -@@ -668,7 +669,7 @@ static struct sec_request_el - el->sgl_in = sgl_in; - - ret = sec_alloc_and_fill_hw_sgl(&el->in, &el->dma_in, el->sgl_in, -- n_ents_in, info); -+ n_ents_in, info, gfp); - if (ret) - goto err_free_el; - -@@ -679,7 +680,7 @@ static struct sec_request_el - el->sgl_out = sgl_out; - ret = sec_alloc_and_fill_hw_sgl(&el->out, &el->dma_out, - el->sgl_out, -- n_ents_out, info); -+ n_ents_out, info, gfp); - if (ret) - goto err_free_hw_sgl_in; - -@@ -720,6 +721,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, - int *splits_out_nents = NULL; - struct sec_request_el *el, *temp; - bool split = skreq->src != skreq->dst; -+ gfp_t gfp = skreq->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL : GFP_ATOMIC; - - mutex_init(&sec_req->lock); - sec_req->req_base = &skreq->base; -@@ -728,13 +730,13 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, - sec_req->len_in = sg_nents(skreq->src); - - ret = sec_alg_alloc_and_calc_split_sizes(skreq->cryptlen, &split_sizes, -- &steps); -+ &steps, gfp); - if (ret) - return ret; - sec_req->num_elements = steps; - ret = sec_map_and_split_sg(skreq->src, split_sizes, steps, &splits_in, - &splits_in_nents, sec_req->len_in, -- info->dev); -+ info->dev, gfp); - if (ret) - goto err_free_split_sizes; - -@@ -742,7 +744,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, - sec_req->len_out = sg_nents(skreq->dst); - ret = sec_map_and_split_sg(skreq->dst, split_sizes, steps, - &splits_out, &splits_out_nents, -- sec_req->len_out, info->dev); -+ sec_req->len_out, info->dev, gfp); - if (ret) - goto err_unmap_in_sg; - } -@@ -775,7 +777,7 @@ static int sec_alg_skcipher_crypto(struct skcipher_request *skreq, - splits_in[i], splits_in_nents[i], - split ? splits_out[i] : NULL, - split ? splits_out_nents[i] : 0, -- info); -+ info, gfp); - if (IS_ERR(el)) { - ret = PTR_ERR(el); - goto err_free_elements; -diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c -index 6bd8f6a2a24f..aeb03081415c 100644 ---- a/drivers/crypto/qat/qat_common/qat_uclo.c -+++ b/drivers/crypto/qat/qat_common/qat_uclo.c -@@ -332,13 +332,18 @@ static int qat_uclo_create_batch_init_list(struct icp_qat_fw_loader_handle - } - return 0; - out_err: -+ /* Do not free the list head unless we allocated it. */ -+ tail_old = tail_old->next; -+ if (flag) { -+ kfree(*init_tab_base); -+ *init_tab_base = NULL; -+ } -+ - while (tail_old) { - mem_init = tail_old->next; - kfree(tail_old); - tail_old = mem_init; - } -- if (flag) -- kfree(*init_tab_base); - return -ENOMEM; - } - -diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c -index 0e7ea3591b78..5e7593753799 100644 ---- a/drivers/edac/edac_device_sysfs.c -+++ b/drivers/edac/edac_device_sysfs.c -@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev) - - /* Error exit stack */ - err_kobj_reg: -+ kobject_put(&edac_dev->kobj); - module_put(edac_dev->owner); - - err_out: -diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c -index 72c9eb9fdffb..53042af7262e 100644 ---- a/drivers/edac/edac_pci_sysfs.c -+++ b/drivers/edac/edac_pci_sysfs.c -@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void) - - /* Error unwind statck */ - kobject_init_and_add_fail: -- kfree(edac_pci_top_main_kobj); -+ kobject_put(edac_pci_top_main_kobj); - - kzalloc_fail: - module_put(THIS_MODULE); -diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c -index 87f737e01473..041f8152272b 100644 ---- a/drivers/firmware/arm_scmi/scmi_pm_domain.c -+++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c -@@ -85,7 +85,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) - for (i = 0; i < num_domains; i++, scmi_pd++) { - u32 state; - -- domains[i] = &scmi_pd->genpd; -+ if (handle->power_ops->state_get(handle, i, &state)) { -+ dev_warn(dev, "failed to get state for domain %d\n", i); -+ continue; -+ } - - scmi_pd->domain = i; - scmi_pd->handle = handle; -@@ -94,13 +97,10 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) - scmi_pd->genpd.power_off = scmi_pd_power_off; - scmi_pd->genpd.power_on = scmi_pd_power_on; - -- if (handle->power_ops->state_get(handle, i, &state)) { -- dev_warn(dev, "failed to get state for domain %d\n", i); -- continue; -- } -- - pm_genpd_init(&scmi_pd->genpd, NULL, - state == SCMI_POWER_STATE_GENERIC_OFF); -+ -+ domains[i] = &scmi_pd->genpd; - } - - scmi_pd_data->domains = domains; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -index 23085b352cf2..c212d5fc665c 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c -@@ -404,7 +404,9 @@ int amdgpu_fence_driver_start_ring(struct amdgpu_ring *ring, - ring->fence_drv.gpu_addr = adev->uvd.inst[ring->me].gpu_addr + index; - } - amdgpu_fence_write(ring, atomic_read(&ring->fence_drv.last_seq)); -- amdgpu_irq_get(adev, irq_src, irq_type); -+ -+ if (irq_src) -+ amdgpu_irq_get(adev, irq_src, irq_type); - - ring->fence_drv.irq_src = irq_src; - ring->fence_drv.irq_type = irq_type; -@@ -539,8 +541,9 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) - /* no need to trigger GPU reset as we are unloading */ - amdgpu_fence_driver_force_completion(ring); - } -- amdgpu_irq_put(adev, ring->fence_drv.irq_src, -- ring->fence_drv.irq_type); -+ if (ring->fence_drv.irq_src) -+ amdgpu_irq_put(adev, ring->fence_drv.irq_src, -+ ring->fence_drv.irq_type); - drm_sched_fini(&ring->sched); - del_timer_sync(&ring->fence_drv.fallback_timer); - for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j) -@@ -576,8 +579,9 @@ void amdgpu_fence_driver_suspend(struct amdgpu_device *adev) - } - - /* disable the interrupt */ -- amdgpu_irq_put(adev, ring->fence_drv.irq_src, -- ring->fence_drv.irq_type); -+ if (ring->fence_drv.irq_src) -+ amdgpu_irq_put(adev, ring->fence_drv.irq_src, -+ ring->fence_drv.irq_type); - } - } - -@@ -603,8 +607,9 @@ void amdgpu_fence_driver_resume(struct amdgpu_device *adev) - continue; - - /* enable the interrupt */ -- amdgpu_irq_get(adev, ring->fence_drv.irq_src, -- ring->fence_drv.irq_type); -+ if (ring->fence_drv.irq_src) -+ amdgpu_irq_get(adev, ring->fence_drv.irq_src, -+ ring->fence_drv.irq_type); - } - } - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c -index 785322cd4c6c..7241d4c20778 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c -@@ -530,6 +530,8 @@ bool dm_pp_get_static_clocks( - &pp_clk_info); - else if (adev->smu.funcs) - ret = smu_get_current_clocks(&adev->smu, &pp_clk_info); -+ else -+ return false; - if (ret) - return false; - -diff --git a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c -index 0922d9cd858a..c4d8c52c6b9c 100644 ---- a/drivers/gpu/drm/amd/powerplay/smu_v11_0.c -+++ b/drivers/gpu/drm/amd/powerplay/smu_v11_0.c -@@ -171,7 +171,8 @@ static int smu_v11_0_init_microcode(struct smu_context *smu) - chip_name = "navi12"; - break; - default: -- BUG(); -+ dev_err(adev->dev, "Unsupported ASIC type %d\n", adev->asic_type); -+ return -EINVAL; - } - - snprintf(fw_name, sizeof(fw_name), "amdgpu/%s_smc.bin", chip_name); -diff --git a/drivers/gpu/drm/arm/malidp_planes.c b/drivers/gpu/drm/arm/malidp_planes.c -index 3c70a53813bf..0b2bb485d9be 100644 ---- a/drivers/gpu/drm/arm/malidp_planes.c -+++ b/drivers/gpu/drm/arm/malidp_planes.c -@@ -928,7 +928,7 @@ int malidp_de_planes_init(struct drm_device *drm) - const struct malidp_hw_regmap *map = &malidp->dev->hw->map; - struct malidp_plane *plane = NULL; - enum drm_plane_type plane_type; -- unsigned long crtcs = 1 << drm->mode_config.num_crtc; -+ unsigned long crtcs = BIT(drm->mode_config.num_crtc); - unsigned long flags = DRM_MODE_ROTATE_0 | DRM_MODE_ROTATE_90 | DRM_MODE_ROTATE_180 | - DRM_MODE_ROTATE_270 | DRM_MODE_REFLECT_X | DRM_MODE_REFLECT_Y; - unsigned int blend_caps = BIT(DRM_MODE_BLEND_PIXEL_NONE) | -diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c -index bd3165ee5354..04431dbac4a4 100644 ---- a/drivers/gpu/drm/bridge/sil-sii8620.c -+++ b/drivers/gpu/drm/bridge/sil-sii8620.c -@@ -177,7 +177,7 @@ static void sii8620_read_buf(struct sii8620 *ctx, u16 addr, u8 *buf, int len) - - static u8 sii8620_readb(struct sii8620 *ctx, u16 addr) - { -- u8 ret; -+ u8 ret = 0; - - sii8620_read_buf(ctx, addr, &ret, 1); - return ret; -diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -index 0a580957c8cf..f1de4bb6558c 100644 ---- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c -+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c -@@ -647,6 +647,12 @@ static ssize_t ti_sn_aux_transfer(struct drm_dp_aux *aux, - buf[i]); - } - -+ /* Clear old status bits before start so we don't get confused */ -+ regmap_write(pdata->regmap, SN_AUX_CMD_STATUS_REG, -+ AUX_IRQ_STATUS_NAT_I2C_FAIL | -+ AUX_IRQ_STATUS_AUX_RPLY_TOUT | -+ AUX_IRQ_STATUS_AUX_SHORT); -+ - regmap_write(pdata->regmap, SN_AUX_CMD_REG, request_val | AUX_CMD_SEND); - - ret = regmap_read_poll_timeout(pdata->regmap, SN_AUX_CMD_REG, val, -diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c -index eab0f2687cd6..00debd02c322 100644 ---- a/drivers/gpu/drm/drm_debugfs.c -+++ b/drivers/gpu/drm/drm_debugfs.c -@@ -337,13 +337,13 @@ static ssize_t connector_write(struct file *file, const char __user *ubuf, - - buf[len] = '\0'; - -- if (!strcmp(buf, "on")) -+ if (sysfs_streq(buf, "on")) - connector->force = DRM_FORCE_ON; -- else if (!strcmp(buf, "digital")) -+ else if (sysfs_streq(buf, "digital")) - connector->force = DRM_FORCE_ON_DIGITAL; -- else if (!strcmp(buf, "off")) -+ else if (sysfs_streq(buf, "off")) - connector->force = DRM_FORCE_OFF; -- else if (!strcmp(buf, "unspecified")) -+ else if (sysfs_streq(buf, "unspecified")) - connector->force = DRM_FORCE_UNSPECIFIED; - else - return -EINVAL; -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index 46ad14470d06..1fdc85a71cec 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -710,6 +710,8 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, - if (!objs) - return -ENOMEM; - -+ *objs_out = objs; -+ - handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL); - if (!handles) { - ret = -ENOMEM; -@@ -723,8 +725,6 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, - } - - ret = objects_lookup(filp, handles, count, objs); -- *objs_out = objs; -- - out: - kvfree(handles); - return ret; -diff --git a/drivers/gpu/drm/drm_mipi_dsi.c b/drivers/gpu/drm/drm_mipi_dsi.c -index bd2498bbd74a..b99f96dcc6f1 100644 ---- a/drivers/gpu/drm/drm_mipi_dsi.c -+++ b/drivers/gpu/drm/drm_mipi_dsi.c -@@ -1029,11 +1029,11 @@ EXPORT_SYMBOL(mipi_dsi_dcs_set_pixel_format); - */ - int mipi_dsi_dcs_set_tear_scanline(struct mipi_dsi_device *dsi, u16 scanline) - { -- u8 payload[3] = { MIPI_DCS_SET_TEAR_SCANLINE, scanline >> 8, -- scanline & 0xff }; -+ u8 payload[2] = { scanline >> 8, scanline & 0xff }; - ssize_t err; - -- err = mipi_dsi_generic_write(dsi, payload, sizeof(payload)); -+ err = mipi_dsi_dcs_write(dsi, MIPI_DCS_SET_TEAR_SCANLINE, payload, -+ sizeof(payload)); - if (err < 0) - return err; - -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -index d47d1a8e0219..85de8551ce86 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -@@ -713,7 +713,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) - ret = pm_runtime_get_sync(gpu->dev); - if (ret < 0) { - dev_err(gpu->dev, "Failed to enable GPU power domain\n"); -- return ret; -+ goto pm_put; - } - - etnaviv_hw_identify(gpu); -@@ -802,6 +802,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) - - fail: - pm_runtime_mark_last_busy(gpu->dev); -+pm_put: - pm_runtime_put_autosuspend(gpu->dev); - - return ret; -@@ -842,7 +843,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m) - - ret = pm_runtime_get_sync(gpu->dev); - if (ret < 0) -- return ret; -+ goto pm_put; - - dma_lo = gpu_read(gpu, VIVS_FE_DMA_LOW); - dma_hi = gpu_read(gpu, VIVS_FE_DMA_HIGH); -@@ -965,6 +966,7 @@ int etnaviv_gpu_debugfs(struct etnaviv_gpu *gpu, struct seq_file *m) - ret = 0; - - pm_runtime_mark_last_busy(gpu->dev); -+pm_put: - pm_runtime_put_autosuspend(gpu->dev); - - return ret; -@@ -978,7 +980,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu) - dev_err(gpu->dev, "recover hung GPU!\n"); - - if (pm_runtime_get_sync(gpu->dev) < 0) -- return; -+ goto pm_put; - - mutex_lock(&gpu->lock); - -@@ -997,6 +999,7 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu) - - mutex_unlock(&gpu->lock); - pm_runtime_mark_last_busy(gpu->dev); -+pm_put: - pm_runtime_put_autosuspend(gpu->dev); - } - -@@ -1269,8 +1272,10 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit) - - if (!submit->runtime_resumed) { - ret = pm_runtime_get_sync(gpu->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(gpu->dev); - return NULL; -+ } - submit->runtime_resumed = true; - } - -@@ -1287,6 +1292,7 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit) - ret = event_alloc(gpu, nr_events, event); - if (ret) { - DRM_ERROR("no free events\n"); -+ pm_runtime_put_noidle(gpu->dev); - return NULL; - } - -@@ -1457,7 +1463,7 @@ static int etnaviv_gpu_clk_enable(struct etnaviv_gpu *gpu) - if (gpu->clk_bus) { - ret = clk_prepare_enable(gpu->clk_bus); - if (ret) -- return ret; -+ goto disable_clk_reg; - } - - if (gpu->clk_core) { -@@ -1480,6 +1486,9 @@ disable_clk_core: - disable_clk_bus: - if (gpu->clk_bus) - clk_disable_unprepare(gpu->clk_bus); -+disable_clk_reg: -+ if (gpu->clk_reg) -+ clk_disable_unprepare(gpu->clk_reg); - - return ret; - } -diff --git a/drivers/gpu/drm/imx/dw_hdmi-imx.c b/drivers/gpu/drm/imx/dw_hdmi-imx.c -index f22cfbf9353e..2e12a4a3bfa1 100644 ---- a/drivers/gpu/drm/imx/dw_hdmi-imx.c -+++ b/drivers/gpu/drm/imx/dw_hdmi-imx.c -@@ -212,9 +212,8 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master, - if (!pdev->dev.of_node) - return -ENODEV; - -- hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL); -- if (!hdmi) -- return -ENOMEM; -+ hdmi = dev_get_drvdata(dev); -+ memset(hdmi, 0, sizeof(*hdmi)); - - match = of_match_node(dw_hdmi_imx_dt_ids, pdev->dev.of_node); - plat_data = match->data; -@@ -239,8 +238,6 @@ static int dw_hdmi_imx_bind(struct device *dev, struct device *master, - drm_encoder_init(drm, encoder, &dw_hdmi_imx_encoder_funcs, - DRM_MODE_ENCODER_TMDS, NULL); - -- platform_set_drvdata(pdev, hdmi); -- - hdmi->hdmi = dw_hdmi_bind(pdev, encoder, plat_data); - - /* -@@ -270,6 +267,14 @@ static const struct component_ops dw_hdmi_imx_ops = { - - static int dw_hdmi_imx_probe(struct platform_device *pdev) - { -+ struct imx_hdmi *hdmi; -+ -+ hdmi = devm_kzalloc(&pdev->dev, sizeof(*hdmi), GFP_KERNEL); -+ if (!hdmi) -+ return -ENOMEM; -+ -+ platform_set_drvdata(pdev, hdmi); -+ - return component_add(&pdev->dev, &dw_hdmi_imx_ops); - } - -diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c -index da87c70e413b..881c36d0f16b 100644 ---- a/drivers/gpu/drm/imx/imx-drm-core.c -+++ b/drivers/gpu/drm/imx/imx-drm-core.c -@@ -281,9 +281,10 @@ static void imx_drm_unbind(struct device *dev) - - drm_kms_helper_poll_fini(drm); - -+ component_unbind_all(drm->dev, drm); -+ - drm_mode_config_cleanup(drm); - -- component_unbind_all(drm->dev, drm); - dev_set_drvdata(dev, NULL); - - drm_dev_put(drm); -diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c -index 695f307f36b2..9af5a08d5490 100644 ---- a/drivers/gpu/drm/imx/imx-ldb.c -+++ b/drivers/gpu/drm/imx/imx-ldb.c -@@ -593,9 +593,8 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) - int ret; - int i; - -- imx_ldb = devm_kzalloc(dev, sizeof(*imx_ldb), GFP_KERNEL); -- if (!imx_ldb) -- return -ENOMEM; -+ imx_ldb = dev_get_drvdata(dev); -+ memset(imx_ldb, 0, sizeof(*imx_ldb)); - - imx_ldb->regmap = syscon_regmap_lookup_by_phandle(np, "gpr"); - if (IS_ERR(imx_ldb->regmap)) { -@@ -703,8 +702,6 @@ static int imx_ldb_bind(struct device *dev, struct device *master, void *data) - } - } - -- dev_set_drvdata(dev, imx_ldb); -- - return 0; - - free_child: -@@ -736,6 +733,14 @@ static const struct component_ops imx_ldb_ops = { - - static int imx_ldb_probe(struct platform_device *pdev) - { -+ struct imx_ldb *imx_ldb; -+ -+ imx_ldb = devm_kzalloc(&pdev->dev, sizeof(*imx_ldb), GFP_KERNEL); -+ if (!imx_ldb) -+ return -ENOMEM; -+ -+ platform_set_drvdata(pdev, imx_ldb); -+ - return component_add(&pdev->dev, &imx_ldb_ops); - } - -diff --git a/drivers/gpu/drm/imx/imx-tve.c b/drivers/gpu/drm/imx/imx-tve.c -index 5bbfaa2cd0f4..f91c3eb7697b 100644 ---- a/drivers/gpu/drm/imx/imx-tve.c -+++ b/drivers/gpu/drm/imx/imx-tve.c -@@ -494,6 +494,13 @@ static int imx_tve_register(struct drm_device *drm, struct imx_tve *tve) - return 0; - } - -+static void imx_tve_disable_regulator(void *data) -+{ -+ struct imx_tve *tve = data; -+ -+ regulator_disable(tve->dac_reg); -+} -+ - static bool imx_tve_readable_reg(struct device *dev, unsigned int reg) - { - return (reg % 4 == 0) && (reg <= 0xdc); -@@ -546,9 +553,8 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) - int irq; - int ret; - -- tve = devm_kzalloc(dev, sizeof(*tve), GFP_KERNEL); -- if (!tve) -- return -ENOMEM; -+ tve = dev_get_drvdata(dev); -+ memset(tve, 0, sizeof(*tve)); - - tve->dev = dev; - spin_lock_init(&tve->lock); -@@ -618,6 +624,9 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) - ret = regulator_enable(tve->dac_reg); - if (ret) - return ret; -+ ret = devm_add_action_or_reset(dev, imx_tve_disable_regulator, tve); -+ if (ret) -+ return ret; - } - - tve->clk = devm_clk_get(dev, "tve"); -@@ -659,27 +668,23 @@ static int imx_tve_bind(struct device *dev, struct device *master, void *data) - if (ret) - return ret; - -- dev_set_drvdata(dev, tve); -- - return 0; - } - --static void imx_tve_unbind(struct device *dev, struct device *master, -- void *data) --{ -- struct imx_tve *tve = dev_get_drvdata(dev); -- -- if (!IS_ERR(tve->dac_reg)) -- regulator_disable(tve->dac_reg); --} -- - static const struct component_ops imx_tve_ops = { - .bind = imx_tve_bind, -- .unbind = imx_tve_unbind, - }; - - static int imx_tve_probe(struct platform_device *pdev) - { -+ struct imx_tve *tve; -+ -+ tve = devm_kzalloc(&pdev->dev, sizeof(*tve), GFP_KERNEL); -+ if (!tve) -+ return -ENOMEM; -+ -+ platform_set_drvdata(pdev, tve); -+ - return component_add(&pdev->dev, &imx_tve_ops); - } - -diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c -index 63c0284f8b3c..2256c9789fc2 100644 ---- a/drivers/gpu/drm/imx/ipuv3-crtc.c -+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c -@@ -438,21 +438,13 @@ static int ipu_drm_bind(struct device *dev, struct device *master, void *data) - struct ipu_client_platformdata *pdata = dev->platform_data; - struct drm_device *drm = data; - struct ipu_crtc *ipu_crtc; -- int ret; - -- ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL); -- if (!ipu_crtc) -- return -ENOMEM; -+ ipu_crtc = dev_get_drvdata(dev); -+ memset(ipu_crtc, 0, sizeof(*ipu_crtc)); - - ipu_crtc->dev = dev; - -- ret = ipu_crtc_init(ipu_crtc, pdata, drm); -- if (ret) -- return ret; -- -- dev_set_drvdata(dev, ipu_crtc); -- -- return 0; -+ return ipu_crtc_init(ipu_crtc, pdata, drm); - } - - static void ipu_drm_unbind(struct device *dev, struct device *master, -@@ -474,6 +466,7 @@ static const struct component_ops ipu_crtc_ops = { - static int ipu_drm_probe(struct platform_device *pdev) - { - struct device *dev = &pdev->dev; -+ struct ipu_crtc *ipu_crtc; - int ret; - - if (!dev->platform_data) -@@ -483,6 +476,12 @@ static int ipu_drm_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ ipu_crtc = devm_kzalloc(dev, sizeof(*ipu_crtc), GFP_KERNEL); -+ if (!ipu_crtc) -+ return -ENOMEM; -+ -+ dev_set_drvdata(dev, ipu_crtc); -+ - return component_add(dev, &ipu_crtc_ops); - } - -diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c -index e7ce17503ae1..be55548f352a 100644 ---- a/drivers/gpu/drm/imx/parallel-display.c -+++ b/drivers/gpu/drm/imx/parallel-display.c -@@ -204,9 +204,8 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data) - u32 bus_format = 0; - const char *fmt; - -- imxpd = devm_kzalloc(dev, sizeof(*imxpd), GFP_KERNEL); -- if (!imxpd) -- return -ENOMEM; -+ imxpd = dev_get_drvdata(dev); -+ memset(imxpd, 0, sizeof(*imxpd)); - - edidp = of_get_property(np, "edid", &imxpd->edid_len); - if (edidp) -@@ -236,8 +235,6 @@ static int imx_pd_bind(struct device *dev, struct device *master, void *data) - if (ret) - return ret; - -- dev_set_drvdata(dev, imxpd); -- - return 0; - } - -@@ -259,6 +256,14 @@ static const struct component_ops imx_pd_ops = { - - static int imx_pd_probe(struct platform_device *pdev) - { -+ struct imx_parallel_display *imxpd; -+ -+ imxpd = devm_kzalloc(&pdev->dev, sizeof(*imxpd), GFP_KERNEL); -+ if (!imxpd) -+ return -ENOMEM; -+ -+ platform_set_drvdata(pdev, imxpd); -+ - return component_add(&pdev->dev, &imx_pd_ops); - } - -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index e62b286947a7..9ea748667fab 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -713,10 +713,19 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu) - /* Turn on the resources */ - pm_runtime_get_sync(gmu->dev); - -+ /* -+ * "enable" the GX power domain which won't actually do anything but it -+ * will make sure that the refcounting is correct in case we need to -+ * bring down the GX after a GMU failure -+ */ -+ if (!IS_ERR_OR_NULL(gmu->gxpd)) -+ pm_runtime_get_sync(gmu->gxpd); -+ - /* Use a known rate to bring up the GMU */ - clk_set_rate(gmu->core_clk, 200000000); - ret = clk_bulk_prepare_enable(gmu->nr_clocks, gmu->clocks); - if (ret) { -+ pm_runtime_put(gmu->gxpd); - pm_runtime_put(gmu->dev); - return ret; - } -@@ -752,19 +761,12 @@ int a6xx_gmu_resume(struct a6xx_gpu *a6xx_gpu) - /* Set the GPU to the highest power frequency */ - __a6xx_gmu_set_freq(gmu, gmu->nr_gpu_freqs - 1); - -- /* -- * "enable" the GX power domain which won't actually do anything but it -- * will make sure that the refcounting is correct in case we need to -- * bring down the GX after a GMU failure -- */ -- if (!IS_ERR_OR_NULL(gmu->gxpd)) -- pm_runtime_get(gmu->gxpd); -- - out: - /* On failure, shut down the GMU to leave it in a good state */ - if (ret) { - disable_irq(gmu->gmu_irq); - a6xx_rpmh_stop(gmu); -+ pm_runtime_put(gmu->gxpd); - pm_runtime_put(gmu->dev); - } - -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -index ce59adff06aa..36c85c05b7cf 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c -@@ -381,7 +381,7 @@ static void dpu_crtc_frame_event_cb(void *data, u32 event) - spin_unlock_irqrestore(&dpu_crtc->spin_lock, flags); - - if (!fevent) { -- DRM_ERROR("crtc%d event %d overflow\n", crtc->base.id, event); -+ DRM_ERROR_RATELIMITED("crtc%d event %d overflow\n", crtc->base.id, event); - return; - } - -diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c -index 5a6a79fbc9d6..d92a0ffe2a76 100644 ---- a/drivers/gpu/drm/msm/msm_gem.c -+++ b/drivers/gpu/drm/msm/msm_gem.c -@@ -977,10 +977,8 @@ int msm_gem_new_handle(struct drm_device *dev, struct drm_file *file, - - static int msm_gem_new_impl(struct drm_device *dev, - uint32_t size, uint32_t flags, -- struct drm_gem_object **obj, -- bool struct_mutex_locked) -+ struct drm_gem_object **obj) - { -- struct msm_drm_private *priv = dev->dev_private; - struct msm_gem_object *msm_obj; - - switch (flags & MSM_BO_CACHE_MASK) { -@@ -1006,15 +1004,6 @@ static int msm_gem_new_impl(struct drm_device *dev, - INIT_LIST_HEAD(&msm_obj->submit_entry); - INIT_LIST_HEAD(&msm_obj->vmas); - -- if (struct_mutex_locked) { -- WARN_ON(!mutex_is_locked(&dev->struct_mutex)); -- list_add_tail(&msm_obj->mm_list, &priv->inactive_list); -- } else { -- mutex_lock(&dev->struct_mutex); -- list_add_tail(&msm_obj->mm_list, &priv->inactive_list); -- mutex_unlock(&dev->struct_mutex); -- } -- - *obj = &msm_obj->base; - - return 0; -@@ -1024,6 +1013,7 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, - uint32_t size, uint32_t flags, bool struct_mutex_locked) - { - struct msm_drm_private *priv = dev->dev_private; -+ struct msm_gem_object *msm_obj; - struct drm_gem_object *obj = NULL; - bool use_vram = false; - int ret; -@@ -1044,14 +1034,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, - if (size == 0) - return ERR_PTR(-EINVAL); - -- ret = msm_gem_new_impl(dev, size, flags, &obj, struct_mutex_locked); -+ ret = msm_gem_new_impl(dev, size, flags, &obj); - if (ret) - goto fail; - -+ msm_obj = to_msm_bo(obj); -+ - if (use_vram) { - struct msm_gem_vma *vma; - struct page **pages; -- struct msm_gem_object *msm_obj = to_msm_bo(obj); - - mutex_lock(&msm_obj->lock); - -@@ -1086,6 +1077,15 @@ static struct drm_gem_object *_msm_gem_new(struct drm_device *dev, - mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER); - } - -+ if (struct_mutex_locked) { -+ WARN_ON(!mutex_is_locked(&dev->struct_mutex)); -+ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); -+ } else { -+ mutex_lock(&dev->struct_mutex); -+ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); -+ mutex_unlock(&dev->struct_mutex); -+ } -+ - return obj; - - fail: -@@ -1108,6 +1108,7 @@ struct drm_gem_object *msm_gem_new(struct drm_device *dev, - struct drm_gem_object *msm_gem_import(struct drm_device *dev, - struct dma_buf *dmabuf, struct sg_table *sgt) - { -+ struct msm_drm_private *priv = dev->dev_private; - struct msm_gem_object *msm_obj; - struct drm_gem_object *obj; - uint32_t size; -@@ -1121,7 +1122,7 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, - - size = PAGE_ALIGN(dmabuf->size); - -- ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj, false); -+ ret = msm_gem_new_impl(dev, size, MSM_BO_WC, &obj); - if (ret) - goto fail; - -@@ -1146,6 +1147,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev, - } - - mutex_unlock(&msm_obj->lock); -+ -+ mutex_lock(&dev->struct_mutex); -+ list_add_tail(&msm_obj->mm_list, &priv->inactive_list); -+ mutex_unlock(&dev->struct_mutex); -+ - return obj; - - fail: -diff --git a/drivers/gpu/drm/nouveau/dispnv50/head.c b/drivers/gpu/drm/nouveau/dispnv50/head.c -index c9692df2b76c..46578108a430 100644 ---- a/drivers/gpu/drm/nouveau/dispnv50/head.c -+++ b/drivers/gpu/drm/nouveau/dispnv50/head.c -@@ -83,18 +83,20 @@ nv50_head_atomic_check_dither(struct nv50_head_atom *armh, - { - u32 mode = 0x00; - -- if (asyc->dither.mode == DITHERING_MODE_AUTO) { -- if (asyh->base.depth > asyh->or.bpc * 3) -- mode = DITHERING_MODE_DYNAMIC2X2; -- } else { -- mode = asyc->dither.mode; -- } -+ if (asyc->dither.mode) { -+ if (asyc->dither.mode == DITHERING_MODE_AUTO) { -+ if (asyh->base.depth > asyh->or.bpc * 3) -+ mode = DITHERING_MODE_DYNAMIC2X2; -+ } else { -+ mode = asyc->dither.mode; -+ } - -- if (asyc->dither.depth == DITHERING_DEPTH_AUTO) { -- if (asyh->or.bpc >= 8) -- mode |= DITHERING_DEPTH_8BPC; -- } else { -- mode |= asyc->dither.depth; -+ if (asyc->dither.depth == DITHERING_DEPTH_AUTO) { -+ if (asyh->or.bpc >= 8) -+ mode |= DITHERING_DEPTH_8BPC; -+ } else { -+ mode |= asyc->dither.depth; -+ } - } - - asyh->dither.enable = mode; -diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c -index 7dfbbbc1beea..5c314f135dd1 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c -+++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c -@@ -54,8 +54,10 @@ nouveau_debugfs_strap_peek(struct seq_file *m, void *data) - int ret; - - ret = pm_runtime_get_sync(drm->dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(drm->dev->dev); - return ret; -+ } - - seq_printf(m, "0x%08x\n", - nvif_rd32(&drm->client.device.object, 0x101000)); -diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c -index b1beed40e746..5347e5bdee8c 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_drm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c -@@ -1052,8 +1052,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) - - /* need to bring up power immediately if opening device */ - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - get_task_comm(tmpname, current); - snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); -@@ -1135,8 +1137,10 @@ nouveau_drm_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - long ret; - - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - switch (_IOC_NR(cmd) - DRM_COMMAND_BASE) { - case DRM_NOUVEAU_NVIF: -diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index 1324c19f4e5c..fbfe25422774 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_gem.c -+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -45,8 +45,10 @@ nouveau_gem_object_del(struct drm_gem_object *gem) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (WARN_ON(ret < 0 && ret != -EACCES)) -+ if (WARN_ON(ret < 0 && ret != -EACCES)) { -+ pm_runtime_put_autosuspend(dev); - return; -+ } - - if (gem->import_attach) - drm_prime_gem_destroy(gem, nvbo->bo.sg); -diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c -index feaac908efed..34403b810dba 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c -+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c -@@ -96,12 +96,9 @@ nouveau_sgdma_create_ttm(struct ttm_buffer_object *bo, uint32_t page_flags) - else - nvbe->ttm.ttm.func = &nv50_sgdma_backend; - -- if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags)) -- /* -- * A failing ttm_dma_tt_init() will call ttm_tt_destroy() -- * and thus our nouveau_sgdma_destroy() hook, so we don't need -- * to free nvbe here. -- */ -+ if (ttm_dma_tt_init(&nvbe->ttm, bo, page_flags)) { -+ kfree(nvbe); - return NULL; -+ } - return &nvbe->ttm.ttm; - } -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index 8abb31f83ffc..6d9656323a3f 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -1935,7 +1935,7 @@ static const struct drm_display_mode lg_lb070wv8_mode = { - static const struct panel_desc lg_lb070wv8 = { - .modes = &lg_lb070wv8_mode, - .num_modes = 1, -- .bpc = 16, -+ .bpc = 8, - .size = { - .width = 151, - .height = 91, -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index f9685cce1652..1e62e7bbf1b1 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -4366,7 +4366,7 @@ static int ci_set_mc_special_registers(struct radeon_device *rdev, - table->mc_reg_table_entry[k].mc_data[j] |= 0x100; - } - j++; -- if (j > SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) -+ if (j >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE) - return -EINVAL; - - if (!pi->mem_gddr5) { -diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c -index 0826efd9b5f5..f9f74150d0d7 100644 ---- a/drivers/gpu/drm/radeon/radeon_display.c -+++ b/drivers/gpu/drm/radeon/radeon_display.c -@@ -631,8 +631,10 @@ radeon_crtc_set_config(struct drm_mode_set *set, - dev = set->crtc->dev; - - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - ret = drm_crtc_helper_set_config(set, ctx); - -diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c -index 6128792ab883..c2573096d43c 100644 ---- a/drivers/gpu/drm/radeon/radeon_drv.c -+++ b/drivers/gpu/drm/radeon/radeon_drv.c -@@ -174,12 +174,7 @@ int radeon_no_wb; - int radeon_modeset = -1; - int radeon_dynclks = -1; - int radeon_r4xx_atom = 0; --#ifdef __powerpc__ --/* Default to PCI on PowerPC (fdo #95017) */ - int radeon_agpmode = -1; --#else --int radeon_agpmode = 0; --#endif - int radeon_vram_limit = 0; - int radeon_gart_size = -1; /* auto */ - int radeon_benchmarking = 0; -@@ -555,8 +550,10 @@ long radeon_drm_ioctl(struct file *filp, - long ret; - dev = file_priv->minor->dev; - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - ret = drm_ioctl(filp, cmd, arg); - -diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c -index 2bb0187c5bc7..709c4ef5e7d5 100644 ---- a/drivers/gpu/drm/radeon/radeon_kms.c -+++ b/drivers/gpu/drm/radeon/radeon_kms.c -@@ -638,8 +638,10 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - file_priv->driver_priv = NULL; - - r = pm_runtime_get_sync(dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(dev->dev); - return r; -+ } - - /* new gpu have virtual address space support */ - if (rdev->family >= CHIP_CAYMAN) { -diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c -index 3ab4fbf8eb0d..51571f7246ab 100644 ---- a/drivers/gpu/drm/stm/ltdc.c -+++ b/drivers/gpu/drm/stm/ltdc.c -@@ -424,9 +424,12 @@ static void ltdc_crtc_atomic_enable(struct drm_crtc *crtc, - struct drm_crtc_state *old_state) - { - struct ltdc_device *ldev = crtc_to_ltdc(crtc); -+ struct drm_device *ddev = crtc->dev; - - DRM_DEBUG_DRIVER("\n"); - -+ pm_runtime_get_sync(ddev->dev); -+ - /* Sets the background color value */ - reg_write(ldev->regs, LTDC_BCCR, BCCR_BCBLACK); - -diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc/tilcdc_panel.c -index 5584e656b857..8c4fd1aa4c2d 100644 ---- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c -+++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c -@@ -143,12 +143,16 @@ static int panel_connector_get_modes(struct drm_connector *connector) - int i; - - for (i = 0; i < timings->num_timings; i++) { -- struct drm_display_mode *mode = drm_mode_create(dev); -+ struct drm_display_mode *mode; - struct videomode vm; - - if (videomode_from_timings(timings, &vm, i)) - break; - -+ mode = drm_mode_create(dev); -+ if (!mode) -+ break; -+ - drm_display_mode_from_videomode(&vm, mode); - - mode->type = DRM_MODE_TYPE_DRIVER; -diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c -index e0e9b4f69db6..c770ec7e9e8b 100644 ---- a/drivers/gpu/drm/ttm/ttm_tt.c -+++ b/drivers/gpu/drm/ttm/ttm_tt.c -@@ -241,7 +241,6 @@ int ttm_tt_init(struct ttm_tt *ttm, struct ttm_buffer_object *bo, - ttm_tt_init_fields(ttm, bo, page_flags); - - if (ttm_tt_alloc_page_directory(ttm)) { -- ttm_tt_destroy(ttm); - pr_err("Failed allocating page table\n"); - return -ENOMEM; - } -@@ -265,7 +264,6 @@ int ttm_dma_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, - - INIT_LIST_HEAD(&ttm_dma->pages_list); - if (ttm_dma_tt_alloc_page_directory(ttm_dma)) { -- ttm_tt_destroy(ttm); - pr_err("Failed allocating page table\n"); - return -ENOMEM; - } -@@ -287,7 +285,6 @@ int ttm_sg_tt_init(struct ttm_dma_tt *ttm_dma, struct ttm_buffer_object *bo, - else - ret = ttm_dma_tt_alloc_page_directory(ttm_dma); - if (ret) { -- ttm_tt_destroy(ttm); - pr_err("Failed allocating page table\n"); - return -ENOMEM; - } -diff --git a/drivers/gpu/host1x/debug.c b/drivers/gpu/host1x/debug.c -index c0392672a842..1b4997bda1c7 100644 ---- a/drivers/gpu/host1x/debug.c -+++ b/drivers/gpu/host1x/debug.c -@@ -16,6 +16,8 @@ - #include "debug.h" - #include "channel.h" - -+static DEFINE_MUTEX(debug_lock); -+ - unsigned int host1x_debug_trace_cmdbuf; - - static pid_t host1x_debug_force_timeout_pid; -@@ -52,12 +54,14 @@ static int show_channel(struct host1x_channel *ch, void *data, bool show_fifo) - struct output *o = data; - - mutex_lock(&ch->cdma.lock); -+ mutex_lock(&debug_lock); - - if (show_fifo) - host1x_hw_show_channel_fifo(m, ch, o); - - host1x_hw_show_channel_cdma(m, ch, o); - -+ mutex_unlock(&debug_lock); - mutex_unlock(&ch->cdma.lock); - - return 0; -diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c -index ee2a025e54cf..b3dae9ec1a38 100644 ---- a/drivers/gpu/ipu-v3/ipu-common.c -+++ b/drivers/gpu/ipu-v3/ipu-common.c -@@ -124,6 +124,8 @@ enum ipu_color_space ipu_pixelformat_to_colorspace(u32 pixelformat) - case V4L2_PIX_FMT_RGBX32: - case V4L2_PIX_FMT_ARGB32: - case V4L2_PIX_FMT_XRGB32: -+ case V4L2_PIX_FMT_RGB32: -+ case V4L2_PIX_FMT_BGR32: - return IPUV3_COLORSPACE_RGB; - default: - return IPUV3_COLORSPACE_UNKNOWN; -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index dea9cc65bf80..e8641ce677e4 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -350,13 +350,13 @@ static int hidinput_query_battery_capacity(struct hid_device *dev) - u8 *buf; - int ret; - -- buf = kmalloc(2, GFP_KERNEL); -+ buf = kmalloc(4, GFP_KERNEL); - if (!buf) - return -ENOMEM; - -- ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 2, -+ ret = hid_hw_raw_request(dev, dev->battery_report_id, buf, 4, - dev->battery_report_type, HID_REQ_GET_REPORT); -- if (ret != 2) { -+ if (ret < 2) { - kfree(buf); - return -ENODATA; - } -diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c -index 36cce2bfb744..6375504ba8b0 100644 ---- a/drivers/hwtracing/coresight/coresight-tmc-etf.c -+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c -@@ -639,15 +639,14 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata) - - spin_lock_irqsave(&drvdata->spinlock, flags); - -- /* There is no point in reading a TMC in HW FIFO mode */ -- mode = readl_relaxed(drvdata->base + TMC_MODE); -- if (mode != TMC_MODE_CIRCULAR_BUFFER) { -- spin_unlock_irqrestore(&drvdata->spinlock, flags); -- return -EINVAL; -- } -- - /* Re-enable the TMC if need be */ - if (drvdata->mode == CS_MODE_SYSFS) { -+ /* There is no point in reading a TMC in HW FIFO mode */ -+ mode = readl_relaxed(drvdata->base + TMC_MODE); -+ if (mode != TMC_MODE_CIRCULAR_BUFFER) { -+ spin_unlock_irqrestore(&drvdata->spinlock, flags); -+ return -EINVAL; -+ } - /* - * The trace run will continue with the same allocated trace - * buffer. As such zero-out the buffer so that we don't end -diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c -index 10ae6c6eab0a..59dc9f3cfb37 100644 ---- a/drivers/infiniband/core/device.c -+++ b/drivers/infiniband/core/device.c -@@ -1330,6 +1330,10 @@ out: - return ret; - } - -+static void prevent_dealloc_device(struct ib_device *ib_dev) -+{ -+} -+ - /** - * ib_register_device - Register an IB device with IB core - * @device:Device to register -@@ -1397,11 +1401,11 @@ int ib_register_device(struct ib_device *device, const char *name) - * possibility for a parallel unregistration along with this - * error flow. Since we have a refcount here we know any - * parallel flow is stopped in disable_device and will see the -- * NULL pointers, causing the responsibility to -+ * special dealloc_driver pointer, causing the responsibility to - * ib_dealloc_device() to revert back to this thread. - */ - dealloc_fn = device->ops.dealloc_driver; -- device->ops.dealloc_driver = NULL; -+ device->ops.dealloc_driver = prevent_dealloc_device; - ib_device_put(device); - __ib_unregister_device(device); - device->ops.dealloc_driver = dealloc_fn; -@@ -1449,7 +1453,8 @@ static void __ib_unregister_device(struct ib_device *ib_dev) - * Drivers using the new flow may not call ib_dealloc_device except - * in error unwind prior to registration success. - */ -- if (ib_dev->ops.dealloc_driver) { -+ if (ib_dev->ops.dealloc_driver && -+ ib_dev->ops.dealloc_driver != prevent_dealloc_device) { - WARN_ON(kref_read(&ib_dev->dev.kobj.kref) <= 1); - ib_dealloc_device(ib_dev); - } -diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c -index 244ebf285fc3..e4905d9fecb0 100644 ---- a/drivers/infiniband/core/nldev.c -+++ b/drivers/infiniband/core/nldev.c -@@ -702,9 +702,6 @@ static int fill_stat_counter_qps(struct sk_buff *msg, - continue; - - qp = container_of(res, struct ib_qp, res); -- if (qp->qp_type == IB_QPT_RAW_PACKET && !capable(CAP_NET_RAW)) -- continue; -- - if (!qp->counter || (qp->counter->id != counter->id)) - continue; - -diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c -index 6c4093d0a91d..d4815f29cfd2 100644 ---- a/drivers/infiniband/core/verbs.c -+++ b/drivers/infiniband/core/verbs.c -@@ -1648,7 +1648,7 @@ static int _ib_modify_qp(struct ib_qp *qp, struct ib_qp_attr *attr, - if (!(rdma_protocol_ib(qp->device, - attr->alt_ah_attr.port_num) && - rdma_protocol_ib(qp->device, port))) { -- ret = EINVAL; -+ ret = -EINVAL; - goto out; - } - } -diff --git a/drivers/infiniband/hw/qedr/qedr.h b/drivers/infiniband/hw/qedr/qedr.h -index 8e927f6c1520..ed56df319d2d 100644 ---- a/drivers/infiniband/hw/qedr/qedr.h -+++ b/drivers/infiniband/hw/qedr/qedr.h -@@ -349,10 +349,10 @@ struct qedr_srq_hwq_info { - u32 wqe_prod; - u32 sge_prod; - u32 wr_prod_cnt; -- u32 wr_cons_cnt; -+ atomic_t wr_cons_cnt; - u32 num_elems; - -- u32 *virt_prod_pair_addr; -+ struct rdma_srq_producers *virt_prod_pair_addr; - dma_addr_t phy_prod_pair_addr; - }; - -diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c -index 8b4240c1cc76..16a994fd7d0a 100644 ---- a/drivers/infiniband/hw/qedr/verbs.c -+++ b/drivers/infiniband/hw/qedr/verbs.c -@@ -3460,7 +3460,7 @@ static u32 qedr_srq_elem_left(struct qedr_srq_hwq_info *hw_srq) - * count and consumer count and subtract it from max - * work request supported so that we get elements left. - */ -- used = hw_srq->wr_prod_cnt - hw_srq->wr_cons_cnt; -+ used = hw_srq->wr_prod_cnt - (u32)atomic_read(&hw_srq->wr_cons_cnt); - - return hw_srq->max_wr - used; - } -@@ -3475,7 +3475,6 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, - unsigned long flags; - int status = 0; - u32 num_sge; -- u32 offset; - - spin_lock_irqsave(&srq->lock, flags); - -@@ -3488,7 +3487,8 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, - if (!qedr_srq_elem_left(hw_srq) || - wr->num_sge > srq->hw_srq.max_sges) { - DP_ERR(dev, "Can't post WR (%d,%d) || (%d > %d)\n", -- hw_srq->wr_prod_cnt, hw_srq->wr_cons_cnt, -+ hw_srq->wr_prod_cnt, -+ atomic_read(&hw_srq->wr_cons_cnt), - wr->num_sge, srq->hw_srq.max_sges); - status = -ENOMEM; - *bad_wr = wr; -@@ -3522,22 +3522,20 @@ int qedr_post_srq_recv(struct ib_srq *ibsrq, const struct ib_recv_wr *wr, - hw_srq->sge_prod++; - } - -- /* Flush WQE and SGE information before -+ /* Update WQE and SGE information before - * updating producer. - */ -- wmb(); -+ dma_wmb(); - - /* SRQ producer is 8 bytes. Need to update SGE producer index - * in first 4 bytes and need to update WQE producer in - * next 4 bytes. - */ -- *srq->hw_srq.virt_prod_pair_addr = hw_srq->sge_prod; -- offset = offsetof(struct rdma_srq_producers, wqe_prod); -- *((u8 *)srq->hw_srq.virt_prod_pair_addr + offset) = -- hw_srq->wqe_prod; -+ srq->hw_srq.virt_prod_pair_addr->sge_prod = hw_srq->sge_prod; -+ /* Make sure sge producer is updated first */ -+ dma_wmb(); -+ srq->hw_srq.virt_prod_pair_addr->wqe_prod = hw_srq->wqe_prod; - -- /* Flush producer after updating it. */ -- wmb(); - wr = wr->next; - } - -@@ -3956,7 +3954,7 @@ static int process_resp_one_srq(struct qedr_dev *dev, struct qedr_qp *qp, - } else { - __process_resp_one(dev, qp, cq, wc, resp, wr_id); - } -- srq->hw_srq.wr_cons_cnt++; -+ atomic_inc(&srq->hw_srq.wr_cons_cnt); - - return 1; - } -diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c -index 831ad578a7b2..46e111c218fd 100644 ---- a/drivers/infiniband/sw/rxe/rxe_recv.c -+++ b/drivers/infiniband/sw/rxe/rxe_recv.c -@@ -330,10 +330,14 @@ err1: - - static int rxe_match_dgid(struct rxe_dev *rxe, struct sk_buff *skb) - { -+ struct rxe_pkt_info *pkt = SKB_TO_PKT(skb); - const struct ib_gid_attr *gid_attr; - union ib_gid dgid; - union ib_gid *pdgid; - -+ if (pkt->mask & RXE_LOOPBACK_MASK) -+ return 0; -+ - if (skb->protocol == htons(ETH_P_IP)) { - ipv6_addr_set_v4mapped(ip_hdr(skb)->daddr, - (struct in6_addr *)&dgid); -@@ -366,7 +370,7 @@ void rxe_rcv(struct sk_buff *skb) - if (unlikely(skb->len < pkt->offset + RXE_BTH_BYTES)) - goto drop; - -- if (unlikely(rxe_match_dgid(rxe, skb) < 0)) { -+ if (rxe_match_dgid(rxe, skb) < 0) { - pr_warn_ratelimited("failed matching dgid\n"); - goto drop; - } -diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c -index 623129f27f5a..71358b0b8910 100644 ---- a/drivers/infiniband/sw/rxe/rxe_verbs.c -+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c -@@ -679,6 +679,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, - unsigned int mask; - unsigned int length = 0; - int i; -+ struct ib_send_wr *next; - - while (wr) { - mask = wr_opcode_mask(wr->opcode, qp); -@@ -695,6 +696,8 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, - break; - } - -+ next = wr->next; -+ - length = 0; - for (i = 0; i < wr->num_sge; i++) - length += wr->sg_list[i].length; -@@ -705,7 +708,7 @@ static int rxe_post_send_kernel(struct rxe_qp *qp, const struct ib_send_wr *wr, - *bad_wr = wr; - break; - } -- wr = wr->next; -+ wr = next; - } - - rxe_run_task(&qp->req.task, 1); -diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c -index 982d796b686b..6bfb283e6f28 100644 ---- a/drivers/iommu/intel_irq_remapping.c -+++ b/drivers/iommu/intel_irq_remapping.c -@@ -628,13 +628,21 @@ out_free_table: - - static void intel_teardown_irq_remapping(struct intel_iommu *iommu) - { -+ struct fwnode_handle *fn; -+ - if (iommu && iommu->ir_table) { - if (iommu->ir_msi_domain) { -+ fn = iommu->ir_msi_domain->fwnode; -+ - irq_domain_remove(iommu->ir_msi_domain); -+ irq_domain_free_fwnode(fn); - iommu->ir_msi_domain = NULL; - } - if (iommu->ir_domain) { -+ fn = iommu->ir_domain->fwnode; -+ - irq_domain_remove(iommu->ir_domain); -+ irq_domain_free_fwnode(fn); - iommu->ir_domain = NULL; - } - free_pages((unsigned long)iommu->ir_table->base, -diff --git a/drivers/irqchip/irq-mtk-sysirq.c b/drivers/irqchip/irq-mtk-sysirq.c -index 73eae5966a40..6ff98b87e5c0 100644 ---- a/drivers/irqchip/irq-mtk-sysirq.c -+++ b/drivers/irqchip/irq-mtk-sysirq.c -@@ -15,7 +15,7 @@ - #include - - struct mtk_sysirq_chip_data { -- spinlock_t lock; -+ raw_spinlock_t lock; - u32 nr_intpol_bases; - void __iomem **intpol_bases; - u32 *intpol_words; -@@ -37,7 +37,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) - reg_index = chip_data->which_word[hwirq]; - offset = hwirq & 0x1f; - -- spin_lock_irqsave(&chip_data->lock, flags); -+ raw_spin_lock_irqsave(&chip_data->lock, flags); - value = readl_relaxed(base + reg_index * 4); - if (type == IRQ_TYPE_LEVEL_LOW || type == IRQ_TYPE_EDGE_FALLING) { - if (type == IRQ_TYPE_LEVEL_LOW) -@@ -53,7 +53,7 @@ static int mtk_sysirq_set_type(struct irq_data *data, unsigned int type) - - data = data->parent_data; - ret = data->chip->irq_set_type(data, type); -- spin_unlock_irqrestore(&chip_data->lock, flags); -+ raw_spin_unlock_irqrestore(&chip_data->lock, flags); - return ret; - } - -@@ -212,7 +212,7 @@ static int __init mtk_sysirq_of_init(struct device_node *node, - ret = -ENOMEM; - goto out_free_which_word; - } -- spin_lock_init(&chip_data->lock); -+ raw_spin_lock_init(&chip_data->lock); - - return 0; - -diff --git a/drivers/irqchip/irq-ti-sci-inta.c b/drivers/irqchip/irq-ti-sci-inta.c -index fa7488863bd0..0a35499c4672 100644 ---- a/drivers/irqchip/irq-ti-sci-inta.c -+++ b/drivers/irqchip/irq-ti-sci-inta.c -@@ -571,7 +571,7 @@ static int ti_sci_inta_irq_domain_probe(struct platform_device *pdev) - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - inta->base = devm_ioremap_resource(dev, res); - if (IS_ERR(inta->base)) -- return -ENODEV; -+ return PTR_ERR(inta->base); - - domain = irq_domain_add_linear(dev_of_node(dev), - ti_sci_get_num_resources(inta->vint), -diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c -index d3e83c33783e..0a4823d9797a 100644 ---- a/drivers/leds/led-class.c -+++ b/drivers/leds/led-class.c -@@ -172,6 +172,7 @@ void led_classdev_suspend(struct led_classdev *led_cdev) - { - led_cdev->flags |= LED_SUSPENDED; - led_set_brightness_nopm(led_cdev, 0); -+ flush_work(&led_cdev->set_brightness_work); - } - EXPORT_SYMBOL_GPL(led_classdev_suspend); - -diff --git a/drivers/leds/leds-lm355x.c b/drivers/leds/leds-lm355x.c -index a5abb499574b..129f475aebf2 100644 ---- a/drivers/leds/leds-lm355x.c -+++ b/drivers/leds/leds-lm355x.c -@@ -165,18 +165,19 @@ static int lm355x_chip_init(struct lm355x_chip_data *chip) - /* input and output pins configuration */ - switch (chip->type) { - case CHIP_LM3554: -- reg_val = pdata->pin_tx2 | pdata->ntc_pin; -+ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin; - ret = regmap_update_bits(chip->regmap, 0xE0, 0x28, reg_val); - if (ret < 0) - goto out; -- reg_val = pdata->pass_mode; -+ reg_val = (u32)pdata->pass_mode; - ret = regmap_update_bits(chip->regmap, 0xA0, 0x04, reg_val); - if (ret < 0) - goto out; - break; - - case CHIP_LM3556: -- reg_val = pdata->pin_tx2 | pdata->ntc_pin | pdata->pass_mode; -+ reg_val = (u32)pdata->pin_tx2 | (u32)pdata->ntc_pin | -+ (u32)pdata->pass_mode; - ret = regmap_update_bits(chip->regmap, 0x0A, 0xC4, reg_val); - if (ret < 0) - goto out; -diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c -index ac824d7b2dcf..6aa903529570 100644 ---- a/drivers/macintosh/via-macii.c -+++ b/drivers/macintosh/via-macii.c -@@ -270,15 +270,12 @@ static int macii_autopoll(int devs) - unsigned long flags; - int err = 0; - -+ local_irq_save(flags); -+ - /* bit 1 == device 1, and so on. */ - autopoll_devs = devs & 0xFFFE; - -- if (!autopoll_devs) -- return 0; -- -- local_irq_save(flags); -- -- if (current_req == NULL) { -+ if (autopoll_devs && !current_req) { - /* Send a Talk Reg 0. The controller will repeatedly transmit - * this as long as it is idle. - */ -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 68901745eb20..168d64707859 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -2091,7 +2091,14 @@ found: - sysfs_create_link(&c->kobj, &ca->kobj, buf)) - goto err; - -- if (ca->sb.seq > c->sb.seq) { -+ /* -+ * A special case is both ca->sb.seq and c->sb.seq are 0, -+ * such condition happens on a new created cache device whose -+ * super block is never flushed yet. In this case c->sb.version -+ * and other members should be updated too, otherwise we will -+ * have a mistaken super block version in cache set. -+ */ -+ if (ca->sb.seq > c->sb.seq || c->sb.seq == 0) { - c->sb.version = ca->sb.version; - memcpy(c->sb.set_uuid, ca->sb.set_uuid, 16); - c->sb.flags = ca->sb.flags; -diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c -index 813a99ffa86f..73fd50e77975 100644 ---- a/drivers/md/md-cluster.c -+++ b/drivers/md/md-cluster.c -@@ -1518,6 +1518,7 @@ static void unlock_all_bitmaps(struct mddev *mddev) - } - } - kfree(cinfo->other_bitmap_lockres); -+ cinfo->other_bitmap_lockres = NULL; - } - } - -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 5a378a453a2d..acef01e519d0 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -376,17 +376,18 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio) - struct mddev *mddev = q->queuedata; - unsigned int sectors; - -- if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { -+ if (mddev == NULL || mddev->pers == NULL) { - bio_io_error(bio); - return BLK_QC_T_NONE; - } - -- blk_queue_split(q, &bio); -- -- if (mddev == NULL || mddev->pers == NULL) { -+ if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { - bio_io_error(bio); - return BLK_QC_T_NONE; - } -+ -+ blk_queue_split(q, &bio); -+ - if (mddev->ro == 1 && unlikely(rw == WRITE)) { - if (bio_sectors(bio) != 0) - bio->bi_status = BLK_STS_IOERR; -diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c -index 97144734eb05..3f1ca40b9b98 100644 ---- a/drivers/media/firewire/firedtv-fw.c -+++ b/drivers/media/firewire/firedtv-fw.c -@@ -272,6 +272,8 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) - - name_len = fw_csr_string(unit->directory, CSR_MODEL, - name, sizeof(name)); -+ if (name_len < 0) -+ return name_len; - for (i = ARRAY_SIZE(model_names); --i; ) - if (strlen(model_names[i]) <= name_len && - strncmp(name, model_names[i], name_len) == 0) -diff --git a/drivers/media/mc/mc-request.c b/drivers/media/mc/mc-request.c -index e3fca436c75b..c0782fd96c59 100644 ---- a/drivers/media/mc/mc-request.c -+++ b/drivers/media/mc/mc-request.c -@@ -296,9 +296,18 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) - if (WARN_ON(!mdev->ops->req_alloc ^ !mdev->ops->req_free)) - return -ENOMEM; - -+ if (mdev->ops->req_alloc) -+ req = mdev->ops->req_alloc(mdev); -+ else -+ req = kzalloc(sizeof(*req), GFP_KERNEL); -+ if (!req) -+ return -ENOMEM; -+ - fd = get_unused_fd_flags(O_CLOEXEC); -- if (fd < 0) -- return fd; -+ if (fd < 0) { -+ ret = fd; -+ goto err_free_req; -+ } - - filp = anon_inode_getfile("request", &request_fops, NULL, O_CLOEXEC); - if (IS_ERR(filp)) { -@@ -306,15 +315,6 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) - goto err_put_fd; - } - -- if (mdev->ops->req_alloc) -- req = mdev->ops->req_alloc(mdev); -- else -- req = kzalloc(sizeof(*req), GFP_KERNEL); -- if (!req) { -- ret = -ENOMEM; -- goto err_fput; -- } -- - filp->private_data = req; - req->mdev = mdev; - req->state = MEDIA_REQUEST_STATE_IDLE; -@@ -336,12 +336,15 @@ int media_request_alloc(struct media_device *mdev, int *alloc_fd) - - return 0; - --err_fput: -- fput(filp); -- - err_put_fd: - put_unused_fd(fd); - -+err_free_req: -+ if (mdev->ops->req_free) -+ mdev->ops->req_free(req); -+ else -+ kfree(req); -+ - return ret; - } - -diff --git a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c -index 4a3b3810fd89..31390ce2dbf2 100644 ---- a/drivers/media/platform/cros-ec-cec/cros-ec-cec.c -+++ b/drivers/media/platform/cros-ec-cec/cros-ec-cec.c -@@ -278,11 +278,7 @@ static int cros_ec_cec_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, cros_ec_cec); - cros_ec_cec->cros_ec = cros_ec; - -- ret = device_init_wakeup(&pdev->dev, 1); -- if (ret) { -- dev_err(&pdev->dev, "failed to initialize wakeup\n"); -- return ret; -- } -+ device_init_wakeup(&pdev->dev, 1); - - cros_ec_cec->adap = cec_allocate_adapter(&cros_ec_cec_ops, cros_ec_cec, - DRV_NAME, -diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c -index 9aaf3b8060d5..9c31d950cddf 100644 ---- a/drivers/media/platform/exynos4-is/media-dev.c -+++ b/drivers/media/platform/exynos4-is/media-dev.c -@@ -1270,6 +1270,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) - - pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, - PINCTRL_STATE_IDLE); -+ if (IS_ERR(pctl->state_idle)) -+ return PTR_ERR(pctl->state_idle); -+ - return 0; - } - -diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c -index 803baf97f06e..6de8b3d99fb9 100644 ---- a/drivers/media/platform/marvell-ccic/mcam-core.c -+++ b/drivers/media/platform/marvell-ccic/mcam-core.c -@@ -1940,6 +1940,7 @@ int mccic_register(struct mcam_camera *cam) - out: - v4l2_async_notifier_unregister(&cam->notifier); - v4l2_device_unregister(&cam->v4l2_dev); -+ v4l2_async_notifier_cleanup(&cam->notifier); - return ret; - } - EXPORT_SYMBOL_GPL(mccic_register); -@@ -1961,6 +1962,7 @@ void mccic_shutdown(struct mcam_camera *cam) - v4l2_ctrl_handler_free(&cam->ctrl_handler); - v4l2_async_notifier_unregister(&cam->notifier); - v4l2_device_unregister(&cam->v4l2_dev); -+ v4l2_async_notifier_cleanup(&cam->notifier); - } - EXPORT_SYMBOL_GPL(mccic_shutdown); - -diff --git a/drivers/media/platform/omap3isp/isppreview.c b/drivers/media/platform/omap3isp/isppreview.c -index 97d660606d98..b8c2b8bba826 100644 ---- a/drivers/media/platform/omap3isp/isppreview.c -+++ b/drivers/media/platform/omap3isp/isppreview.c -@@ -2287,7 +2287,7 @@ static int preview_init_entities(struct isp_prev_device *prev) - me->ops = &preview_media_ops; - ret = media_entity_pads_init(me, PREV_PADS_NUM, pads); - if (ret < 0) -- return ret; -+ goto error_handler_free; - - preview_init_formats(sd, NULL); - -@@ -2320,6 +2320,8 @@ error_video_out: - omap3isp_video_cleanup(&prev->video_in); - error_video_in: - media_entity_cleanup(&prev->subdev.entity); -+error_handler_free: -+ v4l2_ctrl_handler_free(&prev->ctrls); - return ret; - } - -diff --git a/drivers/media/usb/dvb-usb/Kconfig b/drivers/media/usb/dvb-usb/Kconfig -index 1a3e5f965ae4..2d7a5c1c84af 100644 ---- a/drivers/media/usb/dvb-usb/Kconfig -+++ b/drivers/media/usb/dvb-usb/Kconfig -@@ -150,6 +150,7 @@ config DVB_USB_CXUSB - config DVB_USB_CXUSB_ANALOG - bool "Analog support for the Conexant USB2.0 hybrid reference design" - depends on DVB_USB_CXUSB && VIDEO_V4L2 -+ depends on VIDEO_V4L2=y || VIDEO_V4L2=DVB_USB_CXUSB - select VIDEO_CX25840 - select VIDEOBUF2_VMALLOC - help -diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c -index f0263d1a1fdf..d97a243ad30c 100644 ---- a/drivers/misc/cxl/sysfs.c -+++ b/drivers/misc/cxl/sysfs.c -@@ -624,7 +624,7 @@ static struct afu_config_record *cxl_sysfs_afu_new_cr(struct cxl_afu *afu, int c - rc = kobject_init_and_add(&cr->kobj, &afu_config_record_type, - &afu->dev.kobj, "cr%i", cr->cr); - if (rc) -- goto err; -+ goto err1; - - rc = sysfs_create_bin_file(&cr->kobj, &cr->config_attr); - if (rc) -diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c -index 5f2e9696ee4d..0c2489446bd7 100644 ---- a/drivers/mmc/host/sdhci-cadence.c -+++ b/drivers/mmc/host/sdhci-cadence.c -@@ -194,57 +194,6 @@ static u32 sdhci_cdns_get_emmc_mode(struct sdhci_cdns_priv *priv) - return FIELD_GET(SDHCI_CDNS_HRS06_MODE, tmp); - } - --static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host, -- unsigned int timing) --{ -- struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); -- u32 mode; -- -- switch (timing) { -- case MMC_TIMING_MMC_HS: -- mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR; -- break; -- case MMC_TIMING_MMC_DDR52: -- mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR; -- break; -- case MMC_TIMING_MMC_HS200: -- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200; -- break; -- case MMC_TIMING_MMC_HS400: -- if (priv->enhanced_strobe) -- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES; -- else -- mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400; -- break; -- default: -- mode = SDHCI_CDNS_HRS06_MODE_SD; -- break; -- } -- -- sdhci_cdns_set_emmc_mode(priv, mode); -- -- /* For SD, fall back to the default handler */ -- if (mode == SDHCI_CDNS_HRS06_MODE_SD) -- sdhci_set_uhs_signaling(host, timing); --} -- --static const struct sdhci_ops sdhci_cdns_ops = { -- .set_clock = sdhci_set_clock, -- .get_timeout_clock = sdhci_cdns_get_timeout_clock, -- .set_bus_width = sdhci_set_bus_width, -- .reset = sdhci_reset, -- .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, --}; -- --static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { -- .ops = &sdhci_cdns_ops, -- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, --}; -- --static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { -- .ops = &sdhci_cdns_ops, --}; -- - static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val) - { - struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); -@@ -278,23 +227,24 @@ static int sdhci_cdns_set_tune_val(struct sdhci_host *host, unsigned int val) - return 0; - } - --static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode) -+/* -+ * In SD mode, software must not use the hardware tuning and instead perform -+ * an almost identical procedure to eMMC. -+ */ -+static int sdhci_cdns_execute_tuning(struct sdhci_host *host, u32 opcode) - { -- struct sdhci_host *host = mmc_priv(mmc); - int cur_streak = 0; - int max_streak = 0; - int end_of_streak = 0; - int i; - - /* -- * This handler only implements the eMMC tuning that is specific to -- * this controller. Fall back to the standard method for SD timing. -+ * Do not execute tuning for UHS_SDR50 or UHS_DDR50. -+ * The delay is set by probe, based on the DT properties. - */ -- if (host->timing != MMC_TIMING_MMC_HS200) -- return sdhci_execute_tuning(mmc, opcode); -- -- if (WARN_ON(opcode != MMC_SEND_TUNING_BLOCK_HS200)) -- return -EINVAL; -+ if (host->timing != MMC_TIMING_MMC_HS200 && -+ host->timing != MMC_TIMING_UHS_SDR104) -+ return 0; - - for (i = 0; i < SDHCI_CDNS_MAX_TUNING_LOOP; i++) { - if (sdhci_cdns_set_tune_val(host, i) || -@@ -317,6 +267,58 @@ static int sdhci_cdns_execute_tuning(struct mmc_host *mmc, u32 opcode) - return sdhci_cdns_set_tune_val(host, end_of_streak - max_streak / 2); - } - -+static void sdhci_cdns_set_uhs_signaling(struct sdhci_host *host, -+ unsigned int timing) -+{ -+ struct sdhci_cdns_priv *priv = sdhci_cdns_priv(host); -+ u32 mode; -+ -+ switch (timing) { -+ case MMC_TIMING_MMC_HS: -+ mode = SDHCI_CDNS_HRS06_MODE_MMC_SDR; -+ break; -+ case MMC_TIMING_MMC_DDR52: -+ mode = SDHCI_CDNS_HRS06_MODE_MMC_DDR; -+ break; -+ case MMC_TIMING_MMC_HS200: -+ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS200; -+ break; -+ case MMC_TIMING_MMC_HS400: -+ if (priv->enhanced_strobe) -+ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400ES; -+ else -+ mode = SDHCI_CDNS_HRS06_MODE_MMC_HS400; -+ break; -+ default: -+ mode = SDHCI_CDNS_HRS06_MODE_SD; -+ break; -+ } -+ -+ sdhci_cdns_set_emmc_mode(priv, mode); -+ -+ /* For SD, fall back to the default handler */ -+ if (mode == SDHCI_CDNS_HRS06_MODE_SD) -+ sdhci_set_uhs_signaling(host, timing); -+} -+ -+static const struct sdhci_ops sdhci_cdns_ops = { -+ .set_clock = sdhci_set_clock, -+ .get_timeout_clock = sdhci_cdns_get_timeout_clock, -+ .set_bus_width = sdhci_set_bus_width, -+ .reset = sdhci_reset, -+ .platform_execute_tuning = sdhci_cdns_execute_tuning, -+ .set_uhs_signaling = sdhci_cdns_set_uhs_signaling, -+}; -+ -+static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = { -+ .ops = &sdhci_cdns_ops, -+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, -+}; -+ -+static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = { -+ .ops = &sdhci_cdns_ops, -+}; -+ - static void sdhci_cdns_hs400_enhanced_strobe(struct mmc_host *mmc, - struct mmc_ios *ios) - { -@@ -377,7 +379,6 @@ static int sdhci_cdns_probe(struct platform_device *pdev) - priv->hrs_addr = host->ioaddr; - priv->enhanced_strobe = false; - host->ioaddr += SDHCI_CDNS_SRS_BASE; -- host->mmc_host_ops.execute_tuning = sdhci_cdns_execute_tuning; - host->mmc_host_ops.hs400_enhanced_strobe = - sdhci_cdns_hs400_enhanced_strobe; - sdhci_enable_v4_mode(host); -diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c -index fa8105087d68..41a2394313dd 100644 ---- a/drivers/mmc/host/sdhci-pci-o2micro.c -+++ b/drivers/mmc/host/sdhci-pci-o2micro.c -@@ -561,6 +561,12 @@ int sdhci_pci_o2_probe_slot(struct sdhci_pci_slot *slot) - slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd; - } - -+ if (chip->pdev->device == PCI_DEVICE_ID_O2_SEABIRD1) { -+ slot->host->mmc_host_ops.get_cd = sdhci_o2_get_cd; -+ host->mmc->caps2 |= MMC_CAP2_NO_SDIO; -+ host->quirks2 |= SDHCI_QUIRK2_PRESET_VALUE_BROKEN; -+ } -+ - host->mmc_host_ops.execute_tuning = sdhci_o2_execute_tuning; - - if (chip->pdev->device != PCI_DEVICE_ID_O2_FUJIN2) -diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c -index 7bb9a7e8e1e7..c1c53b02b35f 100644 ---- a/drivers/mtd/nand/raw/qcom_nandc.c -+++ b/drivers/mtd/nand/raw/qcom_nandc.c -@@ -459,11 +459,13 @@ struct qcom_nand_host { - * among different NAND controllers. - * @ecc_modes - ecc mode for NAND - * @is_bam - whether NAND controller is using BAM -+ * @is_qpic - whether NAND CTRL is part of qpic IP - * @dev_cmd_reg_start - NAND_DEV_CMD_* registers starting offset - */ - struct qcom_nandc_props { - u32 ecc_modes; - bool is_bam; -+ bool is_qpic; - u32 dev_cmd_reg_start; - }; - -@@ -2751,7 +2753,8 @@ static int qcom_nandc_setup(struct qcom_nand_controller *nandc) - u32 nand_ctrl; - - /* kill onenand */ -- nandc_write(nandc, SFLASHC_BURST_CFG, 0); -+ if (!nandc->props->is_qpic) -+ nandc_write(nandc, SFLASHC_BURST_CFG, 0); - nandc_write(nandc, dev_cmd_reg_addr(nandc, NAND_DEV_CMD_VLD), - NAND_DEV_CMD_VLD_VAL); - -@@ -3007,12 +3010,14 @@ static const struct qcom_nandc_props ipq806x_nandc_props = { - static const struct qcom_nandc_props ipq4019_nandc_props = { - .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), - .is_bam = true, -+ .is_qpic = true, - .dev_cmd_reg_start = 0x0, - }; - - static const struct qcom_nandc_props ipq8074_nandc_props = { - .ecc_modes = (ECC_BCH_4BIT | ECC_BCH_8BIT), - .is_bam = true, -+ .is_qpic = true, - .dev_cmd_reg_start = 0x7000, - }; - -diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c -index 6787d560e9e3..92e4d140df6f 100644 ---- a/drivers/net/dsa/mv88e6xxx/chip.c -+++ b/drivers/net/dsa/mv88e6xxx/chip.c -@@ -3063,7 +3063,6 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { - .port_set_frame_mode = mv88e6351_port_set_frame_mode, - .port_set_egress_floods = mv88e6352_port_set_egress_floods, - .port_set_ether_type = mv88e6351_port_set_ether_type, -- .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, - .port_egress_rate_limiting = mv88e6095_port_egress_rate_limiting, - .port_pause_limit = mv88e6097_port_pause_limit, - .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit, -diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c -index ac88caca5ad4..1368816abaed 100644 ---- a/drivers/net/dsa/rtl8366.c -+++ b/drivers/net/dsa/rtl8366.c -@@ -43,18 +43,26 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - int ret; - int i; - -+ dev_dbg(smi->dev, -+ "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", -+ vid, member, untag); -+ - /* Update the 4K table */ - ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); - if (ret) - return ret; - -- vlan4k.member = member; -- vlan4k.untag = untag; -+ vlan4k.member |= member; -+ vlan4k.untag |= untag; - vlan4k.fid = fid; - ret = smi->ops->set_vlan_4k(smi, &vlan4k); - if (ret) - return ret; - -+ dev_dbg(smi->dev, -+ "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", -+ vid, vlan4k.member, vlan4k.untag); -+ - /* Try to find an existing MC entry for this VID */ - for (i = 0; i < smi->num_vlan_mc; i++) { - struct rtl8366_vlan_mc vlanmc; -@@ -65,11 +73,16 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - - if (vid == vlanmc.vid) { - /* update the MC entry */ -- vlanmc.member = member; -- vlanmc.untag = untag; -+ vlanmc.member |= member; -+ vlanmc.untag |= untag; - vlanmc.fid = fid; - - ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); -+ -+ dev_dbg(smi->dev, -+ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", -+ vid, vlanmc.member, vlanmc.untag); -+ - break; - } - } -@@ -384,7 +397,7 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, - if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port)) - dev_err(smi->dev, "port is DSA or CPU port\n"); - -- for (vid = vlan->vid_begin; vid <= vlan->vid_end; ++vid) { -+ for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) { - int pvid_val = 0; - - dev_info(smi->dev, "add VLAN %04x\n", vid); -@@ -407,13 +420,13 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, - if (ret < 0) - return; - } -- } - -- ret = rtl8366_set_vlan(smi, port, member, untag, 0); -- if (ret) -- dev_err(smi->dev, -- "failed to set up VLAN %04x", -- vid); -+ ret = rtl8366_set_vlan(smi, vid, member, untag, 0); -+ if (ret) -+ dev_err(smi->dev, -+ "failed to set up VLAN %04x", -+ vid); -+ } - } - EXPORT_SYMBOL_GPL(rtl8366_vlan_add); - -diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c -index 359a4d387185..9a0db70c1143 100644 ---- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c -+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c -@@ -776,7 +776,7 @@ static int hw_atl_a0_hw_multicast_list_set(struct aq_hw_s *self, - int err = 0; - - if (count > (HW_ATL_A0_MAC_MAX - HW_ATL_A0_MAC_MIN)) { -- err = EBADRQC; -+ err = -EBADRQC; - goto err_exit; - } - for (self->aq_nic_cfg->mc_list_count = 0U; -diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c -index 43d11c38b38a..4cddd628d41b 100644 ---- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c -+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c -@@ -1167,7 +1167,7 @@ static int cn23xx_get_pf_num(struct octeon_device *oct) - oct->pf_num = ((fdl_bit >> CN23XX_PCIE_SRIOV_FDL_BIT_POS) & - CN23XX_PCIE_SRIOV_FDL_MASK); - } else { -- ret = EINVAL; -+ ret = -EINVAL; - - /* Under some virtual environments, extended PCI regs are - * inaccessible, in which case the above read will have failed. -diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c -index f414f5651dbd..5c45c0c6dd23 100644 ---- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c -+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c -@@ -2185,6 +2185,9 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - nic->max_queues *= 2; - nic->ptp_clock = ptp_clock; - -+ /* Initialize mutex that serializes usage of VF's mailbox */ -+ mutex_init(&nic->rx_mode_mtx); -+ - /* MAP VF's configuration registers */ - nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0); - if (!nic->reg_base) { -@@ -2261,7 +2264,6 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - - INIT_WORK(&nic->rx_mode_work.work, nicvf_set_rx_mode_task); - spin_lock_init(&nic->rx_mode_wq_lock); -- mutex_init(&nic->rx_mode_mtx); - - err = register_netdev(netdev); - if (err) { -diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c -index 4c2fa13a7dd7..c8e434c8ab98 100644 ---- a/drivers/net/ethernet/freescale/fman/fman.c -+++ b/drivers/net/ethernet/freescale/fman/fman.c -@@ -1396,8 +1396,7 @@ static void enable_time_stamp(struct fman *fman) - { - struct fman_fpm_regs __iomem *fpm_rg = fman->fpm_regs; - u16 fm_clk_freq = fman->state->fm_clk_freq; -- u32 tmp, intgr, ts_freq; -- u64 frac; -+ u32 tmp, intgr, ts_freq, frac; - - ts_freq = (u32)(1 << fman->state->count1_micro_bit); - /* configure timestamp so that bit 8 will count 1 microsecond -diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c -index 1ca543ac8f2c..d2de9ea80c43 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c -+++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c -@@ -1205,7 +1205,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) - list_for_each(pos, - &dtsec->multicast_addr_hash->lsts[bucket]) { - hash_entry = ETH_HASH_ENTRY_OBJ(pos); -- if (hash_entry->addr == addr) { -+ if (hash_entry && hash_entry->addr == addr) { - list_del_init(&hash_entry->node); - kfree(hash_entry); - break; -@@ -1218,7 +1218,7 @@ int dtsec_del_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) - list_for_each(pos, - &dtsec->unicast_addr_hash->lsts[bucket]) { - hash_entry = ETH_HASH_ENTRY_OBJ(pos); -- if (hash_entry->addr == addr) { -+ if (hash_entry && hash_entry->addr == addr) { - list_del_init(&hash_entry->node); - kfree(hash_entry); - break; -diff --git a/drivers/net/ethernet/freescale/fman/fman_mac.h b/drivers/net/ethernet/freescale/fman/fman_mac.h -index dd6d0526f6c1..19f327efdaff 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_mac.h -+++ b/drivers/net/ethernet/freescale/fman/fman_mac.h -@@ -252,7 +252,7 @@ static inline struct eth_hash_t *alloc_hash_table(u16 size) - struct eth_hash_t *hash; - - /* Allocate address hash table */ -- hash = kmalloc_array(size, sizeof(struct eth_hash_t *), GFP_KERNEL); -+ hash = kmalloc(sizeof(*hash), GFP_KERNEL); - if (!hash) - return NULL; - -diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c -index e1901874c19f..9088b4f4b4b8 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_memac.c -+++ b/drivers/net/ethernet/freescale/fman/fman_memac.c -@@ -856,7 +856,6 @@ int memac_set_tx_pause_frames(struct fman_mac *memac, u8 priority, - - tmp = ioread32be(®s->command_config); - tmp &= ~CMD_CFG_PFC_MODE; -- priority = 0; - - iowrite32be(tmp, ®s->command_config); - -@@ -986,7 +985,7 @@ int memac_del_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr) - - list_for_each(pos, &memac->multicast_addr_hash->lsts[hash]) { - hash_entry = ETH_HASH_ENTRY_OBJ(pos); -- if (hash_entry->addr == addr) { -+ if (hash_entry && hash_entry->addr == addr) { - list_del_init(&hash_entry->node); - kfree(hash_entry); - break; -diff --git a/drivers/net/ethernet/freescale/fman/fman_port.c b/drivers/net/ethernet/freescale/fman/fman_port.c -index ee82ee1384eb..47f6fee1f396 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_port.c -+++ b/drivers/net/ethernet/freescale/fman/fman_port.c -@@ -1756,6 +1756,7 @@ static int fman_port_probe(struct platform_device *of_dev) - struct fman_port *port; - struct fman *fman; - struct device_node *fm_node, *port_node; -+ struct platform_device *fm_pdev; - struct resource res; - struct resource *dev_res; - u32 val; -@@ -1780,8 +1781,14 @@ static int fman_port_probe(struct platform_device *of_dev) - goto return_err; - } - -- fman = dev_get_drvdata(&of_find_device_by_node(fm_node)->dev); -+ fm_pdev = of_find_device_by_node(fm_node); - of_node_put(fm_node); -+ if (!fm_pdev) { -+ err = -EINVAL; -+ goto return_err; -+ } -+ -+ fman = dev_get_drvdata(&fm_pdev->dev); - if (!fman) { - err = -EINVAL; - goto return_err; -diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c -index f75b9c11b2d2..ac5a281e0ec3 100644 ---- a/drivers/net/ethernet/freescale/fman/fman_tgec.c -+++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c -@@ -630,7 +630,7 @@ int tgec_del_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr) - - list_for_each(pos, &tgec->multicast_addr_hash->lsts[hash]) { - hash_entry = ETH_HASH_ENTRY_OBJ(pos); -- if (hash_entry->addr == addr) { -+ if (hash_entry && hash_entry->addr == addr) { - list_del_init(&hash_entry->node); - kfree(hash_entry); - break; -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index bacc5fb7eba2..34124c213d27 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -1863,8 +1863,10 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) - - adapter->rss_key = kzalloc(adapter->rss_key_size, GFP_KERNEL); - adapter->rss_lut = kzalloc(adapter->rss_lut_size, GFP_KERNEL); -- if (!adapter->rss_key || !adapter->rss_lut) -+ if (!adapter->rss_key || !adapter->rss_lut) { -+ err = -ENOMEM; - goto err_mem; -+ } - if (RSS_AQ(adapter)) - adapter->aq_required |= IAVF_FLAG_AQ_CONFIGURE_RSS; - else -@@ -1946,7 +1948,10 @@ static void iavf_watchdog_task(struct work_struct *work) - iavf_send_api_ver(adapter); - } - } else { -- if (!iavf_process_aq_command(adapter) && -+ /* An error will be returned if no commands were -+ * processed; use this opportunity to update stats -+ */ -+ if (iavf_process_aq_command(adapter) && - adapter->state == __IAVF_RUNNING) - iavf_request_stats(adapter); - } -diff --git a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c -index cbd53b586c36..6cfe8eb7f47d 100644 ---- a/drivers/net/ethernet/intel/ice/ice_flex_pipe.c -+++ b/drivers/net/ethernet/intel/ice/ice_flex_pipe.c -@@ -1535,10 +1535,12 @@ enum ice_status ice_init_hw_tbls(struct ice_hw *hw) - es->ref_count = devm_kcalloc(ice_hw_to_dev(hw), es->count, - sizeof(*es->ref_count), - GFP_KERNEL); -+ if (!es->ref_count) -+ goto err; - - es->written = devm_kcalloc(ice_hw_to_dev(hw), es->count, - sizeof(*es->written), GFP_KERNEL); -- if (!es->ref_count) -+ if (!es->written) - goto err; - } - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 86e6bbb57482..b66e5b6eecd9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -809,18 +809,15 @@ static int connect_fts_in_prio(struct mlx5_core_dev *dev, - { - struct mlx5_flow_root_namespace *root = find_root(&prio->node); - struct mlx5_flow_table *iter; -- int i = 0; - int err; - - fs_for_each_ft(iter, prio) { -- i++; - err = root->cmds->modify_flow_table(root, iter, ft); - if (err) { -- mlx5_core_warn(dev, "Failed to modify flow table %d\n", -- iter->id); -+ mlx5_core_err(dev, -+ "Failed to modify flow table id %d, type %d, err %d\n", -+ iter->id, iter->type, err); - /* The driver is out of sync with the FW */ -- if (i > 1) -- WARN_ON(true); - return err; - } - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c -index 1e32e2443f73..348f02e336f6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c -@@ -247,29 +247,9 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, - - /* The order of the actions are must to be keep, only the following - * order is supported by SW steering: -- * TX: push vlan -> modify header -> encap -+ * TX: modify header -> push vlan -> encap - * RX: decap -> pop vlan -> modify header - */ -- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) { -- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]); -- if (!tmp_action) { -- err = -ENOMEM; -- goto free_actions; -- } -- fs_dr_actions[fs_dr_num_actions++] = tmp_action; -- actions[num_actions++] = tmp_action; -- } -- -- if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) { -- tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]); -- if (!tmp_action) { -- err = -ENOMEM; -- goto free_actions; -- } -- fs_dr_actions[fs_dr_num_actions++] = tmp_action; -- actions[num_actions++] = tmp_action; -- } -- - if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_DECAP) { - enum mlx5dr_action_reformat_type decap_type = - DR_ACTION_REFORMAT_TYP_TNL_L2_TO_L2; -@@ -322,6 +302,26 @@ static int mlx5_cmd_dr_create_fte(struct mlx5_flow_root_namespace *ns, - actions[num_actions++] = - fte->action.modify_hdr->action.dr_action; - -+ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH) { -+ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[0]); -+ if (!tmp_action) { -+ err = -ENOMEM; -+ goto free_actions; -+ } -+ fs_dr_actions[fs_dr_num_actions++] = tmp_action; -+ actions[num_actions++] = tmp_action; -+ } -+ -+ if (fte->action.action & MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH_2) { -+ tmp_action = create_action_push_vlan(domain, &fte->action.vlan[1]); -+ if (!tmp_action) { -+ err = -ENOMEM; -+ goto free_actions; -+ } -+ fs_dr_actions[fs_dr_num_actions++] = tmp_action; -+ actions[num_actions++] = tmp_action; -+ } -+ - if (delay_encap_set) - actions[num_actions++] = - fte->action.pkt_reformat->action.dr_action; -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index c00ec9a02097..e66002251596 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -666,7 +666,7 @@ static bool ionic_notifyq_service(struct ionic_cq *cq, - eid = le64_to_cpu(comp->event.eid); - - /* Have we run out of new completions to process? */ -- if (eid <= lif->last_eid) -+ if ((s64)(eid - lif->last_eid) <= 0) - return false; - - lif->last_eid = eid; -diff --git a/drivers/net/ethernet/toshiba/spider_net.c b/drivers/net/ethernet/toshiba/spider_net.c -index 538e70810d3d..a99c7c95de5c 100644 ---- a/drivers/net/ethernet/toshiba/spider_net.c -+++ b/drivers/net/ethernet/toshiba/spider_net.c -@@ -283,8 +283,8 @@ spider_net_free_chain(struct spider_net_card *card, - descr = descr->next; - } while (descr != chain->ring); - -- dma_free_coherent(&card->pdev->dev, chain->num_desc, -- chain->hwring, chain->dma_addr); -+ dma_free_coherent(&card->pdev->dev, chain->num_desc * sizeof(struct spider_net_hw_descr), -+ chain->hwring, chain->dma_addr); - } - - /** -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index dba52a5c378a..110924d62744 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -615,7 +615,9 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, - if (c45_ids) - dev->c45_ids = *c45_ids; - dev->irq = bus->irq[addr]; -+ - dev_set_name(&mdiodev->dev, PHY_ID_FMT, bus->id, addr); -+ device_initialize(&mdiodev->dev); - - dev->state = PHY_DOWN; - -@@ -649,10 +651,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, u32 phy_id, - ret = phy_request_driver_module(dev, phy_id); - } - -- if (!ret) { -- device_initialize(&mdiodev->dev); -- } else { -- kfree(dev); -+ if (ret) { -+ put_device(&mdiodev->dev); - dev = ERR_PTR(ret); - } - -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index 216acf37ca7c..a06e6ab453f5 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -861,7 +861,8 @@ vmxnet3_parse_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq, - - switch (protocol) { - case IPPROTO_TCP: -- ctx->l4_hdr_size = tcp_hdrlen(skb); -+ ctx->l4_hdr_size = skb->encapsulation ? inner_tcp_hdrlen(skb) : -+ tcp_hdrlen(skb); - break; - case IPPROTO_UDP: - ctx->l4_hdr_size = sizeof(struct udphdr); -diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c -index 134e4dd916c1..996eb9c55b39 100644 ---- a/drivers/net/wan/lapbether.c -+++ b/drivers/net/wan/lapbether.c -@@ -157,6 +157,12 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb, - if (!netif_running(dev)) - goto drop; - -+ /* There should be a pseudo header of 1 byte added by upper layers. -+ * Check to make sure it is there before reading it. -+ */ -+ if (skb->len < 1) -+ goto drop; -+ - switch (skb->data[0]) { - case X25_IFACE_DATA: - break; -@@ -305,6 +311,7 @@ static void lapbeth_setup(struct net_device *dev) - dev->netdev_ops = &lapbeth_netdev_ops; - dev->needs_free_netdev = true; - dev->type = ARPHRD_X25; -+ dev->hard_header_len = 0; - dev->mtu = 1000; - dev->addr_len = 0; - } -@@ -331,7 +338,8 @@ static int lapbeth_new_device(struct net_device *dev) - * then this driver prepends a length field of 2 bytes, - * then the underlying Ethernet device prepends its own header. - */ -- ndev->hard_header_len = -1 + 3 + 2 + dev->hard_header_len; -+ ndev->needed_headroom = -1 + 3 + 2 + dev->hard_header_len -+ + dev->needed_headroom; - - lapbeth = netdev_priv(ndev); - lapbeth->axdev = ndev; -diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c -index 735482877a1f..c38e1963ebc0 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_tx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c -@@ -1540,7 +1540,9 @@ static int ath10k_htt_tx_32(struct ath10k_htt *htt, - err_unmap_msdu: - dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); - err_free_msdu_id: -+ spin_lock_bh(&htt->tx_lock); - ath10k_htt_tx_free_msdu_id(htt, msdu_id); -+ spin_unlock_bh(&htt->tx_lock); - err: - return res; - } -@@ -1747,7 +1749,9 @@ static int ath10k_htt_tx_64(struct ath10k_htt *htt, - err_unmap_msdu: - dma_unmap_single(dev, skb_cb->paddr, msdu->len, DMA_TO_DEVICE); - err_free_msdu_id: -+ spin_lock_bh(&htt->tx_lock); - ath10k_htt_tx_free_msdu_id(htt, msdu_id); -+ spin_unlock_bh(&htt->tx_lock); - err: - return res; - } -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h -index 37c512036e0e..ce18433aaefb 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h -@@ -19,7 +19,7 @@ - #define BRCMF_ARP_OL_PEER_AUTO_REPLY 0x00000008 - - #define BRCMF_BSS_INFO_VERSION 109 /* curr ver of brcmf_bss_info_le struct */ --#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0002 -+#define BRCMF_BSS_RSSI_ON_CHANNEL 0x0004 - - #define BRCMF_STA_BRCM 0x00000001 /* Running a Broadcom driver */ - #define BRCMF_STA_WME 0x00000002 /* WMM association */ -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -index 2bd892df83cc..eadc64454839 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c -@@ -643,6 +643,7 @@ static inline int brcmf_fws_hanger_poppkt(struct brcmf_fws_hanger *h, - static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, - int ifidx) - { -+ struct brcmf_fws_hanger_item *hi; - bool (*matchfn)(struct sk_buff *, void *) = NULL; - struct sk_buff *skb; - int prec; -@@ -654,6 +655,9 @@ static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q, - skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx); - while (skb) { - hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT); -+ hi = &fws->hanger.items[hslot]; -+ WARN_ON(skb != hi->pkt); -+ hi->state = BRCMF_FWS_HANGER_ITEM_STATE_FREE; - brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb, - true); - brcmu_pkt_buf_free_skb(skb); -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -index d43247a95ce5..38e6809f16c7 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c -@@ -3685,7 +3685,11 @@ static void brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus) - if (bus->idlecount > bus->idletime) { - brcmf_dbg(SDIO, "idle\n"); - sdio_claim_host(bus->sdiodev->func1); -- brcmf_sdio_wd_timer(bus, false); -+#ifdef DEBUG -+ if (!BRCMF_FWCON_ON() || -+ bus->console_interval == 0) -+#endif -+ brcmf_sdio_wd_timer(bus, false); - bus->idlecount = 0; - brcmf_sdio_bus_sleep(bus, true, false); - sdio_release_host(bus->sdiodev->func1); -diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c -index 746749f37996..1107b96a8a88 100644 ---- a/drivers/net/wireless/intel/iwlegacy/common.c -+++ b/drivers/net/wireless/intel/iwlegacy/common.c -@@ -4286,8 +4286,8 @@ il_apm_init(struct il_priv *il) - * power savings, even without L1. - */ - if (il->cfg->set_l0s) { -- pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); -- if (lctl & PCI_EXP_LNKCTL_ASPM_L1) { -+ ret = pcie_capability_read_word(il->pci_dev, PCI_EXP_LNKCTL, &lctl); -+ if (!ret && (lctl & PCI_EXP_LNKCTL_ASPM_L1)) { - /* L1-ASPM enabled; disable(!) L0S */ - il_set_bit(il, CSR_GIO_REG, - CSR_GIO_REG_VAL_L0S_ENABLED); -diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.h b/drivers/net/wireless/marvell/mwifiex/sdio.h -index f672bdf52cc1..2d9ec225aead 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sdio.h -+++ b/drivers/net/wireless/marvell/mwifiex/sdio.h -@@ -36,9 +36,9 @@ - #define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin" - #define SD8887_DEFAULT_FW_NAME "mrvl/sd8887_uapsta.bin" - #define SD8801_DEFAULT_FW_NAME "mrvl/sd8801_uapsta.bin" --#define SD8977_DEFAULT_FW_NAME "mrvl/sd8977_uapsta.bin" -+#define SD8977_DEFAULT_FW_NAME "mrvl/sdsd8977_combo_v2.bin" - #define SD8987_DEFAULT_FW_NAME "mrvl/sd8987_uapsta.bin" --#define SD8997_DEFAULT_FW_NAME "mrvl/sd8997_uapsta.bin" -+#define SD8997_DEFAULT_FW_NAME "mrvl/sdsd8997_combo_v4.bin" - - #define BLOCK_MODE 1 - #define BYTE_MODE 0 -diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c -index 20c206da0631..7ae2c34f65db 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c -+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c -@@ -580,6 +580,11 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, - { - struct host_cmd_ds_802_11_key_material *key = - &resp->params.key_material; -+ int len; -+ -+ len = le16_to_cpu(key->key_param_set.key_len); -+ if (len > sizeof(key->key_param_set.key)) -+ return -EINVAL; - - if (le16_to_cpu(key->action) == HostCmd_ACT_GEN_SET) { - if ((le16_to_cpu(key->key_param_set.key_info) & KEY_MCAST)) { -@@ -593,9 +598,8 @@ static int mwifiex_ret_802_11_key_material_v1(struct mwifiex_private *priv, - - memset(priv->aes_key.key_param_set.key, 0, - sizeof(key->key_param_set.key)); -- priv->aes_key.key_param_set.key_len = key->key_param_set.key_len; -- memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, -- le16_to_cpu(priv->aes_key.key_param_set.key_len)); -+ priv->aes_key.key_param_set.key_len = cpu_to_le16(len); -+ memcpy(priv->aes_key.key_param_set.key, key->key_param_set.key, len); - - return 0; - } -@@ -610,9 +614,14 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - struct host_cmd_ds_command *resp) - { - struct host_cmd_ds_802_11_key_material_v2 *key_v2; -- __le16 len; -+ int len; - - key_v2 = &resp->params.key_material_v2; -+ -+ len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len); -+ if (len > WLAN_KEY_LEN_CCMP) -+ return -EINVAL; -+ - if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) { - if ((le16_to_cpu(key_v2->key_param_set.key_info) & KEY_MCAST)) { - mwifiex_dbg(priv->adapter, INFO, "info: key: GTK is set\n"); -@@ -628,10 +637,9 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv, - memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0, - WLAN_KEY_LEN_CCMP); - priv->aes_key_v2.key_param_set.key_params.aes.key_len = -- key_v2->key_param_set.key_params.aes.key_len; -- len = priv->aes_key_v2.key_param_set.key_params.aes.key_len; -+ cpu_to_le16(len); - memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key, -- key_v2->key_param_set.key_params.aes.key, le16_to_cpu(len)); -+ key_v2->key_param_set.key_params.aes.key, len); - - return 0; - } -diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -index 842cd81704db..b6867d93c0e3 100644 ---- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c -@@ -119,8 +119,10 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, - struct mt7615_mcu_rxd *rxd = (struct mt7615_mcu_rxd *)skb->data; - int ret = 0; - -- if (seq != rxd->seq) -- return -EAGAIN; -+ if (seq != rxd->seq) { -+ ret = -EAGAIN; -+ goto out; -+ } - - switch (cmd) { - case -MCU_CMD_PATCH_SEM_CONTROL: -@@ -134,6 +136,7 @@ mt7615_mcu_parse_response(struct mt7615_dev *dev, int cmd, - default: - break; - } -+out: - dev_kfree_skb(skb); - - return ret; -diff --git a/drivers/net/wireless/realtek/rtw88/coex.c b/drivers/net/wireless/realtek/rtw88/coex.c -index 3e95ad198912..853ac1c2ed73 100644 ---- a/drivers/net/wireless/realtek/rtw88/coex.c -+++ b/drivers/net/wireless/realtek/rtw88/coex.c -@@ -1923,7 +1923,8 @@ static void rtw_coex_run_coex(struct rtw_dev *rtwdev, u8 reason) - if (coex_stat->wl_under_ips) - return; - -- if (coex->freeze && !coex_stat->bt_setup_link) -+ if (coex->freeze && coex_dm->reason == COEX_RSN_BTINFO && -+ !coex_stat->bt_setup_link) - return; - - coex_stat->cnt_wl[COEX_CNT_WL_COEXRUN]++; -diff --git a/drivers/net/wireless/realtek/rtw88/fw.c b/drivers/net/wireless/realtek/rtw88/fw.c -index 35dbdb3c4f1e..8efaee7571f3 100644 ---- a/drivers/net/wireless/realtek/rtw88/fw.c -+++ b/drivers/net/wireless/realtek/rtw88/fw.c -@@ -340,7 +340,7 @@ void rtw_fw_send_ra_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) - SET_RA_INFO_INIT_RA_LVL(h2c_pkt, si->init_ra_lv); - SET_RA_INFO_SGI_EN(h2c_pkt, si->sgi_enable); - SET_RA_INFO_BW_MODE(h2c_pkt, si->bw_mode); -- SET_RA_INFO_LDPC(h2c_pkt, si->ldpc_en); -+ SET_RA_INFO_LDPC(h2c_pkt, !!si->ldpc_en); - SET_RA_INFO_NO_UPDATE(h2c_pkt, no_update); - SET_RA_INFO_VHT_EN(h2c_pkt, si->vht_enable); - SET_RA_INFO_DIS_PT(h2c_pkt, disable_pt); -diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c -index 88e2252bf8a2..15c7a6fc37b9 100644 ---- a/drivers/net/wireless/realtek/rtw88/main.c -+++ b/drivers/net/wireless/realtek/rtw88/main.c -@@ -553,8 +553,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) - stbc_en = VHT_STBC_EN; - if (sta->vht_cap.cap & IEEE80211_VHT_CAP_RXLDPC) - ldpc_en = VHT_LDPC_EN; -- if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80) -- is_support_sgi = true; - } else if (sta->ht_cap.ht_supported) { - ra_mask |= (sta->ht_cap.mcs.rx_mask[1] << 20) | - (sta->ht_cap.mcs.rx_mask[0] << 12); -@@ -562,9 +560,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) - stbc_en = HT_STBC_EN; - if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING) - ldpc_en = HT_LDPC_EN; -- if (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20 || -- sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40) -- is_support_sgi = true; - } - - if (efuse->hw_cap.nss == 1) -@@ -606,12 +601,18 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si) - switch (sta->bandwidth) { - case IEEE80211_STA_RX_BW_80: - bw_mode = RTW_CHANNEL_WIDTH_80; -+ is_support_sgi = sta->vht_cap.vht_supported && -+ (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80); - break; - case IEEE80211_STA_RX_BW_40: - bw_mode = RTW_CHANNEL_WIDTH_40; -+ is_support_sgi = sta->ht_cap.ht_supported && -+ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_40); - break; - default: - bw_mode = RTW_CHANNEL_WIDTH_20; -+ is_support_sgi = sta->ht_cap.ht_supported && -+ (sta->ht_cap.cap & IEEE80211_HT_CAP_SGI_20); - break; - } - -diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c -index 850864dbafa1..e6d426edab56 100644 ---- a/drivers/net/wireless/ti/wl1251/event.c -+++ b/drivers/net/wireless/ti/wl1251/event.c -@@ -70,7 +70,7 @@ static int wl1251_event_ps_report(struct wl1251 *wl, - break; - } - -- return 0; -+ return ret; - } - - static void wl1251_event_mbox_dump(struct event_mailbox *mbox) -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index 071b63146d4b..ff5681da8780 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -1074,6 +1074,9 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid, - int pos; - int len; - -+ if (ctrl->quirks & NVME_QUIRK_NO_NS_DESC_LIST) -+ return 0; -+ - c.identify.opcode = nvme_admin_identify; - c.identify.nsid = cpu_to_le32(nsid); - c.identify.cns = NVME_ID_CNS_NS_DESC_LIST; -@@ -1087,18 +1090,6 @@ static int nvme_identify_ns_descs(struct nvme_ctrl *ctrl, unsigned nsid, - if (status) { - dev_warn(ctrl->device, - "Identify Descriptors failed (%d)\n", status); -- /* -- * Don't treat non-retryable errors as fatal, as we potentially -- * already have a NGUID or EUI-64. If we failed with DNR set, -- * we want to silently ignore the error as we can still -- * identify the device, but if the status has DNR set, we want -- * to propagate the error back specifically for the disk -- * revalidation flow to make sure we don't abandon the -- * device just because of a temporal retry-able error (such -- * as path of transport errors). -- */ -- if (status > 0 && (status & NVME_SC_DNR)) -- status = 0; - goto free_data; - } - -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 5433aa2f7601..484aad0d0c9c 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -249,6 +249,12 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, - fallback = ns; - } - -+ /* No optimized path found, re-check the current path */ -+ if (!nvme_path_is_disabled(old) && -+ old->ana_state == NVME_ANA_OPTIMIZED) { -+ found = old; -+ goto out; -+ } - if (!fallback) - return NULL; - found = fallback; -@@ -269,10 +275,13 @@ inline struct nvme_ns *nvme_find_path(struct nvme_ns_head *head) - struct nvme_ns *ns; - - ns = srcu_dereference(head->current_path[node], &head->srcu); -- if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR && ns) -- ns = nvme_round_robin_path(head, node, ns); -- if (unlikely(!ns || !nvme_path_is_optimized(ns))) -- ns = __nvme_find_path(head, node); -+ if (unlikely(!ns)) -+ return __nvme_find_path(head, node); -+ -+ if (READ_ONCE(head->subsys->iopolicy) == NVME_IOPOLICY_RR) -+ return nvme_round_robin_path(head, node, ns); -+ if (unlikely(!nvme_path_is_optimized(ns))) -+ return __nvme_find_path(head, node); - return ns; - } - -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index ed02260862cb..056953bd8bd8 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -115,6 +115,13 @@ enum nvme_quirks { - * Prevent tag overlap between queues - */ - NVME_QUIRK_SHARED_TAGS = (1 << 13), -+ -+ /* -+ * The controller doesn't handle the Identify Namespace -+ * Identification Descriptor list subcommand despite claiming -+ * NVMe 1.3 compliance. -+ */ -+ NVME_QUIRK_NO_NS_DESC_LIST = (1 << 15), - }; - - /* -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index ee7669f23cff..100da11ce98c 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -3117,6 +3117,8 @@ static const struct pci_device_id nvme_id_table[] = { - { PCI_VDEVICE(INTEL, 0x5845), /* Qemu emulated controller */ - .driver_data = NVME_QUIRK_IDENTIFY_CNS | - NVME_QUIRK_DISABLE_WRITE_ZEROES, }, -+ { PCI_DEVICE(0x126f, 0x2263), /* Silicon Motion unidentified */ -+ .driver_data = NVME_QUIRK_NO_NS_DESC_LIST, }, - { PCI_DEVICE(0x1bb1, 0x0100), /* Seagate Nytro Flash Storage */ - .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, - { PCI_DEVICE(0x1c58, 0x0003), /* HGST adapter */ -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index cd0d49978190..d0336545e1fe 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -890,15 +890,20 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) - ret = PTR_ERR(ctrl->ctrl.connect_q); - goto out_free_tag_set; - } -- } else { -- blk_mq_update_nr_hw_queues(&ctrl->tag_set, -- ctrl->ctrl.queue_count - 1); - } - - ret = nvme_rdma_start_io_queues(ctrl); - if (ret) - goto out_cleanup_connect_q; - -+ if (!new) { -+ nvme_start_queues(&ctrl->ctrl); -+ nvme_wait_freeze(&ctrl->ctrl); -+ blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset, -+ ctrl->ctrl.queue_count - 1); -+ nvme_unfreeze(&ctrl->ctrl); -+ } -+ - return 0; - - out_cleanup_connect_q: -@@ -931,6 +936,7 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl, - bool remove) - { - if (ctrl->ctrl.queue_count > 1) { -+ nvme_start_freeze(&ctrl->ctrl); - nvme_stop_queues(&ctrl->ctrl); - nvme_rdma_stop_io_queues(ctrl); - if (ctrl->ctrl.tagset) { -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 53e113a18a54..0166ff0e4738 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -1684,15 +1684,20 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new) - ret = PTR_ERR(ctrl->connect_q); - goto out_free_tag_set; - } -- } else { -- blk_mq_update_nr_hw_queues(ctrl->tagset, -- ctrl->queue_count - 1); - } - - ret = nvme_tcp_start_io_queues(ctrl); - if (ret) - goto out_cleanup_connect_q; - -+ if (!new) { -+ nvme_start_queues(ctrl); -+ nvme_wait_freeze(ctrl); -+ blk_mq_update_nr_hw_queues(ctrl->tagset, -+ ctrl->queue_count - 1); -+ nvme_unfreeze(ctrl); -+ } -+ - return 0; - - out_cleanup_connect_q: -@@ -1797,6 +1802,7 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, - { - if (ctrl->queue_count <= 1) - return; -+ nvme_start_freeze(ctrl); - nvme_stop_queues(ctrl); - nvme_tcp_stop_io_queues(ctrl); - if (ctrl->tagset) { -diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c -index de8e4e347249..e410033b6df0 100644 ---- a/drivers/parisc/sba_iommu.c -+++ b/drivers/parisc/sba_iommu.c -@@ -1270,7 +1270,7 @@ sba_ioc_init_pluto(struct parisc_device *sba, struct ioc *ioc, int ioc_num) - ** (one that doesn't overlap memory or LMMIO space) in the - ** IBASE and IMASK registers. - */ -- ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE); -+ ioc->ibase = READ_REG(ioc->ioc_hpa + IOC_IBASE) & ~0x1fffffULL; - iova_space_size = ~(READ_REG(ioc->ioc_hpa + IOC_IMASK) & 0xFFFFFFFFUL) + 1; - - if ((ioc->ibase < 0xfed00000UL) && ((ioc->ibase + iova_space_size) > 0xfee00000UL)) { -diff --git a/drivers/pci/access.c b/drivers/pci/access.c -index 2fccb5762c76..0914ddeae17f 100644 ---- a/drivers/pci/access.c -+++ b/drivers/pci/access.c -@@ -204,17 +204,13 @@ EXPORT_SYMBOL(pci_bus_set_ops); - static DECLARE_WAIT_QUEUE_HEAD(pci_cfg_wait); - - static noinline void pci_wait_cfg(struct pci_dev *dev) -+ __must_hold(&pci_lock) - { -- DECLARE_WAITQUEUE(wait, current); -- -- __add_wait_queue(&pci_cfg_wait, &wait); - do { -- set_current_state(TASK_UNINTERRUPTIBLE); - raw_spin_unlock_irq(&pci_lock); -- schedule(); -+ wait_event(pci_cfg_wait, !dev->block_cfg_access); - raw_spin_lock_irq(&pci_lock); - } while (dev->block_cfg_access); -- __remove_wait_queue(&pci_cfg_wait, &wait); - } - - /* Returns 0 on success, negative values indicate error. */ -diff --git a/drivers/pci/controller/pcie-cadence-host.c b/drivers/pci/controller/pcie-cadence-host.c -index 97e251090b4f..0dfc778f40a7 100644 ---- a/drivers/pci/controller/pcie-cadence-host.c -+++ b/drivers/pci/controller/pcie-cadence-host.c -@@ -102,6 +102,7 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) - { - struct cdns_pcie *pcie = &rc->pcie; - u32 value, ctrl; -+ u32 id; - - /* - * Set the root complex BAR configuration register: -@@ -121,8 +122,12 @@ static int cdns_pcie_host_init_root_port(struct cdns_pcie_rc *rc) - cdns_pcie_writel(pcie, CDNS_PCIE_LM_RC_BAR_CFG, value); - - /* Set root port configuration space */ -- if (rc->vendor_id != 0xffff) -- cdns_pcie_rp_writew(pcie, PCI_VENDOR_ID, rc->vendor_id); -+ if (rc->vendor_id != 0xffff) { -+ id = CDNS_PCIE_LM_ID_VENDOR(rc->vendor_id) | -+ CDNS_PCIE_LM_ID_SUBSYS(rc->vendor_id); -+ cdns_pcie_writel(pcie, CDNS_PCIE_LM_ID, id); -+ } -+ - if (rc->device_id != 0xffff) - cdns_pcie_rp_writew(pcie, PCI_DEVICE_ID, rc->device_id); - -diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c -index 7c24c0aedad4..9966dcf1d112 100644 ---- a/drivers/pci/controller/vmd.c -+++ b/drivers/pci/controller/vmd.c -@@ -694,6 +694,7 @@ static int vmd_enable_domain(struct vmd_dev *vmd, unsigned long features) - if (!vmd->bus) { - pci_free_resource_list(&resources); - irq_domain_remove(vmd->irq_domain); -+ irq_domain_free_fwnode(fn); - return -ENODEV; - } - -@@ -808,6 +809,7 @@ static void vmd_cleanup_srcu(struct vmd_dev *vmd) - static void vmd_remove(struct pci_dev *dev) - { - struct vmd_dev *vmd = pci_get_drvdata(dev); -+ struct fwnode_handle *fn = vmd->irq_domain->fwnode; - - sysfs_remove_link(&vmd->dev->dev.kobj, "domain"); - pci_stop_root_bus(vmd->bus); -@@ -816,6 +818,7 @@ static void vmd_remove(struct pci_dev *dev) - vmd_teardown_dma_ops(vmd); - vmd_detach_resources(vmd); - irq_domain_remove(vmd->irq_domain); -+ irq_domain_free_fwnode(fn); - } - - #ifdef CONFIG_PM_SLEEP -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 4a0ec34062d6..7624c71011c6 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -1157,6 +1157,7 @@ static int pcie_aspm_get_policy(char *buffer, const struct kernel_param *kp) - cnt += sprintf(buffer + cnt, "[%s] ", policy_str[i]); - else - cnt += sprintf(buffer + cnt, "%s ", policy_str[i]); -+ cnt += sprintf(buffer + cnt, "\n"); - return cnt; - } - -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 4ac4b28e0ebb..9bc0f321aaf0 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -4446,6 +4446,8 @@ static int pci_quirk_amd_sb_acs(struct pci_dev *dev, u16 acs_flags) - if (ACPI_FAILURE(status)) - return -ENODEV; - -+ acpi_put_table(header); -+ - /* Filter out flags not applicable to multifunction */ - acs_flags &= (PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_EC | PCI_ACS_DT); - -diff --git a/drivers/phy/marvell/phy-armada38x-comphy.c b/drivers/phy/marvell/phy-armada38x-comphy.c -index 6960dfd8ad8c..0fe408964334 100644 ---- a/drivers/phy/marvell/phy-armada38x-comphy.c -+++ b/drivers/phy/marvell/phy-armada38x-comphy.c -@@ -41,6 +41,7 @@ struct a38x_comphy_lane { - - struct a38x_comphy { - void __iomem *base; -+ void __iomem *conf; - struct device *dev; - struct a38x_comphy_lane lane[MAX_A38X_COMPHY]; - }; -@@ -54,6 +55,21 @@ static const u8 gbe_mux[MAX_A38X_COMPHY][MAX_A38X_PORTS] = { - { 0, 0, 3 }, - }; - -+static void a38x_set_conf(struct a38x_comphy_lane *lane, bool enable) -+{ -+ struct a38x_comphy *priv = lane->priv; -+ u32 conf; -+ -+ if (priv->conf) { -+ conf = readl_relaxed(priv->conf); -+ if (enable) -+ conf |= BIT(lane->port); -+ else -+ conf &= ~BIT(lane->port); -+ writel(conf, priv->conf); -+ } -+} -+ - static void a38x_comphy_set_reg(struct a38x_comphy_lane *lane, - unsigned int offset, u32 mask, u32 value) - { -@@ -97,6 +113,7 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub) - { - struct a38x_comphy_lane *lane = phy_get_drvdata(phy); - unsigned int gen; -+ int ret; - - if (mode != PHY_MODE_ETHERNET) - return -EINVAL; -@@ -115,13 +132,20 @@ static int a38x_comphy_set_mode(struct phy *phy, enum phy_mode mode, int sub) - return -EINVAL; - } - -+ a38x_set_conf(lane, false); -+ - a38x_comphy_set_speed(lane, gen, gen); - -- return a38x_comphy_poll(lane, COMPHY_STAT1, -- COMPHY_STAT1_PLL_RDY_TX | -- COMPHY_STAT1_PLL_RDY_RX, -- COMPHY_STAT1_PLL_RDY_TX | -- COMPHY_STAT1_PLL_RDY_RX); -+ ret = a38x_comphy_poll(lane, COMPHY_STAT1, -+ COMPHY_STAT1_PLL_RDY_TX | -+ COMPHY_STAT1_PLL_RDY_RX, -+ COMPHY_STAT1_PLL_RDY_TX | -+ COMPHY_STAT1_PLL_RDY_RX); -+ -+ if (ret == 0) -+ a38x_set_conf(lane, true); -+ -+ return ret; - } - - static const struct phy_ops a38x_comphy_ops = { -@@ -174,14 +198,21 @@ static int a38x_comphy_probe(struct platform_device *pdev) - if (!priv) - return -ENOMEM; - -- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- base = devm_ioremap_resource(&pdev->dev, res); -+ base = devm_platform_ioremap_resource(pdev, 0); - if (IS_ERR(base)) - return PTR_ERR(base); - - priv->dev = &pdev->dev; - priv->base = base; - -+ /* Optional */ -+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "conf"); -+ if (res) { -+ priv->conf = devm_ioremap_resource(&pdev->dev, res); -+ if (IS_ERR(priv->conf)) -+ return PTR_ERR(priv->conf); -+ } -+ - for_each_available_child_of_node(pdev->dev.of_node, child) { - struct phy *phy; - int ret; -diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -index bfb22f868857..5087b7c44d55 100644 ---- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c -+++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c -@@ -111,6 +111,7 @@ struct rcar_gen3_chan { - struct work_struct work; - struct mutex lock; /* protects rphys[...].powered */ - enum usb_dr_mode dr_mode; -+ int irq; - bool extcon_host; - bool is_otg_channel; - bool uses_otg_pins; -@@ -389,12 +390,38 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch) - rcar_gen3_device_recognition(ch); - } - -+static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch) -+{ -+ struct rcar_gen3_chan *ch = _ch; -+ void __iomem *usb2_base = ch->base; -+ u32 status = readl(usb2_base + USB2_OBINTSTA); -+ irqreturn_t ret = IRQ_NONE; -+ -+ if (status & USB2_OBINT_BITS) { -+ dev_vdbg(ch->dev, "%s: %08x\n", __func__, status); -+ writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA); -+ rcar_gen3_device_recognition(ch); -+ ret = IRQ_HANDLED; -+ } -+ -+ return ret; -+} -+ - static int rcar_gen3_phy_usb2_init(struct phy *p) - { - struct rcar_gen3_phy *rphy = phy_get_drvdata(p); - struct rcar_gen3_chan *channel = rphy->ch; - void __iomem *usb2_base = channel->base; - u32 val; -+ int ret; -+ -+ if (!rcar_gen3_is_any_rphy_initialized(channel) && channel->irq >= 0) { -+ INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); -+ ret = request_irq(channel->irq, rcar_gen3_phy_usb2_irq, -+ IRQF_SHARED, dev_name(channel->dev), channel); -+ if (ret < 0) -+ dev_err(channel->dev, "No irq handler (%d)\n", channel->irq); -+ } - - /* Initialize USB2 part */ - val = readl(usb2_base + USB2_INT_ENABLE); -@@ -433,6 +460,9 @@ static int rcar_gen3_phy_usb2_exit(struct phy *p) - val &= ~USB2_INT_ENABLE_UCOM_INTEN; - writel(val, usb2_base + USB2_INT_ENABLE); - -+ if (channel->irq >= 0 && !rcar_gen3_is_any_rphy_initialized(channel)) -+ free_irq(channel->irq, channel); -+ - return 0; - } - -@@ -503,23 +533,6 @@ static const struct phy_ops rz_g1c_phy_usb2_ops = { - .owner = THIS_MODULE, - }; - --static irqreturn_t rcar_gen3_phy_usb2_irq(int irq, void *_ch) --{ -- struct rcar_gen3_chan *ch = _ch; -- void __iomem *usb2_base = ch->base; -- u32 status = readl(usb2_base + USB2_OBINTSTA); -- irqreturn_t ret = IRQ_NONE; -- -- if (status & USB2_OBINT_BITS) { -- dev_vdbg(ch->dev, "%s: %08x\n", __func__, status); -- writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA); -- rcar_gen3_device_recognition(ch); -- ret = IRQ_HANDLED; -- } -- -- return ret; --} -- - static const struct of_device_id rcar_gen3_phy_usb2_match_table[] = { - { - .compatible = "renesas,usb2-phy-r8a77470", -@@ -598,7 +611,7 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - struct phy_provider *provider; - struct resource *res; - const struct phy_ops *phy_usb2_ops; -- int irq, ret = 0, i; -+ int ret = 0, i; - - if (!dev->of_node) { - dev_err(dev, "This driver needs device tree\n"); -@@ -614,16 +627,8 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) - if (IS_ERR(channel->base)) - return PTR_ERR(channel->base); - -- /* call request_irq for OTG */ -- irq = platform_get_irq_optional(pdev, 0); -- if (irq >= 0) { -- INIT_WORK(&channel->work, rcar_gen3_phy_usb2_work); -- irq = devm_request_irq(dev, irq, rcar_gen3_phy_usb2_irq, -- IRQF_SHARED, dev_name(dev), channel); -- if (irq < 0) -- dev_err(dev, "No irq handler (%d)\n", irq); -- } -- -+ /* get irq number here and request_irq for OTG in phy_init */ -+ channel->irq = platform_get_irq_optional(pdev, 0); - channel->dr_mode = rcar_gen3_get_dr_mode(dev->of_node); - if (channel->dr_mode != USB_DR_MODE_UNKNOWN) { - int ret; -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index 1e0614daee9b..a9d511982780 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -916,7 +916,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, - - /* If pinconf isn't supported, don't parse properties in below. */ - if (!PCS_HAS_PINCONF) -- return 0; -+ return -ENOTSUPP; - - /* cacluate how much properties are supported in current node */ - for (i = 0; i < ARRAY_SIZE(prop2); i++) { -@@ -928,7 +928,7 @@ static int pcs_parse_pinconf(struct pcs_device *pcs, struct device_node *np, - nconfs++; - } - if (!nconfs) -- return 0; -+ return -ENOTSUPP; - - func->conf = devm_kcalloc(pcs->dev, - nconfs, sizeof(struct pcs_conf_vals), -@@ -1056,9 +1056,12 @@ static int pcs_parse_one_pinctrl_entry(struct pcs_device *pcs, - - if (PCS_HAS_PINCONF && function) { - res = pcs_parse_pinconf(pcs, np, function, map); -- if (res) -+ if (res == 0) -+ *num_maps = 2; -+ else if (res == -ENOTSUPP) -+ *num_maps = 1; -+ else - goto free_pingroups; -- *num_maps = 2; - } else { - *num_maps = 1; - } -diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c -index 0d42477946f3..59b78a181723 100644 ---- a/drivers/platform/x86/asus-nb-wmi.c -+++ b/drivers/platform/x86/asus-nb-wmi.c -@@ -110,6 +110,16 @@ static struct quirk_entry quirk_asus_forceals = { - .wmi_force_als_set = true, - }; - -+static struct quirk_entry quirk_asus_ga401i = { -+ .wmi_backlight_power = true, -+ .wmi_backlight_set_devstate = true, -+}; -+ -+static struct quirk_entry quirk_asus_ga502i = { -+ .wmi_backlight_power = true, -+ .wmi_backlight_set_devstate = true, -+}; -+ - static int dmi_matched(const struct dmi_system_id *dmi) - { - pr_info("Identified laptop model '%s'\n", dmi->ident); -@@ -411,6 +421,78 @@ static const struct dmi_system_id asus_quirks[] = { - }, - .driver_data = &quirk_asus_forceals, - }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA401IH", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IH"), -+ }, -+ .driver_data = &quirk_asus_ga401i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA401II", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA401II"), -+ }, -+ .driver_data = &quirk_asus_ga401i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA401IU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IU"), -+ }, -+ .driver_data = &quirk_asus_ga401i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA401IV", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IV"), -+ }, -+ .driver_data = &quirk_asus_ga401i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA401IVC", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA401IVC"), -+ }, -+ .driver_data = &quirk_asus_ga401i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA502II", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA502II"), -+ }, -+ .driver_data = &quirk_asus_ga502i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA502IU", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IU"), -+ }, -+ .driver_data = &quirk_asus_ga502i, -+ }, -+ { -+ .callback = dmi_matched, -+ .ident = "ASUSTeK COMPUTER INC. GA502IV", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "GA502IV"), -+ }, -+ .driver_data = &quirk_asus_ga502i, -+ }, - {}, - }; - -diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c -index 7a506c1d0113..ad1399dcb21f 100644 ---- a/drivers/platform/x86/intel-hid.c -+++ b/drivers/platform/x86/intel-hid.c -@@ -570,7 +570,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) - return AE_OK; - - if (acpi_match_device_ids(dev, ids) == 0) -- if (acpi_create_platform_device(dev, NULL)) -+ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) - dev_info(&dev->dev, - "intel-hid: created platform device\n"); - -diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c -index cb2a80fdd8f4..3393ee95077f 100644 ---- a/drivers/platform/x86/intel-vbtn.c -+++ b/drivers/platform/x86/intel-vbtn.c -@@ -286,7 +286,7 @@ check_acpi_dev(acpi_handle handle, u32 lvl, void *context, void **rv) - return AE_OK; - - if (acpi_match_device_ids(dev, ids) == 0) -- if (acpi_create_platform_device(dev, NULL)) -+ if (!IS_ERR_OR_NULL(acpi_create_platform_device(dev, NULL))) - dev_info(&dev->dev, - "intel-vbtn: created platform device\n"); - -diff --git a/drivers/power/supply/88pm860x_battery.c b/drivers/power/supply/88pm860x_battery.c -index 5ca047b3f58f..23e7d6447ae9 100644 ---- a/drivers/power/supply/88pm860x_battery.c -+++ b/drivers/power/supply/88pm860x_battery.c -@@ -433,7 +433,7 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) - int ret; - int data; - int bat_remove; -- int soc; -+ int soc = 0; - - /* measure enable on GPADC1 */ - data = MEAS1_GP1; -@@ -496,7 +496,9 @@ static void pm860x_init_battery(struct pm860x_battery_info *info) - } - mutex_unlock(&info->lock); - -- calc_soc(info, OCV_MODE_ACTIVE, &soc); -+ ret = calc_soc(info, OCV_MODE_ACTIVE, &soc); -+ if (ret < 0) -+ goto out; - - data = pm860x_reg_read(info->i2c, PM8607_POWER_UP_LOG); - bat_remove = data & BAT_WU_LOG; -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 0011bdc15afb..a17aebe0aa7a 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4994,7 +4994,6 @@ regulator_register(const struct regulator_desc *regulator_desc, - struct regulator_dev *rdev; - bool dangling_cfg_gpiod = false; - bool dangling_of_gpiod = false; -- bool reg_device_fail = false; - struct device *dev; - int ret, i; - -@@ -5123,10 +5122,12 @@ regulator_register(const struct regulator_desc *regulator_desc, - } - - /* register with sysfs */ -+ device_initialize(&rdev->dev); - rdev->dev.class = ®ulator_class; - rdev->dev.parent = dev; - dev_set_name(&rdev->dev, "regulator.%lu", - (unsigned long) atomic_inc_return(®ulator_no)); -+ dev_set_drvdata(&rdev->dev, rdev); - - /* set regulator constraints */ - if (init_data) -@@ -5177,12 +5178,9 @@ regulator_register(const struct regulator_desc *regulator_desc, - !rdev->desc->fixed_uV) - rdev->is_switch = true; - -- dev_set_drvdata(&rdev->dev, rdev); -- ret = device_register(&rdev->dev); -- if (ret != 0) { -- reg_device_fail = true; -+ ret = device_add(&rdev->dev); -+ if (ret != 0) - goto unset_supplies; -- } - - rdev_init_debugfs(rdev); - -@@ -5204,17 +5202,15 @@ unset_supplies: - mutex_unlock(®ulator_list_mutex); - wash: - kfree(rdev->coupling_desc.coupled_rdevs); -- kfree(rdev->constraints); - mutex_lock(®ulator_list_mutex); - regulator_ena_gpio_free(rdev); - mutex_unlock(®ulator_list_mutex); -+ put_device(&rdev->dev); -+ rdev = NULL; - clean: - if (dangling_of_gpiod) - gpiod_put(config->ena_gpiod); -- if (reg_device_fail) -- put_device(&rdev->dev); -- else -- kfree(rdev); -+ kfree(rdev); - kfree(config); - rinse: - if (dangling_cfg_gpiod) -diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c -index 8d4971645cf1..f7ae03fd36cb 100644 ---- a/drivers/s390/block/dasd_diag.c -+++ b/drivers/s390/block/dasd_diag.c -@@ -319,7 +319,7 @@ dasd_diag_check_device(struct dasd_device *device) - struct dasd_diag_characteristics *rdc_data; - struct vtoc_cms_label *label; - struct dasd_block *block; -- struct dasd_diag_bio bio; -+ struct dasd_diag_bio *bio; - unsigned int sb, bsize; - blocknum_t end_block; - int rc; -@@ -395,29 +395,36 @@ dasd_diag_check_device(struct dasd_device *device) - rc = -ENOMEM; - goto out; - } -+ bio = kzalloc(sizeof(*bio), GFP_KERNEL); -+ if (bio == NULL) { -+ DBF_DEV_EVENT(DBF_WARNING, device, "%s", -+ "No memory to allocate initialization bio"); -+ rc = -ENOMEM; -+ goto out_label; -+ } - rc = 0; - end_block = 0; - /* try all sizes - needed for ECKD devices */ - for (bsize = 512; bsize <= PAGE_SIZE; bsize <<= 1) { - mdsk_init_io(device, bsize, 0, &end_block); -- memset(&bio, 0, sizeof (struct dasd_diag_bio)); -- bio.type = MDSK_READ_REQ; -- bio.block_number = private->pt_block + 1; -- bio.buffer = label; -+ memset(bio, 0, sizeof(*bio)); -+ bio->type = MDSK_READ_REQ; -+ bio->block_number = private->pt_block + 1; -+ bio->buffer = label; - memset(&private->iob, 0, sizeof (struct dasd_diag_rw_io)); - private->iob.dev_nr = rdc_data->dev_nr; - private->iob.key = 0; - private->iob.flags = 0; /* do synchronous io */ - private->iob.block_count = 1; - private->iob.interrupt_params = 0; -- private->iob.bio_list = &bio; -+ private->iob.bio_list = bio; - private->iob.flaga = DASD_DIAG_FLAGA_DEFAULT; - rc = dia250(&private->iob, RW_BIO); - if (rc == 3) { - pr_warn("%s: A 64-bit DIAG call failed\n", - dev_name(&device->cdev->dev)); - rc = -EOPNOTSUPP; -- goto out_label; -+ goto out_bio; - } - mdsk_term_io(device); - if (rc == 0) -@@ -427,7 +434,7 @@ dasd_diag_check_device(struct dasd_device *device) - pr_warn("%s: Accessing the DASD failed because of an incorrect format (rc=%d)\n", - dev_name(&device->cdev->dev), rc); - rc = -EIO; -- goto out_label; -+ goto out_bio; - } - /* check for label block */ - if (memcmp(label->label_id, DASD_DIAG_CMS1, -@@ -457,6 +464,8 @@ dasd_diag_check_device(struct dasd_device *device) - (rc == 4) ? ", read-only device" : ""); - rc = 0; - } -+out_bio: -+ kfree(bio); - out_label: - free_page((long) label); - out: -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index 92bace3b28fd..4ce28aa490cd 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -1199,6 +1199,10 @@ static void qeth_bridge_state_change(struct qeth_card *card, - int extrasize; - - QETH_CARD_TEXT(card, 2, "brstchng"); -+ if (qports->num_entries == 0) { -+ QETH_CARD_TEXT(card, 2, "BPempty"); -+ return; -+ } - if (qports->entry_length != sizeof(struct qeth_sbp_port_entry)) { - QETH_CARD_TEXT_(card, 2, "BPsz%04x", qports->entry_length); - return; -diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c -index a1f3e9ee4e63..14e1d001253c 100644 ---- a/drivers/scsi/arm/cumana_2.c -+++ b/drivers/scsi/arm/cumana_2.c -@@ -450,7 +450,7 @@ static int cumanascsi2_probe(struct expansion_card *ec, - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_release: - fas216_release(host); -diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c -index 134f040d58e2..f441ec8eb93d 100644 ---- a/drivers/scsi/arm/eesox.c -+++ b/drivers/scsi/arm/eesox.c -@@ -571,7 +571,7 @@ static int eesoxscsi_probe(struct expansion_card *ec, const struct ecard_id *id) - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_remove: - fas216_remove(host); -diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c -index c795537a671c..2dc0df005cb3 100644 ---- a/drivers/scsi/arm/powertec.c -+++ b/drivers/scsi/arm/powertec.c -@@ -378,7 +378,7 @@ static int powertecscsi_probe(struct expansion_card *ec, - - if (info->info.scsi.dma != NO_DMA) - free_dma(info->info.scsi.dma); -- free_irq(ec->irq, host); -+ free_irq(ec->irq, info); - - out_release: - fas216_release(host); -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 0cbe6740e0c9..2c2966a297c7 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -5586,9 +5586,13 @@ megasas_setup_irqs_msix(struct megasas_instance *instance, u8 is_probe) - &instance->irq_context[i])) { - dev_err(&instance->pdev->dev, - "Failed to register IRQ for vector %d.\n", i); -- for (j = 0; j < i; j++) -+ for (j = 0; j < i; j++) { -+ if (j < instance->low_latency_index_start) -+ irq_set_affinity_hint( -+ pci_irq_vector(pdev, j), NULL); - free_irq(pci_irq_vector(pdev, j), - &instance->irq_context[j]); -+ } - /* Retry irq register for IO_APIC*/ - instance->msix_vectors = 0; - instance->msix_load_balance = false; -@@ -5626,6 +5630,9 @@ megasas_destroy_irqs(struct megasas_instance *instance) { - - if (instance->msix_vectors) - for (i = 0; i < instance->msix_vectors; i++) { -+ if (i < instance->low_latency_index_start) -+ irq_set_affinity_hint( -+ pci_irq_vector(instance->pdev, i), NULL); - free_irq(pci_irq_vector(instance->pdev, i), - &instance->irq_context[i]); - } -diff --git a/drivers/scsi/mesh.c b/drivers/scsi/mesh.c -index 74fb50644678..4dd50db90677 100644 ---- a/drivers/scsi/mesh.c -+++ b/drivers/scsi/mesh.c -@@ -1045,6 +1045,8 @@ static void handle_error(struct mesh_state *ms) - while ((in_8(&mr->bus_status1) & BS1_RST) != 0) - udelay(1); - printk("done\n"); -+ if (ms->dma_started) -+ halt_dma(ms); - handle_reset(ms); - /* request_q is empty, no point in mesh_start() */ - return; -@@ -1357,7 +1359,8 @@ static void halt_dma(struct mesh_state *ms) - ms->conn_tgt, ms->data_ptr, scsi_bufflen(cmd), - ms->tgts[ms->conn_tgt].data_goes_out); - } -- scsi_dma_unmap(cmd); -+ if (cmd) -+ scsi_dma_unmap(cmd); - ms->dma_started = 0; - } - -@@ -1712,6 +1715,9 @@ static int mesh_host_reset(struct scsi_cmnd *cmd) - - spin_lock_irqsave(ms->host->host_lock, flags); - -+ if (ms->dma_started) -+ halt_dma(ms); -+ - /* Reset the controller & dbdma channel */ - out_le32(&md->control, (RUN|PAUSE|FLUSH|WAKE) << 16); /* stop dma */ - out_8(&mr->exception, 0xff); /* clear all exception bits */ -diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c -index 32965ec76965..44181a2cbf18 100644 ---- a/drivers/scsi/scsi_debug.c -+++ b/drivers/scsi/scsi_debug.c -@@ -5296,6 +5296,12 @@ static int __init scsi_debug_init(void) - pr_err("submit_queues must be 1 or more\n"); - return -EINVAL; - } -+ -+ if ((sdebug_max_queue > SDEBUG_CANQUEUE) || (sdebug_max_queue < 1)) { -+ pr_err("max_queue must be in range [1, %d]\n", SDEBUG_CANQUEUE); -+ return -EINVAL; -+ } -+ - sdebug_q_arr = kcalloc(submit_queues, sizeof(struct sdebug_queue), - GFP_KERNEL); - if (sdebug_q_arr == NULL) -diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c -index 0ba1f465db12..8924fcd9f5f5 100644 ---- a/drivers/soc/qcom/rpmh-rsc.c -+++ b/drivers/soc/qcom/rpmh-rsc.c -@@ -715,6 +715,7 @@ static struct platform_driver rpmh_driver = { - .driver = { - .name = "rpmh", - .of_match_table = rpmh_drv_match, -+ .suppress_bind_attrs = true, - }, - }; - -diff --git a/drivers/spi/spi-lantiq-ssc.c b/drivers/spi/spi-lantiq-ssc.c -index 9dfe8b04e688..f9bc1705c0d4 100644 ---- a/drivers/spi/spi-lantiq-ssc.c -+++ b/drivers/spi/spi-lantiq-ssc.c -@@ -184,6 +184,7 @@ struct lantiq_ssc_spi { - unsigned int tx_fifo_size; - unsigned int rx_fifo_size; - unsigned int base_cs; -+ unsigned int fdx_tx_level; - }; - - static u32 lantiq_ssc_readl(const struct lantiq_ssc_spi *spi, u32 reg) -@@ -481,6 +482,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) - u32 data; - unsigned int tx_free = tx_fifo_free(spi); - -+ spi->fdx_tx_level = 0; - while (spi->tx_todo && tx_free) { - switch (spi->bits_per_word) { - case 2 ... 8: -@@ -509,6 +511,7 @@ static void tx_fifo_write(struct lantiq_ssc_spi *spi) - - lantiq_ssc_writel(spi, data, LTQ_SPI_TB); - tx_free--; -+ spi->fdx_tx_level++; - } - } - -@@ -520,6 +523,13 @@ static void rx_fifo_read_full_duplex(struct lantiq_ssc_spi *spi) - u32 data; - unsigned int rx_fill = rx_fifo_level(spi); - -+ /* -+ * Wait until all expected data to be shifted in. -+ * Otherwise, rx overrun may occur. -+ */ -+ while (rx_fill != spi->fdx_tx_level) -+ rx_fill = rx_fifo_level(spi); -+ - while (rx_fill) { - data = lantiq_ssc_readl(spi, LTQ_SPI_RB); - -@@ -907,7 +917,7 @@ static int lantiq_ssc_probe(struct platform_device *pdev) - master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 8) | - SPI_BPW_MASK(16) | SPI_BPW_MASK(32); - -- spi->wq = alloc_ordered_workqueue(dev_name(dev), 0); -+ spi->wq = alloc_ordered_workqueue(dev_name(dev), WQ_MEM_RECLAIM); - if (!spi->wq) { - err = -ENOMEM; - goto err_clk_put; -diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c -index 2cc6d9951b52..008b64f4e031 100644 ---- a/drivers/spi/spi-rockchip.c -+++ b/drivers/spi/spi-rockchip.c -@@ -286,7 +286,7 @@ static void rockchip_spi_pio_writer(struct rockchip_spi *rs) - static void rockchip_spi_pio_reader(struct rockchip_spi *rs) - { - u32 words = readl_relaxed(rs->regs + ROCKCHIP_SPI_RXFLR); -- u32 rx_left = rs->rx_left - words; -+ u32 rx_left = (rs->rx_left > words) ? rs->rx_left - words : 0; - - /* the hardware doesn't allow us to change fifo threshold - * level while spi is enabled, so instead make sure to leave -diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c -index ac6bf1fbbfe6..be503a0e6ef7 100644 ---- a/drivers/spi/spidev.c -+++ b/drivers/spi/spidev.c -@@ -223,6 +223,11 @@ static int spidev_message(struct spidev_data *spidev, - for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; - n; - n--, k_tmp++, u_tmp++) { -+ /* Ensure that also following allocations from rx_buf/tx_buf will meet -+ * DMA alignment requirements. -+ */ -+ unsigned int len_aligned = ALIGN(u_tmp->len, ARCH_KMALLOC_MINALIGN); -+ - k_tmp->len = u_tmp->len; - - total += k_tmp->len; -@@ -238,17 +243,17 @@ static int spidev_message(struct spidev_data *spidev, - - if (u_tmp->rx_buf) { - /* this transfer needs space in RX bounce buffer */ -- rx_total += k_tmp->len; -+ rx_total += len_aligned; - if (rx_total > bufsiz) { - status = -EMSGSIZE; - goto done; - } - k_tmp->rx_buf = rx_buf; -- rx_buf += k_tmp->len; -+ rx_buf += len_aligned; - } - if (u_tmp->tx_buf) { - /* this transfer needs space in TX bounce buffer */ -- tx_total += k_tmp->len; -+ tx_total += len_aligned; - if (tx_total > bufsiz) { - status = -EMSGSIZE; - goto done; -@@ -258,7 +263,7 @@ static int spidev_message(struct spidev_data *spidev, - (uintptr_t) u_tmp->tx_buf, - u_tmp->len)) - goto done; -- tx_buf += k_tmp->len; -+ tx_buf += len_aligned; - } - - k_tmp->cs_change = !!u_tmp->cs_change; -@@ -290,16 +295,16 @@ static int spidev_message(struct spidev_data *spidev, - goto done; - - /* copy any rx data out of bounce buffer */ -- rx_buf = spidev->rx_buffer; -- for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) { -+ for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers; -+ n; -+ n--, k_tmp++, u_tmp++) { - if (u_tmp->rx_buf) { - if (copy_to_user((u8 __user *) -- (uintptr_t) u_tmp->rx_buf, rx_buf, -+ (uintptr_t) u_tmp->rx_buf, k_tmp->rx_buf, - u_tmp->len)) { - status = -EFAULT; - goto done; - } -- rx_buf += u_tmp->len; - } - } - status = total; -diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c -index 511136dce3a4..ddc09616248a 100644 ---- a/drivers/staging/rtl8192u/r8192U_core.c -+++ b/drivers/staging/rtl8192u/r8192U_core.c -@@ -2401,7 +2401,7 @@ static int rtl8192_read_eeprom_info(struct net_device *dev) - ret = eprom_read(dev, (EEPROM_TX_PW_INDEX_CCK >> 1)); - if (ret < 0) - return ret; -- priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff) >> 8; -+ priv->EEPROMTxPowerLevelCCK = ((u16)ret & 0xff00) >> 8; - } else - priv->EEPROMTxPowerLevelCCK = 0x10; - RT_TRACE(COMP_EPROM, "CCK Tx Power Levl: 0x%02x\n", priv->EEPROMTxPowerLevelCCK); -diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -index af6bf0736b52..eb76cc2cbfd8 100644 ---- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c -@@ -3257,6 +3257,7 @@ failed_platform_init: - - static int vchiq_remove(struct platform_device *pdev) - { -+ platform_device_unregister(bcm2835_audio); - platform_device_unregister(bcm2835_camera); - vchiq_debugfs_deinit(); - device_destroy(vchiq_class, vchiq_devid); -diff --git a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c -index 85776db4bf34..2ce4b19f312a 100644 ---- a/drivers/thermal/ti-soc-thermal/ti-thermal-common.c -+++ b/drivers/thermal/ti-soc-thermal/ti-thermal-common.c -@@ -169,7 +169,7 @@ int ti_thermal_expose_sensor(struct ti_bandgap *bgp, int id, - - data = ti_bandgap_get_sensor_data(bgp, id); - -- if (!IS_ERR_OR_NULL(data)) -+ if (IS_ERR_OR_NULL(data)) - data = ti_thermal_build_data(bgp, id); - - if (!data) -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index e0b77674869c..c96c50faccf7 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -25,17 +25,23 @@ static unsigned int quirk_count; - - static char quirks_param[128]; - --static int quirks_param_set(const char *val, const struct kernel_param *kp) -+static int quirks_param_set(const char *value, const struct kernel_param *kp) - { -- char *p, *field; -+ char *val, *p, *field; - u16 vid, pid; - u32 flags; - size_t i; - int err; - -+ val = kstrdup(value, GFP_KERNEL); -+ if (!val) -+ return -ENOMEM; -+ - err = param_set_copystring(val, kp); -- if (err) -+ if (err) { -+ kfree(val); - return err; -+ } - - mutex_lock(&quirk_mutex); - -@@ -60,10 +66,11 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) - if (!quirk_list) { - quirk_count = 0; - mutex_unlock(&quirk_mutex); -+ kfree(val); - return -ENOMEM; - } - -- for (i = 0, p = (char *)val; p && *p;) { -+ for (i = 0, p = val; p && *p;) { - /* Each entry consists of VID:PID:flags */ - field = strsep(&p, ":"); - if (!field) -@@ -144,6 +151,7 @@ static int quirks_param_set(const char *val, const struct kernel_param *kp) - - unlock: - mutex_unlock(&quirk_mutex); -+ kfree(val); - - return 0; - } -diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c -index 4e14c4f7fed7..34bb6124f1e2 100644 ---- a/drivers/usb/dwc2/platform.c -+++ b/drivers/usb/dwc2/platform.c -@@ -514,6 +514,7 @@ static int dwc2_driver_probe(struct platform_device *dev) - if (hsotg->gadget_enabled) { - retval = usb_add_gadget_udc(hsotg->dev, &hsotg->gadget); - if (retval) { -+ hsotg->gadget.udc = NULL; - dwc2_hsotg_remove(hsotg); - goto error; - } -@@ -522,7 +523,8 @@ static int dwc2_driver_probe(struct platform_device *dev) - return 0; - - error: -- dwc2_lowlevel_hw_disable(hsotg); -+ if (hsotg->dr_mode != USB_DR_MODE_PERIPHERAL) -+ dwc2_lowlevel_hw_disable(hsotg); - return retval; - } - -diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c -index db2d4980cb35..3633df6d7610 100644 ---- a/drivers/usb/gadget/function/f_uac2.c -+++ b/drivers/usb/gadget/function/f_uac2.c -@@ -215,10 +215,7 @@ static struct uac2_ac_header_descriptor ac_hdr_desc = { - .bDescriptorSubtype = UAC_MS_HEADER, - .bcdADC = cpu_to_le16(0x200), - .bCategory = UAC2_FUNCTION_IO_BOX, -- .wTotalLength = cpu_to_le16(sizeof in_clk_src_desc -- + sizeof out_clk_src_desc + sizeof usb_out_it_desc -- + sizeof io_in_it_desc + sizeof usb_in_ot_desc -- + sizeof io_out_ot_desc), -+ /* .wTotalLength = DYNAMIC */ - .bmControls = 0, - }; - -@@ -501,7 +498,7 @@ static void setup_descriptor(struct f_uac2_opts *opts) - as_in_hdr_desc.bTerminalLink = usb_in_ot_desc.bTerminalID; - - iad_desc.bInterfaceCount = 1; -- ac_hdr_desc.wTotalLength = 0; -+ ac_hdr_desc.wTotalLength = cpu_to_le16(sizeof(ac_hdr_desc)); - - if (EPIN_EN(opts)) { - u16 len = le16_to_cpu(ac_hdr_desc.wTotalLength); -diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c -index cc4a16e253ac..3d33499db50b 100644 ---- a/drivers/usb/gadget/udc/bdc/bdc_core.c -+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c -@@ -282,6 +282,7 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) - * in that case reinit is passed as 1 - */ - if (reinit) { -+ int i; - /* Enable interrupts */ - temp = bdc_readl(bdc->regs, BDC_BDCSC); - temp |= BDC_GIE; -@@ -291,6 +292,9 @@ static void bdc_mem_init(struct bdc *bdc, bool reinit) - /* Initialize SRR to 0 */ - memset(bdc->srr.sr_bds, 0, - NUM_SR_ENTRIES * sizeof(struct bdc_bd)); -+ /* clear ep flags to avoid post disconnect stops/deconfigs */ -+ for (i = 1; i < bdc->num_eps; ++i) -+ bdc->bdc_ep_array[i]->flags = 0; - } else { - /* One time initiaization only */ - /* Enable status report function pointers */ -@@ -601,9 +605,14 @@ static int bdc_remove(struct platform_device *pdev) - static int bdc_suspend(struct device *dev) - { - struct bdc *bdc = dev_get_drvdata(dev); -+ int ret; - -- clk_disable_unprepare(bdc->clk); -- return 0; -+ /* Halt the controller */ -+ ret = bdc_stop(bdc); -+ if (!ret) -+ clk_disable_unprepare(bdc->clk); -+ -+ return ret; - } - - static int bdc_resume(struct device *dev) -diff --git a/drivers/usb/gadget/udc/bdc/bdc_ep.c b/drivers/usb/gadget/udc/bdc/bdc_ep.c -index d49c6dc1082d..9ddc0b4e92c9 100644 ---- a/drivers/usb/gadget/udc/bdc/bdc_ep.c -+++ b/drivers/usb/gadget/udc/bdc/bdc_ep.c -@@ -615,7 +615,6 @@ int bdc_ep_enable(struct bdc_ep *ep) - } - bdc_dbg_bd_list(bdc, ep); - /* only for ep0: config ep is called for ep0 from connect event */ -- ep->flags |= BDC_EP_ENABLED; - if (ep->ep_num == 1) - return ret; - -@@ -759,10 +758,13 @@ static int ep_dequeue(struct bdc_ep *ep, struct bdc_req *req) - __func__, ep->name, start_bdi, end_bdi); - dev_dbg(bdc->dev, "ep_dequeue ep=%p ep->desc=%p\n", - ep, (void *)ep->usb_ep.desc); -- /* Stop the ep to see where the HW is ? */ -- ret = bdc_stop_ep(bdc, ep->ep_num); -- /* if there is an issue with stopping ep, then no need to go further */ -- if (ret) -+ /* if still connected, stop the ep to see where the HW is ? */ -+ if (!(bdc_readl(bdc->regs, BDC_USPC) & BDC_PST_MASK)) { -+ ret = bdc_stop_ep(bdc, ep->ep_num); -+ /* if there is an issue, then no need to go further */ -+ if (ret) -+ return 0; -+ } else - return 0; - - /* -@@ -1911,7 +1913,9 @@ static int bdc_gadget_ep_disable(struct usb_ep *_ep) - __func__, ep->name, ep->flags); - - if (!(ep->flags & BDC_EP_ENABLED)) { -- dev_warn(bdc->dev, "%s is already disabled\n", ep->name); -+ if (bdc->gadget.speed != USB_SPEED_UNKNOWN) -+ dev_warn(bdc->dev, "%s is already disabled\n", -+ ep->name); - return 0; - } - spin_lock_irqsave(&bdc->lock, flags); -diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c -index 51efee21915f..7c616d7641c6 100644 ---- a/drivers/usb/gadget/udc/net2280.c -+++ b/drivers/usb/gadget/udc/net2280.c -@@ -3782,8 +3782,10 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id) - return 0; - - done: -- if (dev) -+ if (dev) { - net2280_remove(pdev); -+ kfree(dev); -+ } - return retval; - } - -diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c -index 9dd02160cca9..e3780d4d6514 100644 ---- a/drivers/usb/mtu3/mtu3_core.c -+++ b/drivers/usb/mtu3/mtu3_core.c -@@ -131,8 +131,12 @@ static void mtu3_device_disable(struct mtu3 *mtu) - mtu3_setbits(ibase, SSUSB_U2_CTRL(0), - SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN); - -- if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) -+ if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) { - mtu3_clrbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL); -+ if (mtu->is_u3_ip) -+ mtu3_clrbits(ibase, SSUSB_U3_CTRL(0), -+ SSUSB_U3_PORT_DUAL_MODE); -+ } - - mtu3_setbits(ibase, U3D_SSUSB_IP_PW_CTRL2, SSUSB_IP_DEV_PDN); - } -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index f5143eedbc48..a90801ef0055 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -272,6 +272,8 @@ static struct usb_serial_driver cp210x_device = { - .break_ctl = cp210x_break_ctl, - .set_termios = cp210x_set_termios, - .tx_empty = cp210x_tx_empty, -+ .throttle = usb_serial_generic_throttle, -+ .unthrottle = usb_serial_generic_unthrottle, - .tiocmget = cp210x_tiocmget, - .tiocmset = cp210x_tiocmset, - .attach = cp210x_attach, -@@ -915,6 +917,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, - u32 baud; - u16 bits; - u32 ctl_hs; -+ u32 flow_repl; - - cp210x_read_u32_reg(port, CP210X_GET_BAUDRATE, &baud); - -@@ -1015,6 +1018,22 @@ static void cp210x_get_termios_port(struct usb_serial_port *port, - ctl_hs = le32_to_cpu(flow_ctl.ulControlHandshake); - if (ctl_hs & CP210X_SERIAL_CTS_HANDSHAKE) { - dev_dbg(dev, "%s - flow control = CRTSCTS\n", __func__); -+ /* -+ * When the port is closed, the CP210x hardware disables -+ * auto-RTS and RTS is deasserted but it leaves auto-CTS when -+ * in hardware flow control mode. When re-opening the port, if -+ * auto-CTS is enabled on the cp210x, then auto-RTS must be -+ * re-enabled in the driver. -+ */ -+ flow_repl = le32_to_cpu(flow_ctl.ulFlowReplace); -+ flow_repl &= ~CP210X_SERIAL_RTS_MASK; -+ flow_repl |= CP210X_SERIAL_RTS_SHIFT(CP210X_SERIAL_RTS_FLOW_CTL); -+ flow_ctl.ulFlowReplace = cpu_to_le32(flow_repl); -+ cp210x_write_reg_block(port, -+ CP210X_SET_FLOW, -+ &flow_ctl, -+ sizeof(flow_ctl)); -+ - cflag |= CRTSCTS; - } else { - dev_dbg(dev, "%s - flow control = NONE\n", __func__); -diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c -index b8dfeb4fb2ed..ffbb2a8901b2 100644 ---- a/drivers/usb/serial/iuu_phoenix.c -+++ b/drivers/usb/serial/iuu_phoenix.c -@@ -353,10 +353,11 @@ static void iuu_led_activity_on(struct urb *urb) - struct usb_serial_port *port = urb->context; - int result; - char *buf_ptr = port->write_urb->transfer_buffer; -- *buf_ptr++ = IUU_SET_LED; -+ - if (xmas) { -- get_random_bytes(buf_ptr, 6); -- *(buf_ptr+7) = 1; -+ buf_ptr[0] = IUU_SET_LED; -+ get_random_bytes(buf_ptr + 1, 6); -+ buf_ptr[7] = 1; - } else { - iuu_rgbf_fill_buffer(buf_ptr, 255, 255, 0, 0, 0, 0, 255); - } -@@ -374,13 +375,14 @@ static void iuu_led_activity_off(struct urb *urb) - struct usb_serial_port *port = urb->context; - int result; - char *buf_ptr = port->write_urb->transfer_buffer; -+ - if (xmas) { - iuu_rxcmd(urb); - return; -- } else { -- *buf_ptr++ = IUU_SET_LED; -- iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); - } -+ -+ iuu_rgbf_fill_buffer(buf_ptr, 0, 0, 255, 255, 0, 0, 255); -+ - usb_fill_bulk_urb(port->write_urb, port->serial->dev, - usb_sndbulkpipe(port->serial->dev, - port->bulk_out_endpointAddress), -diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c -index 00dddf6e08b0..2d2ee17052e8 100644 ---- a/drivers/video/console/newport_con.c -+++ b/drivers/video/console/newport_con.c -@@ -32,6 +32,8 @@ - #include - #include - -+#define NEWPORT_LEN 0x10000 -+ - #define FONT_DATA ((unsigned char *)font_vga_8x16.data) - - /* borrowed from fbcon.c */ -@@ -43,6 +45,7 @@ - static unsigned char *font_data[MAX_NR_CONSOLES]; - - static struct newport_regs *npregs; -+static unsigned long newport_addr; - - static int logo_active; - static int topscan; -@@ -702,7 +705,6 @@ const struct consw newport_con = { - static int newport_probe(struct gio_device *dev, - const struct gio_device_id *id) - { -- unsigned long newport_addr; - int err; - - if (!dev->resource.start) -@@ -712,7 +714,7 @@ static int newport_probe(struct gio_device *dev, - return -EBUSY; /* we only support one Newport as console */ - - newport_addr = dev->resource.start + 0xF0000; -- if (!request_mem_region(newport_addr, 0x10000, "Newport")) -+ if (!request_mem_region(newport_addr, NEWPORT_LEN, "Newport")) - return -ENODEV; - - npregs = (struct newport_regs *)/* ioremap cannot fail */ -@@ -720,6 +722,11 @@ static int newport_probe(struct gio_device *dev, - console_lock(); - err = do_take_over_console(&newport_con, 0, MAX_NR_CONSOLES - 1, 1); - console_unlock(); -+ -+ if (err) { -+ iounmap((void *)npregs); -+ release_mem_region(newport_addr, NEWPORT_LEN); -+ } - return err; - } - -@@ -727,6 +734,7 @@ static void newport_remove(struct gio_device *dev) - { - give_up_console(&newport_con); - iounmap((void *)npregs); -+ release_mem_region(newport_addr, NEWPORT_LEN); - } - - static struct gio_device_id newport_ids[] = { -diff --git a/drivers/video/fbdev/neofb.c b/drivers/video/fbdev/neofb.c -index b770946a0920..76464000933d 100644 ---- a/drivers/video/fbdev/neofb.c -+++ b/drivers/video/fbdev/neofb.c -@@ -1820,6 +1820,7 @@ static int neo_scan_monitor(struct fb_info *info) - #else - printk(KERN_ERR - "neofb: Only 640x480, 800x600/480 and 1024x768 panels are currently supported\n"); -+ kfree(info->monspecs.modedb); - return -1; - #endif - default: -diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c -index f70c9f79622e..27635926cea3 100644 ---- a/drivers/video/fbdev/pxafb.c -+++ b/drivers/video/fbdev/pxafb.c -@@ -2425,8 +2425,8 @@ static int pxafb_remove(struct platform_device *dev) - - free_pages_exact(fbi->video_mem, fbi->video_mem_size); - -- dma_free_wc(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, -- fbi->dma_buff_phys); -+ dma_free_coherent(&dev->dev, fbi->dma_buff_size, fbi->dma_buff, -+ fbi->dma_buff_phys); - - return 0; - } -diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c -index 512789f5f884..d5d22d9c0f56 100644 ---- a/drivers/video/fbdev/savage/savagefb_driver.c -+++ b/drivers/video/fbdev/savage/savagefb_driver.c -@@ -2158,6 +2158,8 @@ static int savage_init_fb_info(struct fb_info *info, struct pci_dev *dev, - info->flags |= FBINFO_HWACCEL_COPYAREA | - FBINFO_HWACCEL_FILLRECT | - FBINFO_HWACCEL_IMAGEBLIT; -+ else -+ kfree(info->pixmap.addr); - } - #endif - return err; -diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c -index 207d0add684b..246681414577 100644 ---- a/drivers/video/fbdev/sm712fb.c -+++ b/drivers/video/fbdev/sm712fb.c -@@ -1429,6 +1429,8 @@ static int smtc_map_smem(struct smtcfb_info *sfb, - static void smtc_unmap_smem(struct smtcfb_info *sfb) - { - if (sfb && sfb->fb->screen_base) { -+ if (sfb->chip_id == 0x720) -+ sfb->fb->screen_base -= 0x00200000; - iounmap(sfb->fb->screen_base); - sfb->fb->screen_base = NULL; - } -diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c -index bed90d612e48..ebb05517b6aa 100644 ---- a/drivers/xen/balloon.c -+++ b/drivers/xen/balloon.c -@@ -570,11 +570,13 @@ static int add_ballooned_pages(int nr_pages) - if (xen_hotplug_unpopulated) { - st = reserve_additional_memory(); - if (st != BP_ECANCELED) { -+ int rc; -+ - mutex_unlock(&balloon_mutex); -- wait_event(balloon_wq, -+ rc = wait_event_interruptible(balloon_wq, - !list_empty(&ballooned_pages)); - mutex_lock(&balloon_mutex); -- return 0; -+ return rc ? -ENOMEM : 0; - } - } - -@@ -632,6 +634,12 @@ int alloc_xenballooned_pages(int nr_pages, struct page **pages) - out_undo: - mutex_unlock(&balloon_mutex); - free_xenballooned_pages(pgno, pages); -+ /* -+ * NB: free_xenballooned_pages will only subtract pgno pages, but since -+ * target_unpopulated is incremented with nr_pages at the start we need -+ * to remove the remaining ones also, or accounting will be screwed. -+ */ -+ balloon_stats.target_unpopulated -= nr_pages - pgno; - return ret; - } - EXPORT_SYMBOL(alloc_xenballooned_pages); -diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c -index 2c4f324f8626..da799929087d 100644 ---- a/drivers/xen/gntdev-dmabuf.c -+++ b/drivers/xen/gntdev-dmabuf.c -@@ -641,6 +641,14 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, - goto fail_detach; - } - -+ /* Check that we have zero offset. */ -+ if (sgt->sgl->offset) { -+ ret = ERR_PTR(-EINVAL); -+ pr_debug("DMA buffer has %d bytes offset, user-space expects 0\n", -+ sgt->sgl->offset); -+ goto fail_unmap; -+ } -+ - /* Check number of pages that imported buffer has. */ - if (attach->dmabuf->size != gntdev_dmabuf->nr_pages << PAGE_SHIFT) { - ret = ERR_PTR(-EINVAL); -diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c -index 15a99f9c7253..39def020a074 100644 ---- a/fs/9p/v9fs.c -+++ b/fs/9p/v9fs.c -@@ -500,10 +500,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses) - } - - #ifdef CONFIG_9P_FSCACHE -- if (v9ses->fscache) { -+ if (v9ses->fscache) - v9fs_cache_session_put_cookie(v9ses); -- kfree(v9ses->cachetag); -- } -+ kfree(v9ses->cachetag); - #endif - kfree(v9ses->uname); - kfree(v9ses->aname); -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 1a089a642422..99dcb3897659 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4481,6 +4481,8 @@ int try_release_extent_mapping(struct page *page, gfp_t mask) - - /* once for us */ - free_extent_map(em); -+ -+ cond_resched(); /* Allow large-extent preemption. */ - } - } - return try_release_extent_state(tree, page, mask); -diff --git a/fs/btrfs/space-info.c b/fs/btrfs/space-info.c -index 7889a59a57fa..6f484f0d347e 100644 ---- a/fs/btrfs/space-info.c -+++ b/fs/btrfs/space-info.c -@@ -304,8 +304,8 @@ again: - cache->key.objectid, cache->key.offset, - btrfs_block_group_used(&cache->item), cache->pinned, - cache->reserved, cache->ro ? "[readonly]" : ""); -- btrfs_dump_free_space(cache, bytes); - spin_unlock(&cache->lock); -+ btrfs_dump_free_space(cache, bytes); - } - if (++index < BTRFS_NR_RAID_TYPES) - goto again; -diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c -index afb8340918b8..c689359ca532 100644 ---- a/fs/dlm/lockspace.c -+++ b/fs/dlm/lockspace.c -@@ -632,6 +632,9 @@ static int new_lockspace(const char *name, const char *cluster, - wait_event(ls->ls_recover_lock_wait, - test_bit(LSFL_RECOVER_LOCK, &ls->ls_flags)); - -+ /* let kobject handle freeing of ls if there's an error */ -+ do_unreg = 1; -+ - ls->ls_kobj.kset = dlm_kset; - error = kobject_init_and_add(&ls->ls_kobj, &dlm_ktype, NULL, - "%s", ls->ls_name); -@@ -639,9 +642,6 @@ static int new_lockspace(const char *name, const char *cluster, - goto out_recoverd; - kobject_uevent(&ls->ls_kobj, KOBJ_ADD); - -- /* let kobject handle freeing of ls if there's an error */ -- do_unreg = 1; -- - /* This uevent triggers dlm_controld in userspace to add us to the - group of nodes that are members of this lockspace (managed by the - cluster infrastructure.) Once it's done that, it tells us who the -diff --git a/fs/erofs/inode.c b/fs/erofs/inode.c -index 3350ab65d892..b36b414cd7a7 100644 ---- a/fs/erofs/inode.c -+++ b/fs/erofs/inode.c -@@ -8,31 +8,80 @@ - - #include - --/* no locking */ --static int erofs_read_inode(struct inode *inode, void *data) -+/* -+ * if inode is successfully read, return its inode page (or sometimes -+ * the inode payload page if it's an extended inode) in order to fill -+ * inline data if possible. -+ */ -+static struct page *erofs_read_inode(struct inode *inode, -+ unsigned int *ofs) - { -+ struct super_block *sb = inode->i_sb; -+ struct erofs_sb_info *sbi = EROFS_SB(sb); - struct erofs_inode *vi = EROFS_I(inode); -- struct erofs_inode_compact *dic = data; -- struct erofs_inode_extended *die; -+ const erofs_off_t inode_loc = iloc(sbi, vi->nid); -+ -+ erofs_blk_t blkaddr, nblks = 0; -+ struct page *page; -+ struct erofs_inode_compact *dic; -+ struct erofs_inode_extended *die, *copied = NULL; -+ unsigned int ifmt; -+ int err; - -- const unsigned int ifmt = le16_to_cpu(dic->i_format); -- struct erofs_sb_info *sbi = EROFS_SB(inode->i_sb); -- erofs_blk_t nblks = 0; -+ blkaddr = erofs_blknr(inode_loc); -+ *ofs = erofs_blkoff(inode_loc); - -- vi->datalayout = erofs_inode_datalayout(ifmt); -+ erofs_dbg("%s, reading inode nid %llu at %u of blkaddr %u", -+ __func__, vi->nid, *ofs, blkaddr); -+ -+ page = erofs_get_meta_page(sb, blkaddr); -+ if (IS_ERR(page)) { -+ erofs_err(sb, "failed to get inode (nid: %llu) page, err %ld", -+ vi->nid, PTR_ERR(page)); -+ return page; -+ } - -+ dic = page_address(page) + *ofs; -+ ifmt = le16_to_cpu(dic->i_format); -+ -+ vi->datalayout = erofs_inode_datalayout(ifmt); - if (vi->datalayout >= EROFS_INODE_DATALAYOUT_MAX) { - erofs_err(inode->i_sb, "unsupported datalayout %u of nid %llu", - vi->datalayout, vi->nid); -- DBG_BUGON(1); -- return -EOPNOTSUPP; -+ err = -EOPNOTSUPP; -+ goto err_out; - } - - switch (erofs_inode_version(ifmt)) { - case EROFS_INODE_LAYOUT_EXTENDED: -- die = data; -- - vi->inode_isize = sizeof(struct erofs_inode_extended); -+ /* check if the inode acrosses page boundary */ -+ if (*ofs + vi->inode_isize <= PAGE_SIZE) { -+ *ofs += vi->inode_isize; -+ die = (struct erofs_inode_extended *)dic; -+ } else { -+ const unsigned int gotten = PAGE_SIZE - *ofs; -+ -+ copied = kmalloc(vi->inode_isize, GFP_NOFS); -+ if (!copied) { -+ err = -ENOMEM; -+ goto err_out; -+ } -+ memcpy(copied, dic, gotten); -+ unlock_page(page); -+ put_page(page); -+ -+ page = erofs_get_meta_page(sb, blkaddr + 1); -+ if (IS_ERR(page)) { -+ erofs_err(sb, "failed to get inode payload page (nid: %llu), err %ld", -+ vi->nid, PTR_ERR(page)); -+ kfree(copied); -+ return page; -+ } -+ *ofs = vi->inode_isize - gotten; -+ memcpy((u8 *)copied + gotten, page_address(page), *ofs); -+ die = copied; -+ } - vi->xattr_isize = erofs_xattr_ibody_size(die->i_xattr_icount); - - inode->i_mode = le16_to_cpu(die->i_mode); -@@ -69,9 +118,12 @@ static int erofs_read_inode(struct inode *inode, void *data) - /* total blocks for compressed files */ - if (erofs_inode_is_data_compressed(vi->datalayout)) - nblks = le32_to_cpu(die->i_u.compressed_blocks); -+ -+ kfree(copied); - break; - case EROFS_INODE_LAYOUT_COMPACT: - vi->inode_isize = sizeof(struct erofs_inode_compact); -+ *ofs += vi->inode_isize; - vi->xattr_isize = erofs_xattr_ibody_size(dic->i_xattr_icount); - - inode->i_mode = le16_to_cpu(dic->i_mode); -@@ -111,8 +163,8 @@ static int erofs_read_inode(struct inode *inode, void *data) - erofs_err(inode->i_sb, - "unsupported on-disk inode version %u of nid %llu", - erofs_inode_version(ifmt), vi->nid); -- DBG_BUGON(1); -- return -EOPNOTSUPP; -+ err = -EOPNOTSUPP; -+ goto err_out; - } - - if (!nblks) -@@ -120,13 +172,18 @@ static int erofs_read_inode(struct inode *inode, void *data) - inode->i_blocks = roundup(inode->i_size, EROFS_BLKSIZ) >> 9; - else - inode->i_blocks = nblks << LOG_SECTORS_PER_BLOCK; -- return 0; -+ return page; - - bogusimode: - erofs_err(inode->i_sb, "bogus i_mode (%o) @ nid %llu", - inode->i_mode, vi->nid); -+ err = -EFSCORRUPTED; -+err_out: - DBG_BUGON(1); -- return -EFSCORRUPTED; -+ kfree(copied); -+ unlock_page(page); -+ put_page(page); -+ return ERR_PTR(err); - } - - static int erofs_fill_symlink(struct inode *inode, void *data, -@@ -146,7 +203,7 @@ static int erofs_fill_symlink(struct inode *inode, void *data, - if (!lnk) - return -ENOMEM; - -- m_pofs += vi->inode_isize + vi->xattr_isize; -+ m_pofs += vi->xattr_isize; - /* inline symlink data shouldn't cross page boundary as well */ - if (m_pofs + inode->i_size > PAGE_SIZE) { - kfree(lnk); -@@ -167,37 +224,17 @@ static int erofs_fill_symlink(struct inode *inode, void *data, - - static int erofs_fill_inode(struct inode *inode, int isdir) - { -- struct super_block *sb = inode->i_sb; - struct erofs_inode *vi = EROFS_I(inode); - struct page *page; -- void *data; -- int err; -- erofs_blk_t blkaddr; - unsigned int ofs; -- erofs_off_t inode_loc; -+ int err = 0; - - trace_erofs_fill_inode(inode, isdir); -- inode_loc = iloc(EROFS_SB(sb), vi->nid); -- blkaddr = erofs_blknr(inode_loc); -- ofs = erofs_blkoff(inode_loc); -- -- erofs_dbg("%s, reading inode nid %llu at %u of blkaddr %u", -- __func__, vi->nid, ofs, blkaddr); - -- page = erofs_get_meta_page(sb, blkaddr); -- -- if (IS_ERR(page)) { -- erofs_err(sb, "failed to get inode (nid: %llu) page, err %ld", -- vi->nid, PTR_ERR(page)); -+ /* read inode base data from disk */ -+ page = erofs_read_inode(inode, &ofs); -+ if (IS_ERR(page)) - return PTR_ERR(page); -- } -- -- DBG_BUGON(!PageUptodate(page)); -- data = page_address(page); -- -- err = erofs_read_inode(inode, data + ofs); -- if (err) -- goto out_unlock; - - /* setup the new inode */ - switch (inode->i_mode & S_IFMT) { -@@ -210,7 +247,7 @@ static int erofs_fill_inode(struct inode *inode, int isdir) - inode->i_fop = &erofs_dir_fops; - break; - case S_IFLNK: -- err = erofs_fill_symlink(inode, data, ofs); -+ err = erofs_fill_symlink(inode, page_address(page), ofs); - if (err) - goto out_unlock; - inode_nohighmem(inode); -diff --git a/fs/io_uring.c b/fs/io_uring.c -index be3d595a607f..fada14ee1cdc 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -1433,8 +1433,10 @@ static int io_read(struct io_kiocb *req, const struct sqe_submit *s, - - if (file->f_op->read_iter) - ret2 = call_read_iter(file, kiocb, &iter); -- else -+ else if (req->file->f_op->read) - ret2 = loop_rw_iter(READ, file, kiocb, &iter); -+ else -+ ret2 = -EINVAL; - - /* - * In case of a short read, punt to async. This can happen -@@ -1524,8 +1526,10 @@ static int io_write(struct io_kiocb *req, const struct sqe_submit *s, - - if (file->f_op->write_iter) - ret2 = call_write_iter(file, kiocb, &iter); -- else -+ else if (req->file->f_op->write) - ret2 = loop_rw_iter(WRITE, file, kiocb, &iter); -+ else -+ ret2 = -EINVAL; - - if (!force_nonblock) - current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY; -@@ -2559,6 +2563,7 @@ static void io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s, - goto err; - } - -+ memcpy(&req->submit, s, sizeof(*s)); - ret = io_req_set_file(ctx, s, state, req); - if (unlikely(ret)) { - err_req: -@@ -3390,6 +3395,9 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries, - return SIZE_MAX; - #endif - -+ if (sq_offset) -+ *sq_offset = off; -+ - sq_array_size = array_size(sizeof(u32), sq_entries); - if (sq_array_size == SIZE_MAX) - return SIZE_MAX; -@@ -3397,9 +3405,6 @@ static unsigned long rings_size(unsigned sq_entries, unsigned cq_entries, - if (check_add_overflow(off, sq_array_size, &off)) - return SIZE_MAX; - -- if (sq_offset) -- *sq_offset = off; -- - return off; - } - -@@ -3856,6 +3861,10 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, - struct io_rings *rings; - size_t size, sq_array_offset; - -+ /* make sure these are sane, as we already accounted them */ -+ ctx->sq_entries = p->sq_entries; -+ ctx->cq_entries = p->cq_entries; -+ - size = rings_size(p->sq_entries, p->cq_entries, &sq_array_offset); - if (size == SIZE_MAX) - return -EOVERFLOW; -@@ -3872,8 +3881,6 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx, - rings->cq_ring_entries = p->cq_entries; - ctx->sq_mask = rings->sq_ring_mask; - ctx->cq_mask = rings->cq_ring_mask; -- ctx->sq_entries = rings->sq_ring_entries; -- ctx->cq_entries = rings->cq_ring_entries; - - size = array_size(sizeof(struct io_uring_sqe), p->sq_entries); - if (size == SIZE_MAX) { -diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c -index e8c792b49616..c35bbaa19486 100644 ---- a/fs/kernfs/file.c -+++ b/fs/kernfs/file.c -@@ -912,7 +912,7 @@ repeat: - } - - fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE, -- &name, 0); -+ NULL, 0); - iput(inode); - } - -diff --git a/fs/minix/inode.c b/fs/minix/inode.c -index 7cb5fd38eb14..0dd929346f3f 100644 ---- a/fs/minix/inode.c -+++ b/fs/minix/inode.c -@@ -150,6 +150,23 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) - return 0; - } - -+static bool minix_check_superblock(struct minix_sb_info *sbi) -+{ -+ if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) -+ return false; -+ -+ /* -+ * s_max_size must not exceed the block mapping limitation. This check -+ * is only needed for V1 filesystems, since V2/V3 support an extra level -+ * of indirect blocks which places the limit well above U32_MAX. -+ */ -+ if (sbi->s_version == MINIX_V1 && -+ sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) -+ return false; -+ -+ return true; -+} -+ - static int minix_fill_super(struct super_block *s, void *data, int silent) - { - struct buffer_head *bh; -@@ -228,11 +245,12 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) - } else - goto out_no_fs; - -+ if (!minix_check_superblock(sbi)) -+ goto out_illegal_sb; -+ - /* - * Allocate the buffer map to keep the superblock small. - */ -- if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) -- goto out_illegal_sb; - i = (sbi->s_imap_blocks + sbi->s_zmap_blocks) * sizeof(bh); - map = kzalloc(i, GFP_KERNEL); - if (!map) -@@ -468,6 +486,13 @@ static struct inode *V1_minix_iget(struct inode *inode) - iget_failed(inode); - return ERR_PTR(-EIO); - } -+ if (raw_inode->i_nlinks == 0) { -+ printk("MINIX-fs: deleted inode referenced: %lu\n", -+ inode->i_ino); -+ brelse(bh); -+ iget_failed(inode); -+ return ERR_PTR(-ESTALE); -+ } - inode->i_mode = raw_inode->i_mode; - i_uid_write(inode, raw_inode->i_uid); - i_gid_write(inode, raw_inode->i_gid); -@@ -501,6 +526,13 @@ static struct inode *V2_minix_iget(struct inode *inode) - iget_failed(inode); - return ERR_PTR(-EIO); - } -+ if (raw_inode->i_nlinks == 0) { -+ printk("MINIX-fs: deleted inode referenced: %lu\n", -+ inode->i_ino); -+ brelse(bh); -+ iget_failed(inode); -+ return ERR_PTR(-ESTALE); -+ } - inode->i_mode = raw_inode->i_mode; - i_uid_write(inode, raw_inode->i_uid); - i_gid_write(inode, raw_inode->i_gid); -diff --git a/fs/minix/itree_common.c b/fs/minix/itree_common.c -index 043c3fdbc8e7..446148792f41 100644 ---- a/fs/minix/itree_common.c -+++ b/fs/minix/itree_common.c -@@ -75,6 +75,7 @@ static int alloc_branch(struct inode *inode, - int n = 0; - int i; - int parent = minix_new_block(inode); -+ int err = -ENOSPC; - - branch[0].key = cpu_to_block(parent); - if (parent) for (n = 1; n < num; n++) { -@@ -85,6 +86,11 @@ static int alloc_branch(struct inode *inode, - break; - branch[n].key = cpu_to_block(nr); - bh = sb_getblk(inode->i_sb, parent); -+ if (!bh) { -+ minix_free_block(inode, nr); -+ err = -ENOMEM; -+ break; -+ } - lock_buffer(bh); - memset(bh->b_data, 0, bh->b_size); - branch[n].bh = bh; -@@ -103,7 +109,7 @@ static int alloc_branch(struct inode *inode, - bforget(branch[i].bh); - for (i = 0; i < n; i++) - minix_free_block(inode, block_to_cpu(branch[i].key)); -- return -ENOSPC; -+ return err; - } - - static inline int splice_branch(struct inode *inode, -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 443639cbb0cf..9c2b07ce57b2 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1198,31 +1198,27 @@ out: - return status; - } - -+static bool -+pnfs_layout_segments_returnable(struct pnfs_layout_hdr *lo, -+ enum pnfs_iomode iomode, -+ u32 seq) -+{ -+ struct pnfs_layout_range recall_range = { -+ .length = NFS4_MAX_UINT64, -+ .iomode = iomode, -+ }; -+ return pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, -+ &recall_range, seq) != -EBUSY; -+} -+ - /* Return true if layoutreturn is needed */ - static bool - pnfs_layout_need_return(struct pnfs_layout_hdr *lo) - { -- struct pnfs_layout_segment *s; -- enum pnfs_iomode iomode; -- u32 seq; -- - if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) - return false; -- -- seq = lo->plh_return_seq; -- iomode = lo->plh_return_iomode; -- -- /* Defer layoutreturn until all recalled lsegs are done */ -- list_for_each_entry(s, &lo->plh_segs, pls_list) { -- if (seq && pnfs_seqid_is_newer(s->pls_seq, seq)) -- continue; -- if (iomode != IOMODE_ANY && s->pls_range.iomode != iomode) -- continue; -- if (test_bit(NFS_LSEG_LAYOUTRETURN, &s->pls_flags)) -- return false; -- } -- -- return true; -+ return pnfs_layout_segments_returnable(lo, lo->plh_return_iomode, -+ lo->plh_return_seq); - } - - static void pnfs_layoutreturn_before_put_layout_hdr(struct pnfs_layout_hdr *lo) -@@ -2362,16 +2358,6 @@ out_forget: - return ERR_PTR(-EAGAIN); - } - --static int --mark_lseg_invalid_or_return(struct pnfs_layout_segment *lseg, -- struct list_head *tmp_list) --{ -- if (!mark_lseg_invalid(lseg, tmp_list)) -- return 0; -- pnfs_cache_lseg_for_layoutreturn(lseg->pls_layout, lseg); -- return 1; --} -- - /** - * pnfs_mark_matching_lsegs_return - Free or return matching layout segments - * @lo: pointer to layout header -@@ -2408,7 +2394,7 @@ pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, - lseg, lseg->pls_range.iomode, - lseg->pls_range.offset, - lseg->pls_range.length); -- if (mark_lseg_invalid_or_return(lseg, tmp_list)) -+ if (mark_lseg_invalid(lseg, tmp_list)) - continue; - remaining++; - set_bit(NFS_LSEG_LAYOUTRETURN, &lseg->pls_flags); -diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c -index e2c34c704185..50a863fc1779 100644 ---- a/fs/ocfs2/dlmglue.c -+++ b/fs/ocfs2/dlmglue.c -@@ -2871,9 +2871,15 @@ int ocfs2_nfs_sync_lock(struct ocfs2_super *osb, int ex) - - status = ocfs2_cluster_lock(osb, lockres, ex ? LKM_EXMODE : LKM_PRMODE, - 0, 0); -- if (status < 0) -+ if (status < 0) { - mlog(ML_ERROR, "lock on nfs sync lock failed %d\n", status); - -+ if (ex) -+ up_write(&osb->nfs_sync_rwlock); -+ else -+ up_read(&osb->nfs_sync_rwlock); -+ } -+ - return status; - } - -diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c -index cdf5b8ae2583..74a60bae2b23 100644 ---- a/fs/pstore/platform.c -+++ b/fs/pstore/platform.c -@@ -275,6 +275,9 @@ static int pstore_compress(const void *in, void *out, - { - int ret; - -+ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION)) -+ return -EINVAL; -+ - ret = crypto_comp_compress(tfm, in, inlen, out, &outlen); - if (ret) { - pr_err("crypto_comp_compress failed, ret = %d!\n", ret); -@@ -661,7 +664,7 @@ static void decompress_record(struct pstore_record *record) - int unzipped_len; - char *unzipped, *workspace; - -- if (!record->compressed) -+ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed) - return; - - /* Only PSTORE_TYPE_DMESG support compression. */ -diff --git a/fs/xfs/libxfs/xfs_trans_space.h b/fs/xfs/libxfs/xfs_trans_space.h -index 88221c7a04cc..c6df01a2a158 100644 ---- a/fs/xfs/libxfs/xfs_trans_space.h -+++ b/fs/xfs/libxfs/xfs_trans_space.h -@@ -57,7 +57,7 @@ - XFS_DAREMOVE_SPACE_RES(mp, XFS_DATA_FORK) - #define XFS_IALLOC_SPACE_RES(mp) \ - (M_IGEO(mp)->ialloc_blks + \ -- (xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1 * \ -+ ((xfs_sb_version_hasfinobt(&mp->m_sb) ? 2 : 1) * \ - (M_IGEO(mp)->inobt_maxlevels - 1))) - - /* -diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c -index fa6ea6407992..392fb4df5c12 100644 ---- a/fs/xfs/scrub/bmap.c -+++ b/fs/xfs/scrub/bmap.c -@@ -45,9 +45,27 @@ xchk_setup_inode_bmap( - */ - if (S_ISREG(VFS_I(sc->ip)->i_mode) && - sc->sm->sm_type == XFS_SCRUB_TYPE_BMBTD) { -+ struct address_space *mapping = VFS_I(sc->ip)->i_mapping; -+ - inode_dio_wait(VFS_I(sc->ip)); -- error = filemap_write_and_wait(VFS_I(sc->ip)->i_mapping); -- if (error) -+ -+ /* -+ * Try to flush all incore state to disk before we examine the -+ * space mappings for the data fork. Leave accumulated errors -+ * in the mapping for the writer threads to consume. -+ * -+ * On ENOSPC or EIO writeback errors, we continue into the -+ * extent mapping checks because write failures do not -+ * necessarily imply anything about the correctness of the file -+ * metadata. The metadata and the file data could be on -+ * completely separate devices; a media failure might only -+ * affect a subset of the disk, etc. We can handle delalloc -+ * extents in the scrubber, so leaving them in memory is fine. -+ */ -+ error = filemap_fdatawrite(mapping); -+ if (!error) -+ error = filemap_fdatawait_keep_errors(mapping); -+ if (error && (error != -ENOSPC && error != -EIO)) - goto out; - } - -diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c -index 6a4fd1738b08..904d8285c226 100644 ---- a/fs/xfs/xfs_reflink.c -+++ b/fs/xfs/xfs_reflink.c -@@ -1005,6 +1005,7 @@ xfs_reflink_remap_extent( - xfs_filblks_t rlen; - xfs_filblks_t unmap_len; - xfs_off_t newlen; -+ int64_t qres; - int error; - - unmap_len = irec->br_startoff + irec->br_blockcount - destoff; -@@ -1027,13 +1028,19 @@ xfs_reflink_remap_extent( - xfs_ilock(ip, XFS_ILOCK_EXCL); - xfs_trans_ijoin(tp, ip, 0); - -- /* If we're not just clearing space, then do we have enough quota? */ -- if (real_extent) { -- error = xfs_trans_reserve_quota_nblks(tp, ip, -- irec->br_blockcount, 0, XFS_QMOPT_RES_REGBLKS); -- if (error) -- goto out_cancel; -- } -+ /* -+ * Reserve quota for this operation. We don't know if the first unmap -+ * in the dest file will cause a bmap btree split, so we always reserve -+ * at least enough blocks for that split. If the extent being mapped -+ * in is written, we need to reserve quota for that too. -+ */ -+ qres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK); -+ if (real_extent) -+ qres += irec->br_blockcount; -+ error = xfs_trans_reserve_quota_nblks(tp, ip, qres, 0, -+ XFS_QMOPT_RES_REGBLKS); -+ if (error) -+ goto out_cancel; - - trace_xfs_reflink_remap(ip, irec->br_startoff, - irec->br_blockcount, irec->br_startblock); -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index d7616d08e863..f050039ca2c0 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -340,6 +340,7 @@ - */ - #ifndef RO_AFTER_INIT_DATA - #define RO_AFTER_INIT_DATA \ -+ . = ALIGN(8); \ - __start_ro_after_init = .; \ - *(.data..ro_after_init) \ - JUMP_TABLE_DATA \ -diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h -index 4bbb5f1c8b5b..4c0224ff0a14 100644 ---- a/include/linux/bitfield.h -+++ b/include/linux/bitfield.h -@@ -64,7 +64,7 @@ - */ - #define FIELD_FIT(_mask, _val) \ - ({ \ -- __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: "); \ -+ __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: "); \ - !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \ - }) - -diff --git a/include/linux/tpm.h b/include/linux/tpm.h -index 53c0ea9ec9df..77fdc988c610 100644 ---- a/include/linux/tpm.h -+++ b/include/linux/tpm.h -@@ -93,6 +93,7 @@ struct tpm_space { - u8 *context_buf; - u32 session_tbl[3]; - u8 *session_buf; -+ u32 buf_size; - }; - - struct tpm_bios_log { -diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h -index eccfd3a4e4c8..f3caeeb7a0d0 100644 ---- a/include/linux/tpm_eventlog.h -+++ b/include/linux/tpm_eventlog.h -@@ -211,9 +211,16 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, - - efispecid = (struct tcg_efi_specid_event_head *)event_header->event; - -- /* Check if event is malformed. */ -+ /* -+ * Perform validation of the event in order to identify malformed -+ * events. This function may be asked to parse arbitrary byte sequences -+ * immediately following a valid event log. The caller expects this -+ * function to recognize that the byte sequence is not a valid event -+ * and to return an event size of 0. -+ */ - if (memcmp(efispecid->signature, TCG_SPECID_SIG, -- sizeof(TCG_SPECID_SIG)) || count > efispecid->num_algs) { -+ sizeof(TCG_SPECID_SIG)) || -+ !efispecid->num_algs || count != efispecid->num_algs) { - size = 0; - goto out; - } -diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h -index 1fb11daa5c53..57ce5af258a3 100644 ---- a/include/linux/tracepoint.h -+++ b/include/linux/tracepoint.h -@@ -362,7 +362,7 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p) - static const char *___tp_str __tracepoint_string = str; \ - ___tp_str; \ - }) --#define __tracepoint_string __attribute__((section("__tracepoint_str"))) -+#define __tracepoint_string __attribute__((section("__tracepoint_str"), used)) - #else - /* - * tracepoint_string() is used to save the string address for userspace -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index 895546058a20..c71eb294da95 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -309,6 +309,10 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname, - int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname, - char __user *optval, unsigned int optlen); - -+/* update the fast reuse flag when adding a socket */ -+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, -+ struct sock *sk); -+ - struct dst_entry *inet_csk_update_pmtu(struct sock *sk, u32 mtu); - - #define TCP_PINGPONG_THRESH 3 -diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h -index 078887c8c586..7c37e3c3b1c7 100644 ---- a/include/net/ip_vs.h -+++ b/include/net/ip_vs.h -@@ -1624,18 +1624,16 @@ static inline void ip_vs_conn_drop_conntrack(struct ip_vs_conn *cp) - } - #endif /* CONFIG_IP_VS_NFCT */ - --/* Really using conntrack? */ --static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, -- struct sk_buff *skb) -+/* Using old conntrack that can not be redirected to another real server? */ -+static inline bool ip_vs_conn_uses_old_conntrack(struct ip_vs_conn *cp, -+ struct sk_buff *skb) - { - #ifdef CONFIG_IP_VS_NFCT - enum ip_conntrack_info ctinfo; - struct nf_conn *ct; - -- if (!(cp->flags & IP_VS_CONN_F_NFCT)) -- return false; - ct = nf_ct_get(skb, &ctinfo); -- if (ct) -+ if (ct && nf_ct_is_confirmed(ct)) - return true; - #endif - return false; -diff --git a/include/net/tcp.h b/include/net/tcp.h -index 7cf1b4972c66..377179283c46 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1650,6 +1650,8 @@ void tcp_fastopen_destroy_cipher(struct sock *sk); - void tcp_fastopen_ctx_destroy(struct net *net); - int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk, - void *primary_key, void *backup_key); -+int tcp_fastopen_get_cipher(struct net *net, struct inet_connection_sock *icsk, -+ u64 *key); - void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb); - struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, - struct request_sock *req, -diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h -index 90734aa5aa36..b5f901af79f0 100644 ---- a/include/uapi/linux/seccomp.h -+++ b/include/uapi/linux/seccomp.h -@@ -93,5 +93,6 @@ struct seccomp_notif_resp { - #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) - #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ - struct seccomp_notif_resp) --#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64) -+#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) -+ - #endif /* _UAPI_LINUX_SECCOMP_H */ -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 38ae3cf9d173..b34b5c6e2524 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1238,6 +1238,20 @@ static void uclamp_fork(struct task_struct *p) - } - } - -+static void __init init_uclamp_rq(struct rq *rq) -+{ -+ enum uclamp_id clamp_id; -+ struct uclamp_rq *uc_rq = rq->uclamp; -+ -+ for_each_clamp_id(clamp_id) { -+ uc_rq[clamp_id] = (struct uclamp_rq) { -+ .value = uclamp_none(clamp_id) -+ }; -+ } -+ -+ rq->uclamp_flags = 0; -+} -+ - static void __init init_uclamp(void) - { - struct uclamp_se uc_max = {}; -@@ -1246,11 +1260,8 @@ static void __init init_uclamp(void) - - mutex_init(&uclamp_mutex); - -- for_each_possible_cpu(cpu) { -- memset(&cpu_rq(cpu)->uclamp, 0, -- sizeof(struct uclamp_rq)*UCLAMP_CNT); -- cpu_rq(cpu)->uclamp_flags = 0; -- } -+ for_each_possible_cpu(cpu) -+ init_uclamp_rq(cpu_rq(cpu)); - - for_each_clamp_id(clamp_id) { - uclamp_se_set(&init_task.uclamp_req[clamp_id], -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 9b16080093be..20bf1f66733a 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -9385,7 +9385,12 @@ static void kick_ilb(unsigned int flags) - { - int ilb_cpu; - -- nohz.next_balance++; -+ /* -+ * Increase nohz.next_balance only when if full ilb is triggered but -+ * not if we only update stats. -+ */ -+ if (flags & NOHZ_BALANCE_KICK) -+ nohz.next_balance = jiffies+1; - - ilb_cpu = find_new_ilb(); - -@@ -9703,6 +9708,14 @@ static bool _nohz_idle_balance(struct rq *this_rq, unsigned int flags, - } - } - -+ /* -+ * next_balance will be updated only when there is a need. -+ * When the CPU is attached to null domain for ex, it will not be -+ * updated. -+ */ -+ if (likely(update_next_balance)) -+ nohz.next_balance = next_balance; -+ - /* Newly idle CPU doesn't need an update */ - if (idle != CPU_NEWLY_IDLE) { - update_blocked_averages(this_cpu); -@@ -9723,14 +9736,6 @@ abort: - if (has_blocked_load) - WRITE_ONCE(nohz.has_blocked, 1); - -- /* -- * next_balance will be updated only when there is a need. -- * When the CPU is attached to null domain for ex, it will not be -- * updated. -- */ -- if (likely(update_next_balance)) -- nohz.next_balance = next_balance; -- - return ret; - } - -diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c -index 1fa1e13a5944..ffaa97a8d405 100644 ---- a/kernel/sched/topology.c -+++ b/kernel/sched/topology.c -@@ -1333,7 +1333,7 @@ sd_init(struct sched_domain_topology_level *tl, - sd_flags = (*tl->sd_flags)(); - if (WARN_ONCE(sd_flags & ~TOPOLOGY_SD_FLAGS, - "wrong sd_flags in topology description\n")) -- sd_flags &= ~TOPOLOGY_SD_FLAGS; -+ sd_flags &= TOPOLOGY_SD_FLAGS; - - /* Apply detected topology flags */ - sd_flags |= dflags; -diff --git a/kernel/seccomp.c b/kernel/seccomp.c -index 2c697ce7be21..e0fd97235653 100644 ---- a/kernel/seccomp.c -+++ b/kernel/seccomp.c -@@ -42,6 +42,14 @@ - #include - #include - -+/* -+ * When SECCOMP_IOCTL_NOTIF_ID_VALID was first introduced, it had the -+ * wrong direction flag in the ioctl number. This is the broken one, -+ * which the kernel needs to keep supporting until all userspaces stop -+ * using the wrong command number. -+ */ -+#define SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR SECCOMP_IOR(2, __u64) -+ - enum notify_state { - SECCOMP_NOTIFY_INIT, - SECCOMP_NOTIFY_SENT, -@@ -1168,6 +1176,7 @@ static long seccomp_notify_ioctl(struct file *file, unsigned int cmd, - return seccomp_notify_recv(filter, buf); - case SECCOMP_IOCTL_NOTIF_SEND: - return seccomp_notify_send(filter, buf); -+ case SECCOMP_IOCTL_NOTIF_ID_VALID_WRONG_DIR: - case SECCOMP_IOCTL_NOTIF_ID_VALID: - return seccomp_notify_id_valid(filter, buf); - default: -diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c -index eaee960153e1..a4c8f9d9522e 100644 ---- a/kernel/trace/blktrace.c -+++ b/kernel/trace/blktrace.c -@@ -521,10 +521,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, - if (!bt->msg_data) - goto err; - -- ret = -ENOENT; -- -- dir = debugfs_lookup(buts->name, blk_debugfs_root); -- if (!dir) -+#ifdef CONFIG_BLK_DEBUG_FS -+ /* -+ * When tracing whole make_request drivers (multiqueue) block devices, -+ * reuse the existing debugfs directory created by the block layer on -+ * init. For request-based block devices, all partitions block devices, -+ * and scsi-generic block devices we create a temporary new debugfs -+ * directory that will be removed once the trace ends. -+ */ -+ if (queue_is_mq(q) && bdev && bdev == bdev->bd_contains) -+ dir = q->debugfs_dir; -+ else -+#endif - bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); - - bt->dev = dev; -@@ -565,8 +573,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, - - ret = 0; - err: -- if (dir && !bt->dir) -- dput(dir); - if (ret) - blk_trace_free(bt); - return ret; -diff --git a/lib/crc-t10dif.c b/lib/crc-t10dif.c -index 8cc01a603416..c9acf1c12cfc 100644 ---- a/lib/crc-t10dif.c -+++ b/lib/crc-t10dif.c -@@ -19,39 +19,46 @@ - static struct crypto_shash __rcu *crct10dif_tfm; - static struct static_key crct10dif_fallback __read_mostly; - static DEFINE_MUTEX(crc_t10dif_mutex); -+static struct work_struct crct10dif_rehash_work; - --static int crc_t10dif_rehash(struct notifier_block *self, unsigned long val, void *data) -+static int crc_t10dif_notify(struct notifier_block *self, unsigned long val, void *data) - { - struct crypto_alg *alg = data; -- struct crypto_shash *new, *old; - - if (val != CRYPTO_MSG_ALG_LOADED || - static_key_false(&crct10dif_fallback) || - strncmp(alg->cra_name, CRC_T10DIF_STRING, strlen(CRC_T10DIF_STRING))) - return 0; - -+ schedule_work(&crct10dif_rehash_work); -+ return 0; -+} -+ -+static void crc_t10dif_rehash(struct work_struct *work) -+{ -+ struct crypto_shash *new, *old; -+ - mutex_lock(&crc_t10dif_mutex); - old = rcu_dereference_protected(crct10dif_tfm, - lockdep_is_held(&crc_t10dif_mutex)); - if (!old) { - mutex_unlock(&crc_t10dif_mutex); -- return 0; -+ return; - } - new = crypto_alloc_shash("crct10dif", 0, 0); - if (IS_ERR(new)) { - mutex_unlock(&crc_t10dif_mutex); -- return 0; -+ return; - } - rcu_assign_pointer(crct10dif_tfm, new); - mutex_unlock(&crc_t10dif_mutex); - - synchronize_rcu(); - crypto_free_shash(old); -- return 0; - } - - static struct notifier_block crc_t10dif_nb = { -- .notifier_call = crc_t10dif_rehash, -+ .notifier_call = crc_t10dif_notify, - }; - - __u16 crc_t10dif_update(__u16 crc, const unsigned char *buffer, size_t len) -@@ -86,19 +93,26 @@ EXPORT_SYMBOL(crc_t10dif); - - static int __init crc_t10dif_mod_init(void) - { -+ struct crypto_shash *tfm; -+ -+ INIT_WORK(&crct10dif_rehash_work, crc_t10dif_rehash); - crypto_register_notifier(&crc_t10dif_nb); -- crct10dif_tfm = crypto_alloc_shash("crct10dif", 0, 0); -- if (IS_ERR(crct10dif_tfm)) { -+ mutex_lock(&crc_t10dif_mutex); -+ tfm = crypto_alloc_shash("crct10dif", 0, 0); -+ if (IS_ERR(tfm)) { - static_key_slow_inc(&crct10dif_fallback); -- crct10dif_tfm = NULL; -+ tfm = NULL; - } -+ RCU_INIT_POINTER(crct10dif_tfm, tfm); -+ mutex_unlock(&crc_t10dif_mutex); - return 0; - } - - static void __exit crc_t10dif_mod_fini(void) - { - crypto_unregister_notifier(&crc_t10dif_nb); -- crypto_free_shash(crct10dif_tfm); -+ cancel_work_sync(&crct10dif_rehash_work); -+ crypto_free_shash(rcu_dereference_protected(crct10dif_tfm, 1)); - } - - module_init(crc_t10dif_mod_init); -@@ -106,11 +120,27 @@ module_exit(crc_t10dif_mod_fini); - - static int crc_t10dif_transform_show(char *buffer, const struct kernel_param *kp) - { -+ struct crypto_shash *tfm; -+ const char *name; -+ int len; -+ - if (static_key_false(&crct10dif_fallback)) - return sprintf(buffer, "fallback\n"); - -- return sprintf(buffer, "%s\n", -- crypto_tfm_alg_driver_name(crypto_shash_tfm(crct10dif_tfm))); -+ rcu_read_lock(); -+ tfm = rcu_dereference(crct10dif_tfm); -+ if (!tfm) { -+ len = sprintf(buffer, "init\n"); -+ goto unlock; -+ } -+ -+ name = crypto_tfm_alg_driver_name(crypto_shash_tfm(tfm)); -+ len = sprintf(buffer, "%s\n", name); -+ -+unlock: -+ rcu_read_unlock(); -+ -+ return len; - } - - module_param_call(transform, NULL, crc_t10dif_transform_show, NULL, 0644); -diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c -index c60409138e13..ccf05719b1ad 100644 ---- a/lib/dynamic_debug.c -+++ b/lib/dynamic_debug.c -@@ -87,22 +87,22 @@ static struct { unsigned flag:8; char opt_char; } opt_array[] = { - { _DPRINTK_FLAGS_NONE, '_' }, - }; - -+struct flagsbuf { char buf[ARRAY_SIZE(opt_array)+1]; }; -+ - /* format a string into buf[] which describes the _ddebug's flags */ --static char *ddebug_describe_flags(struct _ddebug *dp, char *buf, -- size_t maxlen) -+static char *ddebug_describe_flags(unsigned int flags, struct flagsbuf *fb) - { -- char *p = buf; -+ char *p = fb->buf; - int i; - -- BUG_ON(maxlen < 6); - for (i = 0; i < ARRAY_SIZE(opt_array); ++i) -- if (dp->flags & opt_array[i].flag) -+ if (flags & opt_array[i].flag) - *p++ = opt_array[i].opt_char; -- if (p == buf) -+ if (p == fb->buf) - *p++ = '_'; - *p = '\0'; - -- return buf; -+ return fb->buf; - } - - #define vpr_info(fmt, ...) \ -@@ -144,7 +144,7 @@ static int ddebug_change(const struct ddebug_query *query, - struct ddebug_table *dt; - unsigned int newflags; - unsigned int nfound = 0; -- char flagbuf[10]; -+ struct flagsbuf fbuf; - - /* search for matching ddebugs */ - mutex_lock(&ddebug_lock); -@@ -201,8 +201,7 @@ static int ddebug_change(const struct ddebug_query *query, - vpr_info("changed %s:%d [%s]%s =%s\n", - trim_prefix(dp->filename), dp->lineno, - dt->mod_name, dp->function, -- ddebug_describe_flags(dp, flagbuf, -- sizeof(flagbuf))); -+ ddebug_describe_flags(dp->flags, &fbuf)); - } - } - mutex_unlock(&ddebug_lock); -@@ -816,7 +815,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) - { - struct ddebug_iter *iter = m->private; - struct _ddebug *dp = p; -- char flagsbuf[10]; -+ struct flagsbuf flags; - - vpr_info("called m=%p p=%p\n", m, p); - -@@ -829,7 +828,7 @@ static int ddebug_proc_show(struct seq_file *m, void *p) - seq_printf(m, "%s:%u [%s]%s =%s \"", - trim_prefix(dp->filename), dp->lineno, - iter->table->mod_name, dp->function, -- ddebug_describe_flags(dp, flagsbuf, sizeof(flagsbuf))); -+ ddebug_describe_flags(dp->flags, &flags)); - seq_escape(m, dp->format, "\t\r\n\""); - seq_puts(m, "\"\n"); - -diff --git a/lib/kobject.c b/lib/kobject.c -index 83198cb37d8d..386873bdd51c 100644 ---- a/lib/kobject.c -+++ b/lib/kobject.c -@@ -599,14 +599,7 @@ out: - } - EXPORT_SYMBOL_GPL(kobject_move); - --/** -- * kobject_del() - Unlink kobject from hierarchy. -- * @kobj: object. -- * -- * This is the function that should be called to delete an object -- * successfully added via kobject_add(). -- */ --void kobject_del(struct kobject *kobj) -+static void __kobject_del(struct kobject *kobj) - { - struct kernfs_node *sd; - const struct kobj_type *ktype; -@@ -625,9 +618,23 @@ void kobject_del(struct kobject *kobj) - - kobj->state_in_sysfs = 0; - kobj_kset_leave(kobj); -- kobject_put(kobj->parent); - kobj->parent = NULL; - } -+ -+/** -+ * kobject_del() - Unlink kobject from hierarchy. -+ * @kobj: object. -+ * -+ * This is the function that should be called to delete an object -+ * successfully added via kobject_add(). -+ */ -+void kobject_del(struct kobject *kobj) -+{ -+ struct kobject *parent = kobj->parent; -+ -+ __kobject_del(kobj); -+ kobject_put(parent); -+} - EXPORT_SYMBOL(kobject_del); - - /** -@@ -663,6 +670,7 @@ EXPORT_SYMBOL(kobject_get_unless_zero); - */ - static void kobject_cleanup(struct kobject *kobj) - { -+ struct kobject *parent = kobj->parent; - struct kobj_type *t = get_ktype(kobj); - const char *name = kobj->name; - -@@ -684,7 +692,10 @@ static void kobject_cleanup(struct kobject *kobj) - if (kobj->state_in_sysfs) { - pr_debug("kobject: '%s' (%p): auto cleanup kobject_del\n", - kobject_name(kobj), kobj); -- kobject_del(kobj); -+ __kobject_del(kobj); -+ } else { -+ /* avoid dropping the parent reference unnecessarily */ -+ parent = NULL; - } - - if (t && t->release) { -@@ -698,6 +709,8 @@ static void kobject_cleanup(struct kobject *kobj) - pr_debug("kobject: '%s': free name\n", name); - kfree_const(name); - } -+ -+ kobject_put(parent); - } - - #ifdef CONFIG_DEBUG_KOBJECT_RELEASE -diff --git a/mm/mmap.c b/mm/mmap.c -index ea1ba2db4f4f..a3584a90c55c 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -3172,6 +3172,7 @@ void exit_mmap(struct mm_struct *mm) - if (vma->vm_flags & VM_ACCOUNT) - nr_accounted += vma_pages(vma); - vma = remove_vma(vma); -+ cond_resched(); - } - vm_unacct_memory(nr_accounted); - } -diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c -index 4febc82a7c76..52fb6d6d6d58 100644 ---- a/net/bluetooth/6lowpan.c -+++ b/net/bluetooth/6lowpan.c -@@ -50,6 +50,7 @@ static bool enable_6lowpan; - /* We are listening incoming connections via this channel - */ - static struct l2cap_chan *listen_chan; -+static DEFINE_MUTEX(set_lock); - - struct lowpan_peer { - struct list_head list; -@@ -1070,12 +1071,14 @@ static void do_enable_set(struct work_struct *work) - - enable_6lowpan = set_enable->flag; - -+ mutex_lock(&set_lock); - if (listen_chan) { - l2cap_chan_close(listen_chan, 0); - l2cap_chan_put(listen_chan); - } - - listen_chan = bt_6lowpan_listen(); -+ mutex_unlock(&set_lock); - - kfree(set_enable); - } -@@ -1127,11 +1130,13 @@ static ssize_t lowpan_control_write(struct file *fp, - if (ret == -EINVAL) - return ret; - -+ mutex_lock(&set_lock); - if (listen_chan) { - l2cap_chan_close(listen_chan, 0); - l2cap_chan_put(listen_chan); - listen_chan = NULL; - } -+ mutex_unlock(&set_lock); - - if (conn) { - struct lowpan_peer *peer; -diff --git a/net/core/sock.c b/net/core/sock.c -index 33a232974374..991ab80234ce 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -3337,6 +3337,16 @@ static void sock_inuse_add(struct net *net, int val) - } - #endif - -+static void tw_prot_cleanup(struct timewait_sock_ops *twsk_prot) -+{ -+ if (!twsk_prot) -+ return; -+ kfree(twsk_prot->twsk_slab_name); -+ twsk_prot->twsk_slab_name = NULL; -+ kmem_cache_destroy(twsk_prot->twsk_slab); -+ twsk_prot->twsk_slab = NULL; -+} -+ - static void req_prot_cleanup(struct request_sock_ops *rsk_prot) - { - if (!rsk_prot) -@@ -3407,7 +3417,7 @@ int proto_register(struct proto *prot, int alloc_slab) - prot->slab_flags, - NULL); - if (prot->twsk_prot->twsk_slab == NULL) -- goto out_free_timewait_sock_slab_name; -+ goto out_free_timewait_sock_slab; - } - } - -@@ -3415,15 +3425,15 @@ int proto_register(struct proto *prot, int alloc_slab) - ret = assign_proto_idx(prot); - if (ret) { - mutex_unlock(&proto_list_mutex); -- goto out_free_timewait_sock_slab_name; -+ goto out_free_timewait_sock_slab; - } - list_add(&prot->node, &proto_list); - mutex_unlock(&proto_list_mutex); - return ret; - --out_free_timewait_sock_slab_name: -+out_free_timewait_sock_slab: - if (alloc_slab && prot->twsk_prot) -- kfree(prot->twsk_prot->twsk_slab_name); -+ tw_prot_cleanup(prot->twsk_prot); - out_free_request_sock_slab: - if (alloc_slab) { - req_prot_cleanup(prot->rsk_prot); -@@ -3447,12 +3457,7 @@ void proto_unregister(struct proto *prot) - prot->slab = NULL; - - req_prot_cleanup(prot->rsk_prot); -- -- if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) { -- kmem_cache_destroy(prot->twsk_prot->twsk_slab); -- kfree(prot->twsk_prot->twsk_slab_name); -- prot->twsk_prot->twsk_slab = NULL; -- } -+ tw_prot_cleanup(prot->twsk_prot); - } - EXPORT_SYMBOL(proto_unregister); - -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 5e486895d67c..9745c52f49ca 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -284,6 +284,57 @@ static inline int sk_reuseport_match(struct inet_bind_bucket *tb, - ipv6_only_sock(sk), true, false); - } - -+void inet_csk_update_fastreuse(struct inet_bind_bucket *tb, -+ struct sock *sk) -+{ -+ kuid_t uid = sock_i_uid(sk); -+ bool reuse = sk->sk_reuse && sk->sk_state != TCP_LISTEN; -+ -+ if (hlist_empty(&tb->owners)) { -+ tb->fastreuse = reuse; -+ if (sk->sk_reuseport) { -+ tb->fastreuseport = FASTREUSEPORT_ANY; -+ tb->fastuid = uid; -+ tb->fast_rcv_saddr = sk->sk_rcv_saddr; -+ tb->fast_ipv6_only = ipv6_only_sock(sk); -+ tb->fast_sk_family = sk->sk_family; -+#if IS_ENABLED(CONFIG_IPV6) -+ tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; -+#endif -+ } else { -+ tb->fastreuseport = 0; -+ } -+ } else { -+ if (!reuse) -+ tb->fastreuse = 0; -+ if (sk->sk_reuseport) { -+ /* We didn't match or we don't have fastreuseport set on -+ * the tb, but we have sk_reuseport set on this socket -+ * and we know that there are no bind conflicts with -+ * this socket in this tb, so reset our tb's reuseport -+ * settings so that any subsequent sockets that match -+ * our current socket will be put on the fast path. -+ * -+ * If we reset we need to set FASTREUSEPORT_STRICT so we -+ * do extra checking for all subsequent sk_reuseport -+ * socks. -+ */ -+ if (!sk_reuseport_match(tb, sk)) { -+ tb->fastreuseport = FASTREUSEPORT_STRICT; -+ tb->fastuid = uid; -+ tb->fast_rcv_saddr = sk->sk_rcv_saddr; -+ tb->fast_ipv6_only = ipv6_only_sock(sk); -+ tb->fast_sk_family = sk->sk_family; -+#if IS_ENABLED(CONFIG_IPV6) -+ tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; -+#endif -+ } -+ } else { -+ tb->fastreuseport = 0; -+ } -+ } -+} -+ - /* Obtain a reference to a local port for the given sock, - * if snum is zero it means select any available local port. - * We try to allocate an odd port (and leave even ports for connect()) -@@ -296,7 +347,6 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum) - struct inet_bind_hashbucket *head; - struct net *net = sock_net(sk); - struct inet_bind_bucket *tb = NULL; -- kuid_t uid = sock_i_uid(sk); - int l3mdev; - - l3mdev = inet_sk_bound_l3mdev(sk); -@@ -333,49 +383,8 @@ tb_found: - goto fail_unlock; - } - success: -- if (hlist_empty(&tb->owners)) { -- tb->fastreuse = reuse; -- if (sk->sk_reuseport) { -- tb->fastreuseport = FASTREUSEPORT_ANY; -- tb->fastuid = uid; -- tb->fast_rcv_saddr = sk->sk_rcv_saddr; -- tb->fast_ipv6_only = ipv6_only_sock(sk); -- tb->fast_sk_family = sk->sk_family; --#if IS_ENABLED(CONFIG_IPV6) -- tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; --#endif -- } else { -- tb->fastreuseport = 0; -- } -- } else { -- if (!reuse) -- tb->fastreuse = 0; -- if (sk->sk_reuseport) { -- /* We didn't match or we don't have fastreuseport set on -- * the tb, but we have sk_reuseport set on this socket -- * and we know that there are no bind conflicts with -- * this socket in this tb, so reset our tb's reuseport -- * settings so that any subsequent sockets that match -- * our current socket will be put on the fast path. -- * -- * If we reset we need to set FASTREUSEPORT_STRICT so we -- * do extra checking for all subsequent sk_reuseport -- * socks. -- */ -- if (!sk_reuseport_match(tb, sk)) { -- tb->fastreuseport = FASTREUSEPORT_STRICT; -- tb->fastuid = uid; -- tb->fast_rcv_saddr = sk->sk_rcv_saddr; -- tb->fast_ipv6_only = ipv6_only_sock(sk); -- tb->fast_sk_family = sk->sk_family; --#if IS_ENABLED(CONFIG_IPV6) -- tb->fast_v6_rcv_saddr = sk->sk_v6_rcv_saddr; --#endif -- } -- } else { -- tb->fastreuseport = 0; -- } -- } -+ inet_csk_update_fastreuse(tb, sk); -+ - if (!inet_csk(sk)->icsk_bind_hash) - inet_bind_hash(sk, tb, port); - WARN_ON(inet_csk(sk)->icsk_bind_hash != tb); -diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c -index 2bbaaf0c7176..006a34b18537 100644 ---- a/net/ipv4/inet_hashtables.c -+++ b/net/ipv4/inet_hashtables.c -@@ -163,6 +163,7 @@ int __inet_inherit_port(const struct sock *sk, struct sock *child) - return -ENOMEM; - } - } -+ inet_csk_update_fastreuse(tb, child); - } - inet_bind_hash(child, tb, port); - spin_unlock(&head->lock); -diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c -index 0902cb32bbad..c83a5d05aeaa 100644 ---- a/net/ipv4/sysctl_net_ipv4.c -+++ b/net/ipv4/sysctl_net_ipv4.c -@@ -307,24 +307,16 @@ static int proc_tcp_fastopen_key(struct ctl_table *table, int write, - struct ctl_table tbl = { .maxlen = ((TCP_FASTOPEN_KEY_LENGTH * - 2 * TCP_FASTOPEN_KEY_MAX) + - (TCP_FASTOPEN_KEY_MAX * 5)) }; -- struct tcp_fastopen_context *ctx; -- u32 user_key[TCP_FASTOPEN_KEY_MAX * 4]; -- __le32 key[TCP_FASTOPEN_KEY_MAX * 4]; -+ u32 user_key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u32)]; -+ __le32 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(__le32)]; - char *backup_data; -- int ret, i = 0, off = 0, n_keys = 0; -+ int ret, i = 0, off = 0, n_keys; - - tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); - if (!tbl.data) - return -ENOMEM; - -- rcu_read_lock(); -- ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx); -- if (ctx) { -- n_keys = tcp_fastopen_context_len(ctx); -- memcpy(&key[0], &ctx->key[0], TCP_FASTOPEN_KEY_LENGTH * n_keys); -- } -- rcu_read_unlock(); -- -+ n_keys = tcp_fastopen_get_cipher(net, NULL, (u64 *)key); - if (!n_keys) { - memset(&key[0], 0, TCP_FASTOPEN_KEY_LENGTH); - n_keys = 1; -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 840901154210..01ddfb4156e4 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -3527,22 +3527,14 @@ static int do_tcp_getsockopt(struct sock *sk, int level, - return 0; - - case TCP_FASTOPEN_KEY: { -- __u8 key[TCP_FASTOPEN_KEY_BUF_LENGTH]; -- struct tcp_fastopen_context *ctx; -- unsigned int key_len = 0; -+ u64 key[TCP_FASTOPEN_KEY_BUF_LENGTH / sizeof(u64)]; -+ unsigned int key_len; - - if (get_user(len, optlen)) - return -EFAULT; - -- rcu_read_lock(); -- ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx); -- if (ctx) { -- key_len = tcp_fastopen_context_len(ctx) * -- TCP_FASTOPEN_KEY_LENGTH; -- memcpy(&key[0], &ctx->key[0], key_len); -- } -- rcu_read_unlock(); -- -+ key_len = tcp_fastopen_get_cipher(net, icsk, key) * -+ TCP_FASTOPEN_KEY_LENGTH; - len = min_t(unsigned int, len, key_len); - if (put_user(len, optlen)) - return -EFAULT; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index a915ade0c818..a9971e41f31b 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -108,6 +108,29 @@ out: - return err; - } - -+int tcp_fastopen_get_cipher(struct net *net, struct inet_connection_sock *icsk, -+ u64 *key) -+{ -+ struct tcp_fastopen_context *ctx; -+ int n_keys = 0, i; -+ -+ rcu_read_lock(); -+ if (icsk) -+ ctx = rcu_dereference(icsk->icsk_accept_queue.fastopenq.ctx); -+ else -+ ctx = rcu_dereference(net->ipv4.tcp_fastopen_ctx); -+ if (ctx) { -+ n_keys = tcp_fastopen_context_len(ctx); -+ for (i = 0; i < n_keys; i++) { -+ put_unaligned_le64(ctx->key[i].key[0], key + (i * 2)); -+ put_unaligned_le64(ctx->key[i].key[1], key + (i * 2) + 1); -+ } -+ } -+ rcu_read_unlock(); -+ -+ return n_keys; -+} -+ - static bool __tcp_fastopen_cookie_gen_cipher(struct request_sock *req, - struct sk_buff *syn, - const siphash_key_t *key, -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 8b80ab794a92..64a05906cc0e 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -2061,14 +2061,14 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - - conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); - if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { -- bool uses_ct = false, resched = false; -+ bool old_ct = false, resched = false; - - if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && - unlikely(!atomic_read(&cp->dest->weight))) { - resched = true; -- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); -+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); - } else if (is_new_conn_expected(cp, conn_reuse_mode)) { -- uses_ct = ip_vs_conn_uses_conntrack(cp, skb); -+ old_ct = ip_vs_conn_uses_old_conntrack(cp, skb); - if (!atomic_read(&cp->n_control)) { - resched = true; - } else { -@@ -2076,15 +2076,17 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int - * that uses conntrack while it is still - * referenced by controlled connection(s). - */ -- resched = !uses_ct; -+ resched = !old_ct; - } - } - - if (resched) { -+ if (!old_ct) -+ cp->flags &= ~IP_VS_CONN_F_NFCT; - if (!atomic_read(&cp->n_control)) - ip_vs_conn_expire_now(cp); - __ip_vs_conn_put(cp); -- if (uses_ct) -+ if (old_ct) - return NF_DROP; - cp = NULL; - } -diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c -index ba5ffd3badd3..b5c867fe3232 100644 ---- a/net/nfc/rawsock.c -+++ b/net/nfc/rawsock.c -@@ -332,10 +332,13 @@ static int rawsock_create(struct net *net, struct socket *sock, - if ((sock->type != SOCK_SEQPACKET) && (sock->type != SOCK_RAW)) - return -ESOCKTNOSUPPORT; - -- if (sock->type == SOCK_RAW) -+ if (sock->type == SOCK_RAW) { -+ if (!capable(CAP_NET_RAW)) -+ return -EPERM; - sock->ops = &rawsock_raw_ops; -- else -+ } else { - sock->ops = &rawsock_ops; -+ } - - sk = sk_alloc(net, PF_NFC, GFP_ATOMIC, nfc_proto->proto, kern); - if (!sk) -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 1d63ab3a878a..7735340c892e 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -941,6 +941,7 @@ static int prb_queue_frozen(struct tpacket_kbdq_core *pkc) - } - - static void prb_clear_blk_fill_status(struct packet_ring_buffer *rb) -+ __releases(&pkc->blk_fill_in_prog_lock) - { - struct tpacket_kbdq_core *pkc = GET_PBDQC_FROM_RB(rb); - atomic_dec(&pkc->blk_fill_in_prog); -@@ -988,6 +989,7 @@ static void prb_fill_curr_block(char *curr, - struct tpacket_kbdq_core *pkc, - struct tpacket_block_desc *pbd, - unsigned int len) -+ __acquires(&pkc->blk_fill_in_prog_lock) - { - struct tpacket3_hdr *ppd; - -@@ -2285,8 +2287,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - if (do_vnet && - virtio_net_hdr_from_skb(skb, h.raw + macoff - - sizeof(struct virtio_net_hdr), -- vio_le(), true, 0)) -+ vio_le(), true, 0)) { -+ if (po->tp_version == TPACKET_V3) -+ prb_clear_blk_fill_status(&po->rx_ring); - goto drop_n_account; -+ } - - if (po->tp_version <= TPACKET_V2) { - packet_increment_rx_head(po, &po->rx_ring); -@@ -2392,7 +2397,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - __clear_bit(slot_id, po->rx_ring.rx_owner_map); - spin_unlock(&sk->sk_receive_queue.lock); - sk->sk_data_ready(sk); -- } else { -+ } else if (po->tp_version == TPACKET_V3) { - prb_clear_blk_fill_status(&po->rx_ring); - } - -diff --git a/net/socket.c b/net/socket.c -index 432800b39ddb..d1a0264401b7 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -485,7 +485,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed) - if (f.file) { - sock = sock_from_file(f.file, err); - if (likely(sock)) { -- *fput_needed = f.flags; -+ *fput_needed = f.flags & FDPUT_FPUT; - return sock; - } - fdput(f); -diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c -index 683755d95075..78ad41656996 100644 ---- a/net/sunrpc/auth_gss/gss_krb5_wrap.c -+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c -@@ -584,7 +584,7 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *kctx, int offset, int len, - buf->head[0].iov_len); - memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen); - buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip; -- buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip; -+ buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip); - - /* Trim off the trailing "extra count" and checksum blob */ - xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip); -diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index fd91274e834d..3645cd241d3e 100644 ---- a/net/sunrpc/auth_gss/svcauth_gss.c -+++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -949,7 +949,6 @@ unwrap_priv_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct gs - - maj_stat = gss_unwrap(ctx, 0, priv_len, buf); - pad = priv_len - buf->len; -- buf->len -= pad; - /* The upper layers assume the buffer is aligned on 4-byte boundaries. - * In the krb5p case, at least, the data ends up offset, so we need to - * move it around. */ -diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c -index 066af6b2eb01..0bb3f0dca80d 100644 ---- a/net/sunrpc/xprtrdma/svc_rdma_rw.c -+++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c -@@ -677,7 +677,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp, - struct svc_rdma_read_info *info, - __be32 *p) - { -- unsigned int i; - int ret; - - ret = -EINVAL; -@@ -700,12 +699,6 @@ static int svc_rdma_build_read_chunk(struct svc_rqst *rqstp, - info->ri_chunklen += rs_length; - } - -- /* Pages under I/O have been copied to head->rc_pages. -- * Prevent their premature release by svc_xprt_release() . -- */ -- for (i = 0; i < info->ri_readctxt->rc_page_count; i++) -- rqstp->rq_pages[i] = NULL; -- - return ret; - } - -@@ -800,6 +793,26 @@ out: - return ret; - } - -+/* Pages under I/O have been copied to head->rc_pages. Ensure they -+ * are not released by svc_xprt_release() until the I/O is complete. -+ * -+ * This has to be done after all Read WRs are constructed to properly -+ * handle a page that is part of I/O on behalf of two different RDMA -+ * segments. -+ * -+ * Do this only if I/O has been posted. Otherwise, we do indeed want -+ * svc_xprt_release() to clean things up properly. -+ */ -+static void svc_rdma_save_io_pages(struct svc_rqst *rqstp, -+ const unsigned int start, -+ const unsigned int num_pages) -+{ -+ unsigned int i; -+ -+ for (i = start; i < num_pages + start; i++) -+ rqstp->rq_pages[i] = NULL; -+} -+ - /** - * svc_rdma_recv_read_chunk - Pull a Read chunk from the client - * @rdma: controlling RDMA transport -@@ -853,6 +866,7 @@ int svc_rdma_recv_read_chunk(struct svcxprt_rdma *rdma, struct svc_rqst *rqstp, - ret = svc_rdma_post_chunk_ctxt(&info->ri_cc); - if (ret < 0) - goto out_err; -+ svc_rdma_save_io_pages(rqstp, 0, head->rc_page_count); - return 0; - - out_err: -diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c -index 1adeb1c0473b..25fca390cdcf 100644 ---- a/net/tls/tls_device.c -+++ b/net/tls/tls_device.c -@@ -549,7 +549,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, - { - struct tls_context *tls_ctx = tls_get_ctx(sk); - struct iov_iter msg_iter; -- char *kaddr = kmap(page); -+ char *kaddr; - struct kvec iov; - int rc; - -@@ -564,6 +564,7 @@ int tls_device_sendpage(struct sock *sk, struct page *page, - goto out; - } - -+ kaddr = kmap(page); - iov.iov_base = kaddr + offset; - iov.iov_len = size; - iov_iter_kvec(&msg_iter, WRITE, &iov, 1, size); -diff --git a/samples/bpf/fds_example.c b/samples/bpf/fds_example.c -index 2d4b717726b6..34b3fca788e8 100644 ---- a/samples/bpf/fds_example.c -+++ b/samples/bpf/fds_example.c -@@ -30,6 +30,8 @@ - #define BPF_M_MAP 1 - #define BPF_M_PROG 2 - -+char bpf_log_buf[BPF_LOG_BUF_SIZE]; -+ - static void usage(void) - { - printf("Usage: fds_example [...]\n"); -@@ -57,7 +59,6 @@ static int bpf_prog_create(const char *object) - BPF_EXIT_INSN(), - }; - size_t insns_cnt = sizeof(insns) / sizeof(struct bpf_insn); -- char bpf_log_buf[BPF_LOG_BUF_SIZE]; - struct bpf_object *obj; - int prog_fd; - -diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c -index 7225107a9aaf..e59022b3f125 100644 ---- a/scripts/recordmcount.c -+++ b/scripts/recordmcount.c -@@ -434,6 +434,11 @@ static int arm_is_fake_mcount(Elf32_Rel const *rp) - return 1; - } - -+static int arm64_is_fake_mcount(Elf64_Rel const *rp) -+{ -+ return ELF64_R_TYPE(w(rp->r_info)) != R_AARCH64_CALL26; -+} -+ - /* 64-bit EM_MIPS has weird ELF64_Rela.r_info. - * http://techpubs.sgi.com/library/manuals/4000/007-4658-001/pdf/007-4658-001.pdf - * We interpret Table 29 Relocation Operation (Elf64_Rel, Elf64_Rela) [p.40] -@@ -547,6 +552,7 @@ static int do_file(char const *const fname) - make_nop = make_nop_arm64; - rel_type_nop = R_AARCH64_NONE; - ideal_nop = ideal_nop4_arm64; -+ is_fake_mcount64 = arm64_is_fake_mcount; - break; - case EM_IA_64: reltype = R_IA64_IMM64; break; - case EM_MIPS: /* reltype: e_class */ break; -diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h -index be469fce19e1..8173982e00ab 100644 ---- a/security/integrity/ima/ima.h -+++ b/security/integrity/ima/ima.h -@@ -362,6 +362,7 @@ static inline void ima_free_modsig(struct modsig *modsig) - #ifdef CONFIG_IMA_LSM_RULES - - #define security_filter_rule_init security_audit_rule_init -+#define security_filter_rule_free security_audit_rule_free - #define security_filter_rule_match security_audit_rule_match - - #else -@@ -372,6 +373,10 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr, - return -EINVAL; - } - -+static inline void security_filter_rule_free(void *lsmrule) -+{ -+} -+ - static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, - void *lsmrule) - { -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index 558a7607bf93..e725d4187271 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -254,7 +254,7 @@ static void ima_lsm_free_rule(struct ima_rule_entry *entry) - int i; - - for (i = 0; i < MAX_LSM_RULES; i++) { -- kfree(entry->lsm[i].rule); -+ security_filter_rule_free(entry->lsm[i].rule); - kfree(entry->lsm[i].args_p); - } - kfree(entry); -diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c -index 840a192e9337..9c4308077574 100644 ---- a/security/smack/smackfs.c -+++ b/security/smack/smackfs.c -@@ -884,7 +884,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - } - - ret = sscanf(rule, "%d", &maplevel); -- if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) -+ if (ret != 1 || maplevel < 0 || maplevel > SMACK_CIPSO_MAXLEVEL) - goto out; - - rule += SMK_DIGITLEN; -@@ -905,6 +905,10 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, - - for (i = 0; i < catlen; i++) { - rule += SMK_DIGITLEN; -+ if (rule > data + count) { -+ rc = -EOVERFLOW; -+ goto out; -+ } - ret = sscanf(rule, "%u", &cat); - if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM) - goto out; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index ea25b8d0350d..88629906f314 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4391,6 +4391,7 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec, - { - struct alc_spec *spec = codec->spec; - -+ spec->micmute_led_polarity = 1; - alc_fixup_hp_gpio_led(codec, action, 0, 0x04); - if (action == HDA_FIXUP_ACT_PRE_PROBE) { - spec->init_amp = ALC_INIT_DEFAULT; -diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c -index 41b83ecaf008..914b75c23d1b 100644 ---- a/sound/soc/fsl/fsl_sai.c -+++ b/sound/soc/fsl/fsl_sai.c -@@ -680,10 +680,11 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai) - regmap_write(sai->regmap, FSL_SAI_RCSR(ofs), 0); - - regmap_update_bits(sai->regmap, FSL_SAI_TCR1(ofs), -- FSL_SAI_CR1_RFW_MASK, -+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth), - sai->soc_data->fifo_depth - FSL_SAI_MAXBURST_TX); - regmap_update_bits(sai->regmap, FSL_SAI_RCR1(ofs), -- FSL_SAI_CR1_RFW_MASK, FSL_SAI_MAXBURST_RX - 1); -+ FSL_SAI_CR1_RFW_MASK(sai->soc_data->fifo_depth), -+ FSL_SAI_MAXBURST_RX - 1); - - snd_soc_dai_init_dma_data(cpu_dai, &sai->dma_params_tx, - &sai->dma_params_rx); -diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h -index 76b15deea80c..6aba7d28f5f3 100644 ---- a/sound/soc/fsl/fsl_sai.h -+++ b/sound/soc/fsl/fsl_sai.h -@@ -94,7 +94,7 @@ - #define FSL_SAI_CSR_FRDE BIT(0) - - /* SAI Transmit and Receive Configuration 1 Register */ --#define FSL_SAI_CR1_RFW_MASK 0x1f -+#define FSL_SAI_CR1_RFW_MASK(x) ((x) - 1) - - /* SAI Transmit and Receive Configuration 2 Register */ - #define FSL_SAI_CR2_SYNC BIT(30) -diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c -index adf416a49b48..60fb87495050 100644 ---- a/sound/soc/intel/boards/bxt_rt298.c -+++ b/sound/soc/intel/boards/bxt_rt298.c -@@ -556,6 +556,7 @@ static int bxt_card_late_probe(struct snd_soc_card *card) - /* broxton audio machine driver for SPT + RT298S */ - static struct snd_soc_card broxton_rt298 = { - .name = "broxton-rt298", -+ .owner = THIS_MODULE, - .dai_link = broxton_rt298_dais, - .num_links = ARRAY_SIZE(broxton_rt298_dais), - .controls = broxton_controls, -@@ -571,6 +572,7 @@ static struct snd_soc_card broxton_rt298 = { - - static struct snd_soc_card geminilake_rt298 = { - .name = "geminilake-rt298", -+ .owner = THIS_MODULE, - .dai_link = broxton_rt298_dais, - .num_links = ARRAY_SIZE(broxton_rt298_dais), - .controls = broxton_controls, -diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c -index 1f698adde506..7126344017fa 100644 ---- a/sound/soc/meson/axg-card.c -+++ b/sound/soc/meson/axg-card.c -@@ -266,7 +266,7 @@ static int axg_card_add_tdm_loopback(struct snd_soc_card *card, - - lb = &card->dai_link[*index + 1]; - -- lb->name = kasprintf(GFP_KERNEL, "%s-lb", pad->name); -+ lb->name = devm_kasprintf(card->dev, GFP_KERNEL, "%s-lb", pad->name); - if (!lb->name) - return -ENOMEM; - -diff --git a/sound/soc/meson/axg-tdm-formatter.c b/sound/soc/meson/axg-tdm-formatter.c -index 358c8c0d861c..f7e8e9da68a0 100644 ---- a/sound/soc/meson/axg-tdm-formatter.c -+++ b/sound/soc/meson/axg-tdm-formatter.c -@@ -70,7 +70,7 @@ EXPORT_SYMBOL_GPL(axg_tdm_formatter_set_channel_masks); - static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter) - { - struct axg_tdm_stream *ts = formatter->stream; -- bool invert = formatter->drv->quirks->invert_sclk; -+ bool invert; - int ret; - - /* Do nothing if the formatter is already enabled */ -@@ -96,11 +96,12 @@ static int axg_tdm_formatter_enable(struct axg_tdm_formatter *formatter) - return ret; - - /* -- * If sclk is inverted, invert it back and provide the inversion -- * required by the formatter -+ * If sclk is inverted, it means the bit should latched on the -+ * rising edge which is what our HW expects. If not, we need to -+ * invert it before the formatter. - */ -- invert ^= axg_tdm_sclk_invert(ts->iface->fmt); -- ret = clk_set_phase(formatter->sclk, invert ? 180 : 0); -+ invert = axg_tdm_sclk_invert(ts->iface->fmt); -+ ret = clk_set_phase(formatter->sclk, invert ? 0 : 180); - if (ret) - return ret; - -diff --git a/sound/soc/meson/axg-tdm-formatter.h b/sound/soc/meson/axg-tdm-formatter.h -index 9ef98e955cb2..a1f0dcc0ff13 100644 ---- a/sound/soc/meson/axg-tdm-formatter.h -+++ b/sound/soc/meson/axg-tdm-formatter.h -@@ -16,7 +16,6 @@ struct snd_kcontrol; - - struct axg_tdm_formatter_hw { - unsigned int skew_offset; -- bool invert_sclk; - }; - - struct axg_tdm_formatter_ops { -diff --git a/sound/soc/meson/axg-tdm-interface.c b/sound/soc/meson/axg-tdm-interface.c -index d51f3344be7c..e25336f73912 100644 ---- a/sound/soc/meson/axg-tdm-interface.c -+++ b/sound/soc/meson/axg-tdm-interface.c -@@ -119,18 +119,25 @@ static int axg_tdm_iface_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - { - struct axg_tdm_iface *iface = snd_soc_dai_get_drvdata(dai); - -- /* These modes are not supported */ -- if (fmt & (SND_SOC_DAIFMT_CBS_CFM | SND_SOC_DAIFMT_CBM_CFS)) { -+ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { -+ case SND_SOC_DAIFMT_CBS_CFS: -+ if (!iface->mclk) { -+ dev_err(dai->dev, "cpu clock master: mclk missing\n"); -+ return -ENODEV; -+ } -+ break; -+ -+ case SND_SOC_DAIFMT_CBM_CFM: -+ break; -+ -+ case SND_SOC_DAIFMT_CBS_CFM: -+ case SND_SOC_DAIFMT_CBM_CFS: - dev_err(dai->dev, "only CBS_CFS and CBM_CFM are supported\n"); -+ /* Fall-through */ -+ default: - return -EINVAL; - } - -- /* If the TDM interface is the clock master, it requires mclk */ -- if (!iface->mclk && (fmt & SND_SOC_DAIFMT_CBS_CFS)) { -- dev_err(dai->dev, "cpu clock master: mclk missing\n"); -- return -ENODEV; -- } -- - iface->fmt = fmt; - return 0; - } -@@ -319,7 +326,8 @@ static int axg_tdm_iface_hw_params(struct snd_pcm_substream *substream, - if (ret) - return ret; - -- if (iface->fmt & SND_SOC_DAIFMT_CBS_CFS) { -+ if ((iface->fmt & SND_SOC_DAIFMT_MASTER_MASK) == -+ SND_SOC_DAIFMT_CBS_CFS) { - ret = axg_tdm_iface_set_sclk(dai, params); - if (ret) - return ret; -diff --git a/sound/soc/meson/axg-tdmin.c b/sound/soc/meson/axg-tdmin.c -index 973d4c02ef8d..88ed95ae886b 100644 ---- a/sound/soc/meson/axg-tdmin.c -+++ b/sound/soc/meson/axg-tdmin.c -@@ -228,15 +228,29 @@ static const struct axg_tdm_formatter_driver axg_tdmin_drv = { - .regmap_cfg = &axg_tdmin_regmap_cfg, - .ops = &axg_tdmin_ops, - .quirks = &(const struct axg_tdm_formatter_hw) { -- .invert_sclk = false, - .skew_offset = 2, - }, - }; - -+static const struct axg_tdm_formatter_driver g12a_tdmin_drv = { -+ .component_drv = &axg_tdmin_component_drv, -+ .regmap_cfg = &axg_tdmin_regmap_cfg, -+ .ops = &axg_tdmin_ops, -+ .quirks = &(const struct axg_tdm_formatter_hw) { -+ .skew_offset = 3, -+ }, -+}; -+ - static const struct of_device_id axg_tdmin_of_match[] = { - { - .compatible = "amlogic,axg-tdmin", - .data = &axg_tdmin_drv, -+ }, { -+ .compatible = "amlogic,g12a-tdmin", -+ .data = &g12a_tdmin_drv, -+ }, { -+ .compatible = "amlogic,sm1-tdmin", -+ .data = &g12a_tdmin_drv, - }, {} - }; - MODULE_DEVICE_TABLE(of, axg_tdmin_of_match); -diff --git a/sound/soc/meson/axg-tdmout.c b/sound/soc/meson/axg-tdmout.c -index 418ec314b37d..3ceabddae629 100644 ---- a/sound/soc/meson/axg-tdmout.c -+++ b/sound/soc/meson/axg-tdmout.c -@@ -238,7 +238,6 @@ static const struct axg_tdm_formatter_driver axg_tdmout_drv = { - .regmap_cfg = &axg_tdmout_regmap_cfg, - .ops = &axg_tdmout_ops, - .quirks = &(const struct axg_tdm_formatter_hw) { -- .invert_sclk = true, - .skew_offset = 1, - }, - }; -@@ -248,7 +247,6 @@ static const struct axg_tdm_formatter_driver g12a_tdmout_drv = { - .regmap_cfg = &axg_tdmout_regmap_cfg, - .ops = &axg_tdmout_ops, - .quirks = &(const struct axg_tdm_formatter_hw) { -- .invert_sclk = true, - .skew_offset = 2, - }, - }; -@@ -309,7 +307,6 @@ static const struct axg_tdm_formatter_driver sm1_tdmout_drv = { - .regmap_cfg = &axg_tdmout_regmap_cfg, - .ops = &axg_tdmout_ops, - .quirks = &(const struct axg_tdm_formatter_hw) { -- .invert_sclk = true, - .skew_offset = 2, - }, - }; -diff --git a/sound/soc/sof/nocodec.c b/sound/soc/sof/nocodec.c -index ea0fe9a09f3f..71410116add1 100644 ---- a/sound/soc/sof/nocodec.c -+++ b/sound/soc/sof/nocodec.c -@@ -14,6 +14,7 @@ - - static struct snd_soc_card sof_nocodec_card = { - .name = "nocodec", /* the sof- prefix is added by the core */ -+ .owner = THIS_MODULE - }; - - static int sof_nocodec_bes_setup(struct device *dev, -diff --git a/sound/usb/card.h b/sound/usb/card.h -index f39f23e3525d..d8ec5caf464d 100644 ---- a/sound/usb/card.h -+++ b/sound/usb/card.h -@@ -133,6 +133,7 @@ struct snd_usb_substream { - unsigned int tx_length_quirk:1; /* add length specifier to transfers */ - unsigned int fmt_type; /* USB audio format type (1-3) */ - unsigned int pkt_offset_adj; /* Bytes to drop from beginning of packets (for non-compliant devices) */ -+ unsigned int stream_offset_adj; /* Bytes to drop from beginning of stream (for non-compliant devices) */ - - unsigned int running: 1; /* running status */ - -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index d39bf5b648d1..49f0dc0e3e4d 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -184,6 +184,7 @@ static const struct rc_config { - { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */ - { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ -+ { USB_ID(0x041e, 0x3263), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */ - { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */ - }; - -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index d11d00efc574..7b41f9748978 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -1417,6 +1417,12 @@ static void retire_capture_urb(struct snd_usb_substream *subs, - // continue; - } - bytes = urb->iso_frame_desc[i].actual_length; -+ if (subs->stream_offset_adj > 0) { -+ unsigned int adj = min(subs->stream_offset_adj, bytes); -+ cp += adj; -+ bytes -= adj; -+ subs->stream_offset_adj -= adj; -+ } - frames = bytes / stride; - if (!subs->txfr_quirk) - bytes = frames * stride; -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 562179492a33..1573229d8cf4 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -3570,6 +3570,62 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), - } - } - }, -+{ -+ /* -+ * PIONEER DJ DDJ-RB -+ * PCM is 4 channels out, 2 dummy channels in @ 44.1 fixed -+ * The feedback for the output is the dummy input. -+ */ -+ USB_DEVICE_VENDOR_SPEC(0x2b73, 0x000e), -+ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { -+ .ifnum = QUIRK_ANY_INTERFACE, -+ .type = QUIRK_COMPOSITE, -+ .data = (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S24_3LE, -+ .channels = 4, -+ .iface = 0, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .endpoint = 0x01, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC| -+ USB_ENDPOINT_SYNC_ASYNC, -+ .rates = SNDRV_PCM_RATE_44100, -+ .rate_min = 44100, -+ .rate_max = 44100, -+ .nr_rates = 1, -+ .rate_table = (unsigned int[]) { 44100 } -+ } -+ }, -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S24_3LE, -+ .channels = 2, -+ .iface = 0, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .endpoint = 0x82, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC| -+ USB_ENDPOINT_SYNC_ASYNC| -+ USB_ENDPOINT_USAGE_IMPLICIT_FB, -+ .rates = SNDRV_PCM_RATE_44100, -+ .rate_min = 44100, -+ .rate_max = 44100, -+ .nr_rates = 1, -+ .rate_table = (unsigned int[]) { 44100 } -+ } -+ }, -+ { -+ .ifnum = -1 -+ } -+ } -+ } -+}, - - #define ALC1220_VB_DESKTOP(vend, prod) { \ - USB_DEVICE(vend, prod), \ -@@ -3623,7 +3679,13 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */ - * with. - */ - { -- USB_DEVICE(0x534d, 0x2109), -+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -+ USB_DEVICE_ID_MATCH_INT_CLASS | -+ USB_DEVICE_ID_MATCH_INT_SUBCLASS, -+ .idVendor = 0x534d, -+ .idProduct = 0x2109, -+ .bInterfaceClass = USB_CLASS_AUDIO, -+ .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL, - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { - .vendor_name = "MacroSilicon", - .product_name = "MS2109", -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index a8bb953cc468..a756f50d9f07 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1432,6 +1432,9 @@ void snd_usb_set_format_quirk(struct snd_usb_substream *subs, - case USB_ID(0x041e, 0x3f19): /* E-Mu 0204 USB */ - set_format_emu_quirk(subs, fmt); - break; -+ case USB_ID(0x534d, 0x2109): /* MacroSilicon MS2109 */ -+ subs->stream_offset_adj = 2; -+ break; - } - } - -diff --git a/sound/usb/stream.c b/sound/usb/stream.c -index 11785f9652ad..d01edd5da6cf 100644 ---- a/sound/usb/stream.c -+++ b/sound/usb/stream.c -@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as, - subs->tx_length_quirk = as->chip->tx_length_quirk; - subs->speed = snd_usb_get_speed(subs->dev); - subs->pkt_offset_adj = 0; -+ subs->stream_offset_adj = 0; - - snd_usb_set_pcm_ops(as->pcm, stream); - -diff --git a/tools/bpf/bpftool/btf.c b/tools/bpf/bpftool/btf.c -index 9a9376d1d3df..66765f970bc5 100644 ---- a/tools/bpf/bpftool/btf.c -+++ b/tools/bpf/bpftool/btf.c -@@ -510,7 +510,7 @@ static int do_dump(int argc, char **argv) - goto done; - } - if (!btf) { -- err = ENOENT; -+ err = -ENOENT; - p_err("can't find btf with ID (%u)", btf_id); - goto done; - } -diff --git a/tools/build/Build.include b/tools/build/Build.include -index 9ec01f4454f9..585486e40995 100644 ---- a/tools/build/Build.include -+++ b/tools/build/Build.include -@@ -74,7 +74,8 @@ dep-cmd = $(if $(wildcard $(fixdep)), - # dependencies in the cmd file - if_changed_dep = $(if $(strip $(any-prereq) $(arg-check)), \ - @set -e; \ -- $(echo-cmd) $(cmd_$(1)) && $(dep-cmd)) -+ $(echo-cmd) $(cmd_$(1)); \ -+ $(dep-cmd)) - - # if_changed - execute command if any prerequisite is newer than - # target, or command line has changed -diff --git a/tools/testing/selftests/powerpc/benchmarks/context_switch.c b/tools/testing/selftests/powerpc/benchmarks/context_switch.c -index a2e8c9da7fa5..d50cc05df495 100644 ---- a/tools/testing/selftests/powerpc/benchmarks/context_switch.c -+++ b/tools/testing/selftests/powerpc/benchmarks/context_switch.c -@@ -19,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -104,8 +105,9 @@ static void start_thread_on(void *(*fn)(void *), void *arg, unsigned long cpu) - - static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) - { -- int pid; -- cpu_set_t cpuset; -+ int pid, ncpus; -+ cpu_set_t *cpuset; -+ size_t size; - - pid = fork(); - if (pid == -1) { -@@ -116,14 +118,23 @@ static void start_process_on(void *(*fn)(void *), void *arg, unsigned long cpu) - if (pid) - return; - -- CPU_ZERO(&cpuset); -- CPU_SET(cpu, &cpuset); -+ ncpus = get_nprocs(); -+ size = CPU_ALLOC_SIZE(ncpus); -+ cpuset = CPU_ALLOC(ncpus); -+ if (!cpuset) { -+ perror("malloc"); -+ exit(1); -+ } -+ CPU_ZERO_S(size, cpuset); -+ CPU_SET_S(cpu, size, cpuset); - -- if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) { -+ if (sched_setaffinity(0, size, cpuset)) { - perror("sched_setaffinity"); -+ CPU_FREE(cpuset); - exit(1); - } - -+ CPU_FREE(cpuset); - fn(arg); - - exit(0); -diff --git a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh -index f52ed92b53e7..00dc32c0ed75 100755 ---- a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh -+++ b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh -@@ -5,12 +5,17 @@ pe_ok() { - local dev="$1" - local path="/sys/bus/pci/devices/$dev/eeh_pe_state" - -- if ! [ -e "$path" ] ; then -+ # if a driver doesn't support the error handling callbacks then the -+ # device is recovered by removing and re-probing it. This causes the -+ # sysfs directory to disappear so read the PE state once and squash -+ # any potential error messages -+ local eeh_state="$(cat $path 2>/dev/null)" -+ if [ -z "$eeh_state" ]; then - return 1; - fi - -- local fw_state="$(cut -d' ' -f1 < $path)" -- local sw_state="$(cut -d' ' -f2 < $path)" -+ local fw_state="$(echo $eeh_state | cut -d' ' -f1)" -+ local sw_state="$(echo $eeh_state | cut -d' ' -f2)" - - # If EEH_PE_ISOLATED or EEH_PE_RECOVERING are set then the PE is in an - # error state or being recovered. Either way, not ok. -diff --git a/tools/testing/selftests/powerpc/utils.c b/tools/testing/selftests/powerpc/utils.c -index c02d24835db4..176102eca994 100644 ---- a/tools/testing/selftests/powerpc/utils.c -+++ b/tools/testing/selftests/powerpc/utils.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -88,28 +89,40 @@ void *get_auxv_entry(int type) - - int pick_online_cpu(void) - { -- cpu_set_t mask; -- int cpu; -+ int ncpus, cpu = -1; -+ cpu_set_t *mask; -+ size_t size; -+ -+ ncpus = get_nprocs_conf(); -+ size = CPU_ALLOC_SIZE(ncpus); -+ mask = CPU_ALLOC(ncpus); -+ if (!mask) { -+ perror("malloc"); -+ return -1; -+ } - -- CPU_ZERO(&mask); -+ CPU_ZERO_S(size, mask); - -- if (sched_getaffinity(0, sizeof(mask), &mask)) { -+ if (sched_getaffinity(0, size, mask)) { - perror("sched_getaffinity"); -- return -1; -+ goto done; - } - - /* We prefer a primary thread, but skip 0 */ -- for (cpu = 8; cpu < CPU_SETSIZE; cpu += 8) -- if (CPU_ISSET(cpu, &mask)) -- return cpu; -+ for (cpu = 8; cpu < ncpus; cpu += 8) -+ if (CPU_ISSET_S(cpu, size, mask)) -+ goto done; - - /* Search for anything, but in reverse */ -- for (cpu = CPU_SETSIZE - 1; cpu >= 0; cpu--) -- if (CPU_ISSET(cpu, &mask)) -- return cpu; -+ for (cpu = ncpus - 1; cpu >= 0; cpu--) -+ if (CPU_ISSET_S(cpu, size, mask)) -+ goto done; - - printf("No cpus in affinity mask?!\n"); -- return -1; -+ -+done: -+ CPU_FREE(mask); -+ return cpu; - } - - bool is_ppc64le(void) -diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c -index 96bbda4f10fc..19c7351eeb74 100644 ---- a/tools/testing/selftests/seccomp/seccomp_bpf.c -+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c -@@ -177,7 +177,7 @@ struct seccomp_metadata { - #define SECCOMP_IOCTL_NOTIF_RECV SECCOMP_IOWR(0, struct seccomp_notif) - #define SECCOMP_IOCTL_NOTIF_SEND SECCOMP_IOWR(1, \ - struct seccomp_notif_resp) --#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOR(2, __u64) -+#define SECCOMP_IOCTL_NOTIF_ID_VALID SECCOMP_IOW(2, __u64) - - struct seccomp_notif { - __u64 id; diff --git a/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch b/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch deleted file mode 100644 index 280c19f64a..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.59-60.patch +++ /dev/null @@ -1,4875 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt -index c82794002595f..89647d7143879 100644 ---- a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt -+++ b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt -@@ -21,7 +21,7 @@ controller state. The mux controller state is described in - - Example: - mux: mux-controller { -- compatible = "mux-gpio"; -+ compatible = "gpio-mux"; - #mux-control-cells = <0>; - - mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>, -diff --git a/Makefile b/Makefile -index cc72b8472f24a..7c001e21e28e7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 59 -+SUBLEVEL = 60 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -index fbcf03f86c967..05dc58c13fa41 100644 ---- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -+++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts -@@ -19,6 +19,12 @@ - model = "Globalscale Marvell ESPRESSOBin Board"; - compatible = "globalscale,espressobin", "marvell,armada3720", "marvell,armada3710"; - -+ aliases { -+ ethernet0 = ð0; -+ serial0 = &uart0; -+ serial1 = &uart1; -+ }; -+ - chosen { - stdout-path = "serial0:115200n8"; - }; -diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c -index a0b4f1bca4917..19128d994ee97 100644 ---- a/arch/arm64/kernel/perf_event.c -+++ b/arch/arm64/kernel/perf_event.c -@@ -155,7 +155,7 @@ armv8pmu_events_sysfs_show(struct device *dev, - - pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr); - -- return sprintf(page, "event=0x%03llx\n", pmu_attr->id); -+ return sprintf(page, "event=0x%04llx\n", pmu_attr->id); - } - - #define ARMV8_EVENT_ATTR(name, config) \ -@@ -303,10 +303,13 @@ armv8pmu_event_attr_is_visible(struct kobject *kobj, - test_bit(pmu_attr->id, cpu_pmu->pmceid_bitmap)) - return attr->mode; - -- pmu_attr->id -= ARMV8_PMUV3_EXT_COMMON_EVENT_BASE; -- if (pmu_attr->id < ARMV8_PMUV3_MAX_COMMON_EVENTS && -- test_bit(pmu_attr->id, cpu_pmu->pmceid_ext_bitmap)) -- return attr->mode; -+ if (pmu_attr->id >= ARMV8_PMUV3_EXT_COMMON_EVENT_BASE) { -+ u64 id = pmu_attr->id - ARMV8_PMUV3_EXT_COMMON_EVENT_BASE; -+ -+ if (id < ARMV8_PMUV3_MAX_COMMON_EVENTS && -+ test_bit(id, cpu_pmu->pmceid_ext_bitmap)) -+ return attr->mode; -+ } - - return 0; - } -diff --git a/arch/mips/boot/dts/ingenic/qi_lb60.dts b/arch/mips/boot/dts/ingenic/qi_lb60.dts -index 7a371d9c5a33f..eda37fb516f0e 100644 ---- a/arch/mips/boot/dts/ingenic/qi_lb60.dts -+++ b/arch/mips/boot/dts/ingenic/qi_lb60.dts -@@ -69,7 +69,7 @@ - "Speaker", "OUTL", - "Speaker", "OUTR", - "INL", "LOUT", -- "INL", "ROUT"; -+ "INR", "ROUT"; - - simple-audio-card,aux-devs = <&>; - -diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c -index cd3e1f82e1a5d..08ad6371fbe08 100644 ---- a/arch/mips/kernel/topology.c -+++ b/arch/mips/kernel/topology.c -@@ -20,7 +20,7 @@ static int __init topology_init(void) - for_each_present_cpu(i) { - struct cpu *c = &per_cpu(cpu_devices, i); - -- c->hotpluggable = 1; -+ c->hotpluggable = !!i; - ret = register_cpu(c, i); - if (ret) - printk(KERN_WARNING "topology_init: register_cpu %d " -diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c -index 43f140a28bc72..54d38809e22cb 100644 ---- a/arch/openrisc/kernel/stacktrace.c -+++ b/arch/openrisc/kernel/stacktrace.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) - { - unsigned long *sp = NULL; - -+ if (!try_get_task_stack(tsk)) -+ return; -+ - if (tsk == current) - sp = (unsigned long *) &sp; -- else -- sp = (unsigned long *) KSTK_ESP(tsk); -+ else { -+ unsigned long ksp; -+ -+ /* Locate stack from kernel context */ -+ ksp = task_thread_info(tsk)->ksp; -+ ksp += STACK_FRAME_OVERHEAD; /* redzone */ -+ ksp += sizeof(struct pt_regs); -+ -+ sp = (unsigned long *) ksp; -+ } - - unwind_stack(trace, sp, save_stack_address_nosched); -+ -+ put_task_stack(tsk); - } - EXPORT_SYMBOL_GPL(save_stack_trace_tsk); - -diff --git a/arch/powerpc/include/asm/percpu.h b/arch/powerpc/include/asm/percpu.h -index dce863a7635cd..8e5b7d0b851c6 100644 ---- a/arch/powerpc/include/asm/percpu.h -+++ b/arch/powerpc/include/asm/percpu.h -@@ -10,8 +10,6 @@ - - #ifdef CONFIG_SMP - --#include -- - #define __my_cpu_offset local_paca->data_offset - - #endif /* CONFIG_SMP */ -@@ -19,4 +17,6 @@ - - #include - -+#include -+ - #endif /* _ASM_POWERPC_PERCPU_H_ */ -diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c -index 881a026a603a6..187047592d53c 100644 ---- a/arch/powerpc/mm/fault.c -+++ b/arch/powerpc/mm/fault.c -@@ -241,6 +241,9 @@ static bool bad_kernel_fault(struct pt_regs *regs, unsigned long error_code, - return false; - } - -+// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE -+#define SIGFRAME_MAX_SIZE (4096 + 128) -+ - static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, - struct vm_area_struct *vma, unsigned int flags, - bool *must_retry) -@@ -248,7 +251,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, - /* - * N.B. The POWER/Open ABI allows programs to access up to - * 288 bytes below the stack pointer. -- * The kernel signal delivery code writes up to about 1.5kB -+ * The kernel signal delivery code writes a bit over 4KB - * below the stack pointer (r1) before decrementing it. - * The exec code can write slightly over 640kB to the stack - * before setting the user r1. Thus we allow the stack to -@@ -273,7 +276,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address, - * between the last mapped region and the stack will - * expand the stack rather than segfaulting. - */ -- if (address + 2048 >= uregs->gpr[1]) -+ if (address + SIGFRAME_MAX_SIZE >= uregs->gpr[1]) - return false; - - if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) && -diff --git a/arch/powerpc/mm/ptdump/hashpagetable.c b/arch/powerpc/mm/ptdump/hashpagetable.c -index a07278027c6f4..a2e8c3b2cf351 100644 ---- a/arch/powerpc/mm/ptdump/hashpagetable.c -+++ b/arch/powerpc/mm/ptdump/hashpagetable.c -@@ -259,7 +259,7 @@ static int pseries_find(unsigned long ea, int psize, bool primary, u64 *v, u64 * - for (i = 0; i < HPTES_PER_GROUP; i += 4, hpte_group += 4) { - lpar_rc = plpar_pte_read_4(0, hpte_group, (void *)ptes); - -- if (lpar_rc != H_SUCCESS) -+ if (lpar_rc) - continue; - for (j = 0; j < 4; j++) { - if (HPTE_V_COMPARE(ptes[j].v, want_v) && -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index f1888352b4e0b..e7d23a933a0d3 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -27,7 +27,7 @@ static bool rtas_hp_event; - unsigned long pseries_memory_block_size(void) - { - struct device_node *np; -- unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE; -+ u64 memblock_size = MIN_MEMORY_BLOCK_SIZE; - struct resource r; - - np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory"); -diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c -index 16b4d8b0bb850..2c44b94f82fb2 100644 ---- a/arch/sh/boards/mach-landisk/setup.c -+++ b/arch/sh/boards/mach-landisk/setup.c -@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup); - - static void __init landisk_setup(char **cmdline_p) - { -+ /* I/O port identity mapping */ -+ __set_io_port_base(0); -+ - /* LED ON */ - __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); - -diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c -index 3c222d6fdee3b..187c72a58e69c 100644 ---- a/arch/x86/events/rapl.c -+++ b/arch/x86/events/rapl.c -@@ -642,7 +642,7 @@ static const struct attribute_group *rapl_attr_update[] = { - &rapl_events_pkg_group, - &rapl_events_ram_group, - &rapl_events_gpu_group, -- &rapl_events_gpu_group, -+ &rapl_events_psys_group, - NULL, - }; - -diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c -index df4d5385e6ddd..c8203694d9ce4 100644 ---- a/arch/x86/kernel/apic/vector.c -+++ b/arch/x86/kernel/apic/vector.c -@@ -554,6 +554,10 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, - irqd->chip_data = apicd; - irqd->hwirq = virq + i; - irqd_set_single_target(irqd); -+ -+ /* Don't invoke affinity setter on deactivated interrupts */ -+ irqd_set_affinity_on_activate(irqd); -+ - /* - * Legacy vectors are already assigned when the IOAPIC - * takes them over. They stay on the same vector. This is -diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c -index c65adaf813848..41200706e6da1 100644 ---- a/arch/x86/kernel/tsc_msr.c -+++ b/arch/x86/kernel/tsc_msr.c -@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = { - .mask = 0x0f, - }; - --/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ -+/* -+ * 24 MHz crystal? : 24 * 13 / 4 = 78 MHz -+ * Frequency step for Lightning Mountain SoC is fixed to 78 MHz, -+ * so all the frequency entries are 78000. -+ */ - static const struct freq_desc freq_desc_lgm = { - .use_msr_plat = true, -- .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, -+ .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000, -+ 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, - .mask = 0x0f, - }; - -diff --git a/arch/xtensa/include/asm/thread_info.h b/arch/xtensa/include/asm/thread_info.h -index f092cc3f4e66d..956d4d47c6cd1 100644 ---- a/arch/xtensa/include/asm/thread_info.h -+++ b/arch/xtensa/include/asm/thread_info.h -@@ -55,6 +55,10 @@ struct thread_info { - mm_segment_t addr_limit; /* thread address space */ - - unsigned long cpenable; -+#if XCHAL_HAVE_EXCLUSIVE -+ /* result of the most recent exclusive store */ -+ unsigned long atomctl8; -+#endif - - /* Allocate storage for extra user states and coprocessor states. */ - #if XTENSA_HAVE_COPROCESSORS -diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c -index 33a257b33723a..dc5c83cad9be8 100644 ---- a/arch/xtensa/kernel/asm-offsets.c -+++ b/arch/xtensa/kernel/asm-offsets.c -@@ -93,6 +93,9 @@ int main(void) - DEFINE(THREAD_RA, offsetof (struct task_struct, thread.ra)); - DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp)); - DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable)); -+#if XCHAL_HAVE_EXCLUSIVE -+ DEFINE(THREAD_ATOMCTL8, offsetof (struct thread_info, atomctl8)); -+#endif - #if XTENSA_HAVE_COPROCESSORS - DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0)); - DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1)); -diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S -index 9e3676879168a..59671603c9c62 100644 ---- a/arch/xtensa/kernel/entry.S -+++ b/arch/xtensa/kernel/entry.S -@@ -374,6 +374,11 @@ common_exception: - s32i a2, a1, PT_LCOUNT - #endif - -+#if XCHAL_HAVE_EXCLUSIVE -+ /* Clear exclusive access monitor set by interrupted code */ -+ clrex -+#endif -+ - /* It is now save to restore the EXC_TABLE_FIXUP variable. */ - - rsr a2, exccause -@@ -2024,6 +2029,12 @@ ENTRY(_switch_to) - s32i a3, a4, THREAD_CPENABLE - #endif - -+#if XCHAL_HAVE_EXCLUSIVE -+ l32i a3, a5, THREAD_ATOMCTL8 -+ getex a3 -+ s32i a3, a4, THREAD_ATOMCTL8 -+#endif -+ - /* Flush register file. */ - - spill_registers_kernel -diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c -index 9bae79f703013..86c9ba9631551 100644 ---- a/arch/xtensa/kernel/perf_event.c -+++ b/arch/xtensa/kernel/perf_event.c -@@ -401,7 +401,7 @@ static struct pmu xtensa_pmu = { - .read = xtensa_pmu_read, - }; - --static int xtensa_pmu_setup(int cpu) -+static int xtensa_pmu_setup(unsigned int cpu) - { - unsigned i; - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index a3b9df99af6de..35e026ba2c7ed 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, - - if (!ctx->used) - ctx->merge = 0; -+ ctx->init = ctx->more; - } - EXPORT_SYMBOL_GPL(af_alg_pull_tsgl); - -@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup); - * - * @sk socket of connection to user space - * @flags If MSG_DONTWAIT is set, then only report if function would sleep -+ * @min Set to minimum request size if partial requests are allowed. - * @return 0 when writable memory is available, < 0 upon error - */ --int af_alg_wait_for_data(struct sock *sk, unsigned flags) -+int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min) - { - DEFINE_WAIT_FUNC(wait, woken_wake_function); - struct alg_sock *ask = alg_sk(sk); -@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags) - if (signal_pending(current)) - break; - timeout = MAX_SCHEDULE_TIMEOUT; -- if (sk_wait_event(sk, &timeout, (ctx->used || !ctx->more), -+ if (sk_wait_event(sk, &timeout, -+ ctx->init && (!ctx->more || -+ (min && ctx->used >= min)), - &wait)) { - err = 0; - break; -@@ -843,10 +847,11 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - } - - lock_sock(sk); -- if (!ctx->more && ctx->used) { -+ if (ctx->init && (init || !ctx->more)) { - err = -EINVAL; - goto unlock; - } -+ ctx->init = true; - - if (init) { - ctx->enc = enc; -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 0ae000a61c7f5..43c6aa784858b 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - size_t usedpages = 0; /* [in] RX bufs to be used from user */ - size_t processed = 0; /* [in] TX bufs to be consumed */ - -- if (!ctx->used) { -- err = af_alg_wait_for_data(sk, flags); -+ if (!ctx->init || ctx->more) { -+ err = af_alg_wait_for_data(sk, flags, 0); - if (err) - return err; - } -@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) - - INIT_LIST_HEAD(&ctx->tsgl_list); - ctx->len = len; -- ctx->used = 0; -- atomic_set(&ctx->rcvused, 0); -- ctx->more = 0; -- ctx->merge = 0; -- ctx->enc = 0; -- ctx->aead_assoclen = 0; - crypto_init_wait(&ctx->wait); - - ask->private = ctx; -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index ec5567c87a6df..81c4022285a7c 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - int err = 0; - size_t len = 0; - -- if (!ctx->used) { -- err = af_alg_wait_for_data(sk, flags); -+ if (!ctx->init || (ctx->more && ctx->used < bs)) { -+ err = af_alg_wait_for_data(sk, flags, bs); - if (err) - return err; - } -@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) - ctx = sock_kmalloc(sk, len, GFP_KERNEL); - if (!ctx) - return -ENOMEM; -+ memset(ctx, 0, len); - - ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), - GFP_KERNEL); -@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) - sock_kfree_s(sk, ctx, len); - return -ENOMEM; - } -- - memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); - - INIT_LIST_HEAD(&ctx->tsgl_list); - ctx->len = len; -- ctx->used = 0; -- atomic_set(&ctx->rcvused, 0); -- ctx->more = 0; -- ctx->merge = 0; -- ctx->enc = 0; - crypto_init_wait(&ctx->wait); - - ask->private = ctx; -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index b25bcab2a26bd..1d5dd37f3abe4 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -872,7 +872,9 @@ static int __device_attach(struct device *dev, bool allow_async) - int ret = 0; - - device_lock(dev); -- if (dev->driver) { -+ if (dev->p->dead) { -+ goto out_unlock; -+ } else if (dev->driver) { - if (device_is_bound(dev)) { - ret = 1; - goto out_unlock; -diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c -index e2007ac4d235d..0eb83a0b70bcc 100644 ---- a/drivers/clk/actions/owl-s500.c -+++ b/drivers/clk/actions/owl-s500.c -@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0); - static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0); - - /* divider clocks */ --static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); -+static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); - static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0); - - /* factor clocks */ -diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c -index 6e5d635f030f4..45420b514149f 100644 ---- a/drivers/clk/bcm/clk-bcm2835.c -+++ b/drivers/clk/bcm/clk-bcm2835.c -@@ -314,6 +314,7 @@ struct bcm2835_cprman { - struct device *dev; - void __iomem *regs; - spinlock_t regs_lock; /* spinlock for all clocks */ -+ unsigned int soc; - - /* - * Real names of cprman clock parents looked up through -@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw) - A2W_PLL_CTRL_PRST_DISABLE; - } - -+static u32 bcm2835_pll_get_prediv_mask(struct bcm2835_cprman *cprman, -+ const struct bcm2835_pll_data *data) -+{ -+ /* -+ * On BCM2711 there isn't a pre-divisor available in the PLL feedback -+ * loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed -+ * for to for VCO RANGE bits. -+ */ -+ if (cprman->soc & SOC_BCM2711) -+ return 0; -+ -+ return data->ana->fb_prediv_mask; -+} -+ - static void bcm2835_pll_choose_ndiv_and_fdiv(unsigned long rate, - unsigned long parent_rate, - u32 *ndiv, u32 *fdiv) -@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw, - ndiv = (a2wctrl & A2W_PLL_CTRL_NDIV_MASK) >> A2W_PLL_CTRL_NDIV_SHIFT; - pdiv = (a2wctrl & A2W_PLL_CTRL_PDIV_MASK) >> A2W_PLL_CTRL_PDIV_SHIFT; - using_prediv = cprman_read(cprman, data->ana_reg_base + 4) & -- data->ana->fb_prediv_mask; -+ bcm2835_pll_get_prediv_mask(cprman, data); - - if (using_prediv) { - ndiv *= 2; -@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, - struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw); - struct bcm2835_cprman *cprman = pll->cprman; - const struct bcm2835_pll_data *data = pll->data; -+ u32 prediv_mask = bcm2835_pll_get_prediv_mask(cprman, data); - bool was_using_prediv, use_fb_prediv, do_ana_setup_first; - u32 ndiv, fdiv, a2w_ctl; - u32 ana[4]; -@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, - for (i = 3; i >= 0; i--) - ana[i] = cprman_read(cprman, data->ana_reg_base + i * 4); - -- was_using_prediv = ana[1] & data->ana->fb_prediv_mask; -+ was_using_prediv = ana[1] & prediv_mask; - - ana[0] &= ~data->ana->mask0; - ana[0] |= data->ana->set0; -@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, - ana[3] |= data->ana->set3; - - if (was_using_prediv && !use_fb_prediv) { -- ana[1] &= ~data->ana->fb_prediv_mask; -+ ana[1] &= ~prediv_mask; - do_ana_setup_first = true; - } else if (!was_using_prediv && use_fb_prediv) { -- ana[1] |= data->ana->fb_prediv_mask; -+ ana[1] |= prediv_mask; - do_ana_setup_first = false; - } else { - do_ana_setup_first = true; -@@ -2234,6 +2250,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, cprman); - - cprman->onecell.num = asize; -+ cprman->soc = pdata->soc; - hws = cprman->onecell.hws; - - for (i = 0; i < asize; i++) { -diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c -index 055318f979915..a69f53e435ed5 100644 ---- a/drivers/clk/qcom/clk-alpha-pll.c -+++ b/drivers/clk/qcom/clk-alpha-pll.c -@@ -55,7 +55,6 @@ - #define PLL_STATUS(p) ((p)->offset + (p)->regs[PLL_OFF_STATUS]) - #define PLL_OPMODE(p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE]) - #define PLL_FRAC(p) ((p)->offset + (p)->regs[PLL_OFF_FRAC]) --#define PLL_CAL_VAL(p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL]) - - const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { - [CLK_ALPHA_PLL_TYPE_DEFAULT] = { -@@ -114,7 +113,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { - [PLL_OFF_STATUS] = 0x30, - [PLL_OFF_OPMODE] = 0x38, - [PLL_OFF_ALPHA_VAL] = 0x40, -- [PLL_OFF_CAL_VAL] = 0x44, - }, - }; - EXPORT_SYMBOL_GPL(clk_alpha_pll_regs); -diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c -index bf5730832ef3d..c6fb57cd576f5 100644 ---- a/drivers/clk/qcom/gcc-sdm660.c -+++ b/drivers/clk/qcom/gcc-sdm660.c -@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = { - - static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = { - .halt_reg = 0x8a004, -+ .halt_check = BRANCH_HALT, -+ .hwcg_reg = 0x8a004, -+ .hwcg_bit = 1, - .clkr = { - .enable_reg = 0x8a004, - .enable_mask = BIT(0), -diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c -index fad42897a7a7f..ee908fbfeab17 100644 ---- a/drivers/clk/qcom/gcc-sm8150.c -+++ b/drivers/clk/qcom/gcc-sm8150.c -@@ -1616,6 +1616,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = { - }; - - static struct clk_branch gcc_gpu_gpll0_clk_src = { -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x52004, - .enable_mask = BIT(15), -@@ -1631,13 +1632,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = { - }; - - static struct clk_branch gcc_gpu_gpll0_div_clk_src = { -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x52004, - .enable_mask = BIT(16), - .hw.init = &(struct clk_init_data){ - .name = "gcc_gpu_gpll0_div_clk_src", - .parent_hws = (const struct clk_hw *[]){ -- &gcc_gpu_gpll0_clk_src.clkr.hw }, -+ &gpll0_out_even.clkr.hw }, - .num_parents = 1, - .flags = CLK_SET_RATE_PARENT, - .ops = &clk_branch2_ops, -@@ -1728,6 +1730,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = { - }; - - static struct clk_branch gcc_npu_gpll0_clk_src = { -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x52004, - .enable_mask = BIT(18), -@@ -1743,13 +1746,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = { - }; - - static struct clk_branch gcc_npu_gpll0_div_clk_src = { -+ .halt_check = BRANCH_HALT_SKIP, - .clkr = { - .enable_reg = 0x52004, - .enable_mask = BIT(19), - .hw.init = &(struct clk_init_data){ - .name = "gcc_npu_gpll0_div_clk_src", - .parent_hws = (const struct clk_hw *[]){ -- &gcc_npu_gpll0_clk_src.clkr.hw }, -+ &gpll0_out_even.clkr.hw }, - .num_parents = 1, - .flags = CLK_SET_RATE_PARENT, - .ops = &clk_branch2_ops, -diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c -index c84d5bab7ac28..b95483bb6a5ec 100644 ---- a/drivers/clk/sirf/clk-atlas6.c -+++ b/drivers/clk/sirf/clk-atlas6.c -@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np) - - for (i = pll1; i < maxclk; i++) { - atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]); -- BUG_ON(!atlas6_clks[i]); -+ BUG_ON(IS_ERR(atlas6_clks[i])); - } - clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu"); - clk_register_clkdev(atlas6_clks[io], NULL, "io"); -diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c -index 4ce9c2b4544a2..fdd994ee55e22 100644 ---- a/drivers/crypto/caam/caamalg.c -+++ b/drivers/crypto/caam/caamalg.c -@@ -818,12 +818,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher, - return skcipher_setkey(skcipher, key, keylen, ctx1_iv_off); - } - --static int arc4_skcipher_setkey(struct crypto_skcipher *skcipher, -- const u8 *key, unsigned int keylen) --{ -- return skcipher_setkey(skcipher, key, keylen, 0); --} -- - static int des_skcipher_setkey(struct crypto_skcipher *skcipher, - const u8 *key, unsigned int keylen) - { -@@ -2058,21 +2052,6 @@ static struct caam_skcipher_alg driver_algs[] = { - }, - .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB, - }, -- { -- .skcipher = { -- .base = { -- .cra_name = "ecb(arc4)", -- .cra_driver_name = "ecb-arc4-caam", -- .cra_blocksize = ARC4_BLOCK_SIZE, -- }, -- .setkey = arc4_skcipher_setkey, -- .encrypt = skcipher_encrypt, -- .decrypt = skcipher_decrypt, -- .min_keysize = ARC4_MIN_KEY_SIZE, -- .max_keysize = ARC4_MAX_KEY_SIZE, -- }, -- .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB, -- }, - }; - - static struct caam_aead_alg driver_aeads[] = { -@@ -3533,7 +3512,6 @@ int caam_algapi_init(struct device *ctrldev) - struct caam_drv_private *priv = dev_get_drvdata(ctrldev); - int i = 0, err = 0; - u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst; -- u32 arc4_inst; - unsigned int md_limit = SHA512_DIGEST_SIZE; - bool registered = false, gcm_support; - -@@ -3553,8 +3531,6 @@ int caam_algapi_init(struct device *ctrldev) - CHA_ID_LS_DES_SHIFT; - aes_inst = cha_inst & CHA_ID_LS_AES_MASK; - md_inst = (cha_inst & CHA_ID_LS_MD_MASK) >> CHA_ID_LS_MD_SHIFT; -- arc4_inst = (cha_inst & CHA_ID_LS_ARC4_MASK) >> -- CHA_ID_LS_ARC4_SHIFT; - ccha_inst = 0; - ptha_inst = 0; - -@@ -3575,7 +3551,6 @@ int caam_algapi_init(struct device *ctrldev) - md_inst = mdha & CHA_VER_NUM_MASK; - ccha_inst = rd_reg32(&priv->ctrl->vreg.ccha) & CHA_VER_NUM_MASK; - ptha_inst = rd_reg32(&priv->ctrl->vreg.ptha) & CHA_VER_NUM_MASK; -- arc4_inst = rd_reg32(&priv->ctrl->vreg.afha) & CHA_VER_NUM_MASK; - - gcm_support = aesa & CHA_VER_MISC_AES_GCM; - } -@@ -3598,10 +3573,6 @@ int caam_algapi_init(struct device *ctrldev) - if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) - continue; - -- /* Skip ARC4 algorithms if not supported by device */ -- if (!arc4_inst && alg_sel == OP_ALG_ALGSEL_ARC4) -- continue; -- - /* - * Check support for AES modes not available - * on LP devices. -diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h -index 60e2a54c19f11..c3c22a8de4c00 100644 ---- a/drivers/crypto/caam/compat.h -+++ b/drivers/crypto/caam/compat.h -@@ -43,7 +43,6 @@ - #include - #include - #include --#include - #include - #include - #include -diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c -index 47f529ce280ae..2718396083ee4 100644 ---- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c -+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn10/rv1_clk_mgr.c -@@ -85,12 +85,77 @@ static int rv1_determine_dppclk_threshold(struct clk_mgr_internal *clk_mgr, stru - return disp_clk_threshold; - } - --static void ramp_up_dispclk_with_dpp(struct clk_mgr_internal *clk_mgr, struct dc *dc, struct dc_clocks *new_clocks) -+static void ramp_up_dispclk_with_dpp( -+ struct clk_mgr_internal *clk_mgr, -+ struct dc *dc, -+ struct dc_clocks *new_clocks, -+ bool safe_to_lower) - { - int i; - int dispclk_to_dpp_threshold = rv1_determine_dppclk_threshold(clk_mgr, new_clocks); - bool request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz; - -+ /* this function is to change dispclk, dppclk and dprefclk according to -+ * bandwidth requirement. Its call stack is rv1_update_clocks --> -+ * update_clocks --> dcn10_prepare_bandwidth / dcn10_optimize_bandwidth -+ * --> prepare_bandwidth / optimize_bandwidth. before change dcn hw, -+ * prepare_bandwidth will be called first to allow enough clock, -+ * watermark for change, after end of dcn hw change, optimize_bandwidth -+ * is executed to lower clock to save power for new dcn hw settings. -+ * -+ * below is sequence of commit_planes_for_stream: -+ * -+ * step 1: prepare_bandwidth - raise clock to have enough bandwidth -+ * step 2: lock_doublebuffer_enable -+ * step 3: pipe_control_lock(true) - make dchubp register change will -+ * not take effect right way -+ * step 4: apply_ctx_for_surface - program dchubp -+ * step 5: pipe_control_lock(false) - dchubp register change take effect -+ * step 6: optimize_bandwidth --> dc_post_update_surfaces_to_stream -+ * for full_date, optimize clock to save power -+ * -+ * at end of step 1, dcn clocks (dprefclk, dispclk, dppclk) may be -+ * changed for new dchubp configuration. but real dcn hub dchubps are -+ * still running with old configuration until end of step 5. this need -+ * clocks settings at step 1 should not less than that before step 1. -+ * this is checked by two conditions: 1. if (should_set_clock(safe_to_lower -+ * , new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) || -+ * new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) -+ * 2. request_dpp_div = new_clocks->dispclk_khz > new_clocks->dppclk_khz -+ * -+ * the second condition is based on new dchubp configuration. dppclk -+ * for new dchubp may be different from dppclk before step 1. -+ * for example, before step 1, dchubps are as below: -+ * pipe 0: recout=(0,40,1920,980) viewport=(0,0,1920,979) -+ * pipe 1: recout=(0,0,1920,1080) viewport=(0,0,1920,1080) -+ * for dppclk for pipe0 need dppclk = dispclk -+ * -+ * new dchubp pipe split configuration: -+ * pipe 0: recout=(0,0,960,1080) viewport=(0,0,960,1080) -+ * pipe 1: recout=(960,0,960,1080) viewport=(960,0,960,1080) -+ * dppclk only needs dppclk = dispclk /2. -+ * -+ * dispclk, dppclk are not lock by otg master lock. they take effect -+ * after step 1. during this transition, dispclk are the same, but -+ * dppclk is changed to half of previous clock for old dchubp -+ * configuration between step 1 and step 6. This may cause p-state -+ * warning intermittently. -+ * -+ * for new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz, we -+ * need make sure dppclk are not changed to less between step 1 and 6. -+ * for new_clocks->dispclk_khz > clk_mgr_base->clks.dispclk_khz, -+ * new display clock is raised, but we do not know ratio of -+ * new_clocks->dispclk_khz and clk_mgr_base->clks.dispclk_khz, -+ * new_clocks->dispclk_khz /2 does not guarantee equal or higher than -+ * old dppclk. we could ignore power saving different between -+ * dppclk = displck and dppclk = dispclk / 2 between step 1 and step 6. -+ * as long as safe_to_lower = false, set dpclk = dispclk to simplify -+ * condition check. -+ * todo: review this change for other asic. -+ **/ -+ if (!safe_to_lower) -+ request_dpp_div = false; -+ - /* set disp clk to dpp clk threshold */ - - clk_mgr->funcs->set_dispclk(clk_mgr, dispclk_to_dpp_threshold); -@@ -206,7 +271,7 @@ static void rv1_update_clocks(struct clk_mgr *clk_mgr_base, - /* program dispclk on = as a w/a for sleep resume clock ramping issues */ - if (should_set_clock(safe_to_lower, new_clocks->dispclk_khz, clk_mgr_base->clks.dispclk_khz) - || new_clocks->dispclk_khz == clk_mgr_base->clks.dispclk_khz) { -- ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks); -+ ramp_up_dispclk_with_dpp(clk_mgr, dc, new_clocks, safe_to_lower); - clk_mgr_base->clks.dispclk_khz = new_clocks->dispclk_khz; - send_request_to_lower = true; - } -diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c -index 2e71ca3e19f58..09a3d8ae44491 100644 ---- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c -+++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c -@@ -2725,7 +2725,10 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr) - - static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr) - { -- return ci_is_smc_ram_running(hwmgr); -+ return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device, -+ CGS_IND_REG__SMC, FEATURE_STATUS, -+ VOLTAGE_CONTROLLER_ON)) -+ ? true : false; - } - - static int ci_smu_init(struct pp_hwmgr *hwmgr) -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 006d6087700fb..2de1eebe591f9 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -3369,11 +3369,11 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, - { - int ret; - -- port = drm_dp_mst_topology_get_port_validated(mgr, port); -- if (!port) -+ if (slots < 0) - return false; - -- if (slots < 0) -+ port = drm_dp_mst_topology_get_port_validated(mgr, port); -+ if (!port) - return false; - - if (port->vcpi.vcpi > 0) { -@@ -3389,6 +3389,7 @@ bool drm_dp_mst_allocate_vcpi(struct drm_dp_mst_topology_mgr *mgr, - if (ret) { - DRM_DEBUG_KMS("failed to init vcpi slots=%d max=63 ret=%d\n", - DIV_ROUND_UP(pbn, mgr->pbn_div), ret); -+ drm_dp_mst_topology_put_port(port); - goto out; - } - DRM_DEBUG_KMS("initing vcpi for pbn=%d slots=%d\n", -diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c -index d00ea384dcbfe..58f5dc2f6dd52 100644 ---- a/drivers/gpu/drm/drm_panel_orientation_quirks.c -+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c -@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = { - DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), - }, - .driver_data = (void *)&lcd800x1280_rightside_up, -+ }, { /* Asus T103HAF */ -+ .matches = { -+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), -+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), -+ }, -+ .driver_data = (void *)&lcd800x1280_rightside_up, - }, { /* GPD MicroPC (generic strings, also match on bios date) */ - .matches = { - DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), -diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c -index 9af5a08d5490f..d6629fc869f3f 100644 ---- a/drivers/gpu/drm/imx/imx-ldb.c -+++ b/drivers/gpu/drm/imx/imx-ldb.c -@@ -302,18 +302,19 @@ static void imx_ldb_encoder_disable(struct drm_encoder *encoder) - { - struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder); - struct imx_ldb *ldb = imx_ldb_ch->ldb; -+ int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN; - int mux, ret; - - drm_panel_disable(imx_ldb_ch->panel); - -- if (imx_ldb_ch == &ldb->channel[0]) -+ if (imx_ldb_ch == &ldb->channel[0] || dual) - ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK; -- else if (imx_ldb_ch == &ldb->channel[1]) -+ if (imx_ldb_ch == &ldb->channel[1] || dual) - ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK; - - regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl); - -- if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) { -+ if (dual) { - clk_disable_unprepare(ldb->clk[0]); - clk_disable_unprepare(ldb->clk[1]); - } -diff --git a/drivers/gpu/drm/panfrost/panfrost_gem.c b/drivers/gpu/drm/panfrost/panfrost_gem.c -index 77c3a3855c682..c05e013bb8e3d 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_gem.c -+++ b/drivers/gpu/drm/panfrost/panfrost_gem.c -@@ -46,7 +46,7 @@ static void panfrost_gem_free_object(struct drm_gem_object *obj) - sg_free_table(&bo->sgts[i]); - } - } -- kfree(bo->sgts); -+ kvfree(bo->sgts); - } - - drm_gem_shmem_free_object(obj); -diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c -index 5d75f8cf64776..3dc9b30a64b01 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_mmu.c -+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c -@@ -486,7 +486,7 @@ static int panfrost_mmu_map_fault_addr(struct panfrost_device *pfdev, int as, - pages = kvmalloc_array(bo->base.base.size >> PAGE_SHIFT, - sizeof(struct page *), GFP_KERNEL | __GFP_ZERO); - if (!pages) { -- kfree(bo->sgts); -+ kvfree(bo->sgts); - bo->sgts = NULL; - mutex_unlock(&bo->base.pages_lock); - ret = -ENOMEM; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index f47d5710cc951..33b1519887474 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -2666,7 +2666,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, - ++i; - } - -- if (i != unit) { -+ if (&con->head == &dev_priv->dev->mode_config.connector_list) { - DRM_ERROR("Could not find initial display unit.\n"); - ret = -EINVAL; - goto out_unlock; -@@ -2690,13 +2690,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, - break; - } - -- if (mode->type & DRM_MODE_TYPE_PREFERRED) -- *p_mode = mode; -- else { -+ if (&mode->head == &con->modes) { - WARN_ONCE(true, "Could not find initial preferred mode.\n"); - *p_mode = list_first_entry(&con->modes, - struct drm_display_mode, - head); -+ } else { -+ *p_mode = mode; - } - - out_unlock: -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c -index 5702219ec38f6..7b54c1f56208f 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c -@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) - struct vmw_legacy_display_unit *entry; - struct drm_framebuffer *fb = NULL; - struct drm_crtc *crtc = NULL; -- int i = 0; -+ int i; - - /* If there is no display topology the host just assumes - * that the guest will set the same layout as the host. -@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) - crtc = &entry->base.crtc; - w = max(w, crtc->x + crtc->mode.hdisplay); - h = max(h, crtc->y + crtc->mode.vdisplay); -- i++; - } - - if (crtc == NULL) - return 0; -- fb = entry->base.crtc.primary->state->fb; -+ fb = crtc->primary->state->fb; - - return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0], - fb->format->cpp[0] * 8, -diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c -index eeca50d9a1ee4..aa1d4b6d278f7 100644 ---- a/drivers/gpu/ipu-v3/ipu-image-convert.c -+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c -@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx; - struct ipu_image_convert_chan; - struct ipu_image_convert_priv; - -+enum eof_irq_mask { -+ EOF_IRQ_IN = BIT(0), -+ EOF_IRQ_ROT_IN = BIT(1), -+ EOF_IRQ_OUT = BIT(2), -+ EOF_IRQ_ROT_OUT = BIT(3), -+}; -+ -+#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT) -+#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \ -+ EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT) -+ - struct ipu_image_convert_ctx { - struct ipu_image_convert_chan *chan; - -@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx { - /* where to place converted tile in dest image */ - unsigned int out_tile_map[MAX_TILES]; - -+ /* mask of completed EOF irqs at every tile conversion */ -+ enum eof_irq_mask eof_mask; -+ - struct list_head list; - }; - -@@ -189,6 +203,8 @@ struct ipu_image_convert_chan { - struct ipuv3_channel *rotation_out_chan; - - /* the IPU end-of-frame irqs */ -+ int in_eof_irq; -+ int rot_in_eof_irq; - int out_eof_irq; - int rot_out_eof_irq; - -@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile) - dev_dbg(priv->ipu->dev, "%s: task %u: starting ctx %p run %p tile %u -> %u\n", - __func__, chan->ic_task, ctx, run, tile, dst_tile); - -+ /* clear EOF irq mask */ -+ ctx->eof_mask = 0; -+ - if (ipu_rot_mode_is_irt(ctx->rot_mode)) { - /* swap width/height for resizer */ - dest_width = d_image->tile[dst_tile].height; -@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx) - } - - /* hold irqlock when calling */ --static irqreturn_t do_irq(struct ipu_image_convert_run *run) -+static irqreturn_t do_tile_complete(struct ipu_image_convert_run *run) - { - struct ipu_image_convert_ctx *ctx = run->ctx; - struct ipu_image_convert_chan *chan = ctx->chan; -@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run) - ctx->cur_buf_num ^= 1; - } - -+ ctx->eof_mask = 0; /* clear EOF irq mask for next tile */ - ctx->next_tile++; - return IRQ_HANDLED; - done: -@@ -1709,13 +1729,15 @@ done: - return IRQ_WAKE_THREAD; - } - --static irqreturn_t norotate_irq(int irq, void *data) -+static irqreturn_t eof_irq(int irq, void *data) - { - struct ipu_image_convert_chan *chan = data; -+ struct ipu_image_convert_priv *priv = chan->priv; - struct ipu_image_convert_ctx *ctx; - struct ipu_image_convert_run *run; -+ irqreturn_t ret = IRQ_HANDLED; -+ bool tile_complete = false; - unsigned long flags; -- irqreturn_t ret; - - spin_lock_irqsave(&chan->irqlock, flags); - -@@ -1728,46 +1750,33 @@ static irqreturn_t norotate_irq(int irq, void *data) - - ctx = run->ctx; - -- if (ipu_rot_mode_is_irt(ctx->rot_mode)) { -- /* this is a rotation operation, just ignore */ -- spin_unlock_irqrestore(&chan->irqlock, flags); -- return IRQ_HANDLED; -- } -- -- ret = do_irq(run); --out: -- spin_unlock_irqrestore(&chan->irqlock, flags); -- return ret; --} -- --static irqreturn_t rotate_irq(int irq, void *data) --{ -- struct ipu_image_convert_chan *chan = data; -- struct ipu_image_convert_priv *priv = chan->priv; -- struct ipu_image_convert_ctx *ctx; -- struct ipu_image_convert_run *run; -- unsigned long flags; -- irqreturn_t ret; -- -- spin_lock_irqsave(&chan->irqlock, flags); -- -- /* get current run and its context */ -- run = chan->current_run; -- if (!run) { -+ if (irq == chan->in_eof_irq) { -+ ctx->eof_mask |= EOF_IRQ_IN; -+ } else if (irq == chan->out_eof_irq) { -+ ctx->eof_mask |= EOF_IRQ_OUT; -+ } else if (irq == chan->rot_in_eof_irq || -+ irq == chan->rot_out_eof_irq) { -+ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { -+ /* this was NOT a rotation op, shouldn't happen */ -+ dev_err(priv->ipu->dev, -+ "Unexpected rotation interrupt\n"); -+ goto out; -+ } -+ ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ? -+ EOF_IRQ_ROT_IN : EOF_IRQ_ROT_OUT; -+ } else { -+ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq); - ret = IRQ_NONE; - goto out; - } - -- ctx = run->ctx; -- -- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { -- /* this was NOT a rotation operation, shouldn't happen */ -- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n"); -- spin_unlock_irqrestore(&chan->irqlock, flags); -- return IRQ_HANDLED; -- } -+ if (ipu_rot_mode_is_irt(ctx->rot_mode)) -+ tile_complete = (ctx->eof_mask == EOF_IRQ_ROT_COMPLETE); -+ else -+ tile_complete = (ctx->eof_mask == EOF_IRQ_COMPLETE); - -- ret = do_irq(run); -+ if (tile_complete) -+ ret = do_tile_complete(run); - out: - spin_unlock_irqrestore(&chan->irqlock, flags); - return ret; -@@ -1801,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx) - - static void release_ipu_resources(struct ipu_image_convert_chan *chan) - { -+ if (chan->in_eof_irq >= 0) -+ free_irq(chan->in_eof_irq, chan); -+ if (chan->rot_in_eof_irq >= 0) -+ free_irq(chan->rot_in_eof_irq, chan); - if (chan->out_eof_irq >= 0) - free_irq(chan->out_eof_irq, chan); - if (chan->rot_out_eof_irq >= 0) -@@ -1819,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan) - - chan->in_chan = chan->out_chan = chan->rotation_in_chan = - chan->rotation_out_chan = NULL; -- chan->out_eof_irq = chan->rot_out_eof_irq = -1; -+ chan->in_eof_irq = -1; -+ chan->rot_in_eof_irq = -1; -+ chan->out_eof_irq = -1; -+ chan->rot_out_eof_irq = -1; -+} -+ -+static int get_eof_irq(struct ipu_image_convert_chan *chan, -+ struct ipuv3_channel *channel) -+{ -+ struct ipu_image_convert_priv *priv = chan->priv; -+ int ret, irq; -+ -+ irq = ipu_idmac_channel_irq(priv->ipu, channel, IPU_IRQ_EOF); -+ -+ ret = request_threaded_irq(irq, eof_irq, do_bh, 0, "ipu-ic", chan); -+ if (ret < 0) { -+ dev_err(priv->ipu->dev, "could not acquire irq %d\n", irq); -+ return ret; -+ } -+ -+ return irq; - } - - static int get_ipu_resources(struct ipu_image_convert_chan *chan) -@@ -1855,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) - } - - /* acquire the EOF interrupts */ -- chan->out_eof_irq = ipu_idmac_channel_irq(priv->ipu, -- chan->out_chan, -- IPU_IRQ_EOF); -+ ret = get_eof_irq(chan, chan->in_chan); -+ if (ret < 0) { -+ chan->in_eof_irq = -1; -+ goto err; -+ } -+ chan->in_eof_irq = ret; - -- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh, -- 0, "ipu-ic", chan); -+ ret = get_eof_irq(chan, chan->rotation_in_chan); - if (ret < 0) { -- dev_err(priv->ipu->dev, "could not acquire irq %d\n", -- chan->out_eof_irq); -- chan->out_eof_irq = -1; -+ chan->rot_in_eof_irq = -1; - goto err; - } -+ chan->rot_in_eof_irq = ret; - -- chan->rot_out_eof_irq = ipu_idmac_channel_irq(priv->ipu, -- chan->rotation_out_chan, -- IPU_IRQ_EOF); -+ ret = get_eof_irq(chan, chan->out_chan); -+ if (ret < 0) { -+ chan->out_eof_irq = -1; -+ goto err; -+ } -+ chan->out_eof_irq = ret; - -- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh, -- 0, "ipu-ic", chan); -+ ret = get_eof_irq(chan, chan->rotation_out_chan); - if (ret < 0) { -- dev_err(priv->ipu->dev, "could not acquire irq %d\n", -- chan->rot_out_eof_irq); - chan->rot_out_eof_irq = -1; - goto err; - } -+ chan->rot_out_eof_irq = ret; - - return 0; - err: -@@ -2458,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev) - chan->ic_task = i; - chan->priv = priv; - chan->dma_ch = &image_convert_dma_chan[i]; -+ chan->in_eof_irq = -1; -+ chan->rot_in_eof_irq = -1; - chan->out_eof_irq = -1; - chan->rot_out_eof_irq = -1; - -diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c -index 03475f1799730..dd9661c11782a 100644 ---- a/drivers/i2c/busses/i2c-bcm-iproc.c -+++ b/drivers/i2c/busses/i2c-bcm-iproc.c -@@ -1037,7 +1037,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) - if (!iproc_i2c->slave) - return -EINVAL; - -- iproc_i2c->slave = NULL; -+ disable_irq(iproc_i2c->irq); - - /* disable all slave interrupts */ - tmp = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET); -@@ -1050,6 +1050,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) - tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT); - iproc_i2c_wr_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET, tmp); - -+ /* flush TX/RX FIFOs */ -+ tmp = (BIT(S_FIFO_RX_FLUSH_SHIFT) | BIT(S_FIFO_TX_FLUSH_SHIFT)); -+ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, tmp); -+ -+ /* clear all pending slave interrupts */ -+ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, ISR_MASK_SLAVE); -+ -+ iproc_i2c->slave = NULL; -+ -+ enable_irq(iproc_i2c->irq); -+ - return 0; - } - -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index 36af8fdb66586..0b90aa0318df3 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -580,13 +580,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); - } - -- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); -+ /* Clear SSR, too, because of old STOPs to other clients than us */ -+ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); - } - - /* master sent stop */ - if (ssr_filtered & SSR) { - i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); -- rcar_i2c_write(priv, ICSIER, SAR | SSR); -+ rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); - } - -@@ -850,7 +851,7 @@ static int rcar_reg_slave(struct i2c_client *slave) - priv->slave = slave; - rcar_i2c_write(priv, ICSAR, slave->addr); - rcar_i2c_write(priv, ICSSR, 0); -- rcar_i2c_write(priv, ICSIER, SAR | SSR); -+ rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSCR, SIE | SDBS); - - return 0; -@@ -862,12 +863,14 @@ static int rcar_unreg_slave(struct i2c_client *slave) - - WARN_ON(!priv->slave); - -- /* disable irqs and ensure none is running before clearing ptr */ -+ /* ensure no irq is running before clearing ptr */ -+ disable_irq(priv->irq); - rcar_i2c_write(priv, ICSIER, 0); -- rcar_i2c_write(priv, ICSCR, 0); -+ rcar_i2c_write(priv, ICSSR, 0); -+ enable_irq(priv->irq); -+ rcar_i2c_write(priv, ICSCR, SDBS); - rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ - -- synchronize_irq(priv->irq); - priv->slave = NULL; - - pm_runtime_put(rcar_i2c_priv_to_dev(priv)); -diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c -index 2d897e64c6a9e..424922cad1e39 100644 ---- a/drivers/iio/dac/ad5592r-base.c -+++ b/drivers/iio/dac/ad5592r-base.c -@@ -416,7 +416,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, - s64 tmp = *val * (3767897513LL / 25LL); - *val = div_s64_rem(tmp, 1000000000LL, val2); - -- ret = IIO_VAL_INT_PLUS_MICRO; -+ return IIO_VAL_INT_PLUS_MICRO; - } else { - int mult; - -@@ -447,7 +447,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev, - ret = IIO_VAL_INT; - break; - default: -- ret = -EINVAL; -+ return -EINVAL; - } - - unlock: -diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c -index 11210bf7fd61b..f454d63008d69 100644 ---- a/drivers/infiniband/core/counters.c -+++ b/drivers/infiniband/core/counters.c -@@ -284,7 +284,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port) - struct rdma_counter *counter; - int ret; - -- if (!qp->res.valid) -+ if (!qp->res.valid || rdma_is_kernel_res(&qp->res)) - return 0; - - if (!rdma_is_port_valid(dev, port)) -@@ -487,7 +487,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port, - goto err; - } - -- if (counter->res.task != qp->res.task) { -+ if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res)) { - ret = -EINVAL; - goto err_task; - } -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index e2ddcb0dc4ee3..c398d1a64614c 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -757,6 +757,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) - mr->uobject = uobj; - atomic_inc(&pd->usecnt); - mr->res.type = RDMA_RESTRACK_MR; -+ mr->iova = cmd.hca_va; - rdma_restrack_uadd(&mr->res); - - uobj->object = mr; -@@ -847,6 +848,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) - atomic_dec(&old_pd->usecnt); - } - -+ if (cmd.flags & IB_MR_REREG_TRANS) -+ mr->iova = cmd.hca_va; -+ - memset(&resp, 0, sizeof(resp)); - resp.lkey = mr->lkey; - resp.rkey = mr->rkey; -diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c -index 35c284af574da..dcb58cef336d9 100644 ---- a/drivers/infiniband/hw/cxgb4/mem.c -+++ b/drivers/infiniband/hw/cxgb4/mem.c -@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag) - mmid = stag >> 8; - mhp->ibmr.rkey = mhp->ibmr.lkey = stag; - mhp->ibmr.length = mhp->attr.len; -- mhp->ibmr.iova = mhp->attr.va_fbo; - mhp->ibmr.page_size = 1U << (mhp->attr.page_size + 12); - pr_debug("mmid 0x%x mhp %p\n", mmid, mhp); - return xa_insert_irq(&mhp->rhp->mrs, mmid, mhp, GFP_KERNEL); -diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c -index 6ae503cfc5264..9114cb7307692 100644 ---- a/drivers/infiniband/hw/mlx4/mr.c -+++ b/drivers/infiniband/hw/mlx4/mr.c -@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, - - mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key; - mr->ibmr.length = length; -- mr->ibmr.iova = virt_addr; - mr->ibmr.page_size = 1U << shift; - - return &mr->ibmr; -diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h -index 0e5f27caf2b2d..50a3557386090 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib.h -+++ b/drivers/infiniband/ulp/ipoib/ipoib.h -@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev); - - int ipoib_ib_dev_open_default(struct net_device *dev); - int ipoib_ib_dev_open(struct net_device *dev); --int ipoib_ib_dev_stop(struct net_device *dev); -+void ipoib_ib_dev_stop(struct net_device *dev); - void ipoib_ib_dev_up(struct net_device *dev); - void ipoib_ib_dev_down(struct net_device *dev); - int ipoib_ib_dev_stop_default(struct net_device *dev); -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c -index da3c5315bbb51..494f413dc3c6c 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c -@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, - return rc; - } - --static void __ipoib_reap_ah(struct net_device *dev) -+static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv) - { -- struct ipoib_dev_priv *priv = ipoib_priv(dev); - struct ipoib_ah *ah, *tah; - unsigned long flags; - -- netif_tx_lock_bh(dev); -+ netif_tx_lock_bh(priv->dev); - spin_lock_irqsave(&priv->lock, flags); - - list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list) -@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev) - } - - spin_unlock_irqrestore(&priv->lock, flags); -- netif_tx_unlock_bh(dev); -+ netif_tx_unlock_bh(priv->dev); - } - - void ipoib_reap_ah(struct work_struct *work) - { - struct ipoib_dev_priv *priv = - container_of(work, struct ipoib_dev_priv, ah_reap_task.work); -- struct net_device *dev = priv->dev; - -- __ipoib_reap_ah(dev); -+ ipoib_reap_dead_ahs(priv); - - if (!test_bit(IPOIB_STOP_REAPER, &priv->flags)) - queue_delayed_work(priv->wq, &priv->ah_reap_task, - round_jiffies_relative(HZ)); - } - --static void ipoib_flush_ah(struct net_device *dev) -+static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv) - { -- struct ipoib_dev_priv *priv = ipoib_priv(dev); -- -- cancel_delayed_work(&priv->ah_reap_task); -- flush_workqueue(priv->wq); -- ipoib_reap_ah(&priv->ah_reap_task.work); -+ clear_bit(IPOIB_STOP_REAPER, &priv->flags); -+ queue_delayed_work(priv->wq, &priv->ah_reap_task, -+ round_jiffies_relative(HZ)); - } - --static void ipoib_stop_ah(struct net_device *dev) -+static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv) - { -- struct ipoib_dev_priv *priv = ipoib_priv(dev); -- - set_bit(IPOIB_STOP_REAPER, &priv->flags); -- ipoib_flush_ah(dev); -+ cancel_delayed_work(&priv->ah_reap_task); -+ /* -+ * After ipoib_stop_ah_reaper() we always go through -+ * ipoib_reap_dead_ahs() which ensures the work is really stopped and -+ * does a final flush out of the dead_ah's list -+ */ - } - - static int recvs_pending(struct net_device *dev) -@@ -846,18 +845,6 @@ timeout: - return 0; - } - --int ipoib_ib_dev_stop(struct net_device *dev) --{ -- struct ipoib_dev_priv *priv = ipoib_priv(dev); -- -- priv->rn_ops->ndo_stop(dev); -- -- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); -- ipoib_flush_ah(dev); -- -- return 0; --} -- - int ipoib_ib_dev_open_default(struct net_device *dev) - { - struct ipoib_dev_priv *priv = ipoib_priv(dev); -@@ -901,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev) - return -1; - } - -- clear_bit(IPOIB_STOP_REAPER, &priv->flags); -- queue_delayed_work(priv->wq, &priv->ah_reap_task, -- round_jiffies_relative(HZ)); -- -+ ipoib_start_ah_reaper(priv); - if (priv->rn_ops->ndo_open(dev)) { - pr_warn("%s: Failed to open dev\n", dev->name); - goto dev_stop; -@@ -915,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev) - return 0; - - dev_stop: -- set_bit(IPOIB_STOP_REAPER, &priv->flags); -- cancel_delayed_work(&priv->ah_reap_task); -- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); -- ipoib_ib_dev_stop(dev); -+ ipoib_stop_ah_reaper(priv); - return -1; - } - -+void ipoib_ib_dev_stop(struct net_device *dev) -+{ -+ struct ipoib_dev_priv *priv = ipoib_priv(dev); -+ -+ priv->rn_ops->ndo_stop(dev); -+ -+ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); -+ ipoib_stop_ah_reaper(priv); -+} -+ - void ipoib_pkey_dev_check_presence(struct net_device *dev) - { - struct ipoib_dev_priv *priv = ipoib_priv(dev); -@@ -1232,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, - ipoib_mcast_dev_flush(dev); - if (oper_up) - set_bit(IPOIB_FLAG_OPER_UP, &priv->flags); -- ipoib_flush_ah(dev); -+ ipoib_reap_dead_ahs(priv); - } - - if (level >= IPOIB_FLUSH_NORMAL) -@@ -1307,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) - * the neighbor garbage collection is stopped and reaped. - * That should all be done now, so make a final ah flush. - */ -- ipoib_stop_ah(dev); -+ ipoib_reap_dead_ahs(priv); - - clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags); - -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c -index 4fd095fd63b6f..044bcacad6e48 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c -@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev) - - /* no more works over the priv->wq */ - if (priv->wq) { -+ /* See ipoib_mcast_carrier_on_task() */ -+ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)); - flush_workqueue(priv->wq); - destroy_workqueue(priv->wq); - priv->wq = NULL; -diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c -index e99d9bf1a267d..e78c4c7eda34d 100644 ---- a/drivers/input/mouse/sentelic.c -+++ b/drivers/input/mouse/sentelic.c -@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data, - - fsp_reg_write_enable(psmouse, false); - -- return count; -+ return retval; - } - - PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg); -diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c -index 8e19bfa94121e..a99afb5d9011c 100644 ---- a/drivers/iommu/omap-iommu-debug.c -+++ b/drivers/iommu/omap-iommu-debug.c -@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf, - mutex_lock(&iommu_debug_lock); - - bytes = omap_iommu_dump_ctx(obj, p, count); -+ if (bytes < 0) -+ goto err; - bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes); - -+err: - mutex_unlock(&iommu_debug_lock); - kfree(buf); - -diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c -index 263cf9240b168..7966b19ceba79 100644 ---- a/drivers/irqchip/irq-gic-v3-its.c -+++ b/drivers/irqchip/irq-gic-v3-its.c -@@ -2581,6 +2581,7 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, - msi_alloc_info_t *info = args; - struct its_device *its_dev = info->scratchpad[0].ptr; - struct its_node *its = its_dev->its; -+ struct irq_data *irqd; - irq_hw_number_t hwirq; - int err; - int i; -@@ -2600,7 +2601,9 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq, - - irq_domain_set_hwirq_and_chip(domain, virq + i, - hwirq + i, &its_irq_chip, its_dev); -- irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i))); -+ irqd = irq_get_irq_data(virq + i); -+ irqd_set_single_target(irqd); -+ irqd_set_affinity_on_activate(irqd); - pr_debug("ID:%d pID:%d vID:%d\n", - (int)(hwirq + i - its_dev->event_map.lpi_base), - (int)(hwirq + i), virq + i); -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index 3d2b63585da95..217c838a1b405 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -264,7 +264,7 @@ struct bcache_device { - #define BCACHE_DEV_UNLINK_DONE 2 - #define BCACHE_DEV_WB_RUNNING 3 - #define BCACHE_DEV_RATE_DW_RUNNING 4 -- unsigned int nr_stripes; -+ int nr_stripes; - unsigned int stripe_size; - atomic_t *stripe_sectors_dirty; - unsigned long *full_dirty_stripes; -diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c -index 08768796b5439..fda68c00ddd53 100644 ---- a/drivers/md/bcache/bset.c -+++ b/drivers/md/bcache/bset.c -@@ -321,7 +321,7 @@ int bch_btree_keys_alloc(struct btree_keys *b, - - b->page_order = page_order; - -- t->data = (void *) __get_free_pages(gfp, b->page_order); -+ t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order); - if (!t->data) - goto err; - -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 3c1109fceb2fb..46556bde032e2 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -840,7 +840,7 @@ int bch_btree_cache_alloc(struct cache_set *c) - mutex_init(&c->verify_lock); - - c->verify_ondisk = (void *) -- __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c))); -+ __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c))); - - c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL); - -diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c -index 6730820780b06..8250d2d1d780c 100644 ---- a/drivers/md/bcache/journal.c -+++ b/drivers/md/bcache/journal.c -@@ -1002,8 +1002,8 @@ int bch_journal_alloc(struct cache_set *c) - j->w[1].c = c; - - if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) || -- !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) || -- !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS))) -+ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS)) || -+ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, JSET_BITS))) - return -ENOMEM; - - return 0; -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 168d647078591..25ad64a3919f6 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1754,7 +1754,7 @@ void bch_cache_set_unregister(struct cache_set *c) - } - - #define alloc_bucket_pages(gfp, c) \ -- ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c)))) -+ ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, ilog2(bucket_pages(c)))) - - struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) - { -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index d60268fe49e10..0b02210ab4355 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -519,15 +519,19 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned int inode, - uint64_t offset, int nr_sectors) - { - struct bcache_device *d = c->devices[inode]; -- unsigned int stripe_offset, stripe, sectors_dirty; -+ unsigned int stripe_offset, sectors_dirty; -+ int stripe; - - if (!d) - return; - -+ stripe = offset_to_stripe(d, offset); -+ if (stripe < 0) -+ return; -+ - if (UUID_FLASH_ONLY(&c->uuids[inode])) - atomic_long_add(nr_sectors, &c->flash_dev_dirty_sectors); - -- stripe = offset_to_stripe(d, offset); - stripe_offset = offset & (d->stripe_size - 1); - - while (nr_sectors) { -@@ -567,12 +571,12 @@ static bool dirty_pred(struct keybuf *buf, struct bkey *k) - static void refill_full_stripes(struct cached_dev *dc) - { - struct keybuf *buf = &dc->writeback_keys; -- unsigned int start_stripe, stripe, next_stripe; -+ unsigned int start_stripe, next_stripe; -+ int stripe; - bool wrapped = false; - - stripe = offset_to_stripe(&dc->disk, KEY_OFFSET(&buf->last_scanned)); -- -- if (stripe >= dc->disk.nr_stripes) -+ if (stripe < 0) - stripe = 0; - - start_stripe = stripe; -diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h -index 4e4c6810dc3c7..c4ff76037227b 100644 ---- a/drivers/md/bcache/writeback.h -+++ b/drivers/md/bcache/writeback.h -@@ -33,10 +33,22 @@ static inline uint64_t bcache_dev_sectors_dirty(struct bcache_device *d) - return ret; - } - --static inline unsigned int offset_to_stripe(struct bcache_device *d, -+static inline int offset_to_stripe(struct bcache_device *d, - uint64_t offset) - { - do_div(offset, d->stripe_size); -+ -+ /* d->nr_stripes is in range [1, INT_MAX] */ -+ if (unlikely(offset >= d->nr_stripes)) { -+ pr_err("Invalid stripe %llu (>= nr_stripes %d).\n", -+ offset, d->nr_stripes); -+ return -EINVAL; -+ } -+ -+ /* -+ * Here offset is definitly smaller than INT_MAX, -+ * return it as int will never overflow. -+ */ - return offset; - } - -@@ -44,7 +56,10 @@ static inline bool bcache_dev_stripe_dirty(struct cached_dev *dc, - uint64_t offset, - unsigned int nr_sectors) - { -- unsigned int stripe = offset_to_stripe(&dc->disk, offset); -+ int stripe = offset_to_stripe(&dc->disk, offset); -+ -+ if (stripe < 0) -+ return false; - - while (1) { - if (atomic_read(dc->disk.stripe_sectors_dirty + stripe)) -diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c -index 3f8577e2c13be..2bd2444ad99c6 100644 ---- a/drivers/md/dm-rq.c -+++ b/drivers/md/dm-rq.c -@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q) - - void dm_stop_queue(struct request_queue *q) - { -- if (blk_mq_queue_stopped(q)) -- return; -- - blk_mq_quiesce_queue(q); - } - -diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c -index 73fd50e779754..d50737ec40394 100644 ---- a/drivers/md/md-cluster.c -+++ b/drivers/md/md-cluster.c -@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz - bitmap = get_bitmap_from_slot(mddev, i); - if (IS_ERR(bitmap)) { - pr_err("can't get bitmap from slot %d\n", i); -+ bitmap = NULL; - goto out; - } - counts = &bitmap->counts; -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index a3cbc9f4fec17..02acd5d5a8488 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -3604,6 +3604,7 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s, - * is missing/faulty, then we need to read everything we can. - */ - if (sh->raid_conf->level != 6 && -+ sh->raid_conf->rmw_level != PARITY_DISABLE_RMW && - sh->sector < sh->raid_conf->mddev->recovery_cp) - /* reconstruct-write isn't being forced */ - return 0; -@@ -4839,7 +4840,7 @@ static void handle_stripe(struct stripe_head *sh) - * or to load a block that is being partially written. - */ - if (s.to_read || s.non_overwrite -- || (conf->level == 6 && s.to_write && s.failed) -+ || (s.to_write && s.failed) - || (s.syncing && (s.uptodate + s.compute < disks)) - || s.replacing - || s.expanding) -diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c -index 4be6dcf292fff..aaa96f256356b 100644 ---- a/drivers/media/platform/rockchip/rga/rga-hw.c -+++ b/drivers/media/platform/rockchip/rga/rga-hw.c -@@ -200,22 +200,25 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) - dst_info.data.format = ctx->out.fmt->hw_format; - dst_info.data.swap = ctx->out.fmt->color_swap; - -- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { -- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) { -- switch (ctx->in.colorspace) { -- case V4L2_COLORSPACE_REC709: -- src_info.data.csc_mode = -- RGA_SRC_CSC_MODE_BT709_R0; -- break; -- default: -- src_info.data.csc_mode = -- RGA_SRC_CSC_MODE_BT601_R0; -- break; -- } -+ /* -+ * CSC mode must only be set when the colorspace families differ between -+ * input and output. It must remain unset (zeroed) if both are the same. -+ */ -+ -+ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) && -+ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) { -+ switch (ctx->in.colorspace) { -+ case V4L2_COLORSPACE_REC709: -+ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; -+ break; -+ default: -+ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0; -+ break; - } - } - -- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { -+ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) && -+ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) { - switch (ctx->out.colorspace) { - case V4L2_COLORSPACE_REC709: - dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; -diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h -index 96cb0314dfa70..e8917e5630a48 100644 ---- a/drivers/media/platform/rockchip/rga/rga-hw.h -+++ b/drivers/media/platform/rockchip/rga/rga-hw.h -@@ -95,6 +95,11 @@ - #define RGA_COLOR_FMT_CP_8BPP 15 - #define RGA_COLOR_FMT_MASK 15 - -+#define RGA_COLOR_FMT_IS_YUV(fmt) \ -+ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP)) -+#define RGA_COLOR_FMT_IS_RGB(fmt) \ -+ ((fmt) < RGA_COLOR_FMT_YUV422SP) -+ - #define RGA_COLOR_NONE_SWAP 0 - #define RGA_COLOR_RB_SWAP 1 - #define RGA_COLOR_ALPHA_SWAP 2 -diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c -index d7b43037e500a..e07b135613eb5 100644 ---- a/drivers/media/platform/vsp1/vsp1_dl.c -+++ b/drivers/media/platform/vsp1/vsp1_dl.c -@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_device *vsp1, enum vsp1_extcmd_type type, - if (!pool) - return NULL; - -+ pool->vsp1 = vsp1; -+ - spin_lock_init(&pool->lock); - INIT_LIST_HEAD(&pool->free); - -diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c -index 4a31907a4525f..3ff872c205eeb 100644 ---- a/drivers/mfd/arizona-core.c -+++ b/drivers/mfd/arizona-core.c -@@ -1430,6 +1430,15 @@ err_irq: - arizona_irq_exit(arizona); - err_pm: - pm_runtime_disable(arizona->dev); -+ -+ switch (arizona->pdata.clk32k_src) { -+ case ARIZONA_32KZ_MCLK1: -+ case ARIZONA_32KZ_MCLK2: -+ arizona_clk32k_disable(arizona); -+ break; -+ default: -+ break; -+ } - err_reset: - arizona_enable_reset(arizona); - regulator_disable(arizona->dcvdd); -@@ -1452,6 +1461,15 @@ int arizona_dev_exit(struct arizona *arizona) - regulator_disable(arizona->dcvdd); - regulator_put(arizona->dcvdd); - -+ switch (arizona->pdata.clk32k_src) { -+ case ARIZONA_32KZ_MCLK1: -+ case ARIZONA_32KZ_MCLK2: -+ arizona_clk32k_disable(arizona); -+ break; -+ default: -+ break; -+ } -+ - mfd_remove_devices(arizona->dev); - arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona); - arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona); -diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c -index 4faa8d2e5d045..707f4287ab4a0 100644 ---- a/drivers/mfd/dln2.c -+++ b/drivers/mfd/dln2.c -@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb) - len = urb->actual_length - sizeof(struct dln2_header); - - if (handle == DLN2_HANDLE_EVENT) { -+ unsigned long flags; -+ -+ spin_lock_irqsave(&dln2->event_cb_lock, flags); - dln2_run_event_callbacks(dln2, id, echo, data, len); -+ spin_unlock_irqrestore(&dln2->event_cb_lock, flags); - } else { - /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ - if (dln2_transfer_complete(dln2, urb, handle, echo)) -diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c -index a66f8d6d61d1b..cb89f0578d425 100644 ---- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c -+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c -@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg) - DTRAN_CTRL_DM_START); - } - --static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) -+static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host) - { -- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; - enum dma_data_direction dir; - -- spin_lock_irq(&host->lock); -- - if (!host->data) -- goto out; -+ return false; - - if (host->data->flags & MMC_DATA_READ) - dir = DMA_FROM_DEVICE; -@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) - if (dir == DMA_FROM_DEVICE) - clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags); - -+ return true; -+} -+ -+static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) -+{ -+ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; -+ -+ spin_lock_irq(&host->lock); -+ if (!renesas_sdhi_internal_dmac_complete(host)) -+ goto out; -+ - tmio_mmc_do_data_irq(host); - out: - spin_unlock_irq(&host->lock); -diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c -index 1054cc070747e..20b0ee174dc61 100644 ---- a/drivers/mtd/nand/raw/fsl_upm.c -+++ b/drivers/mtd/nand/raw/fsl_upm.c -@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip) - static void fun_wait_rnb(struct fsl_upm_nand *fun) - { - if (fun->rnb_gpio[fun->mchip_number] >= 0) { -- struct mtd_info *mtd = nand_to_mtd(&fun->chip); - int cnt = 1000000; - - while (--cnt && !fun_chip_ready(&fun->chip)) -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h -index 413c3f254cf85..c881a573da662 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/common.h -+++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h -@@ -43,7 +43,7 @@ struct qmem { - void *base; - dma_addr_t iova; - int alloc_sz; -- u8 entry_sz; -+ u16 entry_sz; - u8 align; - u32 qsize; - }; -diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c -index c84ab052ef265..3eee8df359a12 100644 ---- a/drivers/net/ethernet/qualcomm/emac/emac.c -+++ b/drivers/net/ethernet/qualcomm/emac/emac.c -@@ -485,13 +485,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev, - - ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]); - if (ret) -- return ret; -+ goto disable_clk_axi; - - ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000); - if (ret) -- return ret; -+ goto disable_clk_cfg_ahb; -+ -+ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); -+ if (ret) -+ goto disable_clk_cfg_ahb; - -- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); -+ return 0; -+ -+disable_clk_cfg_ahb: -+ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]); -+disable_clk_axi: -+ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]); -+ -+ return ret; - } - - /* Enable clocks; needs emac_clks_phase1_init to be called before */ -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -index 4d75158c64b29..826626e870d5c 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -@@ -350,6 +350,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - plat_dat->has_gmac = true; - plat_dat->bsp_priv = gmac; - plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed; -+ plat_dat->multicast_filter_bins = 0; - - err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res); - if (err) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -index bc9b01376e807..1d0b64bd1e1a9 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c -@@ -166,6 +166,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw, - value = GMAC_FRAME_FILTER_PR | GMAC_FRAME_FILTER_PCF; - } else if (dev->flags & IFF_ALLMULTI) { - value = GMAC_FRAME_FILTER_PM; /* pass all multi */ -+ } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) { -+ /* Fall back to all multicast if we've no filter */ -+ value = GMAC_FRAME_FILTER_PM; - } else if (!netdev_mc_empty(dev)) { - struct netdev_hw_addr *ha; - -diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c -index 89b85970912db..35d265014e1ec 100644 ---- a/drivers/nvdimm/security.c -+++ b/drivers/nvdimm/security.c -@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) - else - dev_dbg(&nvdimm->dev, "overwrite completed\n"); - -- if (nvdimm->sec.overwrite_state) -- sysfs_notify_dirent(nvdimm->sec.overwrite_state); -+ /* -+ * Mark the overwrite work done and update dimm security flags, -+ * then send a sysfs event notification to wake up userspace -+ * poll threads to picked up the changed state. -+ */ - nvdimm->sec.overwrite_tmo = 0; - clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); - clear_bit(NDD_WORK_PENDING, &nvdimm->flags); -- put_device(&nvdimm->dev); - nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); -- nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); -+ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); -+ if (nvdimm->sec.overwrite_state) -+ sysfs_notify_dirent(nvdimm->sec.overwrite_state); -+ put_device(&nvdimm->dev); - } - - void nvdimm_security_overwrite_query(struct work_struct *work) -diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c -index 8e40b3e6da77d..3cef835b375fd 100644 ---- a/drivers/pci/bus.c -+++ b/drivers/pci/bus.c -@@ -322,12 +322,8 @@ void pci_bus_add_device(struct pci_dev *dev) - - dev->match_driver = true; - retval = device_attach(&dev->dev); -- if (retval < 0 && retval != -EPROBE_DEFER) { -+ if (retval < 0 && retval != -EPROBE_DEFER) - pci_warn(dev, "device attach failed (%d)\n", retval); -- pci_proc_detach_device(dev); -- pci_remove_sysfs_dev_files(dev); -- return; -- } - - pci_dev_assign_added(dev, true); - } -diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c -index 70ded8900e285..270d502b8cd50 100644 ---- a/drivers/pci/controller/dwc/pcie-qcom.c -+++ b/drivers/pci/controller/dwc/pcie-qcom.c -@@ -45,7 +45,13 @@ - #define PCIE_CAP_CPL_TIMEOUT_DISABLE 0x10 - - #define PCIE20_PARF_PHY_CTRL 0x40 -+#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK GENMASK(20, 16) -+#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x) ((x) << 16) -+ - #define PCIE20_PARF_PHY_REFCLK 0x4C -+#define PHY_REFCLK_SSP_EN BIT(16) -+#define PHY_REFCLK_USE_PAD BIT(12) -+ - #define PCIE20_PARF_DBI_BASE_ADDR 0x168 - #define PCIE20_PARF_SLV_ADDR_SPACE_SIZE 0x16C - #define PCIE20_PARF_MHI_CLOCK_RESET_CTRL 0x174 -@@ -76,6 +82,18 @@ - #define DBI_RO_WR_EN 1 - - #define PERST_DELAY_US 1000 -+/* PARF registers */ -+#define PCIE20_PARF_PCS_DEEMPH 0x34 -+#define PCS_DEEMPH_TX_DEEMPH_GEN1(x) ((x) << 16) -+#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x) ((x) << 8) -+#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x) ((x) << 0) -+ -+#define PCIE20_PARF_PCS_SWING 0x38 -+#define PCS_SWING_TX_SWING_FULL(x) ((x) << 8) -+#define PCS_SWING_TX_SWING_LOW(x) ((x) << 0) -+ -+#define PCIE20_PARF_CONFIG_BITS 0x50 -+#define PHY_RX0_EQ(x) ((x) << 24) - - #define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE 0x358 - #define SLV_ADDR_SPACE_SZ 0x10000000 -@@ -275,6 +293,7 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) - struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0; - struct dw_pcie *pci = pcie->pci; - struct device *dev = pci->dev; -+ struct device_node *node = dev->of_node; - u32 val; - int ret; - -@@ -319,9 +338,29 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) - val &= ~BIT(0); - writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); - -+ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) { -+ writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) | -+ PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) | -+ PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34), -+ pcie->parf + PCIE20_PARF_PCS_DEEMPH); -+ writel(PCS_SWING_TX_SWING_FULL(120) | -+ PCS_SWING_TX_SWING_LOW(120), -+ pcie->parf + PCIE20_PARF_PCS_SWING); -+ writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS); -+ } -+ -+ if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) { -+ /* set TX termination offset */ -+ val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); -+ val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK; -+ val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7); -+ writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL); -+ } -+ - /* enable external reference clock */ - val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK); -- val |= BIT(16); -+ val &= ~PHY_REFCLK_USE_PAD; -+ val |= PHY_REFCLK_SSP_EN; - writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK); - - ret = reset_control_deassert(res->phy_reset); -diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c -index b3869951c0eb7..6e60b4b1bf53b 100644 ---- a/drivers/pci/hotplug/acpiphp_glue.c -+++ b/drivers/pci/hotplug/acpiphp_glue.c -@@ -122,13 +122,21 @@ static struct acpiphp_context *acpiphp_grab_context(struct acpi_device *adev) - struct acpiphp_context *context; - - acpi_lock_hp_context(); -+ - context = acpiphp_get_context(adev); -- if (!context || context->func.parent->is_going_away) { -- acpi_unlock_hp_context(); -- return NULL; -+ if (!context) -+ goto unlock; -+ -+ if (context->func.parent->is_going_away) { -+ acpiphp_put_context(context); -+ context = NULL; -+ goto unlock; - } -+ - get_bridge(context->func.parent); - acpiphp_put_context(context); -+ -+unlock: - acpi_unlock_hp_context(); - return context; - } -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 9bc0f321aaf0e..c98067579e9f3 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -5208,7 +5208,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags); - */ - static void quirk_amd_harvest_no_ats(struct pci_dev *pdev) - { -- if (pdev->device == 0x7340 && pdev->revision != 0xc5) -+ if ((pdev->device == 0x7312 && pdev->revision != 0x00) || -+ (pdev->device == 0x7340 && pdev->revision != 0xc5)) - return; - - pci_info(pdev, "disabling ATS\n"); -@@ -5219,6 +5220,8 @@ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev) - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats); - /* AMD Iceland dGPU */ - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats); -+/* AMD Navi10 dGPU */ -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7312, quirk_amd_harvest_no_ats); - /* AMD Navi14 dGPU */ - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats); - #endif /* CONFIG_PCI_ATS */ -diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c -index 6e2683016c1f0..8bd0a078bfc47 100644 ---- a/drivers/pinctrl/pinctrl-ingenic.c -+++ b/drivers/pinctrl/pinctrl-ingenic.c -@@ -1500,9 +1500,9 @@ static void ingenic_gpio_irq_ack(struct irq_data *irqd) - */ - high = ingenic_gpio_get_value(jzgc, irq); - if (high) -- irq_set_type(jzgc, irq, IRQ_TYPE_EDGE_FALLING); -+ irq_set_type(jzgc, irq, IRQ_TYPE_LEVEL_LOW); - else -- irq_set_type(jzgc, irq, IRQ_TYPE_EDGE_RISING); -+ irq_set_type(jzgc, irq, IRQ_TYPE_LEVEL_HIGH); - } - - if (jzgc->jzpc->version >= ID_JZ4760) -@@ -1538,7 +1538,7 @@ static int ingenic_gpio_irq_set_type(struct irq_data *irqd, unsigned int type) - */ - bool high = ingenic_gpio_get_value(jzgc, irqd->hwirq); - -- type = high ? IRQ_TYPE_EDGE_FALLING : IRQ_TYPE_EDGE_RISING; -+ type = high ? IRQ_TYPE_LEVEL_LOW : IRQ_TYPE_LEVEL_HIGH; - } - - irq_set_type(jzgc, irqd->hwirq, type); -@@ -1644,7 +1644,8 @@ static int ingenic_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) - unsigned int pin = gc->base + offset; - - if (jzpc->version >= ID_JZ4760) -- return ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_PAT1); -+ return ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_INT) || -+ ingenic_get_pin_config(jzpc, pin, JZ4760_GPIO_PAT1); - - if (ingenic_get_pin_config(jzpc, pin, JZ4740_GPIO_SELECT)) - return true; -diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c -index 25ca2c894b4de..ab0662a33b41a 100644 ---- a/drivers/platform/chrome/cros_ec_ishtp.c -+++ b/drivers/platform/chrome/cros_ec_ishtp.c -@@ -645,8 +645,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device) - - /* Register croc_ec_dev mfd */ - rv = cros_ec_dev_init(client_data); -- if (rv) -+ if (rv) { -+ down_write(&init_lock); - goto end_cros_ec_dev_init_error; -+ } - - return 0; - -diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c -index 1f829edd8ee70..d392a828fc493 100644 ---- a/drivers/pwm/pwm-bcm-iproc.c -+++ b/drivers/pwm/pwm-bcm-iproc.c -@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, - u64 tmp, multi, rate; - u32 value, prescale; - -- rate = clk_get_rate(ip->clk); -- - value = readl(ip->base + IPROC_PWM_CTRL_OFFSET); - - if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm))) -@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, - else - state->polarity = PWM_POLARITY_INVERSED; - -+ rate = clk_get_rate(ip->clk); -+ if (rate == 0) { -+ state->period = 0; -+ state->duty_cycle = 0; -+ return; -+ } -+ - value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET); - prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm); - prescale &= IPROC_PWM_PRESCALE_MAX; -diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c -index cb0f4a0be0322..eaeb6aee6da5c 100644 ---- a/drivers/remoteproc/qcom_q6v5.c -+++ b/drivers/remoteproc/qcom_q6v5.c -@@ -151,6 +151,8 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5) - { - int ret; - -+ q6v5->running = false; -+ - qcom_smem_state_update_bits(q6v5->state, - BIT(q6v5->stop_bit), BIT(q6v5->stop_bit)); - -diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c -index d84e9f306086b..a67c55785b4de 100644 ---- a/drivers/remoteproc/qcom_q6v5_mss.c -+++ b/drivers/remoteproc/qcom_q6v5_mss.c -@@ -381,6 +381,12 @@ static int q6v5_load(struct rproc *rproc, const struct firmware *fw) - { - struct q6v5 *qproc = rproc->priv; - -+ /* MBA is restricted to a maximum size of 1M */ -+ if (fw->size > qproc->mba_size || fw->size > SZ_1M) { -+ dev_err(qproc->dev, "MBA firmware load failed\n"); -+ return -EINVAL; -+ } -+ - memcpy(qproc->mba_region, fw->data, fw->size); - - return 0; -@@ -1028,15 +1034,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc) - } else if (phdr->p_filesz) { - /* Replace "xxx.xxx" with "xxx.bxx" */ - sprintf(fw_name + fw_name_len - 3, "b%02d", i); -- ret = request_firmware(&seg_fw, fw_name, qproc->dev); -+ ret = request_firmware_into_buf(&seg_fw, fw_name, qproc->dev, -+ ptr, phdr->p_filesz); - if (ret) { - dev_err(qproc->dev, "failed to load %s\n", fw_name); - iounmap(ptr); - goto release_firmware; - } - -- memcpy(ptr, seg_fw->data, seg_fw->size); -- - release_firmware(seg_fw); - } - -diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c -index 9884228800a50..f14394ab0e037 100644 ---- a/drivers/scsi/lpfc/lpfc_nvmet.c -+++ b/drivers/scsi/lpfc/lpfc_nvmet.c -@@ -1923,7 +1923,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) - } - tgtp->tport_unreg_cmp = &tport_unreg_cmp; - nvmet_fc_unregister_targetport(phba->targetport); -- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, -+ if (!wait_for_completion_timeout(&tport_unreg_cmp, - msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) - lpfc_printf_log(phba, KERN_ERR, LOG_NVME, - "6179 Unreg targetport x%px timeout " -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 9ad44a96dfe3a..33f1cca7eaa61 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -2480,12 +2480,11 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, - #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) - - static int ftdi_process_packet(struct usb_serial_port *port, -- struct ftdi_private *priv, char *packet, int len) -+ struct ftdi_private *priv, unsigned char *buf, int len) - { -+ unsigned char status; - int i; -- char status; - char flag; -- char *ch; - - if (len < 2) { - dev_dbg(&port->dev, "malformed packet\n"); -@@ -2495,7 +2494,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, - /* Compare new line status to the old one, signal if different/ - N.B. packet may be processed more than once, but differences - are only processed once. */ -- status = packet[0] & FTDI_STATUS_B0_MASK; -+ status = buf[0] & FTDI_STATUS_B0_MASK; - if (status != priv->prev_status) { - char diff_status = status ^ priv->prev_status; - -@@ -2521,13 +2520,12 @@ static int ftdi_process_packet(struct usb_serial_port *port, - } - - /* save if the transmitter is empty or not */ -- if (packet[1] & FTDI_RS_TEMT) -+ if (buf[1] & FTDI_RS_TEMT) - priv->transmit_empty = 1; - else - priv->transmit_empty = 0; - -- len -= 2; -- if (!len) -+ if (len == 2) - return 0; /* status only */ - - /* -@@ -2535,40 +2533,41 @@ static int ftdi_process_packet(struct usb_serial_port *port, - * data payload to avoid over-reporting. - */ - flag = TTY_NORMAL; -- if (packet[1] & FTDI_RS_ERR_MASK) { -+ if (buf[1] & FTDI_RS_ERR_MASK) { - /* Break takes precedence over parity, which takes precedence - * over framing errors */ -- if (packet[1] & FTDI_RS_BI) { -+ if (buf[1] & FTDI_RS_BI) { - flag = TTY_BREAK; - port->icount.brk++; - usb_serial_handle_break(port); -- } else if (packet[1] & FTDI_RS_PE) { -+ } else if (buf[1] & FTDI_RS_PE) { - flag = TTY_PARITY; - port->icount.parity++; -- } else if (packet[1] & FTDI_RS_FE) { -+ } else if (buf[1] & FTDI_RS_FE) { - flag = TTY_FRAME; - port->icount.frame++; - } - /* Overrun is special, not associated with a char */ -- if (packet[1] & FTDI_RS_OE) { -+ if (buf[1] & FTDI_RS_OE) { - port->icount.overrun++; - tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); - } - } - -- port->icount.rx += len; -- ch = packet + 2; -+ port->icount.rx += len - 2; - - if (port->port.console && port->sysrq) { -- for (i = 0; i < len; i++, ch++) { -- if (!usb_serial_handle_sysrq_char(port, *ch)) -- tty_insert_flip_char(&port->port, *ch, flag); -+ for (i = 2; i < len; i++) { -+ if (usb_serial_handle_sysrq_char(port, buf[i])) -+ continue; -+ tty_insert_flip_char(&port->port, buf[i], flag); - } - } else { -- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len); -+ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag, -+ len - 2); - } - -- return len; -+ return len - 2; - } - - static void ftdi_process_read_urb(struct urb *urb) -diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c -index e46104c2fd94e..893cef70c1599 100644 ---- a/drivers/watchdog/f71808e_wdt.c -+++ b/drivers/watchdog/f71808e_wdt.c -@@ -689,9 +689,9 @@ static int __init watchdog_init(int sioaddr) - * into the module have been registered yet. - */ - watchdog.sioaddr = sioaddr; -- watchdog.ident.options = WDIOC_SETTIMEOUT -- | WDIOF_MAGICCLOSE -- | WDIOF_KEEPALIVEPING; -+ watchdog.ident.options = WDIOF_MAGICCLOSE -+ | WDIOF_KEEPALIVEPING -+ | WDIOF_CARDRESET; - - snprintf(watchdog.ident.identity, - sizeof(watchdog.ident.identity), "%s watchdog", -@@ -705,6 +705,13 @@ static int __init watchdog_init(int sioaddr) - wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF); - watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS); - -+ /* -+ * We don't want WDTMOUT_STS to stick around till regular reboot. -+ * Write 1 to the bit to clear it to zero. -+ */ -+ superio_outb(sioaddr, F71808FG_REG_WDT_CONF, -+ wdt_conf | BIT(F71808FG_FLAG_WDTMOUT_STS)); -+ - superio_exit(sioaddr); - - err = watchdog_set_timeout(timeout); -diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c -index c4147e93aa7d4..3729f99fd8eca 100644 ---- a/drivers/watchdog/watchdog_dev.c -+++ b/drivers/watchdog/watchdog_dev.c -@@ -974,6 +974,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) - if (IS_ERR_OR_NULL(watchdog_kworker)) - return -ENODEV; - -+ device_initialize(&wd_data->dev); -+ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); -+ wd_data->dev.class = &watchdog_class; -+ wd_data->dev.parent = wdd->parent; -+ wd_data->dev.groups = wdd->groups; -+ wd_data->dev.release = watchdog_core_data_release; -+ dev_set_drvdata(&wd_data->dev, wdd); -+ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); -+ - kthread_init_work(&wd_data->work, watchdog_ping_work); - hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); - wd_data->timer.function = watchdog_timer_expired; -@@ -994,15 +1003,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) - } - } - -- device_initialize(&wd_data->dev); -- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); -- wd_data->dev.class = &watchdog_class; -- wd_data->dev.parent = wdd->parent; -- wd_data->dev.groups = wdd->groups; -- wd_data->dev.release = watchdog_core_data_release; -- dev_set_drvdata(&wd_data->dev, wdd); -- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); -- - /* Fill in the data structures */ - cdev_init(&wd_data->cdev, &watchdog_fops); - -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 36cd210ee2ef7..2374f3f6f3b70 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -990,8 +990,10 @@ struct btrfs_root { - wait_queue_head_t log_writer_wait; - wait_queue_head_t log_commit_wait[2]; - struct list_head log_ctxs[2]; -+ /* Used only for log trees of subvolumes, not for the log root tree */ - atomic_t log_writers; - atomic_t log_commit[2]; -+ /* Used only for log trees of subvolumes, not for the log root tree */ - atomic_t log_batch; - int log_transid; - /* No matter the commit succeeds or not*/ -@@ -3164,7 +3166,7 @@ do { \ - /* Report first abort since mount */ \ - if (!test_and_set_bit(BTRFS_FS_STATE_TRANS_ABORTED, \ - &((trans)->fs_info->fs_state))) { \ -- if ((errno) != -EIO) { \ -+ if ((errno) != -EIO && (errno) != -EROFS) { \ - WARN(1, KERN_DEBUG \ - "BTRFS: Transaction aborted (error %d)\n", \ - (errno)); \ -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index 273d1ccdd45df..ad1c8e3b8133a 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1475,9 +1475,16 @@ int btrfs_init_fs_root(struct btrfs_root *root) - spin_lock_init(&root->ino_cache_lock); - init_waitqueue_head(&root->ino_cache_wait); - -- ret = get_anon_bdev(&root->anon_dev); -- if (ret) -- goto fail; -+ /* -+ * Don't assign anonymous block device to roots that are not exposed to -+ * userspace, the id pool is limited to 1M -+ */ -+ if (is_fstree(root->root_key.objectid) && -+ btrfs_root_refs(&root->root_item) > 0) { -+ ret = get_anon_bdev(&root->anon_dev); -+ if (ret) -+ goto fail; -+ } - - mutex_lock(&root->objectid_mutex); - ret = btrfs_find_highest_objectid(root, -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 47ecf7216b3e5..739332b462059 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -5221,7 +5221,14 @@ int btrfs_drop_snapshot(struct btrfs_root *root, - goto out; - } - -- trans = btrfs_start_transaction(tree_root, 0); -+ /* -+ * Use join to avoid potential EINTR from transaction start. See -+ * wait_reserve_ticket and the whole reservation callchain. -+ */ -+ if (for_reloc) -+ trans = btrfs_join_transaction(tree_root); -+ else -+ trans = btrfs_start_transaction(tree_root, 0); - if (IS_ERR(trans)) { - err = PTR_ERR(trans); - goto out_free; -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 99dcb38976592..035ea5bc692ad 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4467,15 +4467,25 @@ int try_release_extent_mapping(struct page *page, gfp_t mask) - free_extent_map(em); - break; - } -- if (!test_range_bit(tree, em->start, -- extent_map_end(em) - 1, -- EXTENT_LOCKED, 0, NULL)) { -+ if (test_range_bit(tree, em->start, -+ extent_map_end(em) - 1, -+ EXTENT_LOCKED, 0, NULL)) -+ goto next; -+ /* -+ * If it's not in the list of modified extents, used -+ * by a fast fsync, we can remove it. If it's being -+ * logged we can safely remove it since fsync took an -+ * extra reference on the em. -+ */ -+ if (list_empty(&em->list) || -+ test_bit(EXTENT_FLAG_LOGGING, &em->flags)) { - set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, - &btrfs_inode->runtime_flags); - remove_extent_mapping(map, em); - /* once for the rb tree */ - free_extent_map(em); - } -+next: - start = extent_map_end(em); - write_unlock(&map->lock); - -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index d86ada9c3c541..8bfc0f348ad55 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -2166,7 +2166,7 @@ out: - static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, - struct btrfs_free_space *info, bool update_stat) - { -- struct btrfs_free_space *left_info; -+ struct btrfs_free_space *left_info = NULL; - struct btrfs_free_space *right_info; - bool merged = false; - u64 offset = info->offset; -@@ -2181,7 +2181,7 @@ static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl, - if (right_info && rb_prev(&right_info->offset_index)) - left_info = rb_entry(rb_prev(&right_info->offset_index), - struct btrfs_free_space, offset_index); -- else -+ else if (!right_info) - left_info = tree_search_offset(ctl, offset - 1, 0, 0); - - if (right_info && !right_info->bitmap) { -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index e408181a5eba3..fa7f3a59813ea 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -641,12 +641,18 @@ cont: - page_error_op | - PAGE_END_WRITEBACK); - -- for (i = 0; i < nr_pages; i++) { -- WARN_ON(pages[i]->mapping); -- put_page(pages[i]); -+ /* -+ * Ensure we only free the compressed pages if we have -+ * them allocated, as we can still reach here with -+ * inode_need_compress() == false. -+ */ -+ if (pages) { -+ for (i = 0; i < nr_pages; i++) { -+ WARN_ON(pages[i]->mapping); -+ put_page(pages[i]); -+ } -+ kfree(pages); - } -- kfree(pages); -- - return 0; - } - } -@@ -4681,6 +4687,8 @@ int btrfs_delete_subvolume(struct inode *dir, struct dentry *dentry) - } - } - -+ free_anon_bdev(dest->anon_dev); -+ dest->anon_dev = 0; - out_end_trans: - trans->block_rsv = NULL; - trans->bytes_reserved = 0; -@@ -7186,7 +7194,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, - extent_type == BTRFS_FILE_EXTENT_PREALLOC) { - /* Only regular file could have regular/prealloc extent */ - if (!S_ISREG(inode->vfs_inode.i_mode)) { -- ret = -EUCLEAN; -+ err = -EUCLEAN; - btrfs_crit(fs_info, - "regular/prealloc extent found for non-regular inode %llu", - btrfs_ino(inode)); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index d88b8d8897cc5..88745b5182126 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -167,8 +167,11 @@ static int btrfs_ioctl_getflags(struct file *file, void __user *arg) - return 0; - } - --/* Check if @flags are a supported and valid set of FS_*_FL flags */ --static int check_fsflags(unsigned int flags) -+/* -+ * Check if @flags are a supported and valid set of FS_*_FL flags and that -+ * the old and new flags are not conflicting -+ */ -+static int check_fsflags(unsigned int old_flags, unsigned int flags) - { - if (flags & ~(FS_IMMUTABLE_FL | FS_APPEND_FL | \ - FS_NOATIME_FL | FS_NODUMP_FL | \ -@@ -177,9 +180,19 @@ static int check_fsflags(unsigned int flags) - FS_NOCOW_FL)) - return -EOPNOTSUPP; - -+ /* COMPR and NOCOMP on new/old are valid */ - if ((flags & FS_NOCOMP_FL) && (flags & FS_COMPR_FL)) - return -EINVAL; - -+ if ((flags & FS_COMPR_FL) && (flags & FS_NOCOW_FL)) -+ return -EINVAL; -+ -+ /* NOCOW and compression options are mutually exclusive */ -+ if ((old_flags & FS_NOCOW_FL) && (flags & (FS_COMPR_FL | FS_NOCOMP_FL))) -+ return -EINVAL; -+ if ((flags & FS_NOCOW_FL) && (old_flags & (FS_COMPR_FL | FS_NOCOMP_FL))) -+ return -EINVAL; -+ - return 0; - } - -@@ -193,7 +206,7 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) - unsigned int fsflags, old_fsflags; - int ret; - const char *comp = NULL; -- u32 binode_flags = binode->flags; -+ u32 binode_flags; - - if (!inode_owner_or_capable(inode)) - return -EPERM; -@@ -204,22 +217,23 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) - if (copy_from_user(&fsflags, arg, sizeof(fsflags))) - return -EFAULT; - -- ret = check_fsflags(fsflags); -- if (ret) -- return ret; -- - ret = mnt_want_write_file(file); - if (ret) - return ret; - - inode_lock(inode); -- - fsflags = btrfs_mask_fsflags_for_type(inode, fsflags); - old_fsflags = btrfs_inode_flags_to_fsflags(binode->flags); -+ - ret = vfs_ioc_setflags_prepare(inode, old_fsflags, fsflags); - if (ret) - goto out_unlock; - -+ ret = check_fsflags(old_fsflags, fsflags); -+ if (ret) -+ goto out_unlock; -+ -+ binode_flags = binode->flags; - if (fsflags & FS_SYNC_FL) - binode_flags |= BTRFS_INODE_SYNC; - else -diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c -index 454a1015d026b..9a2f15f4c80e0 100644 ---- a/fs/btrfs/ref-verify.c -+++ b/fs/btrfs/ref-verify.c -@@ -286,6 +286,8 @@ static struct block_entry *add_block_entry(struct btrfs_fs_info *fs_info, - exist_re = insert_root_entry(&exist->roots, re); - if (exist_re) - kfree(re); -+ } else { -+ kfree(re); - } - kfree(be); - return exist; -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 1b087ee338ccb..af3605a0bf2e0 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -2312,12 +2312,20 @@ static noinline_for_stack int merge_reloc_root(struct reloc_control *rc, - btrfs_unlock_up_safe(path, 0); - } - -- min_reserved = fs_info->nodesize * (BTRFS_MAX_LEVEL - 1) * 2; -+ /* -+ * In merge_reloc_root(), we modify the upper level pointer to swap the -+ * tree blocks between reloc tree and subvolume tree. Thus for tree -+ * block COW, we COW at most from level 1 to root level for each tree. -+ * -+ * Thus the needed metadata size is at most root_level * nodesize, -+ * and * 2 since we have two trees to COW. -+ */ -+ min_reserved = fs_info->nodesize * btrfs_root_level(root_item) * 2; - memset(&next_key, 0, sizeof(next_key)); - - while (1) { - ret = btrfs_block_rsv_refill(root, rc->block_rsv, min_reserved, -- BTRFS_RESERVE_FLUSH_ALL); -+ BTRFS_RESERVE_FLUSH_LIMIT); - if (ret) { - err = ret; - goto out; -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index aea24202cd355..4b0ee34aa65d5 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -435,6 +435,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - char *compress_type; - bool compress_force = false; - enum btrfs_compression_type saved_compress_type; -+ int saved_compress_level; - bool saved_compress_force; - int no_compress = 0; - -@@ -517,6 +518,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - info->compress_type : BTRFS_COMPRESS_NONE; - saved_compress_force = - btrfs_test_opt(info, FORCE_COMPRESS); -+ saved_compress_level = info->compress_level; - if (token == Opt_compress || - token == Opt_compress_force || - strncmp(args[0].from, "zlib", 4) == 0) { -@@ -561,6 +563,8 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - no_compress = 0; - } else if (strncmp(args[0].from, "no", 2) == 0) { - compress_type = "no"; -+ info->compress_level = 0; -+ info->compress_type = 0; - btrfs_clear_opt(info->mount_opt, COMPRESS); - btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS); - compress_force = false; -@@ -581,11 +585,11 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - */ - btrfs_clear_opt(info->mount_opt, FORCE_COMPRESS); - } -- if ((btrfs_test_opt(info, COMPRESS) && -- (info->compress_type != saved_compress_type || -- compress_force != saved_compress_force)) || -- (!btrfs_test_opt(info, COMPRESS) && -- no_compress == 1)) { -+ if (no_compress == 1) { -+ btrfs_info(info, "use no compression"); -+ } else if ((info->compress_type != saved_compress_type) || -+ (compress_force != saved_compress_force) || -+ (info->compress_level != saved_compress_level)) { - btrfs_info(info, "%s %s compression, level %d", - (compress_force) ? "force" : "use", - compress_type, info->compress_level); -@@ -1848,6 +1852,12 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) - set_bit(BTRFS_FS_OPEN, &fs_info->flags); - } - out: -+ /* -+ * We need to set SB_I_VERSION here otherwise it'll get cleared by VFS, -+ * since the absence of the flag means it can be toggled off by remount. -+ */ -+ *flags |= SB_I_VERSION; -+ - wake_up_process(fs_info->transaction_kthread); - btrfs_remount_cleanup(fs_info, old_opts); - return 0; -@@ -2254,9 +2264,7 @@ static int btrfs_unfreeze(struct super_block *sb) - static int btrfs_show_devname(struct seq_file *m, struct dentry *root) - { - struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb); -- struct btrfs_fs_devices *cur_devices; - struct btrfs_device *dev, *first_dev = NULL; -- struct list_head *head; - - /* - * Lightweight locking of the devices. We should not need -@@ -2266,18 +2274,13 @@ static int btrfs_show_devname(struct seq_file *m, struct dentry *root) - * least until the rcu_read_unlock. - */ - rcu_read_lock(); -- cur_devices = fs_info->fs_devices; -- while (cur_devices) { -- head = &cur_devices->devices; -- list_for_each_entry_rcu(dev, head, dev_list) { -- if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state)) -- continue; -- if (!dev->name) -- continue; -- if (!first_dev || dev->devid < first_dev->devid) -- first_dev = dev; -- } -- cur_devices = cur_devices->seed; -+ list_for_each_entry_rcu(dev, &fs_info->fs_devices->devices, dev_list) { -+ if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state)) -+ continue; -+ if (!dev->name) -+ continue; -+ if (!first_dev || dev->devid < first_dev->devid) -+ first_dev = dev; - } - - if (first_dev) -diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c -index f6d3c80f2e289..5c299e1f2297e 100644 ---- a/fs/btrfs/sysfs.c -+++ b/fs/btrfs/sysfs.c -@@ -975,7 +975,9 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, - { - int error = 0; - struct btrfs_device *dev; -+ unsigned int nofs_flag; - -+ nofs_flag = memalloc_nofs_save(); - list_for_each_entry(dev, &fs_devices->devices, dev_list) { - struct hd_struct *disk; - struct kobject *disk_kobj; -@@ -994,6 +996,7 @@ int btrfs_sysfs_add_device_link(struct btrfs_fs_devices *fs_devices, - if (error) - break; - } -+ memalloc_nofs_restore(nofs_flag); - - return error; - } -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index f46afbff668eb..3c090549ed07d 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3140,29 +3140,17 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, - btrfs_init_log_ctx(&root_log_ctx, NULL); - - mutex_lock(&log_root_tree->log_mutex); -- atomic_inc(&log_root_tree->log_batch); -- atomic_inc(&log_root_tree->log_writers); - - index2 = log_root_tree->log_transid % 2; - list_add_tail(&root_log_ctx.list, &log_root_tree->log_ctxs[index2]); - root_log_ctx.log_transid = log_root_tree->log_transid; - -- mutex_unlock(&log_root_tree->log_mutex); -- -- mutex_lock(&log_root_tree->log_mutex); -- - /* - * Now we are safe to update the log_root_tree because we're under the - * log_mutex, and we're a current writer so we're holding the commit - * open until we drop the log_mutex. - */ - ret = update_log_root(trans, log, &new_root_item); -- -- if (atomic_dec_and_test(&log_root_tree->log_writers)) { -- /* atomic_dec_and_test implies a barrier */ -- cond_wake_up_nomb(&log_root_tree->log_writer_wait); -- } -- - if (ret) { - if (!list_empty(&root_log_ctx.list)) - list_del_init(&root_log_ctx.list); -@@ -3208,8 +3196,6 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans, - root_log_ctx.log_transid - 1); - } - -- wait_for_writer(log_root_tree); -- - /* - * now that we've moved on to the tree of log tree roots, - * check the full commit flag again -@@ -4054,11 +4040,8 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, - fs_info->csum_root, - ds + cs, ds + cs + cl - 1, - &ordered_sums, 0); -- if (ret) { -- btrfs_release_path(dst_path); -- kfree(ins_data); -- return ret; -- } -+ if (ret) -+ break; - } - } - } -@@ -4071,7 +4054,6 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, - * we have to do this after the loop above to avoid changing the - * log tree while trying to change the log tree. - */ -- ret = 0; - while (!list_empty(&ordered_sums)) { - struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next, - struct btrfs_ordered_sum, -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 1e6e3c1d97dfa..196ddbcd29360 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -219,7 +219,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, - * - * global::fs_devs - add, remove, updates to the global list - * -- * does not protect: manipulation of the fs_devices::devices list! -+ * does not protect: manipulation of the fs_devices::devices list in general -+ * but in mount context it could be used to exclude list modifications by eg. -+ * scan ioctl - * - * btrfs_device::name - renames (write side), read is RCU - * -@@ -232,6 +234,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info, - * may be used to exclude some operations from running concurrently without any - * modifications to the list (see write_all_supers) - * -+ * Is not required at mount and close times, because our device list is -+ * protected by the uuid_mutex at that point. -+ * - * balance_mutex - * ------------- - * protects balance structures (status, state) and context accessed from -@@ -778,6 +783,11 @@ static int btrfs_free_stale_devices(const char *path, - return ret; - } - -+/* -+ * This is only used on mount, and we are protected from competing things -+ * messing with our fs_devices by the uuid_mutex, thus we do not need the -+ * fs_devices->device_list_mutex here. -+ */ - static int btrfs_open_one_device(struct btrfs_fs_devices *fs_devices, - struct btrfs_device *device, fmode_t flags, - void *holder) -@@ -1418,8 +1428,14 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, - int ret; - - lockdep_assert_held(&uuid_mutex); -+ /* -+ * The device_list_mutex cannot be taken here in case opening the -+ * underlying device takes further locks like bd_mutex. -+ * -+ * We also don't need the lock here as this is called during mount and -+ * exclusion is provided by uuid_mutex -+ */ - -- mutex_lock(&fs_devices->device_list_mutex); - if (fs_devices->opened) { - fs_devices->opened++; - ret = 0; -@@ -1427,7 +1443,6 @@ int btrfs_open_devices(struct btrfs_fs_devices *fs_devices, - list_sort(NULL, &fs_devices->devices, devid_cmp); - ret = open_fs_devices(fs_devices, flags, holder); - } -- mutex_unlock(&fs_devices->device_list_mutex); - - return ret; - } -@@ -3283,7 +3298,7 @@ static int insert_balance_item(struct btrfs_fs_info *fs_info, - if (!path) - return -ENOMEM; - -- trans = btrfs_start_transaction(root, 0); -+ trans = btrfs_start_transaction_fallback_global_rsv(root, 0); - if (IS_ERR(trans)) { - btrfs_free_path(path); - return PTR_ERR(trans); -@@ -4246,7 +4261,22 @@ int btrfs_balance(struct btrfs_fs_info *fs_info, - mutex_lock(&fs_info->balance_mutex); - if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) - btrfs_info(fs_info, "balance: paused"); -- else if (ret == -ECANCELED && atomic_read(&fs_info->balance_cancel_req)) -+ /* -+ * Balance can be canceled by: -+ * -+ * - Regular cancel request -+ * Then ret == -ECANCELED and balance_cancel_req > 0 -+ * -+ * - Fatal signal to "btrfs" process -+ * Either the signal caught by wait_reserve_ticket() and callers -+ * got -EINTR, or caught by btrfs_should_cancel_balance() and -+ * got -ECANCELED. -+ * Either way, in this case balance_cancel_req = 0, and -+ * ret == -EINTR or ret == -ECANCELED. -+ * -+ * So here we only check the return value to catch canceled balance. -+ */ -+ else if (ret == -ECANCELED || ret == -EINTR) - btrfs_info(fs_info, "balance: canceled"); - else - btrfs_info(fs_info, "balance: ended with status: %d", ret); -@@ -7267,7 +7297,6 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) - * otherwise we don't need it. - */ - mutex_lock(&uuid_mutex); -- mutex_lock(&fs_info->chunk_mutex); - - /* - * It is possible for mount and umount to race in such a way that -@@ -7312,7 +7341,9 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) - } else if (found_key.type == BTRFS_CHUNK_ITEM_KEY) { - struct btrfs_chunk *chunk; - chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk); -+ mutex_lock(&fs_info->chunk_mutex); - ret = read_one_chunk(&found_key, leaf, chunk); -+ mutex_unlock(&fs_info->chunk_mutex); - if (ret) - goto error; - } -@@ -7342,7 +7373,6 @@ int btrfs_read_chunk_tree(struct btrfs_fs_info *fs_info) - } - ret = 0; - error: -- mutex_unlock(&fs_info->chunk_mutex); - mutex_unlock(&uuid_mutex); - - btrfs_free_path(path); -diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c -index 2e4764fd18727..3367a8194f24b 100644 ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -920,6 +920,10 @@ static int ceph_symlink(struct inode *dir, struct dentry *dentry, - req->r_num_caps = 2; - req->r_dentry_drop = CEPH_CAP_FILE_SHARED | CEPH_CAP_AUTH_EXCL; - req->r_dentry_unless = CEPH_CAP_FILE_EXCL; -+ if (as_ctx.pagelist) { -+ req->r_pagelist = as_ctx.pagelist; -+ as_ctx.pagelist = NULL; -+ } - err = ceph_mdsc_do_request(mdsc, dir, req); - if (!err && !req->r_reply_info.head->is_dentry) - err = ceph_handle_notrace_create(dir, dentry); -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index b79fe6549df6f..701bc3f4d4ba1 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -3091,8 +3091,10 @@ static void handle_session(struct ceph_mds_session *session, - goto bad; - /* version >= 3, feature bits */ - ceph_decode_32_safe(&p, end, len, bad); -- ceph_decode_64_safe(&p, end, features, bad); -- p += len - sizeof(features); -+ if (len) { -+ ceph_decode_64_safe(&p, end, features, bad); -+ p += len - sizeof(features); -+ } - } - - mutex_lock(&mdsc->mutex); -diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c -index 14265b4bbcc00..2fc96f7923ee5 100644 ---- a/fs/cifs/smb2misc.c -+++ b/fs/cifs/smb2misc.c -@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_struct *work) - kfree(lw); - } - -+static void -+smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key, -+ __le32 new_lease_state) -+{ -+ struct smb2_lease_break_work *lw; -+ -+ lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL); -+ if (!lw) { -+ cifs_put_tlink(tlink); -+ return; -+ } -+ -+ INIT_WORK(&lw->lease_break, cifs_ses_oplock_break); -+ lw->tlink = tlink; -+ lw->lease_state = new_lease_state; -+ memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE); -+ queue_work(cifsiod_wq, &lw->lease_break); -+} -+ - static bool --smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, -- struct smb2_lease_break_work *lw) -+smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp) - { -- bool found; - __u8 lease_state; - struct list_head *tmp; - struct cifsFileInfo *cfile; -- struct cifs_pending_open *open; - struct cifsInodeInfo *cinode; - int ack_req = le32_to_cpu(rsp->Flags & - SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); -@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp, - &cinode->flags); - - cifs_queue_oplock_break(cfile); -- kfree(lw); - return true; - } - -- found = false; -+ return false; -+} -+ -+static struct cifs_pending_open * -+smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon, -+ struct smb2_lease_break *rsp) -+{ -+ __u8 lease_state = le32_to_cpu(rsp->NewLeaseState); -+ int ack_req = le32_to_cpu(rsp->Flags & -+ SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED); -+ struct cifs_pending_open *open; -+ struct cifs_pending_open *found = NULL; -+ - list_for_each_entry(open, &tcon->pending_opens, olist) { - if (memcmp(open->lease_key, rsp->LeaseKey, - SMB2_LEASE_KEY_SIZE)) - continue; - - if (!found && ack_req) { -- found = true; -- memcpy(lw->lease_key, open->lease_key, -- SMB2_LEASE_KEY_SIZE); -- lw->tlink = cifs_get_tlink(open->tlink); -- queue_work(cifsiod_wq, &lw->lease_break); -+ found = open; - } - - cifs_dbg(FYI, "found in the pending open list\n"); -@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer) - struct TCP_Server_Info *server; - struct cifs_ses *ses; - struct cifs_tcon *tcon; -- struct smb2_lease_break_work *lw; -- -- lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL); -- if (!lw) -- return false; -- -- INIT_WORK(&lw->lease_break, cifs_ses_oplock_break); -- lw->lease_state = rsp->NewLeaseState; -+ struct cifs_pending_open *open; - - cifs_dbg(FYI, "Checking for lease break\n"); - -@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer) - spin_lock(&tcon->open_file_lock); - cifs_stats_inc( - &tcon->stats.cifs_stats.num_oplock_brks); -- if (smb2_tcon_has_lease(tcon, rsp, lw)) { -+ if (smb2_tcon_has_lease(tcon, rsp)) { - spin_unlock(&tcon->open_file_lock); - spin_unlock(&cifs_tcp_ses_lock); - return true; - } -+ open = smb2_tcon_find_pending_open_lease(tcon, -+ rsp); -+ if (open) { -+ __u8 lease_key[SMB2_LEASE_KEY_SIZE]; -+ struct tcon_link *tlink; -+ -+ tlink = cifs_get_tlink(open->tlink); -+ memcpy(lease_key, open->lease_key, -+ SMB2_LEASE_KEY_SIZE); -+ spin_unlock(&tcon->open_file_lock); -+ spin_unlock(&cifs_tcp_ses_lock); -+ smb2_queue_pending_open_break(tlink, -+ lease_key, -+ rsp->NewLeaseState); -+ return true; -+ } - spin_unlock(&tcon->open_file_lock); - - if (tcon->crfid.is_valid && -@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer) - } - } - spin_unlock(&cifs_tcp_ses_lock); -- kfree(lw); - cifs_dbg(FYI, "Can not process lease break - no lease matched\n"); - return false; - } -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 06b1a86d76b18..7ff05c06f2a4c 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -1323,6 +1323,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data) - spnego_key = cifs_get_spnego_key(ses); - if (IS_ERR(spnego_key)) { - rc = PTR_ERR(spnego_key); -+ if (rc == -ENOKEY) -+ cifs_dbg(VFS, "Verify user has a krb5 ticket and keyutils is installed\n"); - spnego_key = NULL; - goto out; - } -diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c -index fda7d3f5b4be5..432c3febea6df 100644 ---- a/fs/ext2/ialloc.c -+++ b/fs/ext2/ialloc.c -@@ -80,6 +80,7 @@ static void ext2_release_inode(struct super_block *sb, int group, int dir) - if (dir) - le16_add_cpu(&desc->bg_used_dirs_count, -1); - spin_unlock(sb_bgl_lock(EXT2_SB(sb), group)); -+ percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter); - if (dir) - percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter); - mark_buffer_dirty(bh); -@@ -528,7 +529,7 @@ got: - goto fail; - } - -- percpu_counter_add(&sbi->s_freeinodes_counter, -1); -+ percpu_counter_dec(&sbi->s_freeinodes_counter); - if (S_ISDIR(mode)) - percpu_counter_inc(&sbi->s_dirs_counter); - -diff --git a/fs/minix/inode.c b/fs/minix/inode.c -index 0dd929346f3f3..7b09a9158e401 100644 ---- a/fs/minix/inode.c -+++ b/fs/minix/inode.c -@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) - return 0; - } - --static bool minix_check_superblock(struct minix_sb_info *sbi) -+static bool minix_check_superblock(struct super_block *sb) - { -+ struct minix_sb_info *sbi = minix_sb(sb); -+ - if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) - return false; - -@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi) - * of indirect blocks which places the limit well above U32_MAX. - */ - if (sbi->s_version == MINIX_V1 && -- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) -+ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE) - return false; - - return true; -@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) - sbi->s_zmap_blocks = ms->s_zmap_blocks; - sbi->s_firstdatazone = ms->s_firstdatazone; - sbi->s_log_zone_size = ms->s_log_zone_size; -- sbi->s_max_size = ms->s_max_size; -+ s->s_maxbytes = ms->s_max_size; - s->s_magic = ms->s_magic; - if (s->s_magic == MINIX_SUPER_MAGIC) { - sbi->s_version = MINIX_V1; -@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) - sbi->s_zmap_blocks = m3s->s_zmap_blocks; - sbi->s_firstdatazone = m3s->s_firstdatazone; - sbi->s_log_zone_size = m3s->s_log_zone_size; -- sbi->s_max_size = m3s->s_max_size; -+ s->s_maxbytes = m3s->s_max_size; - sbi->s_ninodes = m3s->s_ninodes; - sbi->s_nzones = m3s->s_zones; - sbi->s_dirsize = 64; -@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) - } else - goto out_no_fs; - -- if (!minix_check_superblock(sbi)) -+ if (!minix_check_superblock(s)) - goto out_illegal_sb; - - /* -diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c -index 046cc96ee7adb..1fed906042aa8 100644 ---- a/fs/minix/itree_v1.c -+++ b/fs/minix/itree_v1.c -@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) - if (block < 0) { - printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", - block, inode->i_sb->s_bdev); -- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) { -- if (printk_ratelimit()) -- printk("MINIX-fs: block_to_path: " -- "block %ld too big on dev %pg\n", -- block, inode->i_sb->s_bdev); -- } else if (block < 7) { -+ return 0; -+ } -+ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) -+ return 0; -+ -+ if (block < 7) { - offsets[n++] = block; - } else if ((block -= 7) < 512) { - offsets[n++] = 7; -diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c -index f7fc7eccccccd..9d00f31a2d9d1 100644 ---- a/fs/minix/itree_v2.c -+++ b/fs/minix/itree_v2.c -@@ -32,13 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) - if (block < 0) { - printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", - block, sb->s_bdev); -- } else if ((u64)block * (u64)sb->s_blocksize >= -- minix_sb(sb)->s_max_size) { -- if (printk_ratelimit()) -- printk("MINIX-fs: block_to_path: " -- "block %ld too big on dev %pg\n", -- block, sb->s_bdev); -- } else if (block < DIRCOUNT) { -+ return 0; -+ } -+ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) -+ return 0; -+ -+ if (block < DIRCOUNT) { - offsets[n++] = block; - } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) { - offsets[n++] = DIRCOUNT; -diff --git a/fs/minix/minix.h b/fs/minix/minix.h -index df081e8afcc3c..168d45d3de73e 100644 ---- a/fs/minix/minix.h -+++ b/fs/minix/minix.h -@@ -32,7 +32,6 @@ struct minix_sb_info { - unsigned long s_zmap_blocks; - unsigned long s_firstdatazone; - unsigned long s_log_zone_size; -- unsigned long s_max_size; - int s_dirsize; - int s_namelen; - struct buffer_head ** s_imap; -diff --git a/fs/nfs/file.c b/fs/nfs/file.c -index 95dc90570786c..387a2cfa7e172 100644 ---- a/fs/nfs/file.c -+++ b/fs/nfs/file.c -@@ -140,6 +140,7 @@ static int - nfs_file_flush(struct file *file, fl_owner_t id) - { - struct inode *inode = file_inode(file); -+ errseq_t since; - - dprintk("NFS: flush(%pD2)\n", file); - -@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id) - return 0; - - /* Flush writes to the server and return any errors */ -- return nfs_wb_all(inode); -+ since = filemap_sample_wb_err(file->f_mapping); -+ nfs_wb_all(inode); -+ return filemap_check_wb_err(file->f_mapping, since); - } - - ssize_t -@@ -580,12 +583,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = { - .page_mkwrite = nfs_vm_page_mkwrite, - }; - --static int nfs_need_check_write(struct file *filp, struct inode *inode) -+static int nfs_need_check_write(struct file *filp, struct inode *inode, -+ int error) - { - struct nfs_open_context *ctx; - - ctx = nfs_file_open_context(filp); -- if (nfs_ctx_key_to_expire(ctx, inode)) -+ if (nfs_error_is_fatal_on_server(error) || -+ nfs_ctx_key_to_expire(ctx, inode)) - return 1; - return 0; - } -@@ -596,6 +601,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) - struct inode *inode = file_inode(file); - unsigned long written = 0; - ssize_t result; -+ errseq_t since; -+ int error; - - result = nfs_key_timeout_notify(file, inode); - if (result) -@@ -620,6 +627,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) - if (iocb->ki_pos > i_size_read(inode)) - nfs_revalidate_mapping(inode, file->f_mapping); - -+ since = filemap_sample_wb_err(file->f_mapping); - nfs_start_io_write(inode); - result = generic_write_checks(iocb, from); - if (result > 0) { -@@ -638,7 +646,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) - goto out; - - /* Return error values */ -- if (nfs_need_check_write(file, inode)) { -+ error = filemap_check_wb_err(file->f_mapping, since); -+ if (nfs_need_check_write(file, inode, error)) { - int err = nfs_wb_all(inode); - if (err < 0) - result = err; -diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c -index fb55c04cdc6bd..534b6fd70ffdb 100644 ---- a/fs/nfs/nfs4file.c -+++ b/fs/nfs/nfs4file.c -@@ -109,6 +109,7 @@ static int - nfs4_file_flush(struct file *file, fl_owner_t id) - { - struct inode *inode = file_inode(file); -+ errseq_t since; - - dprintk("NFS: flush(%pD2)\n", file); - -@@ -124,7 +125,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id) - return filemap_fdatawrite(file->f_mapping); - - /* Flush writes to the server and return any errors */ -- return nfs_wb_all(inode); -+ since = filemap_sample_wb_err(file->f_mapping); -+ nfs_wb_all(inode); -+ return filemap_check_wb_err(file->f_mapping, since); - } - - #ifdef CONFIG_NFS_V4_2 -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 1a1bd2fe6e98d..d0cb827b72cfa 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, - return ret; - if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) - return -ENOENT; -- if (buflen < label.len) -- return -ERANGE; - return 0; - } - -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 7c0ff1a3b5914..677751bc3a334 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, - return -EIO; - if (len < NFS4_MAXLABELLEN) { - if (label) { -- memcpy(label->label, p, len); -+ if (label->len) { -+ if (label->len < len) -+ return -ERANGE; -+ memcpy(label->label, p, len); -+ } - label->len = len; - label->pi = pi; - label->lfs = lfs; -diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h -index 9461bd3e1c0c8..0a8cd8e59a92c 100644 ---- a/fs/ocfs2/ocfs2.h -+++ b/fs/ocfs2/ocfs2.h -@@ -326,8 +326,8 @@ struct ocfs2_super - spinlock_t osb_lock; - u32 s_next_generation; - unsigned long osb_flags; -- s16 s_inode_steal_slot; -- s16 s_meta_steal_slot; -+ u16 s_inode_steal_slot; -+ u16 s_meta_steal_slot; - atomic_t s_num_inodes_stolen; - atomic_t s_num_meta_stolen; - -diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c -index 503e724d39f53..5e0eaea474055 100644 ---- a/fs/ocfs2/suballoc.c -+++ b/fs/ocfs2/suballoc.c -@@ -879,9 +879,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, int slot, int type) - { - spin_lock(&osb->osb_lock); - if (type == INODE_ALLOC_SYSTEM_INODE) -- osb->s_inode_steal_slot = slot; -+ osb->s_inode_steal_slot = (u16)slot; - else if (type == EXTENT_ALLOC_SYSTEM_INODE) -- osb->s_meta_steal_slot = slot; -+ osb->s_meta_steal_slot = (u16)slot; - spin_unlock(&osb->osb_lock); - } - -diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c -index c81e86c623807..70d8857b161df 100644 ---- a/fs/ocfs2/super.c -+++ b/fs/ocfs2/super.c -@@ -78,7 +78,7 @@ struct mount_options - unsigned long commit_interval; - unsigned long mount_opt; - unsigned int atime_quantum; -- signed short slot; -+ unsigned short slot; - int localalloc_opt; - unsigned int resv_level; - int dir_resv_level; -@@ -1334,7 +1334,7 @@ static int ocfs2_parse_options(struct super_block *sb, - goto bail; - } - if (option) -- mopt->slot = (s16)option; -+ mopt->slot = (u16)option; - break; - case Opt_commit: - if (match_int(&args[0], &option)) { -diff --git a/fs/orangefs/file.c b/fs/orangefs/file.c -index a5612abc09363..bcd4fd5ad1751 100644 ---- a/fs/orangefs/file.c -+++ b/fs/orangefs/file.c -@@ -311,23 +311,8 @@ static ssize_t orangefs_file_read_iter(struct kiocb *iocb, - struct iov_iter *iter) - { - int ret; -- struct orangefs_read_options *ro; -- - orangefs_stats.reads++; - -- /* -- * Remember how they set "count" in read(2) or pread(2) or whatever - -- * users can use count as a knob to control orangefs io size and later -- * we can try to help them fill as many pages as possible in readpage. -- */ -- if (!iocb->ki_filp->private_data) { -- iocb->ki_filp->private_data = kmalloc(sizeof *ro, GFP_KERNEL); -- if (!iocb->ki_filp->private_data) -- return(ENOMEM); -- ro = iocb->ki_filp->private_data; -- ro->blksiz = iter->count; -- } -- - down_read(&file_inode(iocb->ki_filp)->i_rwsem); - ret = orangefs_revalidate_mapping(file_inode(iocb->ki_filp)); - if (ret) -@@ -615,12 +600,6 @@ static int orangefs_lock(struct file *filp, int cmd, struct file_lock *fl) - return rc; - } - --static int orangefs_file_open(struct inode * inode, struct file *file) --{ -- file->private_data = NULL; -- return generic_file_open(inode, file); --} -- - static int orangefs_flush(struct file *file, fl_owner_t id) - { - /* -@@ -634,9 +613,6 @@ static int orangefs_flush(struct file *file, fl_owner_t id) - struct inode *inode = file->f_mapping->host; - int r; - -- kfree(file->private_data); -- file->private_data = NULL; -- - if (inode->i_state & I_DIRTY_TIME) { - spin_lock(&inode->i_lock); - inode->i_state &= ~I_DIRTY_TIME; -@@ -659,7 +635,7 @@ const struct file_operations orangefs_file_operations = { - .lock = orangefs_lock, - .unlocked_ioctl = orangefs_ioctl, - .mmap = orangefs_file_mmap, -- .open = orangefs_file_open, -+ .open = generic_file_open, - .flush = orangefs_flush, - .release = orangefs_file_release, - .fsync = orangefs_fsync, -diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c -index efb12197da181..636892ffec0ba 100644 ---- a/fs/orangefs/inode.c -+++ b/fs/orangefs/inode.c -@@ -259,46 +259,19 @@ static int orangefs_readpage(struct file *file, struct page *page) - pgoff_t index; /* which page */ - struct page *next_page; - char *kaddr; -- struct orangefs_read_options *ro = file->private_data; - loff_t read_size; -- loff_t roundedup; - int buffer_index = -1; /* orangefs shared memory slot */ - int slot_index; /* index into slot */ - int remaining; - - /* -- * If they set some miniscule size for "count" in read(2) -- * (for example) then let's try to read a page, or the whole file -- * if it is smaller than a page. Once "count" goes over a page -- * then lets round up to the highest page size multiple that is -- * less than or equal to "count" and do that much orangefs IO and -- * try to fill as many pages as we can from it. -- * -- * "count" should be represented in ro->blksiz. -- * -- * inode->i_size = file size. -+ * Get up to this many bytes from Orangefs at a time and try -+ * to fill them into the page cache at once. Tests with dd made -+ * this seem like a reasonable static number, if there was -+ * interest perhaps this number could be made setable through -+ * sysfs... - */ -- if (ro) { -- if (ro->blksiz < PAGE_SIZE) { -- if (inode->i_size < PAGE_SIZE) -- read_size = inode->i_size; -- else -- read_size = PAGE_SIZE; -- } else { -- roundedup = ((PAGE_SIZE - 1) & ro->blksiz) ? -- ((ro->blksiz + PAGE_SIZE) & ~(PAGE_SIZE -1)) : -- ro->blksiz; -- if (roundedup > inode->i_size) -- read_size = inode->i_size; -- else -- read_size = roundedup; -- -- } -- } else { -- read_size = PAGE_SIZE; -- } -- if (!read_size) -- read_size = PAGE_SIZE; -+ read_size = 524288; - - if (PageDirty(page)) - orangefs_launder_page(page); -diff --git a/fs/orangefs/orangefs-kernel.h b/fs/orangefs/orangefs-kernel.h -index 34a6c99fa29bd..3003007681a05 100644 ---- a/fs/orangefs/orangefs-kernel.h -+++ b/fs/orangefs/orangefs-kernel.h -@@ -239,10 +239,6 @@ struct orangefs_write_range { - kgid_t gid; - }; - --struct orangefs_read_options { -- ssize_t blksiz; --}; -- - extern struct orangefs_stats orangefs_stats; - - /* -diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c -index 826dad0243dcc..a6ae2428e4c96 100644 ---- a/fs/ubifs/journal.c -+++ b/fs/ubifs/journal.c -@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, - const struct fscrypt_name *nm, const struct inode *inode, - int deletion, int xent) - { -- int err, dlen, ilen, len, lnum, ino_offs, dent_offs; -+ int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0; - int aligned_dlen, aligned_ilen, sync = IS_DIRSYNC(dir); - int last_reference = !!(deletion && inode->i_nlink == 0); - struct ubifs_inode *ui = ubifs_inode(inode); -@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, - goto out_finish; - } - ui->del_cmtno = c->cmt_no; -+ orphan_added = 1; - } - - err = write_head(c, BASEHD, dent, len, &lnum, &dent_offs, sync); -@@ -702,7 +703,7 @@ out_release: - kfree(dent); - out_ro: - ubifs_ro_mode(c, err); -- if (last_reference) -+ if (orphan_added) - ubifs_delete_orphan(c, inode->i_ino); - finish_reservation(c); - return err; -@@ -1217,7 +1218,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, - void *p; - union ubifs_key key; - struct ubifs_dent_node *dent, *dent2; -- int err, dlen1, dlen2, ilen, lnum, offs, len; -+ int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added = 0; - int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ; - int last_reference = !!(new_inode && new_inode->i_nlink == 0); - int move = (old_dir != new_dir); -@@ -1333,6 +1334,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, - goto out_finish; - } - new_ui->del_cmtno = c->cmt_no; -+ orphan_added = 1; - } - - err = write_head(c, BASEHD, dent, len, &lnum, &offs, sync); -@@ -1414,7 +1416,7 @@ out_release: - release_head(c, BASEHD); - out_ro: - ubifs_ro_mode(c, err); -- if (last_reference) -+ if (orphan_added) - ubifs_delete_orphan(c, new_inode->i_ino); - out_finish: - finish_reservation(c); -diff --git a/fs/ufs/super.c b/fs/ufs/super.c -index 1da0be667409b..e3b69fb280e8c 100644 ---- a/fs/ufs/super.c -+++ b/fs/ufs/super.c -@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene - struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; - struct inode *inode; - -- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) -+ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) - return ERR_PTR(-ESTALE); - - inode = ufs_iget(sb, ino); -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index 864849e942c45..c1a8d4a41bb16 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -135,6 +135,7 @@ struct af_alg_async_req { - * SG? - * @enc: Cryptographic operation to be performed when - * recvmsg is invoked. -+ * @init: True if metadata has been sent. - * @len: Length of memory allocated for this data structure. - */ - struct af_alg_ctx { -@@ -151,6 +152,7 @@ struct af_alg_ctx { - bool more; - bool merge; - bool enc; -+ bool init; - - unsigned int len; - }; -@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset); - void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, - size_t dst_offset); - void af_alg_wmem_wakeup(struct sock *sk); --int af_alg_wait_for_data(struct sock *sk, unsigned flags); -+int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); - int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - unsigned int ivsize); - ssize_t af_alg_sendpage(struct socket *sock, struct page *page, -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index 1e5dad8b8e59b..ed870da78326b 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -359,8 +359,8 @@ enum { - - #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK) - #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) --#define QI_DEV_EIOTLB_GLOB(g) ((u64)g) --#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) -+#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1) -+#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32) - #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) - #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) - #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \ -diff --git a/include/linux/irq.h b/include/linux/irq.h -index f8755e5fcd742..e9e69c511ea92 100644 ---- a/include/linux/irq.h -+++ b/include/linux/irq.h -@@ -211,6 +211,8 @@ struct irq_data { - * IRQD_CAN_RESERVE - Can use reservation mode - * IRQD_MSI_NOMASK_QUIRK - Non-maskable MSI quirk for affinity change - * required -+ * IRQD_AFFINITY_ON_ACTIVATE - Affinity is set on activation. Don't call -+ * irq_chip::irq_set_affinity() when deactivated. - */ - enum { - IRQD_TRIGGER_MASK = 0xf, -@@ -234,6 +236,7 @@ enum { - IRQD_DEFAULT_TRIGGER_SET = (1 << 25), - IRQD_CAN_RESERVE = (1 << 26), - IRQD_MSI_NOMASK_QUIRK = (1 << 27), -+ IRQD_AFFINITY_ON_ACTIVATE = (1 << 29), - }; - - #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors) -@@ -408,6 +411,16 @@ static inline bool irqd_msi_nomask_quirk(struct irq_data *d) - return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK; - } - -+static inline void irqd_set_affinity_on_activate(struct irq_data *d) -+{ -+ __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE; -+} -+ -+static inline bool irqd_affinity_on_activate(struct irq_data *d) -+{ -+ return __irqd_to_state(d) & IRQD_AFFINITY_ON_ACTIVATE; -+} -+ - #undef __irqd_to_state - - static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d) -diff --git a/include/net/sock.h b/include/net/sock.h -index 8263bbf756a22..6d9c1131fe5c8 100644 ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -849,6 +849,8 @@ static inline int sk_memalloc_socks(void) - { - return static_branch_unlikely(&memalloc_socks_key); - } -+ -+void __receive_sock(struct file *file); - #else - - static inline int sk_memalloc_socks(void) -@@ -856,6 +858,8 @@ static inline int sk_memalloc_socks(void) - return 0; - } - -+static inline void __receive_sock(struct file *file) -+{ } - #endif - - static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask) -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index df73685de1144..3b1d0a4725a49 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -281,12 +281,16 @@ static bool irq_set_affinity_deactivated(struct irq_data *data, - struct irq_desc *desc = irq_data_to_desc(data); - - /* -+ * Handle irq chips which can handle affinity only in activated -+ * state correctly -+ * - * If the interrupt is not yet activated, just store the affinity - * mask and do not call the chip driver at all. On activation the - * driver has to make sure anyway that the interrupt is in a - * useable state so startup works. - */ -- if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data)) -+ if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || -+ irqd_is_activated(data) || !irqd_affinity_on_activate(data)) - return false; - - cpumask_copy(desc->irq_common_data.affinity, mask); -diff --git a/kernel/irq/pm.c b/kernel/irq/pm.c -index 8f557fa1f4fe4..c6c7e187ae748 100644 ---- a/kernel/irq/pm.c -+++ b/kernel/irq/pm.c -@@ -185,14 +185,18 @@ void rearm_wake_irq(unsigned int irq) - unsigned long flags; - struct irq_desc *desc = irq_get_desc_buslock(irq, &flags, IRQ_GET_DESC_CHECK_GLOBAL); - -- if (!desc || !(desc->istate & IRQS_SUSPENDED) || -- !irqd_is_wakeup_set(&desc->irq_data)) -+ if (!desc) - return; - -+ if (!(desc->istate & IRQS_SUSPENDED) || -+ !irqd_is_wakeup_set(&desc->irq_data)) -+ goto unlock; -+ - desc->istate &= ~IRQS_SUSPENDED; - irqd_set(&desc->irq_data, IRQD_WAKEUP_ARMED); - __enable_irq(desc); - -+unlock: - irq_put_desc_busunlock(desc, flags); - } - -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index 0a967db226d8a..bbff4bccb885d 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -2104,6 +2104,13 @@ static void kill_kprobe(struct kprobe *p) - * the original probed function (which will be freed soon) any more. - */ - arch_remove_kprobe(p); -+ -+ /* -+ * The module is going away. We should disarm the kprobe which -+ * is using ftrace. -+ */ -+ if (kprobe_ftrace(p)) -+ disarm_kprobe_ftrace(p); - } - - /* Disable one kprobe */ -diff --git a/kernel/module.c b/kernel/module.c -index 6baa1080cdb76..819c5d3b4c295 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -1517,18 +1517,34 @@ struct module_sect_attrs { - struct module_sect_attr attrs[0]; - }; - -+#define MODULE_SECT_READ_SIZE (3 /* "0x", "\n" */ + (BITS_PER_LONG / 4)) - static ssize_t module_sect_read(struct file *file, struct kobject *kobj, - struct bin_attribute *battr, - char *buf, loff_t pos, size_t count) - { - struct module_sect_attr *sattr = - container_of(battr, struct module_sect_attr, battr); -+ char bounce[MODULE_SECT_READ_SIZE + 1]; -+ size_t wrote; - - if (pos != 0) - return -EINVAL; - -- return sprintf(buf, "0x%px\n", -- kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL); -+ /* -+ * Since we're a binary read handler, we must account for the -+ * trailing NUL byte that sprintf will write: if "buf" is -+ * too small to hold the NUL, or the NUL is exactly the last -+ * byte, the read will look like it got truncated by one byte. -+ * Since there is no way to ask sprintf nicely to not write -+ * the NUL, we have to use a bounce buffer. -+ */ -+ wrote = scnprintf(bounce, sizeof(bounce), "0x%px\n", -+ kallsyms_show_value(file->f_cred) -+ ? (void *)sattr->address : NULL); -+ count = min(count, wrote); -+ memcpy(buf, bounce, count); -+ -+ return count; - } - - static void free_sect_attrs(struct module_sect_attrs *sect_attrs) -@@ -1577,7 +1593,7 @@ static void add_sect_attrs(struct module *mod, const struct load_info *info) - goto out; - sect_attrs->nsections++; - sattr->battr.read = module_sect_read; -- sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4); -+ sattr->battr.size = MODULE_SECT_READ_SIZE; - sattr->battr.attr.mode = 0400; - *(gattr++) = &(sattr++)->battr; - } -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 15160d707da45..705852c1724aa 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -5699,8 +5699,11 @@ static int referenced_filters(struct dyn_ftrace *rec) - int cnt = 0; - - for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) { -- if (ops_references_rec(ops, rec)) -- cnt++; -+ if (ops_references_rec(ops, rec)) { -+ cnt++; -+ if (ops->flags & FTRACE_OPS_FL_SAVE_REGS) -+ rec->flags |= FTRACE_FL_REGS; -+ } - } - - return cnt; -@@ -5877,8 +5880,8 @@ void ftrace_module_enable(struct module *mod) - if (ftrace_start_up) - cnt += referenced_filters(rec); - -- /* This clears FTRACE_FL_DISABLED */ -- rec->flags = cnt; -+ rec->flags &= ~FTRACE_FL_DISABLED; -+ rec->flags += cnt; - - if (ftrace_start_up && cnt) { - int failed = __ftrace_replace_code(rec, 1); -@@ -6459,12 +6462,12 @@ void ftrace_pid_follow_fork(struct trace_array *tr, bool enable) - if (enable) { - register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, - tr); -- register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, -+ register_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, - tr); - } else { - unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork, - tr); -- unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit, -+ unregister_trace_sched_process_free(ftrace_pid_follow_sched_process_exit, - tr); - } - } -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 721947b9962db..f9c2bdbbd8936 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -5686,7 +5686,7 @@ static int tracing_set_tracer(struct trace_array *tr, const char *buf) - } - - /* If trace pipe files are being read, we can't change the tracer */ -- if (tr->current_trace->ref) { -+ if (tr->trace_ref) { - ret = -EBUSY; - goto out; - } -@@ -5902,7 +5902,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp) - - nonseekable_open(inode, filp); - -- tr->current_trace->ref++; -+ tr->trace_ref++; - out: - mutex_unlock(&trace_types_lock); - return ret; -@@ -5921,7 +5921,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file) - - mutex_lock(&trace_types_lock); - -- tr->current_trace->ref--; -+ tr->trace_ref--; - - if (iter->trace->pipe_close) - iter->trace->pipe_close(iter); -@@ -7230,7 +7230,7 @@ static int tracing_buffers_open(struct inode *inode, struct file *filp) - - filp->private_data = info; - -- tr->current_trace->ref++; -+ tr->trace_ref++; - - mutex_unlock(&trace_types_lock); - -@@ -7331,7 +7331,7 @@ static int tracing_buffers_release(struct inode *inode, struct file *file) - - mutex_lock(&trace_types_lock); - -- iter->tr->current_trace->ref--; -+ iter->tr->trace_ref--; - - __trace_array_put(iter->tr); - -@@ -8470,7 +8470,7 @@ static int __remove_instance(struct trace_array *tr) - { - int i; - -- if (tr->ref || (tr->current_trace && tr->current_trace->ref)) -+ if (tr->ref || (tr->current_trace && tr->trace_ref)) - return -EBUSY; - - list_del(&tr->list); -diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h -index a3c29d5fcc616..4055158c1dd25 100644 ---- a/kernel/trace/trace.h -+++ b/kernel/trace/trace.h -@@ -309,6 +309,7 @@ struct trace_array { - struct trace_event_file *trace_marker_file; - cpumask_var_t tracing_cpumask; /* only trace on set CPUs */ - int ref; -+ int trace_ref; - #ifdef CONFIG_FUNCTION_TRACER - struct ftrace_ops *ops; - struct trace_pid_list __rcu *function_pids; -@@ -498,7 +499,6 @@ struct tracer { - struct tracer *next; - struct tracer_flags *flags; - int enabled; -- int ref; - bool print_max; - bool allow_instances; - #ifdef CONFIG_TRACER_MAX_TRACE -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 995061bb2deca..ed9eb97b64b47 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -527,12 +527,12 @@ void trace_event_follow_fork(struct trace_array *tr, bool enable) - if (enable) { - register_trace_prio_sched_process_fork(event_filter_pid_sched_process_fork, - tr, INT_MIN); -- register_trace_prio_sched_process_exit(event_filter_pid_sched_process_exit, -+ register_trace_prio_sched_process_free(event_filter_pid_sched_process_exit, - tr, INT_MAX); - } else { - unregister_trace_sched_process_fork(event_filter_pid_sched_process_fork, - tr); -- unregister_trace_sched_process_exit(event_filter_pid_sched_process_exit, -+ unregister_trace_sched_process_free(event_filter_pid_sched_process_exit, - tr); - } - } -diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c -index 862f4b0139fcb..35512ed26d9ff 100644 ---- a/kernel/trace/trace_hwlat.c -+++ b/kernel/trace/trace_hwlat.c -@@ -270,6 +270,7 @@ static bool disable_migrate; - static void move_to_next_cpu(void) - { - struct cpumask *current_mask = &save_cpumask; -+ struct trace_array *tr = hwlat_trace; - int next_cpu; - - if (disable_migrate) -@@ -283,7 +284,7 @@ static void move_to_next_cpu(void) - goto disable; - - get_online_cpus(); -- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); -+ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); - next_cpu = cpumask_next(smp_processor_id(), current_mask); - put_online_cpus(); - -@@ -360,7 +361,7 @@ static int start_kthread(struct trace_array *tr) - /* Just pick the first CPU on first iteration */ - current_mask = &save_cpumask; - get_online_cpus(); -- cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask); -+ cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask); - put_online_cpus(); - next_cpu = cpumask_first(current_mask); - -diff --git a/lib/devres.c b/lib/devres.c -index 17624d35e82d4..77c80ca9e4856 100644 ---- a/lib/devres.c -+++ b/lib/devres.c -@@ -155,6 +155,7 @@ void __iomem *devm_ioremap_resource(struct device *dev, - { - resource_size_t size; - void __iomem *dest_ptr; -+ char *pretty_name; - - BUG_ON(!dev); - -@@ -165,7 +166,15 @@ void __iomem *devm_ioremap_resource(struct device *dev, - - size = resource_size(res); - -- if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) { -+ if (res->name) -+ pretty_name = devm_kasprintf(dev, GFP_KERNEL, "%s %s", -+ dev_name(dev), res->name); -+ else -+ pretty_name = devm_kstrdup(dev, dev_name(dev), GFP_KERNEL); -+ if (!pretty_name) -+ return IOMEM_ERR_PTR(-ENOMEM); -+ -+ if (!devm_request_mem_region(dev, res->start, size, pretty_name)) { - dev_err(dev, "can't request region for resource %pR\n", res); - return IOMEM_ERR_PTR(-EBUSY); - } -diff --git a/lib/test_kmod.c b/lib/test_kmod.c -index 9cf77628fc913..87a0cc750ea23 100644 ---- a/lib/test_kmod.c -+++ b/lib/test_kmod.c -@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev, - break; - case TEST_KMOD_FS_TYPE: - kfree_const(config->test_fs); -- config->test_driver = NULL; -+ config->test_fs = NULL; - copied = config_copy_test_fs(config, test_str, - strlen(test_str)); - break; -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index 5977f7824a9ac..719f49d1fba2f 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -1294,7 +1294,7 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) - { - unsigned long haddr = addr & HPAGE_PMD_MASK; - struct vm_area_struct *vma = find_vma(mm, haddr); -- struct page *hpage = NULL; -+ struct page *hpage; - pte_t *start_pte, *pte; - pmd_t *pmd, _pmd; - spinlock_t *ptl; -@@ -1314,9 +1314,17 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) - if (!hugepage_vma_check(vma, vma->vm_flags | VM_HUGEPAGE)) - return; - -+ hpage = find_lock_page(vma->vm_file->f_mapping, -+ linear_page_index(vma, haddr)); -+ if (!hpage) -+ return; -+ -+ if (!PageHead(hpage)) -+ goto drop_hpage; -+ - pmd = mm_find_pmd(mm, haddr); - if (!pmd) -- return; -+ goto drop_hpage; - - start_pte = pte_offset_map_lock(mm, pmd, haddr, &ptl); - -@@ -1335,30 +1343,11 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) - - page = vm_normal_page(vma, addr, *pte); - -- if (!page || !PageCompound(page)) -- goto abort; -- -- if (!hpage) { -- hpage = compound_head(page); -- /* -- * The mapping of the THP should not change. -- * -- * Note that uprobe, debugger, or MAP_PRIVATE may -- * change the page table, but the new page will -- * not pass PageCompound() check. -- */ -- if (WARN_ON(hpage->mapping != vma->vm_file->f_mapping)) -- goto abort; -- } -- - /* -- * Confirm the page maps to the correct subpage. -- * -- * Note that uprobe, debugger, or MAP_PRIVATE may change -- * the page table, but the new page will not pass -- * PageCompound() check. -+ * Note that uprobe, debugger, or MAP_PRIVATE may change the -+ * page table, but the new page will not be a subpage of hpage. - */ -- if (WARN_ON(hpage + i != page)) -+ if (hpage + i != page) - goto abort; - count++; - } -@@ -1377,21 +1366,26 @@ void collapse_pte_mapped_thp(struct mm_struct *mm, unsigned long addr) - pte_unmap_unlock(start_pte, ptl); - - /* step 3: set proper refcount and mm_counters. */ -- if (hpage) { -+ if (count) { - page_ref_sub(hpage, count); - add_mm_counter(vma->vm_mm, mm_counter_file(hpage), -count); - } - - /* step 4: collapse pmd */ - ptl = pmd_lock(vma->vm_mm, pmd); -- _pmd = pmdp_collapse_flush(vma, addr, pmd); -+ _pmd = pmdp_collapse_flush(vma, haddr, pmd); - spin_unlock(ptl); - mm_dec_nr_ptes(mm); - pte_free(mm, pmd_pgtable(_pmd)); -+ -+drop_hpage: -+ unlock_page(hpage); -+ put_page(hpage); - return; - - abort: - pte_unmap_unlock(start_pte, ptl); -+ goto drop_hpage; - } - - static int khugepaged_collapse_pte_mapped_thps(struct mm_slot *mm_slot) -@@ -1420,6 +1414,7 @@ out: - static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) - { - struct vm_area_struct *vma; -+ struct mm_struct *mm; - unsigned long addr; - pmd_t *pmd, _pmd; - -@@ -1448,7 +1443,8 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) - continue; - if (vma->vm_end < addr + HPAGE_PMD_SIZE) - continue; -- pmd = mm_find_pmd(vma->vm_mm, addr); -+ mm = vma->vm_mm; -+ pmd = mm_find_pmd(mm, addr); - if (!pmd) - continue; - /* -@@ -1458,17 +1454,19 @@ static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff) - * mmap_sem while holding page lock. Fault path does it in - * reverse order. Trylock is a way to avoid deadlock. - */ -- if (down_write_trylock(&vma->vm_mm->mmap_sem)) { -- spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd); -- /* assume page table is clear */ -- _pmd = pmdp_collapse_flush(vma, addr, pmd); -- spin_unlock(ptl); -- up_write(&vma->vm_mm->mmap_sem); -- mm_dec_nr_ptes(vma->vm_mm); -- pte_free(vma->vm_mm, pmd_pgtable(_pmd)); -+ if (down_write_trylock(&mm->mmap_sem)) { -+ if (!khugepaged_test_exit(mm)) { -+ spinlock_t *ptl = pmd_lock(mm, pmd); -+ /* assume page table is clear */ -+ _pmd = pmdp_collapse_flush(vma, addr, pmd); -+ spin_unlock(ptl); -+ mm_dec_nr_ptes(mm); -+ pte_free(mm, pmd_pgtable(_pmd)); -+ } -+ up_write(&mm->mmap_sem); - } else { - /* Try again later */ -- khugepaged_add_pte_mapped_thp(vma->vm_mm, addr); -+ khugepaged_add_pte_mapped_thp(mm, addr); - } - } - i_mmap_unlock_write(mapping); -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index c054945a9a742..3128d95847125 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1751,7 +1751,7 @@ static int __ref try_remove_memory(int nid, u64 start, u64 size) - */ - rc = walk_memory_blocks(start, size, NULL, check_memblock_offlined_cb); - if (rc) -- goto done; -+ return rc; - - /* remove memmap entry */ - firmware_map_remove(start, start + size, "System RAM"); -@@ -1771,9 +1771,8 @@ static int __ref try_remove_memory(int nid, u64 start, u64 size) - - try_offline_node(nid); - --done: - mem_hotplug_done(); -- return rc; -+ return 0; - } - - /** -diff --git a/mm/page_counter.c b/mm/page_counter.c -index de31470655f66..147ff99187b81 100644 ---- a/mm/page_counter.c -+++ b/mm/page_counter.c -@@ -77,7 +77,7 @@ void page_counter_charge(struct page_counter *counter, unsigned long nr_pages) - long new; - - new = atomic_long_add_return(nr_pages, &c->usage); -- propagate_protected_usage(counter, new); -+ propagate_protected_usage(c, new); - /* - * This is indeed racy, but we can live with some - * inaccuracy in the watermark. -@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page_counter *counter, - new = atomic_long_add_return(nr_pages, &c->usage); - if (new > c->max) { - atomic_long_sub(nr_pages, &c->usage); -- propagate_protected_usage(counter, new); -+ propagate_protected_usage(c, new); - /* - * This is racy, but we can live with some - * inaccuracy in the failcnt. -@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page_counter *counter, - *fail = c; - goto failed; - } -- propagate_protected_usage(counter, new); -+ propagate_protected_usage(c, new); - /* - * Just like with failcnt, we can live with some - * inaccuracy in the watermark. -diff --git a/net/compat.c b/net/compat.c -index 0f7ded26059ec..c848bcb517f3e 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -291,6 +291,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm) - break; - } - /* Bump the usage count and install the file. */ -+ __receive_sock(fp[i]); - fd_install(new_fd, get_file(fp[i])); - } - -diff --git a/net/core/sock.c b/net/core/sock.c -index 991ab80234cec..919f1a1739e90 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -2736,6 +2736,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, struct vm_area_struct * - } - EXPORT_SYMBOL(sock_no_mmap); - -+/* -+ * When a file is received (via SCM_RIGHTS, etc), we must bump the -+ * various sock-based usage counts. -+ */ -+void __receive_sock(struct file *file) -+{ -+ struct socket *sock; -+ int error; -+ -+ /* -+ * The resulting value of "error" is ignored here since we only -+ * need to take action when the file is a socket and testing -+ * "sock" for NULL is sufficient. -+ */ -+ sock = sock_from_file(file, &error); -+ if (sock) { -+ sock_update_netprioidx(&sock->sk->sk_cgrp_data); -+ sock_update_classid(&sock->sk->sk_cgrp_data); -+ } -+} -+ - ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags) - { - ssize_t res; -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index b1669f0244706..f5d96107af6de 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -1033,7 +1033,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta) - might_sleep(); - lockdep_assert_held(&local->sta_mtx); - -- while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { -+ if (sta->sta_state == IEEE80211_STA_AUTHORIZED) { - ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); - WARN_ON_ONCE(ret); - } -diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c -index e59022b3f1254..b9c2ee7ab43fa 100644 ---- a/scripts/recordmcount.c -+++ b/scripts/recordmcount.c -@@ -42,6 +42,8 @@ - #define R_ARM_THM_CALL 10 - #define R_ARM_CALL 28 - -+#define R_AARCH64_CALL26 283 -+ - static int fd_map; /* File descriptor for file being modified. */ - static int mmap_failed; /* Boolean flag. */ - static char gpfx; /* prefix for global symbol name (sometimes '_') */ -diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c -index ca9125726be24..8596ae4c2bdef 100644 ---- a/sound/pci/echoaudio/echoaudio.c -+++ b/sound/pci/echoaudio/echoaudio.c -@@ -2198,7 +2198,6 @@ static int snd_echo_resume(struct device *dev) - if (err < 0) { - kfree(commpage_bak); - dev_err(dev, "resume init_hw err=%d\n", err); -- snd_echo_free(chip); - return err; - } - -@@ -2225,7 +2224,6 @@ static int snd_echo_resume(struct device *dev) - if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, - KBUILD_MODNAME, chip)) { - dev_err(chip->card->dev, "cannot grab irq\n"); -- snd_echo_free(chip); - return -EBUSY; - } - chip->irq = pci->irq; -diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature -index 8a19753cc26aa..8c6e1ea67f213 100644 ---- a/tools/build/Makefile.feature -+++ b/tools/build/Makefile.feature -@@ -8,7 +8,7 @@ endif - - feature_check = $(eval $(feature_check_code)) - define feature_check_code -- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) -+ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) - endef - - feature_set = $(eval $(feature_set_code)) -diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile -index 8499385365c02..054e09ab4a9e4 100644 ---- a/tools/build/feature/Makefile -+++ b/tools/build/feature/Makefile -@@ -70,8 +70,6 @@ FILES= \ - - FILES := $(addprefix $(OUTPUT),$(FILES)) - --CC ?= $(CROSS_COMPILE)gcc --CXX ?= $(CROSS_COMPILE)g++ - PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config - LLVM_CONFIG ?= llvm-config - -diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c -index 9235b76501be8..19d45c377ac18 100644 ---- a/tools/perf/bench/mem-functions.c -+++ b/tools/perf/bench/mem-functions.c -@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info * - return 0; - } - --static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) -+static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst) - { -- u64 cycle_start = 0ULL, cycle_end = 0ULL; -- memcpy_t fn = r->fn.memcpy; -- int i; -- - /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */ - memset(src, 0, size); - -@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo - * to not measure page fault overhead: - */ - fn(dst, src, size); -+} -+ -+static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) -+{ -+ u64 cycle_start = 0ULL, cycle_end = 0ULL; -+ memcpy_t fn = r->fn.memcpy; -+ int i; -+ -+ memcpy_prefault(fn, size, src, dst); - - cycle_start = get_cycles(); - for (i = 0; i < nr_loops; ++i) -@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void - memcpy_t fn = r->fn.memcpy; - int i; - -- /* -- * We prefault the freshly allocated memory range here, -- * to not measure page fault overhead: -- */ -- fn(dst, src, size); -+ memcpy_prefault(fn, size, src, dst); - - BUG_ON(gettimeofday(&tv_start, NULL)); - for (i = 0; i < nr_loops; ++i) -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index f8ccfd6be0eee..7ffcbd6fcd1ae 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -1164,6 +1164,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder) - return 0; - if (err == -EAGAIN || - intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) { -+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; - if (intel_pt_fup_event(decoder)) - return 0; - return -EAGAIN; -@@ -1942,17 +1943,13 @@ next: - } - if (decoder->set_fup_mwait) - no_tip = true; -+ if (no_tip) -+ decoder->pkt_state = INTEL_PT_STATE_FUP_NO_TIP; -+ else -+ decoder->pkt_state = INTEL_PT_STATE_FUP; - err = intel_pt_walk_fup(decoder); -- if (err != -EAGAIN) { -- if (err) -- return err; -- if (no_tip) -- decoder->pkt_state = -- INTEL_PT_STATE_FUP_NO_TIP; -- else -- decoder->pkt_state = INTEL_PT_STATE_FUP; -- return 0; -- } -+ if (err != -EAGAIN) -+ return err; - if (no_tip) { - no_tip = false; - break; -@@ -1980,8 +1977,10 @@ next: - * possibility of another CBR change that gets caught up - * in the PSB+. - */ -- if (decoder->cbr != decoder->cbr_seen) -+ if (decoder->cbr != decoder->cbr_seen) { -+ decoder->state.type = 0; - return 0; -+ } - break; - - case INTEL_PT_PIP: -@@ -2022,8 +2021,10 @@ next: - - case INTEL_PT_CBR: - intel_pt_calc_cbr(decoder); -- if (decoder->cbr != decoder->cbr_seen) -+ if (decoder->cbr != decoder->cbr_seen) { -+ decoder->state.type = 0; - return 0; -+ } - break; - - case INTEL_PT_MODE_EXEC: -@@ -2599,15 +2600,11 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) - err = intel_pt_walk_tip(decoder); - break; - case INTEL_PT_STATE_FUP: -- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; - err = intel_pt_walk_fup(decoder); - if (err == -EAGAIN) - err = intel_pt_walk_fup_tip(decoder); -- else if (!err) -- decoder->pkt_state = INTEL_PT_STATE_FUP; - break; - case INTEL_PT_STATE_FUP_NO_TIP: -- decoder->pkt_state = INTEL_PT_STATE_IN_SYNC; - err = intel_pt_walk_fup(decoder); - if (err == -EAGAIN) - err = intel_pt_walk_trace(decoder); -diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c -index 8cb3469dd11f2..48bbe8e0ce48d 100644 ---- a/tools/testing/selftests/bpf/test_progs.c -+++ b/tools/testing/selftests/bpf/test_progs.c -@@ -7,6 +7,8 @@ - #include - #include - -+#define EXIT_NO_TEST 2 -+ - /* defined in test_progs.h */ - struct test_env env; - -@@ -584,5 +586,8 @@ int main(int argc, char **argv) - free(env.test_selector.num_set); - free(env.subtest_selector.num_set); - -+ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0) -+ return EXIT_NO_TEST; -+ - return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS; - } -diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c -index bdbbbe8431e03..3694613f418f6 100644 ---- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c -+++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c -@@ -44,7 +44,7 @@ struct shared_info { - unsigned long amr2; - - /* AMR value that ptrace should refuse to write to the child. */ -- unsigned long amr3; -+ unsigned long invalid_amr; - - /* IAMR value the parent expects to read from the child. */ - unsigned long expected_iamr; -@@ -57,8 +57,8 @@ struct shared_info { - * (even though they're valid ones) because userspace doesn't have - * access to those registers. - */ -- unsigned long new_iamr; -- unsigned long new_uamor; -+ unsigned long invalid_iamr; -+ unsigned long invalid_uamor; - }; - - static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) -@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) - return syscall(__NR_pkey_alloc, flags, init_access_rights); - } - --static int sys_pkey_free(int pkey) --{ -- return syscall(__NR_pkey_free, pkey); --} -- - static int child(struct shared_info *info) - { - unsigned long reg; -@@ -100,28 +95,32 @@ static int child(struct shared_info *info) - - info->amr1 |= 3ul << pkeyshift(pkey1); - info->amr2 |= 3ul << pkeyshift(pkey2); -- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3); -+ /* -+ * invalid amr value where we try to force write -+ * things which are deined by a uamor setting. -+ */ -+ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor); - -+ /* -+ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr -+ */ - if (disable_execute) - info->expected_iamr |= 1ul << pkeyshift(pkey1); - else - info->expected_iamr &= ~(1ul << pkeyshift(pkey1)); - -- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3)); -- -- info->expected_uamor |= 3ul << pkeyshift(pkey1) | -- 3ul << pkeyshift(pkey2); -- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2); -- info->new_uamor |= 3ul << pkeyshift(pkey1); -+ /* -+ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits. -+ */ -+ info->expected_iamr &= ~(1ul << pkeyshift(pkey2)); -+ info->expected_iamr &= ~(1ul << pkeyshift(pkey3)); - - /* -- * We won't use pkey3. We just want a plausible but invalid key to test -- * whether ptrace will let us write to AMR bits we are not supposed to. -- * -- * This also tests whether the kernel restores the UAMOR permissions -- * after a key is freed. -+ * Create an IAMR value different from expected value. -+ * Kernel will reject an IAMR and UAMOR change. - */ -- sys_pkey_free(pkey3); -+ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2)); -+ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1)); - - printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n", - user_write, info->amr1, pkey1, pkey2, pkey3); -@@ -196,9 +195,9 @@ static int parent(struct shared_info *info, pid_t pid) - PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync); - PARENT_FAIL_IF(ret, &info->child_sync); - -- info->amr1 = info->amr2 = info->amr3 = regs[0]; -- info->expected_iamr = info->new_iamr = regs[1]; -- info->expected_uamor = info->new_uamor = regs[2]; -+ info->amr1 = info->amr2 = regs[0]; -+ info->expected_iamr = regs[1]; -+ info->expected_uamor = regs[2]; - - /* Wake up child so that it can set itself up. */ - ret = prod_child(&info->child_sync); -@@ -234,10 +233,10 @@ static int parent(struct shared_info *info, pid_t pid) - return ret; - - /* Write invalid AMR value in child. */ -- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1); -+ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1); - PARENT_FAIL_IF(ret, &info->child_sync); - -- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3); -+ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr); - - /* Wake up child so that it can verify it didn't change. */ - ret = prod_child(&info->child_sync); -@@ -249,7 +248,7 @@ static int parent(struct shared_info *info, pid_t pid) - - /* Try to write to IAMR. */ - regs[0] = info->amr1; -- regs[1] = info->new_iamr; -+ regs[1] = info->invalid_iamr; - ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2); - PARENT_FAIL_IF(!ret, &info->child_sync); - -@@ -257,7 +256,7 @@ static int parent(struct shared_info *info, pid_t pid) - ptrace_write_running, regs[0], regs[1]); - - /* Try to write to IAMR and UAMOR. */ -- regs[2] = info->new_uamor; -+ regs[2] = info->invalid_uamor; - ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3); - PARENT_FAIL_IF(!ret, &info->child_sync); - diff --git a/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch b/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch deleted file mode 100644 index bee93bccc5..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.60-61.patch +++ /dev/null @@ -1,3600 +0,0 @@ -diff --git a/Documentation/kbuild/index.rst b/Documentation/kbuild/index.rst -index 0f144fad99a6a..3882bd5f7728c 100644 ---- a/Documentation/kbuild/index.rst -+++ b/Documentation/kbuild/index.rst -@@ -19,6 +19,7 @@ Kernel Build System - - issues - reproducible-builds -+ llvm - - .. only:: subproject and html - -diff --git a/Documentation/kbuild/kbuild.rst b/Documentation/kbuild/kbuild.rst -index f1e5dce86af7c..852ccc551bb3a 100644 ---- a/Documentation/kbuild/kbuild.rst -+++ b/Documentation/kbuild/kbuild.rst -@@ -262,3 +262,8 @@ KBUILD_BUILD_USER, KBUILD_BUILD_HOST - These two variables allow to override the user@host string displayed during - boot and in /proc/version. The default value is the output of the commands - whoami and host, respectively. -+ -+LLVM -+---- -+If this variable is set to 1, Kbuild will use Clang and LLVM utilities instead -+of GCC and GNU binutils to build the kernel. -diff --git a/Documentation/kbuild/llvm.rst b/Documentation/kbuild/llvm.rst -new file mode 100644 -index 0000000000000..c776b6eee969f ---- /dev/null -+++ b/Documentation/kbuild/llvm.rst -@@ -0,0 +1,87 @@ -+============================== -+Building Linux with Clang/LLVM -+============================== -+ -+This document covers how to build the Linux kernel with Clang and LLVM -+utilities. -+ -+About -+----- -+ -+The Linux kernel has always traditionally been compiled with GNU toolchains -+such as GCC and binutils. Ongoing work has allowed for `Clang -+`_ and `LLVM `_ utilities to be -+used as viable substitutes. Distributions such as `Android -+`_, `ChromeOS -+`_, and `OpenMandriva -+`_ use Clang built kernels. `LLVM is a -+collection of toolchain components implemented in terms of C++ objects -+`_. Clang is a front-end to LLVM that -+supports C and the GNU C extensions required by the kernel, and is pronounced -+"klang," not "see-lang." -+ -+Clang -+----- -+ -+The compiler used can be swapped out via `CC=` command line argument to `make`. -+`CC=` should be set when selecting a config and during a build. -+ -+ make CC=clang defconfig -+ -+ make CC=clang -+ -+Cross Compiling -+--------------- -+ -+A single Clang compiler binary will typically contain all supported backends, -+which can help simplify cross compiling. -+ -+ ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- make CC=clang -+ -+`CROSS_COMPILE` is not used to prefix the Clang compiler binary, instead -+`CROSS_COMPILE` is used to set a command line flag: `--target `. For -+example: -+ -+ clang --target aarch64-linux-gnu foo.c -+ -+LLVM Utilities -+-------------- -+ -+LLVM has substitutes for GNU binutils utilities. Kbuild supports `LLVM=1` -+to enable them. -+ -+ make LLVM=1 -+ -+They can be enabled individually. The full list of the parameters: -+ -+ make CC=clang LD=ld.lld AR=llvm-ar NM=llvm-nm STRIP=llvm-strip \\ -+ OBJCOPY=llvm-objcopy OBJDUMP=llvm-objdump OBJSIZE=llvm-size \\ -+ READELF=llvm-readelf HOSTCC=clang HOSTCXX=clang++ HOSTAR=llvm-ar \\ -+ HOSTLD=ld.lld -+ -+Currently, the integrated assembler is disabled by default. You can pass -+`LLVM_IAS=1` to enable it. -+ -+Getting Help -+------------ -+ -+- `Website `_ -+- `Mailing List `_: -+- `Issue Tracker `_ -+- IRC: #clangbuiltlinux on chat.freenode.net -+- `Telegram `_: @ClangBuiltLinux -+- `Wiki `_ -+- `Beginner Bugs `_ -+ -+Getting LLVM -+------------- -+ -+- http://releases.llvm.org/download.html -+- https://github.com/llvm/llvm-project -+- https://llvm.org/docs/GettingStarted.html -+- https://llvm.org/docs/CMake.html -+- https://apt.llvm.org/ -+- https://www.archlinux.org/packages/extra/x86_64/llvm/ -+- https://github.com/ClangBuiltLinux/tc-build -+- https://github.com/ClangBuiltLinux/linux/wiki/Building-Clang-from-source -+- https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/ -diff --git a/MAINTAINERS b/MAINTAINERS -index fe6fa5d3a63e5..1407008df7491 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -4028,6 +4028,7 @@ B: https://github.com/ClangBuiltLinux/linux/issues - C: irc://chat.freenode.net/clangbuiltlinux - S: Supported - K: \b(?i:clang|llvm)\b -+F: Documentation/kbuild/llvm.rst - - CLEANCACHE API - M: Konrad Rzeszutek Wilk -diff --git a/Makefile b/Makefile -index 7c001e21e28e7..2c21b922644d7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 60 -+SUBLEVEL = 61 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -@@ -394,8 +394,13 @@ HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null) - HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null) - HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null) - --HOSTCC = gcc --HOSTCXX = g++ -+ifneq ($(LLVM),) -+HOSTCC = clang -+HOSTCXX = clang++ -+else -+HOSTCC = gcc -+HOSTCXX = g++ -+endif - KBUILD_HOSTCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 \ - -fomit-frame-pointer -std=gnu89 $(HOST_LFS_CFLAGS) \ - $(HOSTCFLAGS) -@@ -404,16 +409,28 @@ KBUILD_HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) $(HOSTLDFLAGS) - KBUILD_HOSTLDLIBS := $(HOST_LFS_LIBS) $(HOSTLDLIBS) - - # Make variables (CC, etc...) --AS = $(CROSS_COMPILE)as --LD = $(CROSS_COMPILE)ld --CC = $(CROSS_COMPILE)gcc - CPP = $(CC) -E -+ifneq ($(LLVM),) -+CC = clang -+LD = ld.lld -+AR = llvm-ar -+NM = llvm-nm -+OBJCOPY = llvm-objcopy -+OBJDUMP = llvm-objdump -+READELF = llvm-readelf -+OBJSIZE = llvm-size -+STRIP = llvm-strip -+else -+CC = $(CROSS_COMPILE)gcc -+LD = $(CROSS_COMPILE)ld - AR = $(CROSS_COMPILE)ar - NM = $(CROSS_COMPILE)nm --STRIP = $(CROSS_COMPILE)strip - OBJCOPY = $(CROSS_COMPILE)objcopy - OBJDUMP = $(CROSS_COMPILE)objdump -+READELF = $(CROSS_COMPILE)readelf - OBJSIZE = $(CROSS_COMPILE)size -+STRIP = $(CROSS_COMPILE)strip -+endif - PAHOLE = pahole - LEX = flex - YACC = bison -@@ -422,7 +439,6 @@ INSTALLKERNEL := installkernel - DEPMOD = /sbin/depmod - PERL = perl - PYTHON = python --PYTHON2 = python2 - PYTHON3 = python3 - CHECK = sparse - BASH = bash -@@ -471,9 +487,9 @@ KBUILD_LDFLAGS := - GCC_PLUGINS_CFLAGS := - CLANG_FLAGS := - --export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC --export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE PAHOLE LEX YACC AWK INSTALLKERNEL --export PERL PYTHON PYTHON2 PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX -+export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC -+export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE READELF PAHOLE LEX YACC AWK INSTALLKERNEL -+export PERL PYTHON PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX - export KBUILD_HOSTCXXFLAGS KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS LDFLAGS_MODULE - - export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS KBUILD_LDFLAGS -@@ -534,7 +550,7 @@ endif - ifneq ($(GCC_TOOLCHAIN),) - CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN) - endif --ifeq ($(shell $(AS) --version 2>&1 | head -n 1 | grep clang),) -+ifneq ($(LLVM_IAS),1) - CLANG_FLAGS += -no-integrated-as - endif - CLANG_FLAGS += -Werror=unknown-warning-option -diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h -index b771bf1b53523..103270d5a9fc6 100644 ---- a/arch/alpha/include/asm/io.h -+++ b/arch/alpha/include/asm/io.h -@@ -502,10 +502,10 @@ extern inline void writeq(u64 b, volatile void __iomem *addr) - } - #endif - --#define ioread16be(p) be16_to_cpu(ioread16(p)) --#define ioread32be(p) be32_to_cpu(ioread32(p)) --#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p)) --#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p)) -+#define ioread16be(p) swab16(ioread16(p)) -+#define ioread32be(p) swab32(ioread32(p)) -+#define iowrite16be(v,p) iowrite16(swab16(v), (p)) -+#define iowrite32be(v,p) iowrite32(swab32(v), (p)) - - #define inb_p inb - #define inw_p inw -diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h -index 1b179b1f46bc5..dd03d5e01a946 100644 ---- a/arch/arm/include/asm/kvm_host.h -+++ b/arch/arm/include/asm/kvm_host.h -@@ -266,7 +266,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu, - - #define KVM_ARCH_WANT_MMU_NOTIFIER - int kvm_unmap_hva_range(struct kvm *kvm, -- unsigned long start, unsigned long end); -+ unsigned long start, unsigned long end, unsigned flags); - int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); - - unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu); -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index d65aef47ece3b..11a7d6208087f 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -146,6 +146,7 @@ zinstall install: - PHONY += vdso_install - vdso_install: - $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ -+ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ - - # We use MRPROPER_FILES and CLEAN_FILES now - archclean: -diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h -index 0c3bd6aff6e91..d719c6b4dd81c 100644 ---- a/arch/arm64/include/asm/kvm_host.h -+++ b/arch/arm64/include/asm/kvm_host.h -@@ -427,7 +427,7 @@ int __kvm_arm_vcpu_set_events(struct kvm_vcpu *vcpu, - - #define KVM_ARCH_WANT_MMU_NOTIFIER - int kvm_unmap_hva_range(struct kvm *kvm, -- unsigned long start, unsigned long end); -+ unsigned long start, unsigned long end, unsigned flags); - int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); - int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); - int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); -diff --git a/arch/arm64/kernel/vdso32/Makefile b/arch/arm64/kernel/vdso32/Makefile -index 76b327f88fbb1..40dffe60b8454 100644 ---- a/arch/arm64/kernel/vdso32/Makefile -+++ b/arch/arm64/kernel/vdso32/Makefile -@@ -190,7 +190,7 @@ quiet_cmd_vdsosym = VDSOSYM $@ - cmd_vdsosym = $(NM) $< | $(gen-vdsosym) | LC_ALL=C sort > $@ - - # Install commands for the unstripped file --quiet_cmd_vdso_install = INSTALL $@ -+quiet_cmd_vdso_install = INSTALL32 $@ - cmd_vdso_install = cp $(obj)/$@.dbg $(MODLIB)/vdso/vdso32.so - - vdso.so: $(obj)/vdso.so.dbg -diff --git a/arch/m68k/include/asm/m53xxacr.h b/arch/m68k/include/asm/m53xxacr.h -index 9138a624c5c81..692f90e7fecc1 100644 ---- a/arch/m68k/include/asm/m53xxacr.h -+++ b/arch/m68k/include/asm/m53xxacr.h -@@ -89,9 +89,9 @@ - * coherency though in all cases. And for copyback caches we will need - * to push cached data as well. - */ --#define CACHE_INIT CACR_CINVA --#define CACHE_INVALIDATE CACR_CINVA --#define CACHE_INVALIDATED CACR_CINVA -+#define CACHE_INIT (CACHE_MODE + CACR_CINVA - CACR_EC) -+#define CACHE_INVALIDATE (CACHE_MODE + CACR_CINVA) -+#define CACHE_INVALIDATED (CACHE_MODE + CACR_CINVA) - - #define ACR0_MODE ((CONFIG_RAMBASE & 0xff000000) + \ - (0x000f0000) + \ -diff --git a/arch/mips/include/asm/kvm_host.h b/arch/mips/include/asm/kvm_host.h -index 7b47a323dc23e..356c61074d136 100644 ---- a/arch/mips/include/asm/kvm_host.h -+++ b/arch/mips/include/asm/kvm_host.h -@@ -939,7 +939,7 @@ enum kvm_mips_fault_result kvm_trap_emul_gva_fault(struct kvm_vcpu *vcpu, - - #define KVM_ARCH_WANT_MMU_NOTIFIER - int kvm_unmap_hva_range(struct kvm *kvm, -- unsigned long start, unsigned long end); -+ unsigned long start, unsigned long end, unsigned flags); - int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); - int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); - int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); -diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c -index 7b06e6ee6817d..b8884de89c81e 100644 ---- a/arch/mips/kernel/setup.c -+++ b/arch/mips/kernel/setup.c -@@ -494,7 +494,7 @@ static void __init mips_parse_crashkernel(void) - if (ret != 0 || crash_size <= 0) - return; - -- if (!memblock_find_in_range(crash_base, crash_base + crash_size, crash_size, 0)) { -+ if (!memblock_find_in_range(crash_base, crash_base + crash_size, crash_size, 1)) { - pr_warn("Invalid memory region reserved for crash kernel\n"); - return; - } -diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c -index 97e538a8c1be2..97f63a84aa51f 100644 ---- a/arch/mips/kvm/mmu.c -+++ b/arch/mips/kvm/mmu.c -@@ -512,7 +512,8 @@ static int kvm_unmap_hva_handler(struct kvm *kvm, gfn_t gfn, gfn_t gfn_end, - return 1; - } - --int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) -+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, -+ unsigned flags) - { - handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL); - -diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h -index 6fe6ad64cba57..740b52ec35097 100644 ---- a/arch/powerpc/include/asm/kvm_host.h -+++ b/arch/powerpc/include/asm/kvm_host.h -@@ -58,7 +58,8 @@ - #define KVM_ARCH_WANT_MMU_NOTIFIER - - extern int kvm_unmap_hva_range(struct kvm *kvm, -- unsigned long start, unsigned long end); -+ unsigned long start, unsigned long end, -+ unsigned flags); - extern int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); - extern int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); - extern int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); -diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c -index ec2547cc5ecbe..1ff971f3b06f9 100644 ---- a/arch/powerpc/kvm/book3s.c -+++ b/arch/powerpc/kvm/book3s.c -@@ -867,7 +867,8 @@ void kvmppc_core_commit_memory_region(struct kvm *kvm, - kvm->arch.kvm_ops->commit_memory_region(kvm, mem, old, new, change); - } - --int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) -+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, -+ unsigned flags) - { - return kvm->arch.kvm_ops->unmap_hva_range(kvm, start, end); - } -diff --git a/arch/powerpc/kvm/e500_mmu_host.c b/arch/powerpc/kvm/e500_mmu_host.c -index 321db0fdb9db8..7154bd424d243 100644 ---- a/arch/powerpc/kvm/e500_mmu_host.c -+++ b/arch/powerpc/kvm/e500_mmu_host.c -@@ -734,7 +734,8 @@ static int kvm_unmap_hva(struct kvm *kvm, unsigned long hva) - return 0; - } - --int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) -+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, -+ unsigned flags) - { - /* kvm_unmap_hva flushes everything anyways */ - kvm_unmap_hva(kvm, start); -diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c -index 13ef77fd648f4..b3c4848869e52 100644 ---- a/arch/powerpc/platforms/pseries/ras.c -+++ b/arch/powerpc/platforms/pseries/ras.c -@@ -184,7 +184,6 @@ static void handle_system_shutdown(char event_modifier) - case EPOW_SHUTDOWN_ON_UPS: - pr_emerg("Loss of system power detected. System is running on" - " UPS/battery. Check RTAS error log for details\n"); -- orderly_poweroff(true); - break; - - case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS: -diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c -index 5aa786063eb3e..c6aef2ecf2890 100644 ---- a/arch/s390/kernel/ptrace.c -+++ b/arch/s390/kernel/ptrace.c -@@ -1283,7 +1283,6 @@ static bool is_ri_cb_valid(struct runtime_instr_cb *cb) - cb->pc == 1 && - cb->qc == 0 && - cb->reserved2 == 0 && -- cb->key == PAGE_DEFAULT_KEY && - cb->reserved3 == 0 && - cb->reserved4 == 0 && - cb->reserved5 == 0 && -@@ -1347,7 +1346,11 @@ static int s390_runtime_instr_set(struct task_struct *target, - kfree(data); - return -EINVAL; - } -- -+ /* -+ * Override access key in any case, since user space should -+ * not be able to set it, nor should it care about it. -+ */ -+ ri_cb.key = PAGE_DEFAULT_KEY >> 4; - preempt_disable(); - if (!target->thread.ri_cb) - target->thread.ri_cb = data; -diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c -index 125c7f6e87150..1788a5454b6fc 100644 ---- a/arch/s390/kernel/runtime_instr.c -+++ b/arch/s390/kernel/runtime_instr.c -@@ -57,7 +57,7 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb) - cb->k = 1; - cb->ps = 1; - cb->pc = 1; -- cb->key = PAGE_DEFAULT_KEY; -+ cb->key = PAGE_DEFAULT_KEY >> 4; - cb->v = 1; - } - -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 6b84afdd75382..98aac5b4bdb7e 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -102,7 +102,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o - quiet_cmd_check_data_rel = DATAREL $@ - define cmd_check_data_rel - for obj in $(filter %.o,$^); do \ -- ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \ -+ $(READELF) -S $$obj | grep -qF .rel.local && { \ - echo "error: $$obj has data relocations!" >&2; \ - exit 1; \ - } || true; \ -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 742de9d97ba14..c41686641c3fb 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -1553,7 +1553,8 @@ asmlinkage void kvm_spurious_fault(void); - _ASM_EXTABLE(666b, 667b) - - #define KVM_ARCH_WANT_MMU_NOTIFIER --int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end); -+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, -+ unsigned flags); - int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end); - int kvm_test_age_hva(struct kvm *kvm, unsigned long hva); - int kvm_set_spte_hva(struct kvm *kvm, unsigned long hva, pte_t pte); -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 342d9ddf35c3a..bb743f956c232 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -2045,7 +2045,8 @@ static int kvm_handle_hva(struct kvm *kvm, unsigned long hva, - return kvm_handle_hva_range(kvm, hva, hva + 1, data, handler); - } - --int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end) -+int kvm_unmap_hva_range(struct kvm *kvm, unsigned long start, unsigned long end, -+ unsigned flags) - { - return kvm_handle_hva_range(kvm, start, end, 0, kvm_unmap_rmapp); - } -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 38b2df0e71096..8920ee7b28811 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -972,7 +972,7 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) - { - unsigned long old_cr4 = kvm_read_cr4(vcpu); - unsigned long pdptr_bits = X86_CR4_PGE | X86_CR4_PSE | X86_CR4_PAE | -- X86_CR4_SMEP | X86_CR4_SMAP | X86_CR4_PKE; -+ X86_CR4_SMEP; - - if (kvm_valid_cr4(vcpu, cr4)) - return 1; -diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c -index 91220cc258547..5c11ae66b5d8e 100644 ---- a/arch/x86/pci/xen.c -+++ b/arch/x86/pci/xen.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - #include - - static int xen_pcifront_enable_irq(struct pci_dev *dev) -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index d3d7c4ef7d045..53dc0fd6f6d3c 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -1571,6 +1571,7 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) - - intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max); - cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling; -+ cpu->pstate.turbo_pstate = phy_max; - } else { - cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling; - } -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index c1167ef5d2b35..b299e22b7532a 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -345,6 +345,7 @@ static int __init efisubsys_init(void) - efi_kobj = kobject_create_and_add("efi", firmware_kobj); - if (!efi_kobj) { - pr_err("efi: Firmware registration failed.\n"); -+ destroy_workqueue(efi_rts_wq); - return -ENOMEM; - } - -@@ -381,6 +382,7 @@ err_unregister: - generic_ops_unregister(); - err_put: - kobject_put(efi_kobj); -+ destroy_workqueue(efi_rts_wq); - return error; - } - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 6091194a3955c..2c0eb7140ca0e 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -1434,6 +1434,7 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector) - - drm_connector_update_edid_property(connector, - aconnector->edid); -+ drm_add_edid_modes(connector, aconnector->edid); - - if (aconnector->dc_link->aux_mode) - drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux, -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -index c13dce760098c..05b98eadc2899 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -@@ -2845,7 +2845,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *co - int vlevel = 0; - int pipe_split_from[MAX_PIPES]; - int pipe_cnt = 0; -- display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_KERNEL); -+ display_e2e_pipe_params_st *pipes = kzalloc(dc->res_pool->pipe_count * sizeof(display_e2e_pipe_params_st), GFP_ATOMIC); - DC_LOGGER_INIT(dc->ctx->logger); - - BW_VAL_TRACE_COUNT(); -diff --git a/drivers/gpu/drm/amd/display/include/fixed31_32.h b/drivers/gpu/drm/amd/display/include/fixed31_32.h -index 89ef9f6860e5b..16df2a485dd0d 100644 ---- a/drivers/gpu/drm/amd/display/include/fixed31_32.h -+++ b/drivers/gpu/drm/amd/display/include/fixed31_32.h -@@ -431,6 +431,9 @@ struct fixed31_32 dc_fixpt_log(struct fixed31_32 arg); - */ - static inline struct fixed31_32 dc_fixpt_pow(struct fixed31_32 arg1, struct fixed31_32 arg2) - { -+ if (arg1.value == 0) -+ return arg2.value == 0 ? dc_fixpt_one : dc_fixpt_zero; -+ - return dc_fixpt_exp( - dc_fixpt_mul( - dc_fixpt_log(arg1), -diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c -index 46dc3de7e81bf..f2bad14ac04ab 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo_vm.c -+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c -@@ -358,8 +358,10 @@ static int ttm_bo_vm_access_kmap(struct ttm_buffer_object *bo, - static int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, - void *buf, int len, int write) - { -- unsigned long offset = (addr) - vma->vm_start; - struct ttm_buffer_object *bo = vma->vm_private_data; -+ unsigned long offset = (addr) - vma->vm_start + -+ ((vma->vm_pgoff - drm_vma_node_start(&bo->base.vma_node)) -+ << PAGE_SHIFT); - int ret; - - if (len < 1 || (offset + len) >> PAGE_SHIFT > bo->num_pages) -diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c -index 909eba43664a2..204d1df5a21d1 100644 ---- a/drivers/gpu/drm/vgem/vgem_drv.c -+++ b/drivers/gpu/drm/vgem/vgem_drv.c -@@ -229,32 +229,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, - return 0; - } - --static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev, -- uint32_t handle, uint64_t *offset) --{ -- struct drm_gem_object *obj; -- int ret; -- -- obj = drm_gem_object_lookup(file, handle); -- if (!obj) -- return -ENOENT; -- -- if (!obj->filp) { -- ret = -EINVAL; -- goto unref; -- } -- -- ret = drm_gem_create_mmap_offset(obj); -- if (ret) -- goto unref; -- -- *offset = drm_vma_node_offset_addr(&obj->vma_node); --unref: -- drm_gem_object_put_unlocked(obj); -- -- return ret; --} -- - static struct drm_ioctl_desc vgem_ioctls[] = { - DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, DRM_RENDER_ALLOW), - DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, DRM_RENDER_ALLOW), -@@ -448,7 +422,6 @@ static struct drm_driver vgem_driver = { - .fops = &vgem_driver_fops, - - .dumb_create = vgem_gem_dumb_create, -- .dumb_map_offset = vgem_gem_dumb_map, - - .prime_handle_to_fd = drm_gem_prime_handle_to_fd, - .prime_fd_to_handle = drm_gem_prime_fd_to_handle, -diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c -index 27e2df44d043d..cfe5f47d9890e 100644 ---- a/drivers/infiniband/hw/bnxt_re/main.c -+++ b/drivers/infiniband/hw/bnxt_re/main.c -@@ -789,7 +789,8 @@ static int bnxt_re_handle_qp_async_event(struct creq_qp_event *qp_event, - struct ib_event event; - unsigned int flags; - -- if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR) { -+ if (qp->qplib_qp.state == CMDQ_MODIFY_QP_NEW_STATE_ERR && -+ rdma_is_kernel_res(&qp->ib_qp.res)) { - flags = bnxt_re_lock_cqs(qp); - bnxt_qplib_add_flush_qp(&qp->qplib_qp); - bnxt_re_unlock_cqs(qp, flags); -diff --git a/drivers/infiniband/hw/hfi1/tid_rdma.c b/drivers/infiniband/hw/hfi1/tid_rdma.c -index 7c6fd720fb2ea..c018fc633cca3 100644 ---- a/drivers/infiniband/hw/hfi1/tid_rdma.c -+++ b/drivers/infiniband/hw/hfi1/tid_rdma.c -@@ -3215,6 +3215,7 @@ bool hfi1_tid_rdma_wqe_interlock(struct rvt_qp *qp, struct rvt_swqe *wqe) - case IB_WR_ATOMIC_CMP_AND_SWP: - case IB_WR_ATOMIC_FETCH_AND_ADD: - case IB_WR_RDMA_WRITE: -+ case IB_WR_RDMA_WRITE_WITH_IMM: - switch (prev->wr.opcode) { - case IB_WR_TID_RDMA_WRITE: - req = wqe_to_tid_req(prev); -diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c -index 527ae0b9a191e..0b4a3039f312f 100644 ---- a/drivers/input/mouse/psmouse-base.c -+++ b/drivers/input/mouse/psmouse-base.c -@@ -2042,7 +2042,7 @@ static int psmouse_get_maxproto(char *buffer, const struct kernel_param *kp) - { - int type = *((unsigned int *)kp->arg); - -- return sprintf(buffer, "%s", psmouse_protocol_by_type(type)->name); -+ return sprintf(buffer, "%s\n", psmouse_protocol_by_type(type)->name); - } - - static int __init psmouse_init(void) -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 25ad64a3919f6..2cbfcd99b7ee7 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -816,19 +816,19 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, - struct request_queue *q; - const size_t max_stripes = min_t(size_t, INT_MAX, - SIZE_MAX / sizeof(atomic_t)); -- size_t n; -+ uint64_t n; - int idx; - - if (!d->stripe_size) - d->stripe_size = 1 << 31; - -- d->nr_stripes = DIV_ROUND_UP_ULL(sectors, d->stripe_size); -- -- if (!d->nr_stripes || d->nr_stripes > max_stripes) { -- pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)", -- (unsigned int)d->nr_stripes); -+ n = DIV_ROUND_UP_ULL(sectors, d->stripe_size); -+ if (!n || n > max_stripes) { -+ pr_err("nr_stripes too large or invalid: %llu (start sector beyond end of disk?)\n", -+ n); - return -ENOMEM; - } -+ d->nr_stripes = n; - - n = d->nr_stripes * sizeof(atomic_t); - d->stripe_sectors_dirty = kvzalloc(n, GFP_KERNEL); -diff --git a/drivers/media/pci/ttpci/budget-core.c b/drivers/media/pci/ttpci/budget-core.c -index fadbdeeb44955..293867b9e7961 100644 ---- a/drivers/media/pci/ttpci/budget-core.c -+++ b/drivers/media/pci/ttpci/budget-core.c -@@ -369,20 +369,25 @@ static int budget_register(struct budget *budget) - ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->hw_frontend); - - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - budget->mem_frontend.source = DMX_MEMORY_FE; - ret = dvbdemux->dmx.add_frontend(&dvbdemux->dmx, &budget->mem_frontend); - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - ret = dvbdemux->dmx.connect_frontend(&dvbdemux->dmx, &budget->hw_frontend); - if (ret < 0) -- return ret; -+ goto err_release_dmx; - - dvb_net_init(&budget->dvb_adapter, &budget->dvb_net, &dvbdemux->dmx); - - return 0; -+ -+err_release_dmx: -+ dvb_dmxdev_release(&budget->dmxdev); -+ dvb_dmx_release(&budget->demux); -+ return ret; - } - - static void budget_unregister(struct budget *budget) -diff --git a/drivers/media/platform/davinci/vpss.c b/drivers/media/platform/davinci/vpss.c -index d38d2bbb6f0f8..7000f0bf0b353 100644 ---- a/drivers/media/platform/davinci/vpss.c -+++ b/drivers/media/platform/davinci/vpss.c -@@ -505,19 +505,31 @@ static void vpss_exit(void) - - static int __init vpss_init(void) - { -+ int ret; -+ - if (!request_mem_region(VPSS_CLK_CTRL, 4, "vpss_clock_control")) - return -EBUSY; - - oper_cfg.vpss_regs_base2 = ioremap(VPSS_CLK_CTRL, 4); - if (unlikely(!oper_cfg.vpss_regs_base2)) { -- release_mem_region(VPSS_CLK_CTRL, 4); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto err_ioremap; - } - - writel(VPSS_CLK_CTRL_VENCCLKEN | -- VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); -+ VPSS_CLK_CTRL_DACCLKEN, oper_cfg.vpss_regs_base2); -+ -+ ret = platform_driver_register(&vpss_driver); -+ if (ret) -+ goto err_pd_register; -+ -+ return 0; - -- return platform_driver_register(&vpss_driver); -+err_pd_register: -+ iounmap(oper_cfg.vpss_regs_base2); -+err_ioremap: -+ release_mem_region(VPSS_CLK_CTRL, 4); -+ return ret; - } - subsys_initcall(vpss_init); - module_exit(vpss_exit); -diff --git a/drivers/media/platform/qcom/camss/camss.c b/drivers/media/platform/qcom/camss/camss.c -index 3fdc9f964a3c6..2483641799dfb 100644 ---- a/drivers/media/platform/qcom/camss/camss.c -+++ b/drivers/media/platform/qcom/camss/camss.c -@@ -504,7 +504,6 @@ static int camss_of_parse_ports(struct camss *camss) - return num_subdevs; - - err_cleanup: -- v4l2_async_notifier_cleanup(&camss->notifier); - of_node_put(node); - return ret; - } -@@ -835,29 +834,38 @@ static int camss_probe(struct platform_device *pdev) - camss->csid_num = 4; - camss->vfe_num = 2; - } else { -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_free; - } - - camss->csiphy = devm_kcalloc(dev, camss->csiphy_num, - sizeof(*camss->csiphy), GFP_KERNEL); -- if (!camss->csiphy) -- return -ENOMEM; -+ if (!camss->csiphy) { -+ ret = -ENOMEM; -+ goto err_free; -+ } - - camss->csid = devm_kcalloc(dev, camss->csid_num, sizeof(*camss->csid), - GFP_KERNEL); -- if (!camss->csid) -- return -ENOMEM; -+ if (!camss->csid) { -+ ret = -ENOMEM; -+ goto err_free; -+ } - - camss->vfe = devm_kcalloc(dev, camss->vfe_num, sizeof(*camss->vfe), - GFP_KERNEL); -- if (!camss->vfe) -- return -ENOMEM; -+ if (!camss->vfe) { -+ ret = -ENOMEM; -+ goto err_free; -+ } - - v4l2_async_notifier_init(&camss->notifier); - - num_subdevs = camss_of_parse_ports(camss); -- if (num_subdevs < 0) -- return num_subdevs; -+ if (num_subdevs < 0) { -+ ret = num_subdevs; -+ goto err_cleanup; -+ } - - ret = camss_init_subdevices(camss); - if (ret < 0) -@@ -936,6 +944,8 @@ err_register_entities: - v4l2_device_unregister(&camss->v4l2_dev); - err_cleanup: - v4l2_async_notifier_cleanup(&camss->notifier); -+err_free: -+ kfree(camss); - - return ret; - } -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 499845c32b1bc..0d7a173f8e61c 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -2037,7 +2037,8 @@ static int bond_release_and_destroy(struct net_device *bond_dev, - int ret; - - ret = __bond_release_one(bond_dev, slave_dev, false, true); -- if (ret == 0 && !bond_has_slaves(bond)) { -+ if (ret == 0 && !bond_has_slaves(bond) && -+ bond_dev->reg_state != NETREG_UNREGISTERING) { - bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; - netdev_info(bond_dev, "Destroying bond\n"); - bond_remove_proc_entry(bond); -@@ -2777,6 +2778,9 @@ static int bond_ab_arp_inspect(struct bonding *bond) - if (bond_time_in_interval(bond, last_rx, 1)) { - bond_propose_link_state(slave, BOND_LINK_UP); - commit++; -+ } else if (slave->link == BOND_LINK_BACK) { -+ bond_propose_link_state(slave, BOND_LINK_FAIL); -+ commit++; - } - continue; - } -@@ -2885,6 +2889,19 @@ static void bond_ab_arp_commit(struct bonding *bond) - - continue; - -+ case BOND_LINK_FAIL: -+ bond_set_slave_link_state(slave, BOND_LINK_FAIL, -+ BOND_SLAVE_NOTIFY_NOW); -+ bond_set_slave_inactive_flags(slave, -+ BOND_SLAVE_NOTIFY_NOW); -+ -+ /* A slave has just been enslaved and has become -+ * the current active slave. -+ */ -+ if (rtnl_dereference(bond->curr_active_slave)) -+ RCU_INIT_POINTER(bond->current_arp_slave, NULL); -+ continue; -+ - default: - slave_err(bond->dev, slave->dev, - "impossible: link_new_state %d on slave\n", -@@ -2935,8 +2952,6 @@ static bool bond_ab_arp_probe(struct bonding *bond) - return should_notify_rtnl; - } - -- bond_set_slave_inactive_flags(curr_arp_slave, BOND_SLAVE_NOTIFY_LATER); -- - bond_for_each_slave_rcu(bond, slave, iter) { - if (!found && !before && bond_slave_is_up(slave)) - before = slave; -@@ -4246,13 +4261,23 @@ static netdev_tx_t bond_start_xmit(struct sk_buff *skb, struct net_device *dev) - return ret; - } - -+static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed) -+{ -+ if (speed == 0 || speed == SPEED_UNKNOWN) -+ speed = slave->speed; -+ else -+ speed = min(speed, slave->speed); -+ -+ return speed; -+} -+ - static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, - struct ethtool_link_ksettings *cmd) - { - struct bonding *bond = netdev_priv(bond_dev); -- unsigned long speed = 0; - struct list_head *iter; - struct slave *slave; -+ u32 speed = 0; - - cmd->base.duplex = DUPLEX_UNKNOWN; - cmd->base.port = PORT_OTHER; -@@ -4264,8 +4289,13 @@ static int bond_ethtool_get_link_ksettings(struct net_device *bond_dev, - */ - bond_for_each_slave(bond, slave, iter) { - if (bond_slave_can_tx(slave)) { -- if (slave->speed != SPEED_UNKNOWN) -- speed += slave->speed; -+ if (slave->speed != SPEED_UNKNOWN) { -+ if (BOND_MODE(bond) == BOND_MODE_BROADCAST) -+ speed = bond_mode_bcast_speed(slave, -+ speed); -+ else -+ speed += slave->speed; -+ } - if (cmd->base.duplex == DUPLEX_UNKNOWN && - slave->duplex != DUPLEX_UNKNOWN) - cmd->base.duplex = slave->duplex; -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 14850b7fe6d7f..4bd66ba72c03c 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -1523,6 +1523,8 @@ static int b53_arl_op(struct b53_device *dev, int op, int port, - return ret; - - switch (ret) { -+ case -ETIMEDOUT: -+ return ret; - case -ENOSPC: - dev_dbg(dev->dev, "{%pM,%.4d} no space left in ARL\n", - addr, vid); -diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c -index 26325f7b3c1fa..4d0d13d5d0998 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -2835,16 +2835,14 @@ static void ena_fw_reset_device(struct work_struct *work) - { - struct ena_adapter *adapter = - container_of(work, struct ena_adapter, reset_task); -- struct pci_dev *pdev = adapter->pdev; - -- if (unlikely(!test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) { -- dev_err(&pdev->dev, -- "device reset schedule while reset bit is off\n"); -- return; -- } - rtnl_lock(); -- ena_destroy_device(adapter, false); -- ena_restore_device(adapter); -+ -+ if (likely(test_bit(ENA_FLAG_TRIGGER_RESET, &adapter->flags))) { -+ ena_destroy_device(adapter, false); -+ ena_restore_device(adapter); -+ } -+ - rtnl_unlock(); - } - -@@ -3675,8 +3673,11 @@ static void __ena_shutoff(struct pci_dev *pdev, bool shutdown) - netdev->rx_cpu_rmap = NULL; - } - #endif /* CONFIG_RFS_ACCEL */ -- del_timer_sync(&adapter->timer_service); - -+ /* Make sure timer and reset routine won't be called after -+ * freeing device resources. -+ */ -+ del_timer_sync(&adapter->timer_service); - cancel_work_sync(&adapter->reset_task); - - rtnl_lock(); /* lock released inside the below if-else block */ -diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c -index 01ae113f122a0..28d4c54505f9a 100644 ---- a/drivers/net/ethernet/cortina/gemini.c -+++ b/drivers/net/ethernet/cortina/gemini.c -@@ -2388,7 +2388,7 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) - - dev_info(dev, "probe %s ID %d\n", dev_name(dev), id); - -- netdev = alloc_etherdev_mq(sizeof(*port), TX_QUEUE_NUM); -+ netdev = devm_alloc_etherdev_mqs(dev, sizeof(*port), TX_QUEUE_NUM, TX_QUEUE_NUM); - if (!netdev) { - dev_err(dev, "Can't allocate ethernet device #%d\n", id); - return -ENOMEM; -@@ -2520,7 +2520,6 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) - } - - port->netdev = NULL; -- free_netdev(netdev); - return ret; - } - -@@ -2529,7 +2528,6 @@ static int gemini_ethernet_port_remove(struct platform_device *pdev) - struct gemini_ethernet_port *port = platform_get_drvdata(pdev); - - gemini_port_remove(port); -- free_netdev(port->netdev); - return 0; - } - -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index 39c112f1543c1..a0e4b12ac4ea2 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -3707,11 +3707,11 @@ failed_mii_init: - failed_irq: - failed_init: - fec_ptp_stop(pdev); -- if (fep->reg_phy) -- regulator_disable(fep->reg_phy); - failed_reset: - pm_runtime_put_noidle(&pdev->dev); - pm_runtime_disable(&pdev->dev); -+ if (fep->reg_phy) -+ regulator_disable(fep->reg_phy); - failed_regulator: - clk_disable_unprepare(fep->clk_ahb); - failed_clk_ahb: -diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h -index 69a2daaca5c56..d7684ac2522ef 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h -+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq_cmd.h -@@ -1211,7 +1211,7 @@ struct i40e_aqc_set_vsi_promiscuous_modes { - #define I40E_AQC_SET_VSI_PROMISC_BROADCAST 0x04 - #define I40E_AQC_SET_VSI_DEFAULT 0x08 - #define I40E_AQC_SET_VSI_PROMISC_VLAN 0x10 --#define I40E_AQC_SET_VSI_PROMISC_TX 0x8000 -+#define I40E_AQC_SET_VSI_PROMISC_RX_ONLY 0x8000 - __le16 seid; - #define I40E_AQC_VSI_PROM_CMD_SEID_MASK 0x3FF - __le16 vlan_tag; -diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c -index 3160b5bbe6728..66f7deaf46ae2 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_common.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c -@@ -1949,6 +1949,21 @@ i40e_status i40e_aq_set_phy_debug(struct i40e_hw *hw, u8 cmd_flags, - return status; - } - -+/** -+ * i40e_is_aq_api_ver_ge -+ * @aq: pointer to AdminQ info containing HW API version to compare -+ * @maj: API major value -+ * @min: API minor value -+ * -+ * Assert whether current HW API version is greater/equal than provided. -+ **/ -+static bool i40e_is_aq_api_ver_ge(struct i40e_adminq_info *aq, u16 maj, -+ u16 min) -+{ -+ return (aq->api_maj_ver > maj || -+ (aq->api_maj_ver == maj && aq->api_min_ver >= min)); -+} -+ - /** - * i40e_aq_add_vsi - * @hw: pointer to the hw struct -@@ -2074,18 +2089,16 @@ i40e_status i40e_aq_set_vsi_unicast_promiscuous(struct i40e_hw *hw, - - if (set) { - flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; -- if (rx_only_promisc && -- (((hw->aq.api_maj_ver == 1) && (hw->aq.api_min_ver >= 5)) || -- (hw->aq.api_maj_ver > 1))) -- flags |= I40E_AQC_SET_VSI_PROMISC_TX; -+ if (rx_only_promisc && i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) -+ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; - } - - cmd->promiscuous_flags = cpu_to_le16(flags); - - cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); -- if (((hw->aq.api_maj_ver >= 1) && (hw->aq.api_min_ver >= 5)) || -- (hw->aq.api_maj_ver > 1)) -- cmd->valid_flags |= cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_TX); -+ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) -+ cmd->valid_flags |= -+ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); - - cmd->seid = cpu_to_le16(seid); - status = i40e_asq_send_command(hw, &desc, NULL, 0, cmd_details); -@@ -2182,11 +2195,17 @@ enum i40e_status_code i40e_aq_set_vsi_uc_promisc_on_vlan(struct i40e_hw *hw, - i40e_fill_default_direct_cmd_desc(&desc, - i40e_aqc_opc_set_vsi_promiscuous_modes); - -- if (enable) -+ if (enable) { - flags |= I40E_AQC_SET_VSI_PROMISC_UNICAST; -+ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) -+ flags |= I40E_AQC_SET_VSI_PROMISC_RX_ONLY; -+ } - - cmd->promiscuous_flags = cpu_to_le16(flags); - cmd->valid_flags = cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_UNICAST); -+ if (i40e_is_aq_api_ver_ge(&hw->aq, 1, 5)) -+ cmd->valid_flags |= -+ cpu_to_le16(I40E_AQC_SET_VSI_PROMISC_RX_ONLY); - cmd->seid = cpu_to_le16(seid); - cmd->vlan_tag = cpu_to_le16(vid | I40E_AQC_SET_VSI_VLAN_VALID); - -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 095ed81cc0ba4..b3c3911adfc2e 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -15342,6 +15342,9 @@ static void i40e_remove(struct pci_dev *pdev) - i40e_write_rx_ctl(hw, I40E_PFQF_HENA(0), 0); - i40e_write_rx_ctl(hw, I40E_PFQF_HENA(1), 0); - -+ while (test_bit(__I40E_RESET_RECOVERY_PENDING, pf->state)) -+ usleep_range(1000, 2000); -+ - /* no more scheduling of any task */ - set_bit(__I40E_SUSPENDED, pf->state); - set_bit(__I40E_DOWN, pf->state); -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 24bb721a12bc0..42eb7a7ecd96b 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -501,7 +501,7 @@ static int netvsc_vf_xmit(struct net_device *net, struct net_device *vf_netdev, - int rc; - - skb->dev = vf_netdev; -- skb->queue_mapping = qdisc_skb_cb(skb)->slave_dev_queue_mapping; -+ skb_record_rx_queue(skb, qdisc_skb_cb(skb)->slave_dev_queue_mapping); - - rc = dev_queue_xmit(skb); - if (likely(rc == NET_XMIT_SUCCESS || rc == NET_XMIT_CN)) { -diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig -index dd1a147f29716..058d77d2e693d 100644 ---- a/drivers/net/wan/Kconfig -+++ b/drivers/net/wan/Kconfig -@@ -200,7 +200,7 @@ config WANXL_BUILD_FIRMWARE - depends on WANXL && !PREVENT_FIRMWARE_BUILD - help - Allows you to rebuild firmware run by the QUICC processor. -- It requires as68k, ld68k and hexdump programs. -+ It requires m68k toolchains and hexdump programs. - - You should never need this option, say N. - -diff --git a/drivers/net/wan/Makefile b/drivers/net/wan/Makefile -index 701f5d2fe3b61..cf7a0a65aae8d 100644 ---- a/drivers/net/wan/Makefile -+++ b/drivers/net/wan/Makefile -@@ -40,17 +40,17 @@ $(obj)/wanxl.o: $(obj)/wanxlfw.inc - - ifeq ($(CONFIG_WANXL_BUILD_FIRMWARE),y) - ifeq ($(ARCH),m68k) -- AS68K = $(AS) -- LD68K = $(LD) -+ M68KCC = $(CC) -+ M68KLD = $(LD) - else -- AS68K = as68k -- LD68K = ld68k -+ M68KCC = $(CROSS_COMPILE_M68K)gcc -+ M68KLD = $(CROSS_COMPILE_M68K)ld - endif - - quiet_cmd_build_wanxlfw = BLD FW $@ - cmd_build_wanxlfw = \ -- $(CPP) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi $< | $(AS68K) -m68360 -o $(obj)/wanxlfw.o; \ -- $(LD68K) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ -+ $(M68KCC) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi -c -o $(obj)/wanxlfw.o $<; \ -+ $(M68KLD) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ - hexdump -ve '"\n" 16/1 "0x%02X,"' $(obj)/wanxlfw.bin | sed 's/0x ,//g;1s/^/static const u8 firmware[]={/;$$s/,$$/\n};\n/' >$(obj)/wanxlfw.inc; \ - rm -f $(obj)/wanxlfw.bin $(obj)/wanxlfw.o - -diff --git a/drivers/opp/core.c b/drivers/opp/core.c -index 9ff0538ee83a0..7b057c32e11b1 100644 ---- a/drivers/opp/core.c -+++ b/drivers/opp/core.c -@@ -843,10 +843,12 @@ int dev_pm_opp_set_rate(struct device *dev, unsigned long target_freq) - - /* Return early if nothing to do */ - if (old_freq == freq) { -- dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n", -- __func__, freq); -- ret = 0; -- goto put_opp_table; -+ if (!opp_table->required_opp_tables && !opp_table->regulators) { -+ dev_dbg(dev, "%s: old/new frequencies (%lu Hz) are same, nothing to do\n", -+ __func__, freq); -+ ret = 0; -+ goto put_opp_table; -+ } - } - - temp_freq = old_freq; -diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c -index 1a3420ee6a4d9..d5083b013fbce 100644 ---- a/drivers/rtc/rtc-goldfish.c -+++ b/drivers/rtc/rtc-goldfish.c -@@ -73,6 +73,7 @@ static int goldfish_rtc_set_alarm(struct device *dev, - rtc_alarm64 = rtc_tm_to_time64(&alrm->time) * NSEC_PER_SEC; - writel((rtc_alarm64 >> 32), base + TIMER_ALARM_HIGH); - writel(rtc_alarm64, base + TIMER_ALARM_LOW); -+ writel(1, base + TIMER_IRQ_ENABLED); - } else { - /* - * if this function was called with enabled=0 -diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c -index cf63916814cca..5c652deb6fed4 100644 ---- a/drivers/s390/scsi/zfcp_fsf.c -+++ b/drivers/s390/scsi/zfcp_fsf.c -@@ -409,7 +409,7 @@ static void zfcp_fsf_req_complete(struct zfcp_fsf_req *req) - return; - } - -- del_timer(&req->timer); -+ del_timer_sync(&req->timer); - zfcp_fsf_protstatus_eval(req); - zfcp_fsf_fsfstatus_eval(req); - req->handler(req); -@@ -762,7 +762,7 @@ static int zfcp_fsf_req_send(struct zfcp_fsf_req *req) - req->qdio_req.qdio_outb_usage = atomic_read(&qdio->req_q_free); - req->issued = get_tod_clock(); - if (zfcp_qdio_send(qdio, &req->qdio_req)) { -- del_timer(&req->timer); -+ del_timer_sync(&req->timer); - /* lookup request again, list might have changed */ - zfcp_reqlist_find_rm(adapter->req_list, req_id); - zfcp_erp_adapter_reopen(adapter, 0, "fsrs__1"); -diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c -index 2b865c6423e29..e00dc4693fcbd 100644 ---- a/drivers/scsi/libfc/fc_disc.c -+++ b/drivers/scsi/libfc/fc_disc.c -@@ -581,8 +581,12 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, - - if (PTR_ERR(fp) == -FC_EX_CLOSED) - goto out; -- if (IS_ERR(fp)) -- goto redisc; -+ if (IS_ERR(fp)) { -+ mutex_lock(&disc->disc_mutex); -+ fc_disc_restart(disc); -+ mutex_unlock(&disc->disc_mutex); -+ goto out; -+ } - - cp = fc_frame_payload_get(fp, sizeof(*cp)); - if (!cp) -@@ -609,7 +613,7 @@ static void fc_disc_gpn_id_resp(struct fc_seq *sp, struct fc_frame *fp, - new_rdata->disc_id = disc->disc_id; - fc_rport_login(new_rdata); - } -- goto out; -+ goto free_fp; - } - rdata->disc_id = disc->disc_id; - mutex_unlock(&rdata->rp_mutex); -@@ -626,6 +630,8 @@ redisc: - fc_disc_restart(disc); - mutex_unlock(&disc->disc_mutex); - } -+free_fp: -+ fc_frame_free(fp); - out: - kref_put(&rdata->kref, fc_rport_destroy); - if (!IS_ERR(fp)) -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index d7ec4083a0911..d91c95d9981ac 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2804,10 +2804,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - /* This may fail but that's ok */ - pci_enable_pcie_error_reporting(pdev); - -- /* Turn off T10-DIF when FC-NVMe is enabled */ -- if (ql2xnvmeenable) -- ql2xenabledif = 0; -- - ha = kzalloc(sizeof(struct qla_hw_data), GFP_KERNEL); - if (!ha) { - ql_log_pci(ql_log_fatal, pdev, 0x0009, -diff --git a/drivers/scsi/ufs/ufs_quirks.h b/drivers/scsi/ufs/ufs_quirks.h -index fe6cad9b2a0d2..03985919150b9 100644 ---- a/drivers/scsi/ufs/ufs_quirks.h -+++ b/drivers/scsi/ufs/ufs_quirks.h -@@ -12,6 +12,7 @@ - #define UFS_ANY_VENDOR 0xFFFF - #define UFS_ANY_MODEL "ANY_MODEL" - -+#define UFS_VENDOR_MICRON 0x12C - #define UFS_VENDOR_TOSHIBA 0x198 - #define UFS_VENDOR_SAMSUNG 0x1CE - #define UFS_VENDOR_SKHYNIX 0x1AD -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 2b6853c7375c9..b41b88bcab3d9 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -217,6 +217,8 @@ ufs_get_desired_pm_lvl_for_dev_link_state(enum ufs_dev_pwr_mode dev_state, - - static struct ufs_dev_fix ufs_fixups[] = { - /* UFS cards deviations table */ -+ UFS_FIX(UFS_VENDOR_MICRON, UFS_ANY_MODEL, -+ UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), - UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, - UFS_DEVICE_QUIRK_DELAY_BEFORE_LPM), - UFS_FIX(UFS_VENDOR_SAMSUNG, UFS_ANY_MODEL, -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index 6f7fdcbb9151f..5bf7542087776 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -944,4 +944,7 @@ config SPI_SLAVE_SYSTEM_CONTROL - - endif # SPI_SLAVE - -+config SPI_DYNAMIC -+ def_bool ACPI || OF_DYNAMIC || SPI_SLAVE -+ - endif # SPI -diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c -index b222ce8d083ef..7e92ab0cc9920 100644 ---- a/drivers/spi/spi-stm32.c -+++ b/drivers/spi/spi-stm32.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1986,6 +1987,8 @@ static int stm32_spi_remove(struct platform_device *pdev) - - pm_runtime_disable(&pdev->dev); - -+ pinctrl_pm_select_sleep_state(&pdev->dev); -+ - return 0; - } - -@@ -1997,13 +2000,18 @@ static int stm32_spi_runtime_suspend(struct device *dev) - - clk_disable_unprepare(spi->clk); - -- return 0; -+ return pinctrl_pm_select_sleep_state(dev); - } - - static int stm32_spi_runtime_resume(struct device *dev) - { - struct spi_master *master = dev_get_drvdata(dev); - struct stm32_spi *spi = spi_master_get_devdata(master); -+ int ret; -+ -+ ret = pinctrl_pm_select_default_state(dev); -+ if (ret) -+ return ret; - - return clk_prepare_enable(spi->clk); - } -@@ -2033,10 +2041,23 @@ static int stm32_spi_resume(struct device *dev) - return ret; - - ret = spi_master_resume(master); -- if (ret) -+ if (ret) { - clk_disable_unprepare(spi->clk); -+ return ret; -+ } - -- return ret; -+ ret = pm_runtime_get_sync(dev); -+ if (ret) { -+ dev_err(dev, "Unable to power device:%d\n", ret); -+ return ret; -+ } -+ -+ spi->cfg->config(spi); -+ -+ pm_runtime_mark_last_busy(dev); -+ pm_runtime_put_autosuspend(dev); -+ -+ return 0; - } - #endif - -diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c -index c6242f0a307f9..6a81b2a33cb4b 100644 ---- a/drivers/spi/spi.c -+++ b/drivers/spi/spi.c -@@ -475,6 +475,12 @@ static LIST_HEAD(spi_controller_list); - */ - static DEFINE_MUTEX(board_lock); - -+/* -+ * Prevents addition of devices with same chip select and -+ * addition of devices below an unregistering controller. -+ */ -+static DEFINE_MUTEX(spi_add_lock); -+ - /** - * spi_alloc_device - Allocate a new SPI device - * @ctlr: Controller to which device is connected -@@ -553,7 +559,6 @@ static int spi_dev_check(struct device *dev, void *data) - */ - int spi_add_device(struct spi_device *spi) - { -- static DEFINE_MUTEX(spi_add_lock); - struct spi_controller *ctlr = spi->controller; - struct device *dev = ctlr->dev.parent; - int status; -@@ -581,6 +586,13 @@ int spi_add_device(struct spi_device *spi) - goto done; - } - -+ /* Controller may unregister concurrently */ -+ if (IS_ENABLED(CONFIG_SPI_DYNAMIC) && -+ !device_is_registered(&ctlr->dev)) { -+ status = -ENODEV; -+ goto done; -+ } -+ - /* Descriptors take precedence */ - if (ctlr->cs_gpiods) - spi->cs_gpiod = ctlr->cs_gpiods[spi->chip_select]; -@@ -2582,6 +2594,10 @@ void spi_unregister_controller(struct spi_controller *ctlr) - struct spi_controller *found; - int id = ctlr->bus_num; - -+ /* Prevent addition of new devices, unregister existing ones */ -+ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) -+ mutex_lock(&spi_add_lock); -+ - device_for_each_child(&ctlr->dev, NULL, __unregister); - - /* First make sure that this controller was ever added */ -@@ -2602,6 +2618,9 @@ void spi_unregister_controller(struct spi_controller *ctlr) - if (found == ctlr) - idr_remove(&spi_master_idr, id); - mutex_unlock(&board_lock); -+ -+ if (IS_ENABLED(CONFIG_SPI_DYNAMIC)) -+ mutex_unlock(&spi_add_lock); - } - EXPORT_SYMBOL_GPL(spi_unregister_controller); - -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index a497e7c1f4fcc..d766fb14942b3 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -601,7 +601,7 @@ static inline void tcmu_flush_dcache_range(void *vaddr, size_t size) - size = round_up(size+offset, PAGE_SIZE); - - while (size) { -- flush_dcache_page(virt_to_page(start)); -+ flush_dcache_page(vmalloc_to_page(start)); - start += PAGE_SIZE; - size -= PAGE_SIZE; - } -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index 6cc47af1f06d3..ca8c10aa4a4bc 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -1187,13 +1187,16 @@ static int vfio_bus_type(struct device *dev, void *data) - static int vfio_iommu_replay(struct vfio_iommu *iommu, - struct vfio_domain *domain) - { -- struct vfio_domain *d; -+ struct vfio_domain *d = NULL; - struct rb_node *n; - unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; - int ret; - - /* Arbitrarily pick the first domain in the list for lookups */ -- d = list_first_entry(&iommu->domain_list, struct vfio_domain, next); -+ if (!list_empty(&iommu->domain_list)) -+ d = list_first_entry(&iommu->domain_list, -+ struct vfio_domain, next); -+ - n = rb_first(&iommu->dma_list); - - for (; n; n = rb_next(n)) { -@@ -1211,6 +1214,11 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, - phys_addr_t p; - dma_addr_t i; - -+ if (WARN_ON(!d)) { /* mapped w/o a domain?! */ -+ ret = -EINVAL; -+ goto unwind; -+ } -+ - phys = iommu_iova_to_phys(d->domain, iova); - - if (WARN_ON(!phys)) { -@@ -1240,7 +1248,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, - if (npage <= 0) { - WARN_ON(!npage); - ret = (int)npage; -- return ret; -+ goto unwind; - } - - phys = pfn << PAGE_SHIFT; -@@ -1249,14 +1257,67 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, - - ret = iommu_map(domain->domain, iova, phys, - size, dma->prot | domain->prot); -- if (ret) -- return ret; -+ if (ret) { -+ if (!dma->iommu_mapped) -+ vfio_unpin_pages_remote(dma, iova, -+ phys >> PAGE_SHIFT, -+ size >> PAGE_SHIFT, -+ true); -+ goto unwind; -+ } - - iova += size; - } -+ } -+ -+ /* All dmas are now mapped, defer to second tree walk for unwind */ -+ for (n = rb_first(&iommu->dma_list); n; n = rb_next(n)) { -+ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); -+ - dma->iommu_mapped = true; - } -+ - return 0; -+ -+unwind: -+ for (; n; n = rb_prev(n)) { -+ struct vfio_dma *dma = rb_entry(n, struct vfio_dma, node); -+ dma_addr_t iova; -+ -+ if (dma->iommu_mapped) { -+ iommu_unmap(domain->domain, dma->iova, dma->size); -+ continue; -+ } -+ -+ iova = dma->iova; -+ while (iova < dma->iova + dma->size) { -+ phys_addr_t phys, p; -+ size_t size; -+ dma_addr_t i; -+ -+ phys = iommu_iova_to_phys(domain->domain, iova); -+ if (!phys) { -+ iova += PAGE_SIZE; -+ continue; -+ } -+ -+ size = PAGE_SIZE; -+ p = phys + size; -+ i = iova + size; -+ while (i < dma->iova + dma->size && -+ p == iommu_iova_to_phys(domain->domain, i)) { -+ size += PAGE_SIZE; -+ p += PAGE_SIZE; -+ i += PAGE_SIZE; -+ } -+ -+ iommu_unmap(domain->domain, iova, size); -+ vfio_unpin_pages_remote(dma, iova, phys >> PAGE_SHIFT, -+ size >> PAGE_SHIFT, true); -+ } -+ } -+ -+ return ret; - } - - /* -diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c -index 51d97ec4f58f9..e0cbf5b3d2174 100644 ---- a/drivers/video/fbdev/efifb.c -+++ b/drivers/video/fbdev/efifb.c -@@ -453,7 +453,7 @@ static int efifb_probe(struct platform_device *dev) - info->apertures->ranges[0].base = efifb_fix.smem_start; - info->apertures->ranges[0].size = size_remap; - -- if (efi_enabled(EFI_BOOT) && -+ if (efi_enabled(EFI_MEMMAP) && - !efi_mem_desc_lookup(efifb_fix.smem_start, &md)) { - if ((efifb_fix.smem_start + efifb_fix.smem_len) > - (md.phys_addr + (md.num_pages << EFI_PAGE_SHIFT))) { -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index 58b96baa8d488..4f7c73e6052f6 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -1960,6 +1960,9 @@ bool virtqueue_poll(struct virtqueue *_vq, unsigned last_used_idx) - { - struct vring_virtqueue *vq = to_vvq(_vq); - -+ if (unlikely(vq->broken)) -+ return false; -+ - virtio_mb(vq->weak_barriers); - return vq->packed_ring ? virtqueue_poll_packed(_vq, last_used_idx) : - virtqueue_poll_split(_vq, last_used_idx); -diff --git a/drivers/xen/preempt.c b/drivers/xen/preempt.c -index 456a164364a22..98a9d6892d989 100644 ---- a/drivers/xen/preempt.c -+++ b/drivers/xen/preempt.c -@@ -27,7 +27,7 @@ EXPORT_SYMBOL_GPL(xen_in_preemptible_hcall); - asmlinkage __visible void xen_maybe_preempt_hcall(void) - { - if (unlikely(__this_cpu_read(xen_in_preemptible_hcall) -- && need_resched())) { -+ && need_resched() && !preempt_count())) { - /* - * Clear flag as we may be rescheduled on a different - * cpu. -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index bd3a10dfac157..06346422f7432 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -335,6 +335,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, - int order = get_order(size); - phys_addr_t phys; - u64 dma_mask = DMA_BIT_MASK(32); -+ struct page *page; - - if (hwdev && hwdev->coherent_dma_mask) - dma_mask = hwdev->coherent_dma_mask; -@@ -346,9 +347,14 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, - /* Convert the size to actually allocated. */ - size = 1UL << (order + XEN_PAGE_SHIFT); - -+ if (is_vmalloc_addr(vaddr)) -+ page = vmalloc_to_page(vaddr); -+ else -+ page = virt_to_page(vaddr); -+ - if (!WARN_ON((dev_addr + size - 1 > dma_mask) || - range_straddles_page_boundary(phys, size)) && -- TestClearPageXenRemapped(virt_to_page(vaddr))) -+ TestClearPageXenRemapped(page)) - xen_destroy_contiguous_region(phys, order); - - xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs); -diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c -index 7503899c0a1b5..f07e53ab808e3 100644 ---- a/fs/afs/dynroot.c -+++ b/fs/afs/dynroot.c -@@ -289,15 +289,17 @@ void afs_dynroot_depopulate(struct super_block *sb) - net->dynroot_sb = NULL; - mutex_unlock(&net->proc_cells_lock); - -- inode_lock(root->d_inode); -- -- /* Remove all the pins for dirs created for manually added cells */ -- list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) { -- if (subdir->d_fsdata) { -- subdir->d_fsdata = NULL; -- dput(subdir); -+ if (root) { -+ inode_lock(root->d_inode); -+ -+ /* Remove all the pins for dirs created for manually added cells */ -+ list_for_each_entry_safe(subdir, tmp, &root->d_subdirs, d_child) { -+ if (subdir->d_fsdata) { -+ subdir->d_fsdata = NULL; -+ dput(subdir); -+ } - } -- } - -- inode_unlock(root->d_inode); -+ inode_unlock(root->d_inode); -+ } - } -diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c -index 42d69e77f89d9..b167649f5f5de 100644 ---- a/fs/btrfs/block-group.c -+++ b/fs/btrfs/block-group.c -@@ -2168,7 +2168,7 @@ static int cache_save_setup(struct btrfs_block_group_cache *block_group, - return 0; - } - -- if (trans->aborted) -+ if (TRANS_ABORTED(trans)) - return 0; - again: - inode = lookup_free_space_inode(block_group, path); -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 2374f3f6f3b70..18357b054a91e 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -2965,6 +2965,8 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans, - int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - unsigned long new_flags); - int btrfs_sync_fs(struct super_block *sb, int wait); -+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -+ u64 subvol_objectid); - - static inline __printf(2, 3) __cold - void btrfs_no_printk(const struct btrfs_fs_info *fs_info, const char *fmt, ...) -diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c -index 5bcccfbcc7c15..a34ee9c2f3151 100644 ---- a/fs/btrfs/delayed-inode.c -+++ b/fs/btrfs/delayed-inode.c -@@ -1151,7 +1151,7 @@ static int __btrfs_run_delayed_items(struct btrfs_trans_handle *trans, int nr) - int ret = 0; - bool count = (nr > 0); - -- if (trans->aborted) -+ if (TRANS_ABORTED(trans)) - return -EIO; - - path = btrfs_alloc_path(); -diff --git a/fs/btrfs/export.c b/fs/btrfs/export.c -index ddf28ecf17f93..93cceeba484cc 100644 ---- a/fs/btrfs/export.c -+++ b/fs/btrfs/export.c -@@ -57,9 +57,9 @@ static int btrfs_encode_fh(struct inode *inode, u32 *fh, int *max_len, - return type; - } - --static struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -- u64 root_objectid, u32 generation, -- int check_generation) -+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -+ u64 root_objectid, u32 generation, -+ int check_generation) - { - struct btrfs_fs_info *fs_info = btrfs_sb(sb); - struct btrfs_root *root; -@@ -152,7 +152,7 @@ static struct dentry *btrfs_fh_to_dentry(struct super_block *sb, struct fid *fh, - return btrfs_get_dentry(sb, objectid, root_objectid, generation, 1); - } - --static struct dentry *btrfs_get_parent(struct dentry *child) -+struct dentry *btrfs_get_parent(struct dentry *child) - { - struct inode *dir = d_inode(child); - struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb); -diff --git a/fs/btrfs/export.h b/fs/btrfs/export.h -index 57488ecd7d4ef..f32f4113c976a 100644 ---- a/fs/btrfs/export.h -+++ b/fs/btrfs/export.h -@@ -18,4 +18,9 @@ struct btrfs_fid { - u64 parent_root_objectid; - } __attribute__ ((packed)); - -+struct dentry *btrfs_get_dentry(struct super_block *sb, u64 objectid, -+ u64 root_objectid, u32 generation, -+ int check_generation); -+struct dentry *btrfs_get_parent(struct dentry *child); -+ - #endif -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 739332b462059..a36bd4507bacd 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -1561,7 +1561,7 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans, - int err = 0; - int metadata = !extent_op->is_data; - -- if (trans->aborted) -+ if (TRANS_ABORTED(trans)) - return 0; - - if (metadata && !btrfs_fs_incompat(fs_info, SKINNY_METADATA)) -@@ -1681,7 +1681,7 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans, - { - int ret = 0; - -- if (trans->aborted) { -+ if (TRANS_ABORTED(trans)) { - if (insert_reserved) - btrfs_pin_extent(trans->fs_info, node->bytenr, - node->num_bytes, 1); -@@ -2169,7 +2169,7 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans, - int run_all = count == (unsigned long)-1; - - /* We'll clean this up in btrfs_cleanup_transaction */ -- if (trans->aborted) -+ if (TRANS_ABORTED(trans)) - return 0; - - if (test_bit(BTRFS_FS_CREATING_FREE_SPACE_TREE, &fs_info->flags)) -@@ -2892,7 +2892,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans) - else - unpin = &fs_info->freed_extents[0]; - -- while (!trans->aborted) { -+ while (!TRANS_ABORTED(trans)) { - struct extent_state *cached_state = NULL; - - mutex_lock(&fs_info->unused_bg_unpin_mutex); -@@ -2924,7 +2924,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans) - u64 trimmed = 0; - - ret = -EROFS; -- if (!trans->aborted) -+ if (!TRANS_ABORTED(trans)) - ret = btrfs_discard_extent(fs_info, - block_group->key.objectid, - block_group->key.offset, -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 035ea5bc692ad..5707bf0575d43 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -4073,7 +4073,7 @@ retry: - if (!test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) { - ret = flush_write_bio(&epd); - } else { -- ret = -EUCLEAN; -+ ret = -EROFS; - end_write_bio(&epd, ret); - } - return ret; -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index a7b043fd7a572..498b824148187 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -3717,7 +3717,7 @@ static noinline_for_stack int scrub_supers(struct scrub_ctx *sctx, - struct btrfs_fs_info *fs_info = sctx->fs_info; - - if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) -- return -EIO; -+ return -EROFS; - - /* Seed devices of a new filesystem has their own generation. */ - if (scrub_dev->fs_devices != fs_info->fs_devices) -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index 4b0ee34aa65d5..a1498df419b4f 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -241,7 +241,7 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans, - { - struct btrfs_fs_info *fs_info = trans->fs_info; - -- trans->aborted = errno; -+ WRITE_ONCE(trans->aborted, errno); - /* Nothing used. The other threads that have joined this - * transaction may be able to continue. */ - if (!trans->dirty && list_empty(&trans->new_bgs)) { -@@ -1009,8 +1009,8 @@ out: - return error; - } - --static char *get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -- u64 subvol_objectid) -+char *btrfs_get_subvol_name_from_objectid(struct btrfs_fs_info *fs_info, -+ u64 subvol_objectid) - { - struct btrfs_root *root = fs_info->tree_root; - struct btrfs_root *fs_root; -@@ -1291,6 +1291,7 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) - { - struct btrfs_fs_info *info = btrfs_sb(dentry->d_sb); - const char *compress_type; -+ const char *subvol_name; - - if (btrfs_test_opt(info, DEGRADED)) - seq_puts(seq, ",degraded"); -@@ -1375,8 +1376,13 @@ static int btrfs_show_options(struct seq_file *seq, struct dentry *dentry) - seq_puts(seq, ",ref_verify"); - seq_printf(seq, ",subvolid=%llu", - BTRFS_I(d_inode(dentry))->root->root_key.objectid); -- seq_puts(seq, ",subvol="); -- seq_dentry(seq, dentry, " \t\n\\"); -+ subvol_name = btrfs_get_subvol_name_from_objectid(info, -+ BTRFS_I(d_inode(dentry))->root->root_key.objectid); -+ if (!IS_ERR(subvol_name)) { -+ seq_puts(seq, ",subvol="); -+ seq_escape(seq, subvol_name, " \t\n\\"); -+ kfree(subvol_name); -+ } - return 0; - } - -@@ -1421,8 +1427,8 @@ static struct dentry *mount_subvol(const char *subvol_name, u64 subvol_objectid, - goto out; - } - } -- subvol_name = get_subvol_name_from_objectid(btrfs_sb(mnt->mnt_sb), -- subvol_objectid); -+ subvol_name = btrfs_get_subvol_name_from_objectid( -+ btrfs_sb(mnt->mnt_sb), subvol_objectid); - if (IS_ERR(subvol_name)) { - root = ERR_CAST(subvol_name); - subvol_name = NULL; -diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c -index 54589e940f9af..c346ee7ec18d4 100644 ---- a/fs/btrfs/transaction.c -+++ b/fs/btrfs/transaction.c -@@ -174,7 +174,7 @@ loop: - - cur_trans = fs_info->running_transaction; - if (cur_trans) { -- if (cur_trans->aborted) { -+ if (TRANS_ABORTED(cur_trans)) { - spin_unlock(&fs_info->trans_lock); - return cur_trans->aborted; - } -@@ -390,7 +390,7 @@ static inline int is_transaction_blocked(struct btrfs_transaction *trans) - { - return (trans->state >= TRANS_STATE_BLOCKED && - trans->state < TRANS_STATE_UNBLOCKED && -- !trans->aborted); -+ !TRANS_ABORTED(trans)); - } - - /* wait for commit against the current transaction to become unblocked -@@ -409,7 +409,7 @@ static void wait_current_trans(struct btrfs_fs_info *fs_info) - - wait_event(fs_info->transaction_wait, - cur_trans->state >= TRANS_STATE_UNBLOCKED || -- cur_trans->aborted); -+ TRANS_ABORTED(cur_trans)); - btrfs_put_transaction(cur_trans); - } else { - spin_unlock(&fs_info->trans_lock); -@@ -870,10 +870,13 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, - if (throttle) - btrfs_run_delayed_iputs(info); - -- if (trans->aborted || -+ if (TRANS_ABORTED(trans) || - test_bit(BTRFS_FS_STATE_ERROR, &info->fs_state)) { - wake_up_process(info->transaction_kthread); -- err = -EIO; -+ if (TRANS_ABORTED(trans)) -+ err = trans->aborted; -+ else -+ err = -EROFS; - } - - kmem_cache_free(btrfs_trans_handle_cachep, trans); -@@ -1727,7 +1730,8 @@ static void wait_current_trans_commit_start(struct btrfs_fs_info *fs_info, - struct btrfs_transaction *trans) - { - wait_event(fs_info->transaction_blocked_wait, -- trans->state >= TRANS_STATE_COMMIT_START || trans->aborted); -+ trans->state >= TRANS_STATE_COMMIT_START || -+ TRANS_ABORTED(trans)); - } - - /* -@@ -1739,7 +1743,8 @@ static void wait_current_trans_commit_start_and_unblock( - struct btrfs_transaction *trans) - { - wait_event(fs_info->transaction_wait, -- trans->state >= TRANS_STATE_UNBLOCKED || trans->aborted); -+ trans->state >= TRANS_STATE_UNBLOCKED || -+ TRANS_ABORTED(trans)); - } - - /* -@@ -1957,7 +1962,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) - trans->dirty = true; - - /* Stop the commit early if ->aborted is set */ -- if (unlikely(READ_ONCE(cur_trans->aborted))) { -+ if (TRANS_ABORTED(cur_trans)) { - ret = cur_trans->aborted; - btrfs_end_transaction(trans); - return ret; -@@ -2031,7 +2036,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) - - wait_for_commit(cur_trans); - -- if (unlikely(cur_trans->aborted)) -+ if (TRANS_ABORTED(cur_trans)) - ret = cur_trans->aborted; - - btrfs_put_transaction(cur_trans); -@@ -2050,7 +2055,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) - spin_unlock(&fs_info->trans_lock); - - wait_for_commit(prev_trans); -- ret = prev_trans->aborted; -+ ret = READ_ONCE(prev_trans->aborted); - - btrfs_put_transaction(prev_trans); - if (ret) -@@ -2104,8 +2109,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) - wait_event(cur_trans->writer_wait, - atomic_read(&cur_trans->num_writers) == 1); - -- /* ->aborted might be set after the previous check, so check it */ -- if (unlikely(READ_ONCE(cur_trans->aborted))) { -+ if (TRANS_ABORTED(cur_trans)) { - ret = cur_trans->aborted; - goto scrub_continue; - } -@@ -2223,7 +2227,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) - * The tasks which save the space cache and inode cache may also - * update ->aborted, check it. - */ -- if (unlikely(READ_ONCE(cur_trans->aborted))) { -+ if (TRANS_ABORTED(cur_trans)) { - ret = cur_trans->aborted; - mutex_unlock(&fs_info->tree_log_mutex); - mutex_unlock(&fs_info->reloc_mutex); -diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h -index b15c31d231488..7291a2a930751 100644 ---- a/fs/btrfs/transaction.h -+++ b/fs/btrfs/transaction.h -@@ -116,6 +116,10 @@ struct btrfs_trans_handle { - struct btrfs_block_rsv *orig_rsv; - refcount_t use_count; - unsigned int type; -+ /* -+ * Error code of transaction abort, set outside of locks and must use -+ * the READ_ONCE/WRITE_ONCE access -+ */ - short aborted; - bool adding_csums; - bool allocating_chunk; -@@ -127,6 +131,14 @@ struct btrfs_trans_handle { - struct list_head new_bgs; - }; - -+/* -+ * The abort status can be changed between calls and is not protected by locks. -+ * This accepts btrfs_transaction and btrfs_trans_handle as types. Once it's -+ * set to a non-zero value it does not change, so the macro should be in checks -+ * but is not necessary for further reads of the value. -+ */ -+#define TRANS_ABORTED(trans) (unlikely(READ_ONCE((trans)->aborted))) -+ - struct btrfs_pending_snapshot { - struct dentry *dentry; - struct inode *dir; -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index 701bc3f4d4ba1..b0077f5a31688 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -4143,7 +4143,6 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) - return -ENOMEM; - } - -- fsc->mdsc = mdsc; - init_completion(&mdsc->safe_umount_waiters); - init_waitqueue_head(&mdsc->session_close_wq); - INIT_LIST_HEAD(&mdsc->waiting_for_map); -@@ -4195,6 +4194,8 @@ int ceph_mdsc_init(struct ceph_fs_client *fsc) - - strscpy(mdsc->nodename, utsname()->nodename, - sizeof(mdsc->nodename)); -+ -+ fsc->mdsc = mdsc; - return 0; - } - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 6307c1d883e0a..0d9b1e2b9da72 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -1991,9 +1991,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - * not already there, and calling reverse_path_check() - * during ep_insert(). - */ -- if (list_empty(&epi->ffd.file->f_tfile_llink)) -+ if (list_empty(&epi->ffd.file->f_tfile_llink)) { -+ get_file(epi->ffd.file); - list_add(&epi->ffd.file->f_tfile_llink, - &tfile_check_list); -+ } - } - } - mutex_unlock(&ep->mtx); -@@ -2037,6 +2039,7 @@ static void clear_tfile_check_list(void) - file = list_first_entry(&tfile_check_list, struct file, - f_tfile_llink); - list_del_init(&file->f_tfile_llink); -+ fput(file); - } - INIT_LIST_HEAD(&tfile_check_list); - } -@@ -2192,13 +2195,13 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - mutex_lock(&epmutex); - if (is_file_epoll(tf.file)) { - error = -ELOOP; -- if (ep_loop_check(ep, tf.file) != 0) { -- clear_tfile_check_list(); -+ if (ep_loop_check(ep, tf.file) != 0) - goto error_tgt_fput; -- } -- } else -+ } else { -+ get_file(tf.file); - list_add(&tf.file->f_tfile_llink, - &tfile_check_list); -+ } - mutex_lock_nested(&ep->mtx, 0); - if (is_file_epoll(tf.file)) { - tep = tf.file->private_data; -@@ -2222,8 +2225,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - error = ep_insert(ep, &epds, tf.file, fd, full_check); - } else - error = -EEXIST; -- if (full_check) -- clear_tfile_check_list(); - break; - case EPOLL_CTL_DEL: - if (epi) -@@ -2246,8 +2247,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd, - mutex_unlock(&ep->mtx); - - error_tgt_fput: -- if (full_check) -+ if (full_check) { -+ clear_tfile_check_list(); - mutex_unlock(&epmutex); -+ } - - fdput(tf); - error_fput: -diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c -index ff8e1205127ee..ceb54ccc937e9 100644 ---- a/fs/ext4/block_validity.c -+++ b/fs/ext4/block_validity.c -@@ -68,7 +68,7 @@ static int add_system_zone(struct ext4_system_blocks *system_blks, - ext4_fsblk_t start_blk, - unsigned int count) - { -- struct ext4_system_zone *new_entry = NULL, *entry; -+ struct ext4_system_zone *new_entry, *entry; - struct rb_node **n = &system_blks->root.rb_node, *node; - struct rb_node *parent = NULL, *new_node = NULL; - -@@ -79,30 +79,20 @@ static int add_system_zone(struct ext4_system_blocks *system_blks, - n = &(*n)->rb_left; - else if (start_blk >= (entry->start_blk + entry->count)) - n = &(*n)->rb_right; -- else { -- if (start_blk + count > (entry->start_blk + -- entry->count)) -- entry->count = (start_blk + count - -- entry->start_blk); -- new_node = *n; -- new_entry = rb_entry(new_node, struct ext4_system_zone, -- node); -- break; -- } -+ else /* Unexpected overlap of system zones. */ -+ return -EFSCORRUPTED; - } - -- if (!new_entry) { -- new_entry = kmem_cache_alloc(ext4_system_zone_cachep, -- GFP_KERNEL); -- if (!new_entry) -- return -ENOMEM; -- new_entry->start_blk = start_blk; -- new_entry->count = count; -- new_node = &new_entry->node; -- -- rb_link_node(new_node, parent, n); -- rb_insert_color(new_node, &system_blks->root); -- } -+ new_entry = kmem_cache_alloc(ext4_system_zone_cachep, -+ GFP_KERNEL); -+ if (!new_entry) -+ return -ENOMEM; -+ new_entry->start_blk = start_blk; -+ new_entry->count = count; -+ new_node = &new_entry->node; -+ -+ rb_link_node(new_node, parent, n); -+ rb_insert_color(new_node, &system_blks->root); - - /* Can we merge to the left? */ - node = rb_prev(new_node); -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index a564d0289a70a..36a81b57012a5 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1392,8 +1392,8 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, - ext4_match(dir, fname, de)) { - /* found a match - just to be sure, do - * a full check */ -- if (ext4_check_dir_entry(dir, NULL, de, bh, bh->b_data, -- bh->b_size, offset)) -+ if (ext4_check_dir_entry(dir, NULL, de, bh, search_buf, -+ buf_size, offset)) - return -1; - *res_dir = de; - return 1; -@@ -1852,7 +1852,7 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - blocksize, hinfo, map); - map -= count; - dx_sort_map(map, count); -- /* Split the existing block in the middle, size-wise */ -+ /* Ensure that neither split block is over half full */ - size = 0; - move = 0; - for (i = count-1; i >= 0; i--) { -@@ -1862,8 +1862,18 @@ static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir, - size += map[i].size; - move++; - } -- /* map index at which we will split */ -- split = count - move; -+ /* -+ * map index at which we will split -+ * -+ * If the sum of active entries didn't exceed half the block size, just -+ * split it in half by count; each resulting block will have at least -+ * half the space free. -+ */ -+ if (i > 0) -+ split = count - move; -+ else -+ split = count/2; -+ - hash2 = map[split].hash; - continued = hash2 == map[split - 1].hash; - dxtrace(printk(KERN_INFO "Split block %lu at %x, %i/%i\n", -@@ -2462,7 +2472,7 @@ int ext4_generic_delete_entry(handle_t *handle, - de = (struct ext4_dir_entry_2 *)entry_buf; - while (i < buf_size - csum_size) { - if (ext4_check_dir_entry(dir, NULL, de, bh, -- bh->b_data, bh->b_size, i)) -+ entry_buf, buf_size, i)) - return -EFSCORRUPTED; - if (de == de_del) { - if (pde) -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index adbb8fef22162..50fa3e08c02f3 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -1350,9 +1350,15 @@ int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsi - return ret; - } - -+/* -+ * NOTE: Never call gfs2_block_zero_range with an open transaction because it -+ * uses iomap write to perform its actions, which begin their own transactions -+ * (iomap_begin, page_prepare, etc.) -+ */ - static int gfs2_block_zero_range(struct inode *inode, loff_t from, - unsigned int length) - { -+ BUG_ON(current->journal_info); - return iomap_zero_range(inode, from, length, NULL, &gfs2_iomap_ops); - } - -@@ -1413,6 +1419,16 @@ static int trunc_start(struct inode *inode, u64 newsize) - u64 oldsize = inode->i_size; - int error; - -+ if (!gfs2_is_stuffed(ip)) { -+ unsigned int blocksize = i_blocksize(inode); -+ unsigned int offs = newsize & (blocksize - 1); -+ if (offs) { -+ error = gfs2_block_zero_range(inode, newsize, -+ blocksize - offs); -+ if (error) -+ return error; -+ } -+ } - if (journaled) - error = gfs2_trans_begin(sdp, RES_DINODE + RES_JDATA, GFS2_JTRUNC_REVOKES); - else -@@ -1426,19 +1442,10 @@ static int trunc_start(struct inode *inode, u64 newsize) - - gfs2_trans_add_meta(ip->i_gl, dibh); - -- if (gfs2_is_stuffed(ip)) { -+ if (gfs2_is_stuffed(ip)) - gfs2_buffer_clear_tail(dibh, sizeof(struct gfs2_dinode) + newsize); -- } else { -- unsigned int blocksize = i_blocksize(inode); -- unsigned int offs = newsize & (blocksize - 1); -- if (offs) { -- error = gfs2_block_zero_range(inode, newsize, -- blocksize - offs); -- if (error) -- goto out; -- } -+ else - ip->i_diskflags |= GFS2_DIF_TRUNC_IN_PROG; -- } - - i_size_write(inode, newsize); - ip->i_inode.i_mtime = ip->i_inode.i_ctime = current_time(&ip->i_inode); -@@ -2442,24 +2449,13 @@ int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length) - struct inode *inode = file_inode(file); - struct gfs2_inode *ip = GFS2_I(inode); - struct gfs2_sbd *sdp = GFS2_SB(inode); -+ unsigned int blocksize = i_blocksize(inode); -+ loff_t start, end; - int error; - -- if (gfs2_is_jdata(ip)) -- error = gfs2_trans_begin(sdp, RES_DINODE + 2 * RES_JDATA, -- GFS2_JTRUNC_REVOKES); -- else -- error = gfs2_trans_begin(sdp, RES_DINODE, 0); -- if (error) -- return error; -+ if (!gfs2_is_stuffed(ip)) { -+ unsigned int start_off, end_len; - -- if (gfs2_is_stuffed(ip)) { -- error = stuffed_zero_range(inode, offset, length); -- if (error) -- goto out; -- } else { -- unsigned int start_off, end_len, blocksize; -- -- blocksize = i_blocksize(inode); - start_off = offset & (blocksize - 1); - end_len = (offset + length) & (blocksize - 1); - if (start_off) { -@@ -2480,6 +2476,26 @@ int __gfs2_punch_hole(struct file *file, loff_t offset, loff_t length) - } - } - -+ start = round_down(offset, blocksize); -+ end = round_up(offset + length, blocksize) - 1; -+ error = filemap_write_and_wait_range(inode->i_mapping, start, end); -+ if (error) -+ return error; -+ -+ if (gfs2_is_jdata(ip)) -+ error = gfs2_trans_begin(sdp, RES_DINODE + 2 * RES_JDATA, -+ GFS2_JTRUNC_REVOKES); -+ else -+ error = gfs2_trans_begin(sdp, RES_DINODE, 0); -+ if (error) -+ return error; -+ -+ if (gfs2_is_stuffed(ip)) { -+ error = stuffed_zero_range(inode, offset, length); -+ if (error) -+ goto out; -+ } -+ - if (gfs2_is_jdata(ip)) { - BUG_ON(!current->journal_info); - gfs2_journaled_truncate_range(inode, offset, length); -diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c -index fa58835668a62..b7c5819bfc411 100644 ---- a/fs/jbd2/journal.c -+++ b/fs/jbd2/journal.c -@@ -1348,8 +1348,10 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags) - int ret; - - /* Buffer got discarded which means block device got invalidated */ -- if (!buffer_mapped(bh)) -+ if (!buffer_mapped(bh)) { -+ unlock_buffer(bh); - return -EIO; -+ } - - trace_jbd2_write_superblock(journal, write_flags); - if (!(journal->j_flags & JBD2_BARRIER)) -diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c -index f20cff1194bb6..776493713153f 100644 ---- a/fs/jffs2/dir.c -+++ b/fs/jffs2/dir.c -@@ -590,10 +590,14 @@ static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry) - int ret; - uint32_t now = JFFS2_NOW(); - -+ mutex_lock(&f->sem); - for (fd = f->dents ; fd; fd = fd->next) { -- if (fd->ino) -+ if (fd->ino) { -+ mutex_unlock(&f->sem); - return -ENOTEMPTY; -+ } - } -+ mutex_unlock(&f->sem); - - ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name, - dentry->d_name.len, f, now); -diff --git a/fs/romfs/storage.c b/fs/romfs/storage.c -index 6b2b4362089e6..b57b3ffcbc327 100644 ---- a/fs/romfs/storage.c -+++ b/fs/romfs/storage.c -@@ -217,10 +217,8 @@ int romfs_dev_read(struct super_block *sb, unsigned long pos, - size_t limit; - - limit = romfs_maxsize(sb); -- if (pos >= limit) -+ if (pos >= limit || buflen > limit - pos) - return -EIO; -- if (buflen > limit - pos) -- buflen = limit - pos; - - #ifdef CONFIG_ROMFS_ON_MTD - if (sb->s_mtd) -diff --git a/fs/signalfd.c b/fs/signalfd.c -index 44b6845b071c3..5b78719be4455 100644 ---- a/fs/signalfd.c -+++ b/fs/signalfd.c -@@ -314,9 +314,10 @@ SYSCALL_DEFINE4(signalfd4, int, ufd, sigset_t __user *, user_mask, - { - sigset_t mask; - -- if (sizemask != sizeof(sigset_t) || -- copy_from_user(&mask, user_mask, sizeof(mask))) -+ if (sizemask != sizeof(sigset_t)) - return -EINVAL; -+ if (copy_from_user(&mask, user_mask, sizeof(mask))) -+ return -EFAULT; - return do_signalfd4(ufd, &mask, flags); - } - -@@ -325,9 +326,10 @@ SYSCALL_DEFINE3(signalfd, int, ufd, sigset_t __user *, user_mask, - { - sigset_t mask; - -- if (sizemask != sizeof(sigset_t) || -- copy_from_user(&mask, user_mask, sizeof(mask))) -+ if (sizemask != sizeof(sigset_t)) - return -EINVAL; -+ if (copy_from_user(&mask, user_mask, sizeof(mask))) -+ return -EFAULT; - return do_signalfd4(ufd, &mask, 0); - } - -diff --git a/fs/xfs/xfs_sysfs.h b/fs/xfs/xfs_sysfs.h -index e9f810fc67317..43585850f1546 100644 ---- a/fs/xfs/xfs_sysfs.h -+++ b/fs/xfs/xfs_sysfs.h -@@ -32,9 +32,11 @@ xfs_sysfs_init( - struct xfs_kobj *parent_kobj, - const char *name) - { -+ struct kobject *parent; -+ -+ parent = parent_kobj ? &parent_kobj->kobject : NULL; - init_completion(&kobj->complete); -- return kobject_init_and_add(&kobj->kobject, ktype, -- &parent_kobj->kobject, "%s", name); -+ return kobject_init_and_add(&kobj->kobject, ktype, parent, "%s", name); - } - - static inline void -diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c -index 16457465833ba..904780dd74aa3 100644 ---- a/fs/xfs/xfs_trans_dquot.c -+++ b/fs/xfs/xfs_trans_dquot.c -@@ -646,7 +646,7 @@ xfs_trans_dqresv( - } - } - if (ninos > 0) { -- total_count = be64_to_cpu(dqp->q_core.d_icount) + ninos; -+ total_count = dqp->q_res_icount + ninos; - timer = be32_to_cpu(dqp->q_core.d_itimer); - warns = be16_to_cpu(dqp->q_core.d_iwarns); - warnlimit = dqp->q_mount->m_quotainfo->qi_iwarnlimit; -diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c -index aa83538efc238..a793bd23fe56c 100644 ---- a/kernel/events/uprobes.c -+++ b/kernel/events/uprobes.c -@@ -211,7 +211,7 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr, - try_to_free_swap(old_page); - page_vma_mapped_walk_done(&pvmw); - -- if (vma->vm_flags & VM_LOCKED) -+ if ((vma->vm_flags & VM_LOCKED) && !PageCompound(old_page)) - munlock_vma_page(old_page); - put_page(old_page); - -diff --git a/kernel/kthread.c b/kernel/kthread.c -index b262f47046ca4..bfbfa481be3a5 100644 ---- a/kernel/kthread.c -+++ b/kernel/kthread.c -@@ -199,8 +199,15 @@ static void __kthread_parkme(struct kthread *self) - if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) - break; - -+ /* -+ * Thread is going to call schedule(), do not preempt it, -+ * or the caller of kthread_park() may spend more time in -+ * wait_task_inactive(). -+ */ -+ preempt_disable(); - complete(&self->parked); -- schedule(); -+ schedule_preempt_disabled(); -+ preempt_enable(); - } - __set_current_state(TASK_RUNNING); - } -@@ -245,8 +252,14 @@ static int kthread(void *_create) - /* OK, tell user we're spawned, wait for stop or wakeup */ - __set_current_state(TASK_UNINTERRUPTIBLE); - create->result = current; -+ /* -+ * Thread is going to call schedule(), do not preempt it, -+ * or the creator may spend more time in wait_task_inactive(). -+ */ -+ preempt_disable(); - complete(done); -- schedule(); -+ schedule_preempt_disabled(); -+ preempt_enable(); - - ret = -EINTR; - if (!test_bit(KTHREAD_SHOULD_STOP, &self->flags)) { -diff --git a/kernel/relay.c b/kernel/relay.c -index 4b760ec163426..d3940becf2fc3 100644 ---- a/kernel/relay.c -+++ b/kernel/relay.c -@@ -197,6 +197,7 @@ free_buf: - static void relay_destroy_channel(struct kref *kref) - { - struct rchan *chan = container_of(kref, struct rchan, kref); -+ free_percpu(chan->buf); - kfree(chan); - } - -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 2af1831596f22..2a83b03c54a69 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -4846,25 +4846,21 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr) - void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma, - unsigned long *start, unsigned long *end) - { -- unsigned long check_addr = *start; -+ unsigned long a_start, a_end; - - if (!(vma->vm_flags & VM_MAYSHARE)) - return; - -- for (check_addr = *start; check_addr < *end; check_addr += PUD_SIZE) { -- unsigned long a_start = check_addr & PUD_MASK; -- unsigned long a_end = a_start + PUD_SIZE; -+ /* Extend the range to be PUD aligned for a worst case scenario */ -+ a_start = ALIGN_DOWN(*start, PUD_SIZE); -+ a_end = ALIGN(*end, PUD_SIZE); - -- /* -- * If sharing is possible, adjust start/end if necessary. -- */ -- if (range_in_vma(vma, a_start, a_end)) { -- if (a_start < *start) -- *start = a_start; -- if (a_end > *end) -- *end = a_end; -- } -- } -+ /* -+ * Intersect the range with the vma range, since pmd sharing won't be -+ * across vma after all -+ */ -+ *start = max(vma->vm_start, a_start); -+ *end = min(vma->vm_end, a_end); - } - - /* -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index 719f49d1fba2f..3623d1c5343f2 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -401,7 +401,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm, - - static inline int khugepaged_test_exit(struct mm_struct *mm) - { -- return atomic_read(&mm->mm_users) == 0; -+ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm); - } - - static bool hugepage_vma_check(struct vm_area_struct *vma, -@@ -438,7 +438,7 @@ int __khugepaged_enter(struct mm_struct *mm) - return -ENOMEM; - - /* __khugepaged_exit() must not run from under us */ -- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm); -+ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm); - if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) { - free_mm_slot(mm_slot); - return 0; -@@ -1019,9 +1019,6 @@ static void collapse_huge_page(struct mm_struct *mm, - * handled by the anon_vma lock + PG_lock. - */ - down_write(&mm->mmap_sem); -- result = SCAN_ANY_PROCESS; -- if (!mmget_still_valid(mm)) -- goto out; - result = hugepage_vma_revalidate(mm, address, &vma); - if (result) - goto out; -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 8686fe760f34c..67a9943aa595f 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1256,6 +1256,11 @@ static void free_pcppages_bulk(struct zone *zone, int count, - struct page *page, *tmp; - LIST_HEAD(head); - -+ /* -+ * Ensure proper count is passed which otherwise would stuck in the -+ * below while (list_empty(list)) loop. -+ */ -+ count = min(pcp->count, count); - while (count) { - struct list_head *list; - -@@ -7867,7 +7872,7 @@ int __meminit init_per_zone_wmark_min(void) - - return 0; - } --core_initcall(init_per_zone_wmark_min) -+postcore_initcall(init_per_zone_wmark_min) - - /* - * min_free_kbytes_sysctl_handler - just a wrapper around proc_dointvec() so -diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c -index f7587428febdd..bf9fd6ee88fe0 100644 ---- a/net/can/j1939/socket.c -+++ b/net/can/j1939/socket.c -@@ -398,6 +398,7 @@ static int j1939_sk_init(struct sock *sk) - spin_lock_init(&jsk->sk_session_queue_lock); - INIT_LIST_HEAD(&jsk->sk_session_queue); - sk->sk_destruct = j1939_sk_sock_destruct; -+ sk->sk_protocol = CAN_J1939; - - return 0; - } -@@ -466,6 +467,14 @@ static int j1939_sk_bind(struct socket *sock, struct sockaddr *uaddr, int len) - goto out_release_sock; - } - -+ if (!ndev->ml_priv) { -+ netdev_warn_once(ndev, -+ "No CAN mid layer private allocated, please fix your driver and use alloc_candev()!\n"); -+ dev_put(ndev); -+ ret = -ENODEV; -+ goto out_release_sock; -+ } -+ - priv = j1939_netdev_start(ndev); - dev_put(ndev); - if (IS_ERR(priv)) { -@@ -553,6 +562,11 @@ static int j1939_sk_connect(struct socket *sock, struct sockaddr *uaddr, - static void j1939_sk_sock2sockaddr_can(struct sockaddr_can *addr, - const struct j1939_sock *jsk, int peer) - { -+ /* There are two holes (2 bytes and 3 bytes) to clear to avoid -+ * leaking kernel information to user space. -+ */ -+ memset(addr, 0, J1939_MIN_NAMELEN); -+ - addr->can_family = AF_CAN; - addr->can_ifindex = jsk->ifindex; - addr->can_addr.j1939.pgn = jsk->addr.pgn; -diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c -index 9f99af5b0b11e..dbd215cbc53d8 100644 ---- a/net/can/j1939/transport.c -+++ b/net/can/j1939/transport.c -@@ -352,17 +352,16 @@ void j1939_session_skb_queue(struct j1939_session *session, - skb_queue_tail(&session->skb_queue, skb); - } - --static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) -+static struct -+sk_buff *j1939_session_skb_find_by_offset(struct j1939_session *session, -+ unsigned int offset_start) - { - struct j1939_priv *priv = session->priv; -+ struct j1939_sk_buff_cb *do_skcb; - struct sk_buff *skb = NULL; - struct sk_buff *do_skb; -- struct j1939_sk_buff_cb *do_skcb; -- unsigned int offset_start; - unsigned long flags; - -- offset_start = session->pkt.dpo * 7; -- - spin_lock_irqsave(&session->skb_queue.lock, flags); - skb_queue_walk(&session->skb_queue, do_skb) { - do_skcb = j1939_skb_to_cb(do_skb); -@@ -382,6 +381,14 @@ static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) - return skb; - } - -+static struct sk_buff *j1939_session_skb_find(struct j1939_session *session) -+{ -+ unsigned int offset_start; -+ -+ offset_start = session->pkt.dpo * 7; -+ return j1939_session_skb_find_by_offset(session, offset_start); -+} -+ - /* see if we are receiver - * returns 0 for broadcasts, although we will receive them - */ -@@ -716,10 +723,12 @@ static int j1939_session_tx_rts(struct j1939_session *session) - return ret; - - session->last_txcmd = dat[0]; -- if (dat[0] == J1939_TP_CMD_BAM) -+ if (dat[0] == J1939_TP_CMD_BAM) { - j1939_tp_schedule_txtimer(session, 50); -- -- j1939_tp_set_rxtimeout(session, 1250); -+ j1939_tp_set_rxtimeout(session, 250); -+ } else { -+ j1939_tp_set_rxtimeout(session, 1250); -+ } - - netdev_dbg(session->priv->ndev, "%s: 0x%p\n", __func__, session); - -@@ -766,7 +775,7 @@ static int j1939_session_tx_dat(struct j1939_session *session) - int ret = 0; - u8 dat[8]; - -- se_skb = j1939_session_skb_find(session); -+ se_skb = j1939_session_skb_find_by_offset(session, session->pkt.tx * 7); - if (!se_skb) - return -ENOBUFS; - -@@ -787,6 +796,18 @@ static int j1939_session_tx_dat(struct j1939_session *session) - if (len > 7) - len = 7; - -+ if (offset + len > se_skb->len) { -+ netdev_err_once(priv->ndev, -+ "%s: 0x%p: requested data outside of queued buffer: offset %i, len %i, pkt.tx: %i\n", -+ __func__, session, skcb->offset, se_skb->len , session->pkt.tx); -+ return -EOVERFLOW; -+ } -+ -+ if (!len) { -+ ret = -ENOBUFS; -+ break; -+ } -+ - memcpy(&dat[1], &tpdat[offset], len); - ret = j1939_tp_tx_dat(session, dat, len + 1); - if (ret < 0) { -@@ -1055,9 +1076,9 @@ static void __j1939_session_cancel(struct j1939_session *session, - lockdep_assert_held(&session->priv->active_session_list_lock); - - session->err = j1939_xtp_abort_to_errno(priv, err); -+ session->state = J1939_SESSION_WAITING_ABORT; - /* do not send aborts on incoming broadcasts */ - if (!j1939_cb_is_broadcast(&session->skcb)) { -- session->state = J1939_SESSION_WAITING_ABORT; - j1939_xtp_tx_abort(priv, &session->skcb, - !session->transmission, - err, session->skcb.addr.pgn); -@@ -1120,6 +1141,9 @@ static enum hrtimer_restart j1939_tp_txtimer(struct hrtimer *hrtimer) - * cleanup including propagation of the error to user space. - */ - break; -+ case -EOVERFLOW: -+ j1939_session_cancel(session, J1939_XTP_ABORT_ECTS_TOO_BIG); -+ break; - case 0: - session->tx_retry = 0; - break; -@@ -1651,8 +1675,12 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, - return; - } - session = j1939_xtp_rx_rts_session_new(priv, skb); -- if (!session) -+ if (!session) { -+ if (cmd == J1939_TP_CMD_BAM && j1939_sk_recv_match(priv, skcb)) -+ netdev_info(priv->ndev, "%s: failed to create TP BAM session\n", -+ __func__); - return; -+ } - } else { - if (j1939_xtp_rx_rts_session_active(session, skb)) { - j1939_session_put(session); -@@ -1661,11 +1689,15 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb, - } - session->last_cmd = cmd; - -- j1939_tp_set_rxtimeout(session, 1250); -- -- if (cmd != J1939_TP_CMD_BAM && !session->transmission) { -- j1939_session_txtimer_cancel(session); -- j1939_tp_schedule_txtimer(session, 0); -+ if (cmd == J1939_TP_CMD_BAM) { -+ if (!session->transmission) -+ j1939_tp_set_rxtimeout(session, 750); -+ } else { -+ if (!session->transmission) { -+ j1939_session_txtimer_cancel(session); -+ j1939_tp_schedule_txtimer(session, 0); -+ } -+ j1939_tp_set_rxtimeout(session, 1250); - } - - j1939_session_put(session); -@@ -1716,6 +1748,7 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, - int offset; - int nbytes; - bool final = false; -+ bool remain = false; - bool do_cts_eoma = false; - int packet; - -@@ -1750,7 +1783,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, - __func__, session); - goto out_session_cancel; - } -- se_skb = j1939_session_skb_find(session); -+ -+ se_skb = j1939_session_skb_find_by_offset(session, packet * 7); - if (!se_skb) { - netdev_warn(priv->ndev, "%s: 0x%p: no skb found\n", __func__, - session); -@@ -1777,6 +1811,8 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, - j1939_cb_is_broadcast(&session->skcb)) { - if (session->pkt.rx >= session->pkt.total) - final = true; -+ else -+ remain = true; - } else { - /* never final, an EOMA must follow */ - if (session->pkt.rx >= session->pkt.last) -@@ -1784,7 +1820,11 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, - } - - if (final) { -+ j1939_session_timers_cancel(session); - j1939_session_completed(session); -+ } else if (remain) { -+ if (!session->transmission) -+ j1939_tp_set_rxtimeout(session, 750); - } else if (do_cts_eoma) { - j1939_tp_set_rxtimeout(session, 1250); - if (!session->transmission) -@@ -1829,6 +1869,13 @@ static void j1939_xtp_rx_dat(struct j1939_priv *priv, struct sk_buff *skb) - else - j1939_xtp_rx_dat_one(session, skb); - } -+ -+ if (j1939_cb_is_broadcast(skcb)) { -+ session = j1939_session_get_by_addr(priv, &skcb->addr, false, -+ false); -+ if (session) -+ j1939_xtp_rx_dat_one(session, skb); -+ } - } - - /* j1939 main intf */ -@@ -1920,7 +1967,7 @@ static void j1939_tp_cmd_recv(struct j1939_priv *priv, struct sk_buff *skb) - if (j1939_tp_im_transmitter(skcb)) - j1939_xtp_rx_rts(priv, skb, true); - -- if (j1939_tp_im_receiver(skcb)) -+ if (j1939_tp_im_receiver(skcb) || j1939_cb_is_broadcast(skcb)) - j1939_xtp_rx_rts(priv, skb, false); - - break; -@@ -1984,7 +2031,7 @@ int j1939_tp_recv(struct j1939_priv *priv, struct sk_buff *skb) - { - struct j1939_sk_buff_cb *skcb = j1939_skb_to_cb(skb); - -- if (!j1939_tp_im_involved_anydir(skcb)) -+ if (!j1939_tp_im_involved_anydir(skcb) && !j1939_cb_is_broadcast(skcb)) - return 0; - - switch (skcb->addr.pgn) { -@@ -2017,6 +2064,10 @@ void j1939_simple_recv(struct j1939_priv *priv, struct sk_buff *skb) - if (!skb->sk) - return; - -+ if (skb->sk->sk_family != AF_CAN || -+ skb->sk->sk_protocol != CAN_J1939) -+ return; -+ - j1939_session_list_lock(priv); - session = j1939_session_get_simple(priv, skb); - j1939_session_list_unlock(priv); -diff --git a/net/core/filter.c b/net/core/filter.c -index bd1e46d61d8a1..5c490d473df1d 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -8010,6 +8010,43 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, - offsetof(OBJ, OBJ_FIELD)); \ - } while (0) - -+#define SOCK_OPS_GET_SK() \ -+ do { \ -+ int fullsock_reg = si->dst_reg, reg = BPF_REG_9, jmp = 1; \ -+ if (si->dst_reg == reg || si->src_reg == reg) \ -+ reg--; \ -+ if (si->dst_reg == reg || si->src_reg == reg) \ -+ reg--; \ -+ if (si->dst_reg == si->src_reg) { \ -+ *insn++ = BPF_STX_MEM(BPF_DW, si->src_reg, reg, \ -+ offsetof(struct bpf_sock_ops_kern, \ -+ temp)); \ -+ fullsock_reg = reg; \ -+ jmp += 2; \ -+ } \ -+ *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ -+ struct bpf_sock_ops_kern, \ -+ is_fullsock), \ -+ fullsock_reg, si->src_reg, \ -+ offsetof(struct bpf_sock_ops_kern, \ -+ is_fullsock)); \ -+ *insn++ = BPF_JMP_IMM(BPF_JEQ, fullsock_reg, 0, jmp); \ -+ if (si->dst_reg == si->src_reg) \ -+ *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \ -+ offsetof(struct bpf_sock_ops_kern, \ -+ temp)); \ -+ *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( \ -+ struct bpf_sock_ops_kern, sk),\ -+ si->dst_reg, si->src_reg, \ -+ offsetof(struct bpf_sock_ops_kern, sk));\ -+ if (si->dst_reg == si->src_reg) { \ -+ *insn++ = BPF_JMP_A(1); \ -+ *insn++ = BPF_LDX_MEM(BPF_DW, reg, si->src_reg, \ -+ offsetof(struct bpf_sock_ops_kern, \ -+ temp)); \ -+ } \ -+ } while (0) -+ - #define SOCK_OPS_GET_TCP_SOCK_FIELD(FIELD) \ - SOCK_OPS_GET_FIELD(FIELD, FIELD, struct tcp_sock) - -@@ -8294,17 +8331,7 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type, - SOCK_OPS_GET_TCP_SOCK_FIELD(bytes_acked); - break; - case offsetof(struct bpf_sock_ops, sk): -- *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( -- struct bpf_sock_ops_kern, -- is_fullsock), -- si->dst_reg, si->src_reg, -- offsetof(struct bpf_sock_ops_kern, -- is_fullsock)); -- *insn++ = BPF_JMP_IMM(BPF_JEQ, si->dst_reg, 0, 1); -- *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF( -- struct bpf_sock_ops_kern, sk), -- si->dst_reg, si->src_reg, -- offsetof(struct bpf_sock_ops_kern, sk)); -+ SOCK_OPS_GET_SK(); - break; - } - return insn - insn_buf; -diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c -index a5e8469859e39..427d77b111b17 100644 ---- a/net/netfilter/nft_exthdr.c -+++ b/net/netfilter/nft_exthdr.c -@@ -44,7 +44,7 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, - - err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); - if (priv->flags & NFT_EXTHDR_F_PRESENT) { -- *dest = (err >= 0); -+ nft_reg_store8(dest, err >= 0); - return; - } else if (err < 0) { - goto err; -@@ -141,7 +141,7 @@ static void nft_exthdr_ipv4_eval(const struct nft_expr *expr, - - err = ipv4_find_option(nft_net(pkt), skb, &offset, priv->type); - if (priv->flags & NFT_EXTHDR_F_PRESENT) { -- *dest = (err >= 0); -+ nft_reg_store8(dest, err >= 0); - return; - } else if (err < 0) { - goto err; -diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c -index 0ce4e75b29812..d803d814a03ad 100644 ---- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c -+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c -@@ -265,6 +265,8 @@ static int svc_rdma_post_recv(struct svcxprt_rdma *rdma) - { - struct svc_rdma_recv_ctxt *ctxt; - -+ if (test_bit(XPT_CLOSE, &rdma->sc_xprt.xpt_flags)) -+ return 0; - ctxt = svc_rdma_recv_ctxt_get(rdma); - if (!ctxt) - return -ENOMEM; -diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc -index 0f8c77f847114..a94909ad9a53a 100644 ---- a/scripts/kconfig/qconf.cc -+++ b/scripts/kconfig/qconf.cc -@@ -869,40 +869,40 @@ void ConfigList::focusInEvent(QFocusEvent *e) - - void ConfigList::contextMenuEvent(QContextMenuEvent *e) - { -- if (e->y() <= header()->geometry().bottom()) { -- if (!headerPopup) { -- QAction *action; -- -- headerPopup = new QMenu(this); -- action = new QAction("Show Name", this); -- action->setCheckable(true); -- connect(action, SIGNAL(toggled(bool)), -- parent(), SLOT(setShowName(bool))); -- connect(parent(), SIGNAL(showNameChanged(bool)), -- action, SLOT(setOn(bool))); -- action->setChecked(showName); -- headerPopup->addAction(action); -- action = new QAction("Show Range", this); -- action->setCheckable(true); -- connect(action, SIGNAL(toggled(bool)), -- parent(), SLOT(setShowRange(bool))); -- connect(parent(), SIGNAL(showRangeChanged(bool)), -- action, SLOT(setOn(bool))); -- action->setChecked(showRange); -- headerPopup->addAction(action); -- action = new QAction("Show Data", this); -- action->setCheckable(true); -- connect(action, SIGNAL(toggled(bool)), -- parent(), SLOT(setShowData(bool))); -- connect(parent(), SIGNAL(showDataChanged(bool)), -- action, SLOT(setOn(bool))); -- action->setChecked(showData); -- headerPopup->addAction(action); -- } -- headerPopup->exec(e->globalPos()); -- e->accept(); -- } else -- e->ignore(); -+ if (!headerPopup) { -+ QAction *action; -+ -+ headerPopup = new QMenu(this); -+ action = new QAction("Show Name", this); -+ action->setCheckable(true); -+ connect(action, SIGNAL(toggled(bool)), -+ parent(), SLOT(setShowName(bool))); -+ connect(parent(), SIGNAL(showNameChanged(bool)), -+ action, SLOT(setChecked(bool))); -+ action->setChecked(showName); -+ headerPopup->addAction(action); -+ -+ action = new QAction("Show Range", this); -+ action->setCheckable(true); -+ connect(action, SIGNAL(toggled(bool)), -+ parent(), SLOT(setShowRange(bool))); -+ connect(parent(), SIGNAL(showRangeChanged(bool)), -+ action, SLOT(setChecked(bool))); -+ action->setChecked(showRange); -+ headerPopup->addAction(action); -+ -+ action = new QAction("Show Data", this); -+ action->setCheckable(true); -+ connect(action, SIGNAL(toggled(bool)), -+ parent(), SLOT(setShowData(bool))); -+ connect(parent(), SIGNAL(showDataChanged(bool)), -+ action, SLOT(setChecked(bool))); -+ action->setChecked(showData); -+ headerPopup->addAction(action); -+ } -+ -+ headerPopup->exec(e->globalPos()); -+ e->accept(); - } - - ConfigView*ConfigView::viewList; -@@ -1228,7 +1228,7 @@ QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos) - - action->setCheckable(true); - connect(action, SIGNAL(toggled(bool)), SLOT(setShowDebug(bool))); -- connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setOn(bool))); -+ connect(this, SIGNAL(showDebugChanged(bool)), action, SLOT(setChecked(bool))); - action->setChecked(showDebug()); - popup->addSeparator(); - popup->addAction(action); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 88629906f314c..06bbcfbb28153 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -7666,6 +7666,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -+ SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -+ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), - SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), -diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c -index 84289ebeae872..337bddb7c2a49 100644 ---- a/sound/soc/codecs/msm8916-wcd-analog.c -+++ b/sound/soc/codecs/msm8916-wcd-analog.c -@@ -19,8 +19,8 @@ - - #define CDC_D_REVISION1 (0xf000) - #define CDC_D_PERPH_SUBTYPE (0xf005) --#define CDC_D_INT_EN_SET (0x015) --#define CDC_D_INT_EN_CLR (0x016) -+#define CDC_D_INT_EN_SET (0xf015) -+#define CDC_D_INT_EN_CLR (0xf016) - #define MBHC_SWITCH_INT BIT(7) - #define MBHC_MIC_ELECTRICAL_INS_REM_DET BIT(6) - #define MBHC_BUTTON_PRESS_DET BIT(5) -diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -index 8cc3cc363eb03..31f1dd6541aa1 100644 ---- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c -+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -@@ -331,7 +331,7 @@ static int sst_media_open(struct snd_pcm_substream *substream, - - ret_val = power_up_sst(stream); - if (ret_val < 0) -- return ret_val; -+ goto out_power_up; - - /* Make sure, that the period size is always even */ - snd_pcm_hw_constraint_step(substream->runtime, 0, -@@ -340,8 +340,9 @@ static int sst_media_open(struct snd_pcm_substream *substream, - return snd_pcm_hw_constraint_integer(runtime, - SNDRV_PCM_HW_PARAM_PERIODS); - out_ops: -- kfree(stream); - mutex_unlock(&sst_lock); -+out_power_up: -+ kfree(stream); - return ret_val; - } - -diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c -index 2a5302f1db98a..0168af8492727 100644 ---- a/sound/soc/qcom/qdsp6/q6afe-dai.c -+++ b/sound/soc/qcom/qdsp6/q6afe-dai.c -@@ -1150,206 +1150,206 @@ static int q6afe_of_xlate_dai_name(struct snd_soc_component *component, - } - - static const struct snd_soc_dapm_widget q6afe_dai_widgets[] = { -- SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, 0, 0, 0), -+ SND_SOC_DAPM_AIF_IN("HDMI_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_0_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_1_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_2_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_3_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_4_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_5_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_IN("SLIMBUS_6_RX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_0_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_1_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_2_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_3_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_4_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_5_TX", NULL, 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("SLIMBUS_6_TX", NULL, 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_MI2S_RX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_MI2S_TX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_MI2S_RX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_MI2S_TX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_MI2S_TX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_MI2S_RX_SD1", - "Secondary MI2S Playback SD1", -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRI_MI2S_RX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRI_MI2S_TX", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("PRIMARY_TDM_RX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("PRIMARY_TDM_TX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("SEC_TDM_RX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("SEC_TDM_TX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("TERT_TDM_RX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("TERT_TDM_TX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUAT_TDM_RX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUAT_TDM_TX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_IN("QUIN_TDM_RX_7", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_0", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_1", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_2", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_3", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_4", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_5", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_6", NULL, -- 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), - SND_SOC_DAPM_AIF_OUT("QUIN_TDM_TX_7", NULL, -- 0, 0, 0, 0), -- SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, 0, 0, 0), -+ 0, SND_SOC_NOPM, 0, 0), -+ SND_SOC_DAPM_AIF_OUT("DISPLAY_PORT_RX", "NULL", 0, SND_SOC_NOPM, 0, 0), - }; - - static const struct snd_soc_component_driver q6afe_dai_component = { -diff --git a/sound/soc/qcom/qdsp6/q6routing.c b/sound/soc/qcom/qdsp6/q6routing.c -index ddcd9978cf57b..745cc9dd14f38 100644 ---- a/sound/soc/qcom/qdsp6/q6routing.c -+++ b/sound/soc/qcom/qdsp6/q6routing.c -@@ -996,6 +996,20 @@ static int msm_routing_probe(struct snd_soc_component *c) - return 0; - } - -+static unsigned int q6routing_reg_read(struct snd_soc_component *component, -+ unsigned int reg) -+{ -+ /* default value */ -+ return 0; -+} -+ -+static int q6routing_reg_write(struct snd_soc_component *component, -+ unsigned int reg, unsigned int val) -+{ -+ /* dummy */ -+ return 0; -+} -+ - static const struct snd_soc_component_driver msm_soc_routing_component = { - .ops = &q6pcm_routing_ops, - .probe = msm_routing_probe, -@@ -1004,6 +1018,8 @@ static const struct snd_soc_component_driver msm_soc_routing_component = { - .num_dapm_widgets = ARRAY_SIZE(msm_qdsp6_widgets), - .dapm_routes = intercon, - .num_dapm_routes = ARRAY_SIZE(intercon), -+ .read = q6routing_reg_read, -+ .write = q6routing_reg_write, - }; - - static int q6pcm_routing_probe(struct platform_device *pdev) -diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile -index ee08aeff30a19..f591c4d1b6fe2 100644 ---- a/tools/objtool/Makefile -+++ b/tools/objtool/Makefile -@@ -3,9 +3,15 @@ include ../scripts/Makefile.include - include ../scripts/Makefile.arch - - # always use the host compiler -+ifneq ($(LLVM),) -+HOSTAR ?= llvm-ar -+HOSTCC ?= clang -+HOSTLD ?= ld.lld -+else - HOSTAR ?= ar - HOSTCC ?= gcc - HOSTLD ?= ld -+endif - AR = $(HOSTAR) - CC = $(HOSTCC) - LD = $(HOSTLD) -diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c -index dc9d495e3d6ab..849d8d2e5976b 100644 ---- a/tools/perf/util/probe-finder.c -+++ b/tools/perf/util/probe-finder.c -@@ -1362,7 +1362,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg, - tf.ntevs = 0; - - ret = debuginfo__find_probes(dbg, &tf.pf); -- if (ret < 0) { -+ if (ret < 0 || tf.ntevs == 0) { - for (i = 0; i < tf.ntevs; i++) - clear_probe_trace_event(&tf.tevs[i]); - zfree(tevs); -diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c -index bdb69599c4bdc..5e939ff1e3f95 100644 ---- a/tools/testing/selftests/cgroup/cgroup_util.c -+++ b/tools/testing/selftests/cgroup/cgroup_util.c -@@ -105,7 +105,7 @@ int cg_read_strcmp(const char *cgroup, const char *control, - - /* Handle the case of comparing against empty string */ - if (!expected) -- size = 32; -+ return -1; - else - size = strlen(expected) + 1; - -diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c -index 767ac4eab4fe9..7501ec8a46004 100644 ---- a/virt/kvm/arm/mmu.c -+++ b/virt/kvm/arm/mmu.c -@@ -332,7 +332,8 @@ static void unmap_stage2_puds(struct kvm *kvm, pgd_t *pgd, - * destroying the VM), otherwise another faulting VCPU may come in and mess - * with things behind our backs. - */ --static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) -+static void __unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size, -+ bool may_block) - { - pgd_t *pgd; - phys_addr_t addr = start, end = start + size; -@@ -357,11 +358,16 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) - * If the range is too large, release the kvm->mmu_lock - * to prevent starvation and lockup detector warnings. - */ -- if (next != end) -+ if (may_block && next != end) - cond_resched_lock(&kvm->mmu_lock); - } while (pgd++, addr = next, addr != end); - } - -+static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) -+{ -+ __unmap_stage2_range(kvm, start, size, true); -+} -+ - static void stage2_flush_ptes(struct kvm *kvm, pmd_t *pmd, - phys_addr_t addr, phys_addr_t end) - { -@@ -2045,18 +2051,21 @@ static int handle_hva_to_gpa(struct kvm *kvm, - - static int kvm_unmap_hva_handler(struct kvm *kvm, gpa_t gpa, u64 size, void *data) - { -- unmap_stage2_range(kvm, gpa, size); -+ unsigned flags = *(unsigned *)data; -+ bool may_block = flags & MMU_NOTIFIER_RANGE_BLOCKABLE; -+ -+ __unmap_stage2_range(kvm, gpa, size, may_block); - return 0; - } - - int kvm_unmap_hva_range(struct kvm *kvm, -- unsigned long start, unsigned long end) -+ unsigned long start, unsigned long end, unsigned flags) - { - if (!kvm->arch.pgd) - return 0; - - trace_kvm_unmap_hva_range(start, end); -- handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, NULL); -+ handle_hva_to_gpa(kvm, start, end, &kvm_unmap_hva_handler, &flags); - return 0; - } - -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index d5d4cd581af32..278bdc53047e8 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -425,7 +425,8 @@ static int kvm_mmu_notifier_invalidate_range_start(struct mmu_notifier *mn, - * count is also read inside the mmu_lock critical section. - */ - kvm->mmu_notifier_count++; -- need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end); -+ need_tlb_flush = kvm_unmap_hva_range(kvm, range->start, range->end, -+ range->flags); - need_tlb_flush |= kvm->tlbs_dirty; - /* we've to flush the tlb before the pages can be freed */ - if (need_tlb_flush) diff --git a/patch/kernel/odroidxu4-current/patch-5.4.61-62.patch b/patch/kernel/odroidxu4-current/patch-5.4.61-62.patch deleted file mode 100644 index b9353d0064..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.61-62.patch +++ /dev/null @@ -1,8044 +0,0 @@ -diff --git a/Makefile b/Makefile -index 2c21b922644d7..aece56450bd9d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 61 -+SUBLEVEL = 62 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -@@ -442,6 +442,12 @@ PYTHON = python - PYTHON3 = python3 - CHECK = sparse - BASH = bash -+KGZIP = gzip -+KBZIP2 = bzip2 -+KLZOP = lzop -+LZMA = lzma -+LZ4 = lz4c -+XZ = xz - - CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ -Dunix -D__unix__ \ - -Wbitwise -Wno-return-void -Wno-unknown-attribute $(CF) -@@ -490,6 +496,7 @@ CLANG_FLAGS := - export ARCH SRCARCH CONFIG_SHELL BASH HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC - export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE READELF PAHOLE LEX YACC AWK INSTALLKERNEL - export PERL PYTHON PYTHON3 CHECK CHECKFLAGS MAKE UTS_MACHINE HOSTCXX -+export KGZIP KBZIP2 KLZOP LZMA LZ4 XZ - export KBUILD_HOSTCXXFLAGS KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS LDFLAGS_MODULE - - export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS KBUILD_LDFLAGS -@@ -997,10 +1004,10 @@ export mod_strip_cmd - mod_compress_cmd = true - ifdef CONFIG_MODULE_COMPRESS - ifdef CONFIG_MODULE_COMPRESS_GZIP -- mod_compress_cmd = gzip -n -f -+ mod_compress_cmd = $(KGZIP) -n -f - endif # CONFIG_MODULE_COMPRESS_GZIP - ifdef CONFIG_MODULE_COMPRESS_XZ -- mod_compress_cmd = xz -f -+ mod_compress_cmd = $(XZ) -f - endif # CONFIG_MODULE_COMPRESS_XZ - endif # CONFIG_MODULE_COMPRESS - export mod_compress_cmd -diff --git a/arch/arm/boot/deflate_xip_data.sh b/arch/arm/boot/deflate_xip_data.sh -index 40937248cebe3..304495c3c2c5d 100755 ---- a/arch/arm/boot/deflate_xip_data.sh -+++ b/arch/arm/boot/deflate_xip_data.sh -@@ -56,7 +56,7 @@ trap 'rm -f "$XIPIMAGE.tmp"; exit 1' 1 2 3 - # substitute the data section by a compressed version - $DD if="$XIPIMAGE" count=$data_start iflag=count_bytes of="$XIPIMAGE.tmp" - $DD if="$XIPIMAGE" skip=$data_start iflag=skip_bytes | --gzip -9 >> "$XIPIMAGE.tmp" -+$KGZIP -9 >> "$XIPIMAGE.tmp" - - # replace kernel binary - mv -f "$XIPIMAGE.tmp" "$XIPIMAGE" -diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi -index 63d9f4a066e38..5a8e58b663420 100644 ---- a/arch/arm/boot/dts/ls1021a.dtsi -+++ b/arch/arm/boot/dts/ls1021a.dtsi -@@ -753,7 +753,7 @@ - fsl,tmr-prsc = <2>; - fsl,tmr-add = <0xaaaaaaab>; - fsl,tmr-fiper1 = <999999995>; -- fsl,tmr-fiper2 = <99990>; -+ fsl,tmr-fiper2 = <999999995>; - fsl,max-adj = <499999999>; - fsl,extts-fifo; - }; -diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile -index 11a7d6208087f..96abe558aea8b 100644 ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -146,7 +146,8 @@ zinstall install: - PHONY += vdso_install - vdso_install: - $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso $@ -- $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@ -+ $(if $(CONFIG_COMPAT_VDSO), \ -+ $(Q)$(MAKE) $(build)=arch/arm64/kernel/vdso32 $@) - - # We use MRPROPER_FILES and CLEAN_FILES now - archclean: -diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -index 1235830ffd0b7..38c0d74767e3f 100644 ---- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -+++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi -@@ -521,7 +521,7 @@ - pins = "gpio63", "gpio64", "gpio65", "gpio66", - "gpio67", "gpio68"; - drive-strength = <2>; -- bias-disable; -+ bias-pull-down; - }; - }; - }; -diff --git a/arch/arm64/include/asm/smp.h b/arch/arm64/include/asm/smp.h -index a0c8a0b652593..0eadbf933e359 100644 ---- a/arch/arm64/include/asm/smp.h -+++ b/arch/arm64/include/asm/smp.h -@@ -46,7 +46,12 @@ DECLARE_PER_CPU_READ_MOSTLY(int, cpu_number); - * Logical CPU mapping. - */ - extern u64 __cpu_logical_map[NR_CPUS]; --#define cpu_logical_map(cpu) __cpu_logical_map[cpu] -+extern u64 cpu_logical_map(int cpu); -+ -+static inline void set_cpu_logical_map(int cpu, u64 hwid) -+{ -+ __cpu_logical_map[cpu] = hwid; -+} - - struct seq_file; - -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 0b2830379fe03..51462c59ab5da 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -917,6 +917,8 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - .desc = "ARM erratum 1418040", - .capability = ARM64_WORKAROUND_1418040, - ERRATA_MIDR_RANGE_LIST(erratum_1418040_list), -+ .type = (ARM64_CPUCAP_SCOPE_LOCAL_CPU | -+ ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU), - }, - #endif - #ifdef CONFIG_ARM64_ERRATUM_1165522 -diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c -index fab013c5ee8c9..10190c4b16dc4 100644 ---- a/arch/arm64/kernel/process.c -+++ b/arch/arm64/kernel/process.c -@@ -498,6 +498,39 @@ static void entry_task_switch(struct task_struct *next) - __this_cpu_write(__entry_task, next); - } - -+/* -+ * ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT. -+ * Assuming the virtual counter is enabled at the beginning of times: -+ * -+ * - disable access when switching from a 64bit task to a 32bit task -+ * - enable access when switching from a 32bit task to a 64bit task -+ */ -+static void erratum_1418040_thread_switch(struct task_struct *prev, -+ struct task_struct *next) -+{ -+ bool prev32, next32; -+ u64 val; -+ -+ if (!(IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) && -+ cpus_have_const_cap(ARM64_WORKAROUND_1418040))) -+ return; -+ -+ prev32 = is_compat_thread(task_thread_info(prev)); -+ next32 = is_compat_thread(task_thread_info(next)); -+ -+ if (prev32 == next32) -+ return; -+ -+ val = read_sysreg(cntkctl_el1); -+ -+ if (!next32) -+ val |= ARCH_TIMER_USR_VCT_ACCESS_EN; -+ else -+ val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN; -+ -+ write_sysreg(val, cntkctl_el1); -+} -+ - /* - * Thread switching. - */ -@@ -514,6 +547,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, - uao_thread_switch(next); - ptrauth_thread_switch(next); - ssbs_thread_switch(next); -+ erratum_1418040_thread_switch(prev, next); - - /* - * Complete any pending TLB or cache maintenance on this CPU in case -diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c -index 56f6645617548..d98987b82874f 100644 ---- a/arch/arm64/kernel/setup.c -+++ b/arch/arm64/kernel/setup.c -@@ -85,7 +85,7 @@ u64 __cacheline_aligned boot_args[4]; - void __init smp_setup_processor_id(void) - { - u64 mpidr = read_cpuid_mpidr() & MPIDR_HWID_BITMASK; -- cpu_logical_map(0) = mpidr; -+ set_cpu_logical_map(0, mpidr); - - /* - * clear __my_cpu_offset on boot CPU to avoid hang caused by -@@ -276,6 +276,12 @@ arch_initcall(reserve_memblock_reserved_regions); - - u64 __cpu_logical_map[NR_CPUS] = { [0 ... NR_CPUS-1] = INVALID_HWID }; - -+u64 cpu_logical_map(int cpu) -+{ -+ return __cpu_logical_map[cpu]; -+} -+EXPORT_SYMBOL_GPL(cpu_logical_map); -+ - void __init setup_arch(char **cmdline_p) - { - init_mm.start_code = (unsigned long) _text; -diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c -index 993a4aedfd377..102dc3e7f2e1d 100644 ---- a/arch/arm64/kernel/smp.c -+++ b/arch/arm64/kernel/smp.c -@@ -549,7 +549,7 @@ acpi_map_gic_cpu_interface(struct acpi_madt_generic_interrupt *processor) - return; - - /* map the logical cpu id to cpu MPIDR */ -- cpu_logical_map(cpu_count) = hwid; -+ set_cpu_logical_map(cpu_count, hwid); - - cpu_madt_gicc[cpu_count] = *processor; - -@@ -663,7 +663,7 @@ static void __init of_parse_and_init_cpus(void) - goto next; - - pr_debug("cpu logical map 0x%llx\n", hwid); -- cpu_logical_map(cpu_count) = hwid; -+ set_cpu_logical_map(cpu_count, hwid); - - early_map_cpu_to_node(cpu_count, of_node_to_nid(dn)); - next: -@@ -704,7 +704,7 @@ void __init smp_init_cpus(void) - for (i = 1; i < nr_cpu_ids; i++) { - if (cpu_logical_map(i) != INVALID_HWID) { - if (smp_cpu_setup(i)) -- cpu_logical_map(i) = INVALID_HWID; -+ set_cpu_logical_map(i, INVALID_HWID); - } - } - } -diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c -index d76a3d39b2699..6f4838b475d0d 100644 ---- a/arch/arm64/kvm/hyp/switch.c -+++ b/arch/arm64/kvm/hyp/switch.c -@@ -754,7 +754,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par, - * making sure it is a kernel address and not a PC-relative - * reference. - */ -- asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va)); -+ asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string)); - - __hyp_do_panic(str_va, - spsr, elr, -diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile -index 32240000dc0c8..2876a7df1b0a1 100644 ---- a/arch/ia64/Makefile -+++ b/arch/ia64/Makefile -@@ -40,7 +40,7 @@ $(error Sorry, you need a newer version of the assember, one that is built from - endif - - quiet_cmd_gzip = GZIP $@ --cmd_gzip = cat $(real-prereqs) | gzip -n -f -9 > $@ -+cmd_gzip = cat $(real-prereqs) | $(KGZIP) -n -f -9 > $@ - - quiet_cmd_objcopy = OBJCOPY $@ - cmd_objcopy = $(OBJCOPY) $(OBJCOPYFLAGS) $(OBJCOPYFLAGS_$(@F)) $< $@ -diff --git a/arch/m68k/Makefile b/arch/m68k/Makefile -index 5d92883840969..0415d28dbe4fc 100644 ---- a/arch/m68k/Makefile -+++ b/arch/m68k/Makefile -@@ -135,10 +135,10 @@ vmlinux.gz: vmlinux - ifndef CONFIG_KGDB - cp vmlinux vmlinux.tmp - $(STRIP) vmlinux.tmp -- gzip -9c vmlinux.tmp >vmlinux.gz -+ $(KGZIP) -9c vmlinux.tmp >vmlinux.gz - rm vmlinux.tmp - else -- gzip -9c vmlinux >vmlinux.gz -+ $(KGZIP) -9c vmlinux >vmlinux.gz - endif - - bzImage: vmlinux.bz2 -@@ -148,10 +148,10 @@ vmlinux.bz2: vmlinux - ifndef CONFIG_KGDB - cp vmlinux vmlinux.tmp - $(STRIP) vmlinux.tmp -- bzip2 -1c vmlinux.tmp >vmlinux.bz2 -+ $(KBZIP2) -1c vmlinux.tmp >vmlinux.bz2 - rm vmlinux.tmp - else -- bzip2 -1c vmlinux >vmlinux.bz2 -+ $(KBZIP2) -1c vmlinux >vmlinux.bz2 - endif - - archclean: -diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c -index b66b6b1c4aeb9..8f581a2c8578b 100644 ---- a/arch/mips/vdso/genvdso.c -+++ b/arch/mips/vdso/genvdso.c -@@ -122,6 +122,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (fstat(fd, &stat) != 0) { - fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name, - path, strerror(errno)); -+ close(fd); - return NULL; - } - -@@ -130,6 +131,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (addr == MAP_FAILED) { - fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name, - path, strerror(errno)); -+ close(fd); - return NULL; - } - -@@ -139,6 +141,7 @@ static void *map_vdso(const char *path, size_t *_size) - if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) { - fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name, - path); -+ close(fd); - return NULL; - } - -@@ -150,6 +153,7 @@ static void *map_vdso(const char *path, size_t *_size) - default: - fprintf(stderr, "%s: '%s' has invalid ELF class\n", - program_name, path); -+ close(fd); - return NULL; - } - -@@ -161,6 +165,7 @@ static void *map_vdso(const char *path, size_t *_size) - default: - fprintf(stderr, "%s: '%s' has invalid ELF data order\n", - program_name, path); -+ close(fd); - return NULL; - } - -@@ -168,15 +173,18 @@ static void *map_vdso(const char *path, size_t *_size) - fprintf(stderr, - "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n", - program_name, path); -+ close(fd); - return NULL; - } else if (swap_uint16(ehdr->e_type) != ET_DYN) { - fprintf(stderr, - "%s: '%s' has invalid ELF type (expected ET_DYN)\n", - program_name, path); -+ close(fd); - return NULL; - } - - *_size = stat.st_size; -+ close(fd); - return addr; - } - -@@ -280,10 +288,12 @@ int main(int argc, char **argv) - /* Calculate and write symbol offsets to */ - if (!get_symbols(dbg_vdso_path, dbg_vdso)) { - unlink(out_path); -+ fclose(out_file); - return EXIT_FAILURE; - } - - fprintf(out_file, "};\n"); -+ fclose(out_file); - - return EXIT_SUCCESS; - } -diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile -index 36b834f1c9330..53f974817affb 100644 ---- a/arch/parisc/Makefile -+++ b/arch/parisc/Makefile -@@ -156,7 +156,7 @@ vmlinuz: bzImage - $(OBJCOPY) $(boot)/bzImage $@ - else - vmlinuz: vmlinux -- @gzip -cf -9 $< > $@ -+ @$(KGZIP) -cf -9 $< > $@ - endif - - install: -diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S -index a460298c7ddb4..f91ecb10d0ae7 100644 ---- a/arch/powerpc/kernel/cpu_setup_power.S -+++ b/arch/powerpc/kernel/cpu_setup_power.S -@@ -184,7 +184,7 @@ __init_LPCR_ISA300: - - __init_FSCR: - mfspr r3,SPRN_FSCR -- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB -+ ori r3,r3,FSCR_TAR|FSCR_EBB - mtspr SPRN_FSCR,r3 - blr - -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index ca92e01d0bd1b..f582aa2d98078 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -1522,9 +1522,16 @@ nocheck: - ret = 0; - out: - if (has_branch_stack(event)) { -- power_pmu_bhrb_enable(event); -- cpuhw->bhrb_filter = ppmu->bhrb_filter_map( -- event->attr.branch_sample_type); -+ u64 bhrb_filter = -1; -+ -+ if (ppmu->bhrb_filter_map) -+ bhrb_filter = ppmu->bhrb_filter_map( -+ event->attr.branch_sample_type); -+ -+ if (bhrb_filter != -1) { -+ cpuhw->bhrb_filter = bhrb_filter; -+ power_pmu_bhrb_enable(event); -+ } - } - - perf_pmu_enable(event->pmu); -@@ -1846,7 +1853,6 @@ static int power_pmu_event_init(struct perf_event *event) - int n; - int err; - struct cpu_hw_events *cpuhw; -- u64 bhrb_filter; - - if (!ppmu) - return -ENOENT; -@@ -1952,7 +1958,10 @@ static int power_pmu_event_init(struct perf_event *event) - err = power_check_constraints(cpuhw, events, cflags, n + 1); - - if (has_branch_stack(event)) { -- bhrb_filter = ppmu->bhrb_filter_map( -+ u64 bhrb_filter = -1; -+ -+ if (ppmu->bhrb_filter_map) -+ bhrb_filter = ppmu->bhrb_filter_map( - event->attr.branch_sample_type); - - if (bhrb_filter == -1) { -@@ -2106,6 +2115,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, - - if (perf_event_overflow(event, &data, regs)) - power_pmu_stop(event, 0); -+ } else if (period) { -+ /* Account for interrupt in case of invalid SIAR */ -+ if (perf_event_account_interrupt(event)) -+ power_pmu_stop(event, 0); - } - } - -diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig -index 0f7c8241912b9..f2ff359041eec 100644 ---- a/arch/powerpc/platforms/cell/Kconfig -+++ b/arch/powerpc/platforms/cell/Kconfig -@@ -44,6 +44,7 @@ config SPU_FS - tristate "SPU file system" - default m - depends on PPC_CELL -+ depends on COREDUMP - select SPU_BASE - help - The SPU file system is used to access Synergistic Processing -diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c -index 50e1a8e02497d..3fd086533dcfc 100644 ---- a/arch/powerpc/sysdev/xive/native.c -+++ b/arch/powerpc/sysdev/xive/native.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -646,6 +647,7 @@ static bool xive_native_provision_pages(void) - pr_err("Failed to allocate provisioning page\n"); - return false; - } -+ kmemleak_ignore(p); - opal_xive_donate_page(chip, __pa(p)); - } - return true; -diff --git a/arch/s390/include/asm/numa.h b/arch/s390/include/asm/numa.h -index 35f8cbe7e5bb0..c759dcffa9eaf 100644 ---- a/arch/s390/include/asm/numa.h -+++ b/arch/s390/include/asm/numa.h -@@ -17,7 +17,6 @@ - - void numa_setup(void); - int numa_pfn_to_nid(unsigned long pfn); --int __node_distance(int a, int b); - void numa_update_cpu_topology(void); - - extern cpumask_t node_to_cpumask_map[MAX_NUMNODES]; -diff --git a/arch/s390/include/asm/topology.h b/arch/s390/include/asm/topology.h -index cca406fdbe51f..ef9dd253dfad0 100644 ---- a/arch/s390/include/asm/topology.h -+++ b/arch/s390/include/asm/topology.h -@@ -83,8 +83,6 @@ static inline const struct cpumask *cpumask_of_node(int node) - - #define pcibus_to_node(bus) __pcibus_to_node(bus) - --#define node_distance(a, b) __node_distance(a, b) -- - #else /* !CONFIG_NUMA */ - - #define numa_node_id numa_node_id -diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c -index d2910fa834c8a..8386c58fdb3a0 100644 ---- a/arch/s390/numa/numa.c -+++ b/arch/s390/numa/numa.c -@@ -49,12 +49,6 @@ void numa_update_cpu_topology(void) - mode->update_cpu_topology(); - } - --int __node_distance(int a, int b) --{ -- return mode->distance ? mode->distance(a, b) : 0; --} --EXPORT_SYMBOL(__node_distance); -- - int numa_debug_enabled; - - /* -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index 9674321ce3a3b..8367bd7a9a810 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -1599,14 +1599,28 @@ int native_cpu_disable(void) - if (ret) - return ret; - -- /* -- * Disable the local APIC. Otherwise IPI broadcasts will reach -- * it. It still responds normally to INIT, NMI, SMI, and SIPI -- * messages. -- */ -- apic_soft_disable(); - cpu_disable_common(); - -+ /* -+ * Disable the local APIC. Otherwise IPI broadcasts will reach -+ * it. It still responds normally to INIT, NMI, SMI, and SIPI -+ * messages. -+ * -+ * Disabling the APIC must happen after cpu_disable_common() -+ * which invokes fixup_irqs(). -+ * -+ * Disabling the APIC preserves already set bits in IRR, but -+ * an interrupt arriving after disabling the local APIC does not -+ * set the corresponding IRR bit. -+ * -+ * fixup_irqs() scans IRR for set bits so it can raise a not -+ * yet handled interrupt on the new destination CPU via an IPI -+ * but obviously it can't do so for IRR bits which are not set. -+ * IOW, interrupts arriving after disabling the local APIC will -+ * be lost. -+ */ -+ apic_soft_disable(); -+ - return 0; - } - -diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c -index 12b707a4e52fd..342a1cfa48c57 100644 ---- a/block/bfq-cgroup.c -+++ b/block/bfq-cgroup.c -@@ -332,7 +332,7 @@ static void bfqg_put(struct bfq_group *bfqg) - kfree(bfqg); - } - --void bfqg_and_blkg_get(struct bfq_group *bfqg) -+static void bfqg_and_blkg_get(struct bfq_group *bfqg) - { - /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */ - bfqg_get(bfqg); -diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h -index c0232975075d0..de98fdfe9ea17 100644 ---- a/block/bfq-iosched.h -+++ b/block/bfq-iosched.h -@@ -980,7 +980,6 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, - struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg); - struct bfq_group *bfqq_group(struct bfq_queue *bfqq); - struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node); --void bfqg_and_blkg_get(struct bfq_group *bfqg); - void bfqg_and_blkg_put(struct bfq_group *bfqg); - - #ifdef CONFIG_BFQ_GROUP_IOSCHED -diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c -index 44079147e396e..05f0bf4a1144d 100644 ---- a/block/bfq-wf2q.c -+++ b/block/bfq-wf2q.c -@@ -536,9 +536,7 @@ static void bfq_get_entity(struct bfq_entity *entity) - bfqq->ref++; - bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d", - bfqq, bfqq->ref); -- } else -- bfqg_and_blkg_get(container_of(entity, struct bfq_group, -- entity)); -+ } - } - - /** -@@ -652,14 +650,8 @@ static void bfq_forget_entity(struct bfq_service_tree *st, - - entity->on_st = false; - st->wsum -= entity->weight; -- if (is_in_service) -- return; -- -- if (bfqq) -+ if (bfqq && !is_in_service) - bfq_put_queue(bfqq); -- else -- bfqg_and_blkg_put(container_of(entity, struct bfq_group, -- entity)); - } - - /** -diff --git a/block/bio.c b/block/bio.c -index 94d697217887a..87505a93bcff6 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -683,8 +683,8 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, - struct page *page, unsigned int len, unsigned int off, - bool *same_page) - { -- phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + -- bv->bv_offset + bv->bv_len - 1; -+ size_t bv_end = bv->bv_offset + bv->bv_len; -+ phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + bv_end - 1; - phys_addr_t page_addr = page_to_phys(page); - - if (vec_end_addr + 1 != page_addr + off) -@@ -693,9 +693,9 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, - return false; - - *same_page = ((vec_end_addr & PAGE_MASK) == page_addr); -- if (!*same_page && pfn_to_page(PFN_DOWN(vec_end_addr)) + 1 != page) -- return false; -- return true; -+ if (*same_page) -+ return true; -+ return (bv->bv_page + bv_end / PAGE_SIZE) == (page + off / PAGE_SIZE); - } - - static bool bio_try_merge_pc_page(struct request_queue *q, struct bio *bio, -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 1eb8895be4c6b..0c7addcd19859 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -1219,13 +1219,15 @@ int blkcg_init_queue(struct request_queue *q) - if (preloaded) - radix_tree_preload_end(); - -- ret = blk_iolatency_init(q); -+ ret = blk_throtl_init(q); - if (ret) - goto err_destroy_all; - -- ret = blk_throtl_init(q); -- if (ret) -+ ret = blk_iolatency_init(q); -+ if (ret) { -+ blk_throtl_exit(q); - goto err_destroy_all; -+ } - return 0; - - err_destroy_all: -diff --git a/block/blk-merge.c b/block/blk-merge.c -index 93cff719b0661..86c4c1ef87429 100644 ---- a/block/blk-merge.c -+++ b/block/blk-merge.c -@@ -154,7 +154,7 @@ static inline unsigned get_max_io_size(struct request_queue *q, - if (max_sectors > start_offset) - return max_sectors - start_offset; - -- return sectors & (lbs - 1); -+ return sectors & ~(lbs - 1); - } - - static inline unsigned get_max_segment_size(const struct request_queue *q, -@@ -553,10 +553,17 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq, - } - EXPORT_SYMBOL(blk_rq_map_sg); - -+static inline unsigned int blk_rq_get_max_segments(struct request *rq) -+{ -+ if (req_op(rq) == REQ_OP_DISCARD) -+ return queue_max_discard_segments(rq->q); -+ return queue_max_segments(rq->q); -+} -+ - static inline int ll_new_hw_segment(struct request *req, struct bio *bio, - unsigned int nr_phys_segs) - { -- if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(req->q)) -+ if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) - goto no_merge; - - if (blk_integrity_merge_bio(req->q, req, bio) == false) -@@ -640,7 +647,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, - return 0; - - total_phys_segments = req->nr_phys_segments + next->nr_phys_segments; -- if (total_phys_segments > queue_max_segments(q)) -+ if (total_phys_segments > blk_rq_get_max_segments(req)) - return 0; - - if (blk_integrity_merge_rq(q, req, next) == false) -diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c -index 74cedea560348..7620734d55429 100644 ---- a/block/blk-mq-sched.c -+++ b/block/blk-mq-sched.c -@@ -77,6 +77,15 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx) - return; - clear_bit(BLK_MQ_S_SCHED_RESTART, &hctx->state); - -+ /* -+ * Order clearing SCHED_RESTART and list_empty_careful(&hctx->dispatch) -+ * in blk_mq_run_hw_queue(). Its pair is the barrier in -+ * blk_mq_dispatch_rq_list(). So dispatch code won't see SCHED_RESTART, -+ * meantime new request added to hctx->dispatch is missed to check in -+ * blk_mq_run_hw_queue(). -+ */ -+ smp_mb(); -+ - blk_mq_run_hw_queue(hctx, true); - } - -diff --git a/block/blk-mq.c b/block/blk-mq.c -index ae7d31cb5a4e1..b748d1e63f9c8 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -1318,6 +1318,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, - list_splice_tail_init(list, &hctx->dispatch); - spin_unlock(&hctx->lock); - -+ /* -+ * Order adding requests to hctx->dispatch and checking -+ * SCHED_RESTART flag. The pair of this smp_mb() is the one -+ * in blk_mq_sched_restart(). Avoid restart code path to -+ * miss the new added requests to hctx->dispatch, meantime -+ * SCHED_RESTART is observed here. -+ */ -+ smp_mb(); -+ - /* - * If SCHED_RESTART was set by the caller of this function and - * it is no longer set that means that it was cleared by another -@@ -1869,7 +1878,8 @@ insert: - if (bypass_insert) - return BLK_STS_RESOURCE; - -- blk_mq_request_bypass_insert(rq, false, run_queue); -+ blk_mq_sched_insert_request(rq, false, run_queue, false); -+ - return BLK_STS_OK; - } - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 35e026ba2c7ed..1d4b0157ee5dc 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -847,9 +848,15 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, - } - - lock_sock(sk); -- if (ctx->init && (init || !ctx->more)) { -- err = -EINVAL; -- goto unlock; -+ if (ctx->init && !ctx->more) { -+ if (ctx->used) { -+ err = -EINVAL; -+ goto unlock; -+ } -+ -+ pr_info_once( -+ "%s sent an empty control message without MSG_MORE.\n", -+ current->comm); - } - ctx->init = true; - -diff --git a/drivers/base/core.c b/drivers/base/core.c -index 7bd9cd366d411..94df2ba1bbed7 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -3400,9 +3400,9 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) - */ - void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) - { -- if (fwnode) { -- struct fwnode_handle *fn = dev->fwnode; -+ struct fwnode_handle *fn = dev->fwnode; - -+ if (fwnode) { - if (fwnode_is_primary(fn)) - fn = fn->secondary; - -@@ -3412,8 +3412,12 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) - } - dev->fwnode = fwnode; - } else { -- dev->fwnode = fwnode_is_primary(dev->fwnode) ? -- dev->fwnode->secondary : NULL; -+ if (fwnode_is_primary(fn)) { -+ dev->fwnode = fn->secondary; -+ fn->secondary = NULL; -+ } else { -+ dev->fwnode = NULL; -+ } - } - } - EXPORT_SYMBOL_GPL(set_primary_fwnode); -diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c -index 8646147dc1946..23af545120534 100644 ---- a/drivers/base/power/main.c -+++ b/drivers/base/power/main.c -@@ -1728,13 +1728,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) - } - - /* -- * If a device configured to wake up the system from sleep states -- * has been suspended at run time and there's a resume request pending -- * for it, this is equivalent to the device signaling wakeup, so the -- * system suspend operation should be aborted. -+ * Wait for possible runtime PM transitions of the device in progress -+ * to complete and if there's a runtime resume request pending for it, -+ * resume it before proceeding with invoking the system-wide suspend -+ * callbacks for it. -+ * -+ * If the system-wide suspend callbacks below change the configuration -+ * of the device, they must disable runtime PM for it or otherwise -+ * ensure that its runtime-resume callbacks will not be confused by that -+ * change in case they are invoked going forward. - */ -- if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) -- pm_wakeup_event(dev, 0); -+ pm_runtime_barrier(dev); - - if (pm_wakeup_pending()) { - dev->power.direct_complete = false; -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index bddbbf5b3dda2..ffbe792410d1c 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -863,6 +863,7 @@ static void loop_config_discard(struct loop_device *lo) - struct file *file = lo->lo_backing_file; - struct inode *inode = file->f_mapping->host; - struct request_queue *q = lo->lo_queue; -+ u32 granularity, max_discard_sectors; - - /* - * If the backing device is a block device, mirror its zeroing -@@ -875,11 +876,10 @@ static void loop_config_discard(struct loop_device *lo) - struct request_queue *backingq; - - backingq = bdev_get_queue(inode->i_bdev); -- blk_queue_max_discard_sectors(q, -- backingq->limits.max_write_zeroes_sectors); - -- blk_queue_max_write_zeroes_sectors(q, -- backingq->limits.max_write_zeroes_sectors); -+ max_discard_sectors = backingq->limits.max_write_zeroes_sectors; -+ granularity = backingq->limits.discard_granularity ?: -+ queue_physical_block_size(backingq); - - /* - * We use punch hole to reclaim the free space used by the -@@ -888,23 +888,26 @@ static void loop_config_discard(struct loop_device *lo) - * useful information. - */ - } else if (!file->f_op->fallocate || lo->lo_encrypt_key_size) { -- q->limits.discard_granularity = 0; -- q->limits.discard_alignment = 0; -- blk_queue_max_discard_sectors(q, 0); -- blk_queue_max_write_zeroes_sectors(q, 0); -+ max_discard_sectors = 0; -+ granularity = 0; - - } else { -- q->limits.discard_granularity = inode->i_sb->s_blocksize; -- q->limits.discard_alignment = 0; -- -- blk_queue_max_discard_sectors(q, UINT_MAX >> 9); -- blk_queue_max_write_zeroes_sectors(q, UINT_MAX >> 9); -+ max_discard_sectors = UINT_MAX >> 9; -+ granularity = inode->i_sb->s_blocksize; - } - -- if (q->limits.max_write_zeroes_sectors) -+ if (max_discard_sectors) { -+ q->limits.discard_granularity = granularity; -+ blk_queue_max_discard_sectors(q, max_discard_sectors); -+ blk_queue_max_write_zeroes_sectors(q, max_discard_sectors); - blk_queue_flag_set(QUEUE_FLAG_DISCARD, q); -- else -+ } else { -+ q->limits.discard_granularity = 0; -+ blk_queue_max_discard_sectors(q, 0); -+ blk_queue_max_write_zeroes_sectors(q, 0); - blk_queue_flag_clear(QUEUE_FLAG_DISCARD, q); -+ } -+ q->limits.discard_alignment = 0; - } - - static void loop_unprepare_queue(struct loop_device *lo) -diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c -index c4454cfc6d530..13eae973eaea4 100644 ---- a/drivers/block/null_blk_main.c -+++ b/drivers/block/null_blk_main.c -@@ -1072,7 +1072,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) - len = bvec.bv_len; - err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset, - op_is_write(req_op(rq)), sector, -- req_op(rq) & REQ_FUA); -+ rq->cmd_flags & REQ_FUA); - if (err) { - spin_unlock_irq(&nullb->lock); - return err; -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index c1de270046bfe..2eeb2bcb488d4 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -205,16 +205,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap) - if (!range) - return -ENOMEM; - -- __rq_for_each_bio(bio, req) { -- u64 sector = bio->bi_iter.bi_sector; -- u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; -- -- range[n].flags = cpu_to_le32(flags); -- range[n].num_sectors = cpu_to_le32(num_sectors); -- range[n].sector = cpu_to_le64(sector); -- n++; -+ /* -+ * Single max discard segment means multi-range discard isn't -+ * supported, and block layer only runs contiguity merge like -+ * normal RW request. So we can't reply on bio for retrieving -+ * each range info. -+ */ -+ if (queue_max_discard_segments(req->q) == 1) { -+ range[0].flags = cpu_to_le32(flags); -+ range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req)); -+ range[0].sector = cpu_to_le64(blk_rq_pos(req)); -+ n = 1; -+ } else { -+ __rq_for_each_bio(bio, req) { -+ u64 sector = bio->bi_iter.bi_sector; -+ u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; -+ -+ range[n].flags = cpu_to_le32(flags); -+ range[n].num_sectors = cpu_to_le32(num_sectors); -+ range[n].sector = cpu_to_le64(sector); -+ n++; -+ } - } - -+ WARN_ON_ONCE(n != segments); -+ - req->special_vec.bv_page = virt_to_page(range); - req->special_vec.bv_offset = offset_in_page(range); - req->special_vec.bv_len = sizeof(*range) * segments; -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index 53dc0fd6f6d3c..927eb3fd23660 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -649,11 +649,12 @@ static int intel_pstate_set_energy_pref_index(struct cpudata *cpu_data, - mutex_lock(&intel_pstate_limits_lock); - - if (boot_cpu_has(X86_FEATURE_HWP_EPP)) { -- u64 value; -- -- ret = rdmsrl_on_cpu(cpu_data->cpu, MSR_HWP_REQUEST, &value); -- if (ret) -- goto return_pref; -+ /* -+ * Use the cached HWP Request MSR value, because the register -+ * itself may be updated by intel_pstate_hwp_boost_up() or -+ * intel_pstate_hwp_boost_down() at any time. -+ */ -+ u64 value = READ_ONCE(cpu_data->hwp_req_cached); - - value &= ~GENMASK_ULL(31, 24); - -@@ -661,13 +662,18 @@ static int intel_pstate_set_energy_pref_index(struct cpudata *cpu_data, - epp = epp_values[pref_index - 1]; - - value |= (u64)epp << 24; -+ /* -+ * The only other updater of hwp_req_cached in the active mode, -+ * intel_pstate_hwp_set(), is called under the same lock as this -+ * function, so it cannot run in parallel with the update below. -+ */ -+ WRITE_ONCE(cpu_data->hwp_req_cached, value); - ret = wrmsrl_on_cpu(cpu_data->cpu, MSR_HWP_REQUEST, value); - } else { - if (epp == -EINVAL) - epp = (pref_index - 1) << 2; - ret = intel_pstate_set_epb(cpu_data->cpu, epp); - } --return_pref: - mutex_unlock(&intel_pstate_limits_lock); - - return ret; -diff --git a/drivers/devfreq/rk3399_dmc.c b/drivers/devfreq/rk3399_dmc.c -index 2e65d7279d79e..027769e39f9b8 100644 ---- a/drivers/devfreq/rk3399_dmc.c -+++ b/drivers/devfreq/rk3399_dmc.c -@@ -95,18 +95,20 @@ static int rk3399_dmcfreq_target(struct device *dev, unsigned long *freq, - - mutex_lock(&dmcfreq->lock); - -- if (target_rate >= dmcfreq->odt_dis_freq) -- odt_enable = true; -- -- /* -- * This makes a SMC call to the TF-A to set the DDR PD (power-down) -- * timings and to enable or disable the ODT (on-die termination) -- * resistors. -- */ -- arm_smccc_smc(ROCKCHIP_SIP_DRAM_FREQ, dmcfreq->odt_pd_arg0, -- dmcfreq->odt_pd_arg1, -- ROCKCHIP_SIP_CONFIG_DRAM_SET_ODT_PD, -- odt_enable, 0, 0, 0, &res); -+ if (dmcfreq->regmap_pmu) { -+ if (target_rate >= dmcfreq->odt_dis_freq) -+ odt_enable = true; -+ -+ /* -+ * This makes a SMC call to the TF-A to set the DDR PD -+ * (power-down) timings and to enable or disable the -+ * ODT (on-die termination) resistors. -+ */ -+ arm_smccc_smc(ROCKCHIP_SIP_DRAM_FREQ, dmcfreq->odt_pd_arg0, -+ dmcfreq->odt_pd_arg1, -+ ROCKCHIP_SIP_CONFIG_DRAM_SET_ODT_PD, -+ odt_enable, 0, 0, 0, &res); -+ } - - /* - * If frequency scaling from low to high, adjust voltage first. -@@ -364,16 +366,21 @@ static int rk3399_dmcfreq_probe(struct platform_device *pdev) - if (res.a0) { - dev_err(dev, "Failed to set dram param: %ld\n", - res.a0); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_edev; - } - } - } - - node = of_parse_phandle(np, "rockchip,pmu", 0); -- if (node) { -- data->regmap_pmu = syscon_node_to_regmap(node); -- if (IS_ERR(data->regmap_pmu)) -- return PTR_ERR(data->regmap_pmu); -+ if (!node) -+ goto no_pmu; -+ -+ data->regmap_pmu = syscon_node_to_regmap(node); -+ of_node_put(node); -+ if (IS_ERR(data->regmap_pmu)) { -+ ret = PTR_ERR(data->regmap_pmu); -+ goto err_edev; - } - - regmap_read(data->regmap_pmu, RK3399_PMUGRF_OS_REG2, &val); -@@ -391,9 +398,11 @@ static int rk3399_dmcfreq_probe(struct platform_device *pdev) - data->odt_dis_freq = data->timing.lpddr4_odt_dis_freq; - break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_edev; - }; - -+no_pmu: - arm_smccc_smc(ROCKCHIP_SIP_DRAM_FREQ, 0, 0, - ROCKCHIP_SIP_CONFIG_DRAM_INIT, - 0, 0, 0, 0, &res); -@@ -425,7 +434,8 @@ static int rk3399_dmcfreq_probe(struct platform_device *pdev) - */ - if (dev_pm_opp_of_add_table(dev)) { - dev_err(dev, "Invalid operating-points in device tree.\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_edev; - } - - of_property_read_u32(np, "upthreshold", -@@ -465,6 +475,9 @@ static int rk3399_dmcfreq_probe(struct platform_device *pdev) - - err_free_opp: - dev_pm_opp_of_remove_table(&pdev->dev); -+err_edev: -+ devfreq_event_disable_edev(data->edev); -+ - return ret; - } - -diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c -index a71cca6eeb333..6be7e65f7389d 100644 ---- a/drivers/edac/i7core_edac.c -+++ b/drivers/edac/i7core_edac.c -@@ -1711,9 +1711,9 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci, - if (uncorrected_error) { - core_err_cnt = 1; - if (ripv) -- tp_event = HW_EVENT_ERR_FATAL; -- else - tp_event = HW_EVENT_ERR_UNCORRECTED; -+ else -+ tp_event = HW_EVENT_ERR_FATAL; - } else { - tp_event = HW_EVENT_ERR_CORRECTED; - } -diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c -index d26300f9cb07d..9be43b4f9c506 100644 ---- a/drivers/edac/ie31200_edac.c -+++ b/drivers/edac/ie31200_edac.c -@@ -170,6 +170,8 @@ - (n << (28 + (2 * skl) - PAGE_SHIFT)) - - static int nr_channels; -+static struct pci_dev *mci_pdev; -+static int ie31200_registered = 1; - - struct ie31200_priv { - void __iomem *window; -@@ -541,12 +543,16 @@ fail_free: - static int ie31200_init_one(struct pci_dev *pdev, - const struct pci_device_id *ent) - { -- edac_dbg(0, "MC:\n"); -+ int rc; - -+ edac_dbg(0, "MC:\n"); - if (pci_enable_device(pdev) < 0) - return -EIO; -+ rc = ie31200_probe1(pdev, ent->driver_data); -+ if (rc == 0 && !mci_pdev) -+ mci_pdev = pci_dev_get(pdev); - -- return ie31200_probe1(pdev, ent->driver_data); -+ return rc; - } - - static void ie31200_remove_one(struct pci_dev *pdev) -@@ -555,6 +561,8 @@ static void ie31200_remove_one(struct pci_dev *pdev) - struct ie31200_priv *priv; - - edac_dbg(0, "\n"); -+ pci_dev_put(mci_pdev); -+ mci_pdev = NULL; - mci = edac_mc_del_mc(&pdev->dev); - if (!mci) - return; -@@ -596,17 +604,53 @@ static struct pci_driver ie31200_driver = { - - static int __init ie31200_init(void) - { -+ int pci_rc, i; -+ - edac_dbg(3, "MC:\n"); - /* Ensure that the OPSTATE is set correctly for POLL or NMI */ - opstate_init(); - -- return pci_register_driver(&ie31200_driver); -+ pci_rc = pci_register_driver(&ie31200_driver); -+ if (pci_rc < 0) -+ goto fail0; -+ -+ if (!mci_pdev) { -+ ie31200_registered = 0; -+ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) { -+ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor, -+ ie31200_pci_tbl[i].device, -+ NULL); -+ if (mci_pdev) -+ break; -+ } -+ if (!mci_pdev) { -+ edac_dbg(0, "ie31200 pci_get_device fail\n"); -+ pci_rc = -ENODEV; -+ goto fail1; -+ } -+ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]); -+ if (pci_rc < 0) { -+ edac_dbg(0, "ie31200 init fail\n"); -+ pci_rc = -ENODEV; -+ goto fail1; -+ } -+ } -+ return 0; -+ -+fail1: -+ pci_unregister_driver(&ie31200_driver); -+fail0: -+ pci_dev_put(mci_pdev); -+ -+ return pci_rc; - } - - static void __exit ie31200_exit(void) - { - edac_dbg(3, "MC:\n"); - pci_unregister_driver(&ie31200_driver); -+ if (!ie31200_registered) -+ ie31200_remove_one(mci_pdev); - } - - module_init(ie31200_init); -diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c -index b1193be1ef1d8..dac45e2071b3f 100644 ---- a/drivers/edac/pnd2_edac.c -+++ b/drivers/edac/pnd2_edac.c -@@ -1155,7 +1155,7 @@ static void pnd2_mce_output_error(struct mem_ctl_info *mci, const struct mce *m, - u32 optypenum = GET_BITFIELD(m->status, 4, 6); - int rc; - -- tp_event = uc_err ? (ripv ? HW_EVENT_ERR_FATAL : HW_EVENT_ERR_UNCORRECTED) : -+ tp_event = uc_err ? (ripv ? HW_EVENT_ERR_UNCORRECTED : HW_EVENT_ERR_FATAL) : - HW_EVENT_ERR_CORRECTED; - - /* -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index f743502ca9b72..b557a53c75c46 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -254,18 +254,20 @@ static const u32 rir_offset[MAX_RIR_RANGES][MAX_RIR_WAY] = { - * FIXME: Implement the error count reads directly - */ - --static const u32 correrrcnt[] = { -- 0x104, 0x108, 0x10c, 0x110, --}; -- - #define RANK_ODD_OV(reg) GET_BITFIELD(reg, 31, 31) - #define RANK_ODD_ERR_CNT(reg) GET_BITFIELD(reg, 16, 30) - #define RANK_EVEN_OV(reg) GET_BITFIELD(reg, 15, 15) - #define RANK_EVEN_ERR_CNT(reg) GET_BITFIELD(reg, 0, 14) - -+#if 0 /* Currently unused*/ -+static const u32 correrrcnt[] = { -+ 0x104, 0x108, 0x10c, 0x110, -+}; -+ - static const u32 correrrthrsld[] = { - 0x11c, 0x120, 0x124, 0x128, - }; -+#endif - - #define RANK_ODD_ERR_THRSLD(reg) GET_BITFIELD(reg, 16, 30) - #define RANK_EVEN_ERR_THRSLD(reg) GET_BITFIELD(reg, 0, 14) -@@ -1340,7 +1342,7 @@ static void knl_show_mc_route(u32 reg, char *s) - */ - static int knl_get_dimm_capacity(struct sbridge_pvt *pvt, u64 *mc_sizes) - { -- u64 sad_base, sad_size, sad_limit = 0; -+ u64 sad_base, sad_limit = 0; - u64 tad_base, tad_size, tad_limit, tad_deadspace, tad_livespace; - int sad_rule = 0; - int tad_rule = 0; -@@ -1427,7 +1429,6 @@ static int knl_get_dimm_capacity(struct sbridge_pvt *pvt, u64 *mc_sizes) - edram_only = KNL_EDRAM_ONLY(dram_rule); - - sad_limit = pvt->info.sad_limit(dram_rule)+1; -- sad_size = sad_limit - sad_base; - - pci_read_config_dword(pvt->pci_sad0, - pvt->info.interleave_list[sad_rule], &interleave_reg); -@@ -2952,7 +2953,7 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci, - struct mem_ctl_info *new_mci; - struct sbridge_pvt *pvt = mci->pvt_info; - enum hw_event_mc_err_type tp_event; -- char *type, *optype, msg[256]; -+ char *optype, msg[256]; - bool ripv = GET_BITFIELD(m->mcgstatus, 0, 0); - bool overflow = GET_BITFIELD(m->status, 62, 62); - bool uncorrected_error = GET_BITFIELD(m->status, 61, 61); -@@ -2981,14 +2982,11 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci, - if (uncorrected_error) { - core_err_cnt = 1; - if (ripv) { -- type = "FATAL"; -- tp_event = HW_EVENT_ERR_FATAL; -- } else { -- type = "NON_FATAL"; - tp_event = HW_EVENT_ERR_UNCORRECTED; -+ } else { -+ tp_event = HW_EVENT_ERR_FATAL; - } - } else { -- type = "CORRECTED"; - tp_event = HW_EVENT_ERR_CORRECTED; - } - -@@ -3200,7 +3198,6 @@ static struct notifier_block sbridge_mce_dec = { - static void sbridge_unregister_mci(struct sbridge_dev *sbridge_dev) - { - struct mem_ctl_info *mci = sbridge_dev->mci; -- struct sbridge_pvt *pvt; - - if (unlikely(!mci || !mci->pvt_info)) { - edac_dbg(0, "MC: dev = %p\n", &sbridge_dev->pdev[0]->dev); -@@ -3209,8 +3206,6 @@ static void sbridge_unregister_mci(struct sbridge_dev *sbridge_dev) - return; - } - -- pvt = mci->pvt_info; -- - edac_dbg(0, "MC: mci = %p, dev = %p\n", - mci, &sbridge_dev->pdev[0]->dev); - -diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c -index 2177ad765bd16..99dea4f66b5e9 100644 ---- a/drivers/edac/skx_common.c -+++ b/drivers/edac/skx_common.c -@@ -475,7 +475,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, - struct decoded_addr *res) - { - enum hw_event_mc_err_type tp_event; -- char *type, *optype; -+ char *optype; - bool ripv = GET_BITFIELD(m->mcgstatus, 0, 0); - bool overflow = GET_BITFIELD(m->status, 62, 62); - bool uncorrected_error = GET_BITFIELD(m->status, 61, 61); -@@ -490,14 +490,11 @@ static void skx_mce_output_error(struct mem_ctl_info *mci, - if (uncorrected_error) { - core_err_cnt = 1; - if (ripv) { -- type = "FATAL"; -- tp_event = HW_EVENT_ERR_FATAL; -- } else { -- type = "NON_FATAL"; - tp_event = HW_EVENT_ERR_UNCORRECTED; -+ } else { -+ tp_event = HW_EVENT_ERR_FATAL; - } - } else { -- type = "CORRECTED"; - tp_event = HW_EVENT_ERR_CORRECTED; - } - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -index ece55c8fa6733..cda0a76a733d3 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c -@@ -719,8 +719,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (encoder) { -@@ -857,8 +859,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = amdgpu_connector_best_single_encoder(connector); -@@ -980,8 +984,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { -@@ -1330,8 +1336,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -index 82efc1e22e611..e0aed42d9cbda 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c -@@ -282,7 +282,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, - - ret = pm_runtime_get_sync(dev->dev); - if (ret < 0) -- return ret; -+ goto out; - - ret = drm_crtc_helper_set_config(set, ctx); - -@@ -297,7 +297,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, - take the current one */ - if (active && !adev->have_disp_power_ref) { - adev->have_disp_power_ref = true; -- return ret; -+ goto out; - } - /* if we have no active crtcs, then drop the power ref - we got before */ -@@ -306,6 +306,7 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set, - adev->have_disp_power_ref = false; - } - -+out: - /* drop the power reference we got coming in here */ - pm_runtime_put_autosuspend(dev->dev); - return ret; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -index 05d114a72ca1e..fa2c0f29ad4de 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c -@@ -1286,11 +1286,12 @@ long amdgpu_drm_ioctl(struct file *filp, - dev = file_priv->minor->dev; - ret = pm_runtime_get_sync(dev->dev); - if (ret < 0) -- return ret; -+ goto out; - - ret = drm_ioctl(filp, cmd, arg); - - pm_runtime_mark_last_busy(dev->dev); -+out: - pm_runtime_put_autosuspend(dev->dev); - return ret; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -index 2a7da26008a27..59fd9ebf3a58b 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c -@@ -638,8 +638,12 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file - * in the bitfields */ - if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) - se_num = 0xffffffff; -+ else if (se_num >= AMDGPU_GFX_MAX_SE) -+ return -EINVAL; - if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) - sh_num = 0xffffffff; -+ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) -+ return -EINVAL; - - if (info->read_mmr_reg.count > 128) - return -EINVAL; -@@ -976,7 +980,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) - - r = pm_runtime_get_sync(dev->dev); - if (r < 0) -- return r; -+ goto pm_put; - - fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); - if (unlikely(!fpriv)) { -@@ -1027,6 +1031,7 @@ error_pasid: - - out_suspend: - pm_runtime_mark_last_busy(dev->dev); -+pm_put: - pm_runtime_put_autosuspend(dev->dev); - - return r; -diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -index 64d96eb0a2337..19876c90be0e1 100644 ---- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c -@@ -4094,10 +4094,8 @@ static void gfx_v10_0_update_medium_grain_clock_gating(struct amdgpu_device *ade - def = data = RREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE); - data &= ~(RLC_CGTT_MGCG_OVERRIDE__GRBM_CGTT_SCLK_OVERRIDE_MASK | - RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGCG_OVERRIDE_MASK | -- RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGLS_OVERRIDE_MASK); -- -- /* only for Vega10 & Raven1 */ -- data |= RLC_CGTT_MGCG_OVERRIDE__RLC_CGTT_SCLK_OVERRIDE_MASK; -+ RLC_CGTT_MGCG_OVERRIDE__GFXIP_MGLS_OVERRIDE_MASK | -+ RLC_CGTT_MGCG_OVERRIDE__ENABLE_CGTS_LEGACY_MASK); - - if (def != data) - WREG32_SOC15(GC, 0, mmRLC_CGTT_MGCG_OVERRIDE, data); -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -index 7551761f2aa97..a49e2ab071d68 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c -@@ -612,8 +612,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - - ret = kobject_init_and_add(dev->kobj_node, &node_type, - sys_props.kobj_nodes, "%d", id); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(dev->kobj_node); - return ret; -+ } - - dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node); - if (!dev->kobj_mem) -@@ -660,8 +662,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(mem->kobj, &mem_type, - dev->kobj_mem, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(mem->kobj); - return ret; -+ } - - mem->attr.name = "properties"; - mem->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -679,8 +683,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(cache->kobj, &cache_type, - dev->kobj_cache, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(cache->kobj); - return ret; -+ } - - cache->attr.name = "properties"; - cache->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -698,8 +704,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, - return -ENOMEM; - ret = kobject_init_and_add(iolink->kobj, &iolink_type, - dev->kobj_iolink, "%d", i); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(iolink->kobj); - return ret; -+ } - - iolink->attr.name = "properties"; - iolink->attr.mode = KFD_SYSFS_FILE_MODE; -@@ -779,8 +787,10 @@ static int kfd_topology_update_sysfs(void) - ret = kobject_init_and_add(sys_props.kobj_topology, - &sysprops_type, &kfd_device->kobj, - "topology"); -- if (ret < 0) -+ if (ret < 0) { -+ kobject_put(sys_props.kobj_topology); - return ret; -+ } - - sys_props.kobj_nodes = kobject_create_and_add("nodes", - sys_props.kobj_topology); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 2c0eb7140ca0e..247f53d41993d 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -7229,6 +7229,30 @@ cleanup: - *out_type = update_type; - return ret; - } -+#if defined(CONFIG_DRM_AMD_DC_DCN) -+static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc) -+{ -+ struct drm_connector *connector; -+ struct drm_connector_state *conn_state; -+ struct amdgpu_dm_connector *aconnector = NULL; -+ int i; -+ for_each_new_connector_in_state(state, connector, conn_state, i) { -+ if (conn_state->crtc != crtc) -+ continue; -+ -+ aconnector = to_amdgpu_dm_connector(connector); -+ if (!aconnector->port || !aconnector->mst_port) -+ aconnector = NULL; -+ else -+ break; -+ } -+ -+ if (!aconnector) -+ return 0; -+ -+ return drm_dp_mst_add_affected_dsc_crtcs(state, &aconnector->mst_port->mst_mgr); -+} -+#endif - - /** - * amdgpu_dm_atomic_check() - Atomic check implementation for AMDgpu DM. -@@ -7282,6 +7306,40 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - if (ret) - goto fail; - -+ /* Check connector changes */ -+ for_each_oldnew_connector_in_state(state, connector, old_con_state, new_con_state, i) { -+ struct dm_connector_state *dm_old_con_state = to_dm_connector_state(old_con_state); -+ struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state); -+ -+ /* Skip connectors that are disabled or part of modeset already. */ -+ if (!old_con_state->crtc && !new_con_state->crtc) -+ continue; -+ -+ if (!new_con_state->crtc) -+ continue; -+ -+ new_crtc_state = drm_atomic_get_crtc_state(state, new_con_state->crtc); -+ if (IS_ERR(new_crtc_state)) { -+ ret = PTR_ERR(new_crtc_state); -+ goto fail; -+ } -+ -+ if (dm_old_con_state->abm_level != -+ dm_new_con_state->abm_level) -+ new_crtc_state->connectors_changed = true; -+ } -+ -+#if defined(CONFIG_DRM_AMD_DC_DCN) -+ if (adev->asic_type >= CHIP_NAVI10) { -+ for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { -+ if (drm_atomic_crtc_needs_modeset(new_crtc_state)) { -+ ret = add_affected_mst_dsc_crtcs(state, crtc); -+ if (ret) -+ goto fail; -+ } -+ } -+ } -+#endif - for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { - if (!drm_atomic_crtc_needs_modeset(new_crtc_state) && - !new_crtc_state->color_mgmt_changed && -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c -index 9aa258f3550b6..ddf66046616d6 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c -@@ -121,35 +121,35 @@ void enc1_update_generic_info_packet( - switch (packet_index) { - case 0: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC0_FRAME_UPDATE, 1); -+ AFMT_GENERIC0_IMMEDIATE_UPDATE, 1); - break; - case 1: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC1_FRAME_UPDATE, 1); -+ AFMT_GENERIC1_IMMEDIATE_UPDATE, 1); - break; - case 2: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC2_FRAME_UPDATE, 1); -+ AFMT_GENERIC2_IMMEDIATE_UPDATE, 1); - break; - case 3: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC3_FRAME_UPDATE, 1); -+ AFMT_GENERIC3_IMMEDIATE_UPDATE, 1); - break; - case 4: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC4_FRAME_UPDATE, 1); -+ AFMT_GENERIC4_IMMEDIATE_UPDATE, 1); - break; - case 5: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC5_FRAME_UPDATE, 1); -+ AFMT_GENERIC5_IMMEDIATE_UPDATE, 1); - break; - case 6: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC6_FRAME_UPDATE, 1); -+ AFMT_GENERIC6_IMMEDIATE_UPDATE, 1); - break; - case 7: - REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, -- AFMT_GENERIC7_FRAME_UPDATE, 1); -+ AFMT_GENERIC7_IMMEDIATE_UPDATE, 1); - break; - default: - break; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h -index a512cbea00d17..b9656614950e3 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h -@@ -275,7 +275,14 @@ struct dcn10_stream_enc_registers { - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_FRAME_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_FRAME_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_FRAME_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC0_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC1_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_IMMEDIATE_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_IMMEDIATE_UPDATE, mask_sh),\ -+ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_IMMEDIATE_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_FRAME_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_FRAME_UPDATE, mask_sh),\ - SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_FRAME_UPDATE, mask_sh),\ -@@ -339,7 +346,14 @@ struct dcn10_stream_enc_registers { - type AFMT_GENERIC2_FRAME_UPDATE;\ - type AFMT_GENERIC3_FRAME_UPDATE;\ - type AFMT_GENERIC4_FRAME_UPDATE;\ -+ type AFMT_GENERIC0_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC1_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC2_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC3_IMMEDIATE_UPDATE;\ - type AFMT_GENERIC4_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC5_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC6_IMMEDIATE_UPDATE;\ -+ type AFMT_GENERIC7_IMMEDIATE_UPDATE;\ - type AFMT_GENERIC5_FRAME_UPDATE;\ - type AFMT_GENERIC6_FRAME_UPDATE;\ - type AFMT_GENERIC7_FRAME_UPDATE;\ -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c -index fed3fc4bb57a9..6322e57893db2 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c -@@ -209,8 +209,7 @@ static int smu10_set_min_deep_sleep_dcefclk(struct pp_hwmgr *hwmgr, uint32_t clo - { - struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); - -- if (smu10_data->need_min_deep_sleep_dcefclk && -- smu10_data->deep_sleep_dcefclk != clock) { -+ if (clock && smu10_data->deep_sleep_dcefclk != clock) { - smu10_data->deep_sleep_dcefclk = clock; - smum_send_msg_to_smc_with_parameter(hwmgr, - PPSMC_MSG_SetMinDeepSleepDcefclk, -@@ -223,8 +222,7 @@ static int smu10_set_hard_min_dcefclk_by_freq(struct pp_hwmgr *hwmgr, uint32_t c - { - struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); - -- if (smu10_data->dcf_actual_hard_min_freq && -- smu10_data->dcf_actual_hard_min_freq != clock) { -+ if (clock && smu10_data->dcf_actual_hard_min_freq != clock) { - smu10_data->dcf_actual_hard_min_freq = clock; - smum_send_msg_to_smc_with_parameter(hwmgr, - PPSMC_MSG_SetHardMinDcefclkByFreq, -@@ -237,8 +235,7 @@ static int smu10_set_hard_min_fclk_by_freq(struct pp_hwmgr *hwmgr, uint32_t cloc - { - struct smu10_hwmgr *smu10_data = (struct smu10_hwmgr *)(hwmgr->backend); - -- if (smu10_data->f_actual_hard_min_freq && -- smu10_data->f_actual_hard_min_freq != clock) { -+ if (clock && smu10_data->f_actual_hard_min_freq != clock) { - smu10_data->f_actual_hard_min_freq = clock; - smum_send_msg_to_smc_with_parameter(hwmgr, - PPSMC_MSG_SetHardMinFclkByFreq, -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -index ba8763daa3808..36a17caa3761d 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -@@ -364,17 +364,19 @@ int vega10_thermal_get_temperature(struct pp_hwmgr *hwmgr) - static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - struct PP_TemperatureRange *range) - { -+ struct phm_ppt_v2_information *pp_table_info = -+ (struct phm_ppt_v2_information *)(hwmgr->pptable); -+ struct phm_tdp_table *tdp_table = pp_table_info->tdp_table; - struct amdgpu_device *adev = hwmgr->adev; -- int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -- int high = VEGA10_THERMAL_MAXIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ int low = VEGA10_THERMAL_MINIMUM_ALERT_TEMP; -+ int high = VEGA10_THERMAL_MAXIMUM_ALERT_TEMP; - uint32_t val; - -- if (low < range->min) -- low = range->min; -- if (high > range->max) -- high = range->max; -+ /* compare them in unit celsius degree */ -+ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) -+ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ if (high > tdp_table->usSoftwareShutdownTemp) -+ high = tdp_table->usSoftwareShutdownTemp; - - if (low > high) - return -EINVAL; -@@ -383,8 +385,8 @@ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - - val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); - val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); -- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -+ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); -+ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); - val &= (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK) & - (~THM_THERMAL_INT_CTRL__THERM_INTH_MASK_MASK) & - (~THM_THERMAL_INT_CTRL__THERM_INTL_MASK_MASK); -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c -index 904eb2c9155b4..40e7c72eeae00 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega12_thermal.c -@@ -170,17 +170,18 @@ int vega12_thermal_get_temperature(struct pp_hwmgr *hwmgr) - static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - struct PP_TemperatureRange *range) - { -+ struct phm_ppt_v3_information *pptable_information = -+ (struct phm_ppt_v3_information *)hwmgr->pptable; - struct amdgpu_device *adev = hwmgr->adev; -- int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -- int high = VEGA12_THERMAL_MAXIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ int low = VEGA12_THERMAL_MINIMUM_ALERT_TEMP; -+ int high = VEGA12_THERMAL_MAXIMUM_ALERT_TEMP; - uint32_t val; - -- if (low < range->min) -- low = range->min; -- if (high > range->max) -- high = range->max; -+ /* compare them in unit celsius degree */ -+ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) -+ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ if (high > pptable_information->us_software_shutdown_temp) -+ high = pptable_information->us_software_shutdown_temp; - - if (low > high) - return -EINVAL; -@@ -189,8 +190,8 @@ static int vega12_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - - val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); - val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); -- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -- val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -+ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); -+ val = REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); - val = val & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK); - - WREG32_SOC15(THM, 0, mmTHM_THERMAL_INT_CTRL, val); -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c -index f5915308e643a..947e4fa3c5e68 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c -@@ -981,27 +981,15 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr) - { - struct vega20_hwmgr *data = - (struct vega20_hwmgr *)(hwmgr->backend); -- uint64_t features_enabled; -- int i; -- bool enabled; -- int ret = 0; -+ int i, ret = 0; - - PP_ASSERT_WITH_CODE((ret = smum_send_msg_to_smc(hwmgr, - PPSMC_MSG_DisableAllSmuFeatures)) == 0, - "[DisableAllSMUFeatures] Failed to disable all smu features!", - return ret); - -- ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); -- PP_ASSERT_WITH_CODE(!ret, -- "[DisableAllSMUFeatures] Failed to get enabled smc features!", -- return ret); -- -- for (i = 0; i < GNLD_FEATURES_MAX; i++) { -- enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? -- true : false; -- data->smu_features[i].enabled = enabled; -- data->smu_features[i].supported = enabled; -- } -+ for (i = 0; i < GNLD_FEATURES_MAX; i++) -+ data->smu_features[i].enabled = 0; - - return 0; - } -@@ -1652,12 +1640,6 @@ static void vega20_init_powergate_state(struct pp_hwmgr *hwmgr) - - data->uvd_power_gated = true; - data->vce_power_gated = true; -- -- if (data->smu_features[GNLD_DPM_UVD].enabled) -- data->uvd_power_gated = false; -- -- if (data->smu_features[GNLD_DPM_VCE].enabled) -- data->vce_power_gated = false; - } - - static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr) -@@ -3211,10 +3193,11 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf) - - static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfeature_masks) - { -- uint64_t features_enabled; -- uint64_t features_to_enable; -- uint64_t features_to_disable; -- int ret = 0; -+ struct vega20_hwmgr *data = -+ (struct vega20_hwmgr *)(hwmgr->backend); -+ uint64_t features_enabled, features_to_enable, features_to_disable; -+ int i, ret = 0; -+ bool enabled; - - if (new_ppfeature_masks >= (1ULL << GNLD_FEATURES_MAX)) - return -EINVAL; -@@ -3243,6 +3226,17 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe - return ret; - } - -+ /* Update the cached feature enablement state */ -+ ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); -+ if (ret) -+ return ret; -+ -+ for (i = 0; i < GNLD_FEATURES_MAX; i++) { -+ enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? -+ true : false; -+ data->smu_features[i].enabled = enabled; -+ } -+ - return 0; - } - -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c -index ede54e87e287b..ce56b93871e8f 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c -@@ -240,17 +240,18 @@ int vega20_thermal_get_temperature(struct pp_hwmgr *hwmgr) - static int vega20_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - struct PP_TemperatureRange *range) - { -+ struct phm_ppt_v3_information *pptable_information = -+ (struct phm_ppt_v3_information *)hwmgr->pptable; - struct amdgpu_device *adev = hwmgr->adev; -- int low = VEGA20_THERMAL_MINIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -- int high = VEGA20_THERMAL_MAXIMUM_ALERT_TEMP * -- PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ int low = VEGA20_THERMAL_MINIMUM_ALERT_TEMP; -+ int high = VEGA20_THERMAL_MAXIMUM_ALERT_TEMP; - uint32_t val; - -- if (low < range->min) -- low = range->min; -- if (high > range->max) -- high = range->max; -+ /* compare them in unit celsius degree */ -+ if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) -+ low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -+ if (high > pptable_information->us_software_shutdown_temp) -+ high = pptable_information->us_software_shutdown_temp; - - if (low > high) - return -EINVAL; -@@ -259,8 +260,8 @@ static int vega20_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - - val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, MAX_IH_CREDIT, 5); - val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, THERM_IH_HW_ENA, 1); -- val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, (high / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -- val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, (low / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)); -+ val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTH, high); -+ val = CGS_REG_SET_FIELD(val, THM_THERMAL_INT_CTRL, DIG_THERM_INTL, low); - val = val & (~THM_THERMAL_INT_CTRL__THERM_TRIGGER_MASK_MASK); - - WREG32_SOC15(THM, 0, mmTHM_THERMAL_INT_CTRL, val); -diff --git a/drivers/gpu/drm/i915/i915_cmd_parser.c b/drivers/gpu/drm/i915/i915_cmd_parser.c -index 21417ac8e878e..a9a69760c18d0 100644 ---- a/drivers/gpu/drm/i915/i915_cmd_parser.c -+++ b/drivers/gpu/drm/i915/i915_cmd_parser.c -@@ -1207,6 +1207,12 @@ static u32 *copy_batch(struct drm_i915_gem_object *dst_obj, - return dst; - } - -+static inline bool cmd_desc_is(const struct drm_i915_cmd_descriptor * const desc, -+ const u32 cmd) -+{ -+ return desc->cmd.value == (cmd & desc->cmd.mask); -+} -+ - static bool check_cmd(const struct intel_engine_cs *engine, - const struct drm_i915_cmd_descriptor *desc, - const u32 *cmd, u32 length) -@@ -1245,19 +1251,19 @@ static bool check_cmd(const struct intel_engine_cs *engine, - * allowed mask/value pair given in the whitelist entry. - */ - if (reg->mask) { -- if (desc->cmd.value == MI_LOAD_REGISTER_MEM) { -+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_MEM)) { - DRM_DEBUG_DRIVER("CMD: Rejected LRM to masked register 0x%08X\n", - reg_addr); - return false; - } - -- if (desc->cmd.value == MI_LOAD_REGISTER_REG) { -+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_REG)) { - DRM_DEBUG_DRIVER("CMD: Rejected LRR to masked register 0x%08X\n", - reg_addr); - return false; - } - -- if (desc->cmd.value == MI_LOAD_REGISTER_IMM(1) && -+ if (cmd_desc_is(desc, MI_LOAD_REGISTER_IMM(1)) && - (offset + 2 > length || - (cmd[offset + 1] & reg->mask) != reg->value)) { - DRM_DEBUG_DRIVER("CMD: Rejected LRI to masked register 0x%08X\n", -@@ -1488,7 +1494,7 @@ int intel_engine_cmd_parser(struct i915_gem_context *ctx, - goto err; - } - -- if (desc->cmd.value == MI_BATCH_BUFFER_START) { -+ if (cmd_desc_is(desc, MI_BATCH_BUFFER_START)) { - ret = check_bbstart(ctx, cmd, offset, length, - batch_len, batch_start, - shadow_batch_start); -diff --git a/drivers/gpu/drm/ingenic/ingenic-drm.c b/drivers/gpu/drm/ingenic/ingenic-drm.c -index 376fca6ca9f47..7e6179fe63f86 100644 ---- a/drivers/gpu/drm/ingenic/ingenic-drm.c -+++ b/drivers/gpu/drm/ingenic/ingenic-drm.c -@@ -375,9 +375,9 @@ static void ingenic_drm_plane_atomic_update(struct drm_plane *plane, - - if (state && state->fb) { - addr = drm_fb_cma_get_gem_addr(state->fb, state, 0); -- width = state->crtc->state->adjusted_mode.hdisplay; -- height = state->crtc->state->adjusted_mode.vdisplay; -- cpp = state->fb->format->cpp[plane->index]; -+ width = state->src_w >> 16; -+ height = state->src_h >> 16; -+ cpp = state->fb->format->cpp[0]; - - priv->dma_hwdesc->addr = addr; - priv->dma_hwdesc->cmd = width * height * cpp / 4; -diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c -index 048c8be426f32..053da39da1cc0 100644 ---- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c -@@ -350,7 +350,7 @@ int adreno_hw_init(struct msm_gpu *gpu) - ring->next = ring->start; - - /* reset completed fence seqno: */ -- ring->memptrs->fence = ring->seqno; -+ ring->memptrs->fence = ring->fctx->completed_fence; - ring->memptrs->rptr = 0; - } - -diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c -index d735ea7e2d886..419a02260bfa7 100644 ---- a/drivers/gpu/drm/nouveau/dispnv50/disp.c -+++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c -@@ -2032,8 +2032,10 @@ nv50_disp_atomic_commit(struct drm_device *dev, - int ret, i; - - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return ret; -+ } - - ret = drm_atomic_helper_setup_commit(state, nonblock); - if (ret) -diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c -index eb31c5b6c8e93..0994aee7671ad 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_connector.c -+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c -@@ -568,8 +568,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) - pm_runtime_get_noresume(dev->dev); - } else { - ret = pm_runtime_get_sync(dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put_autosuspend(dev->dev); - return conn_status; -+ } - } - - nv_encoder = nouveau_connector_ddc_detect(connector); -diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -index 5cf2381f667e2..c09ea357e88f0 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -189,8 +189,10 @@ nouveau_fbcon_open(struct fb_info *info, int user) - struct nouveau_fbdev *fbcon = info->par; - struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev); - int ret = pm_runtime_get_sync(drm->dev->dev); -- if (ret < 0 && ret != -EACCES) -+ if (ret < 0 && ret != -EACCES) { -+ pm_runtime_put(drm->dev->dev); - return ret; -+ } - return 0; - } - -diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c -index b684cd719612b..bc63f4cecf5d5 100644 ---- a/drivers/gpu/drm/radeon/radeon_connectors.c -+++ b/drivers/gpu/drm/radeon/radeon_connectors.c -@@ -883,8 +883,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (encoder) { -@@ -1029,8 +1031,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = radeon_best_single_encoder(connector); -@@ -1167,8 +1171,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - encoder = radeon_best_single_encoder(connector); -@@ -1251,8 +1257,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (radeon_connector->detected_hpd_without_ddc) { -@@ -1666,8 +1674,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) - - if (!drm_kms_helper_is_poll_worker()) { - r = pm_runtime_get_sync(connector->dev->dev); -- if (r < 0) -+ if (r < 0) { -+ pm_runtime_put_autosuspend(connector->dev->dev); - return connector_status_disconnected; -+ } - } - - if (!force && radeon_check_hpd_status_unchanged(connector)) { -diff --git a/drivers/gpu/drm/xen/xen_drm_front.c b/drivers/gpu/drm/xen/xen_drm_front.c -index 4be49c1aef518..09894a1d343f3 100644 ---- a/drivers/gpu/drm/xen/xen_drm_front.c -+++ b/drivers/gpu/drm/xen/xen_drm_front.c -@@ -400,7 +400,7 @@ static int xen_drm_drv_dumb_create(struct drm_file *filp, - args->size = args->pitch * args->height; - - obj = xen_drm_front_gem_create(dev, args->size); -- if (IS_ERR_OR_NULL(obj)) { -+ if (IS_ERR(obj)) { - ret = PTR_ERR(obj); - goto fail; - } -diff --git a/drivers/gpu/drm/xen/xen_drm_front_gem.c b/drivers/gpu/drm/xen/xen_drm_front_gem.c -index f0b85e0941114..4ec8a49241e17 100644 ---- a/drivers/gpu/drm/xen/xen_drm_front_gem.c -+++ b/drivers/gpu/drm/xen/xen_drm_front_gem.c -@@ -83,7 +83,7 @@ static struct xen_gem_object *gem_create(struct drm_device *dev, size_t size) - - size = round_up(size, PAGE_SIZE); - xen_obj = gem_create_obj(dev, size); -- if (IS_ERR_OR_NULL(xen_obj)) -+ if (IS_ERR(xen_obj)) - return xen_obj; - - if (drm_info->front_info->cfg.be_alloc) { -@@ -117,7 +117,7 @@ static struct xen_gem_object *gem_create(struct drm_device *dev, size_t size) - */ - xen_obj->num_pages = DIV_ROUND_UP(size, PAGE_SIZE); - xen_obj->pages = drm_gem_get_pages(&xen_obj->base); -- if (IS_ERR_OR_NULL(xen_obj->pages)) { -+ if (IS_ERR(xen_obj->pages)) { - ret = PTR_ERR(xen_obj->pages); - xen_obj->pages = NULL; - goto fail; -@@ -136,7 +136,7 @@ struct drm_gem_object *xen_drm_front_gem_create(struct drm_device *dev, - struct xen_gem_object *xen_obj; - - xen_obj = gem_create(dev, size); -- if (IS_ERR_OR_NULL(xen_obj)) -+ if (IS_ERR(xen_obj)) - return ERR_CAST(xen_obj); - - return &xen_obj->base; -@@ -194,7 +194,7 @@ xen_drm_front_gem_import_sg_table(struct drm_device *dev, - - size = attach->dmabuf->size; - xen_obj = gem_create_obj(dev, size); -- if (IS_ERR_OR_NULL(xen_obj)) -+ if (IS_ERR(xen_obj)) - return ERR_CAST(xen_obj); - - ret = gem_alloc_pages_array(xen_obj, size); -diff --git a/drivers/gpu/drm/xen/xen_drm_front_kms.c b/drivers/gpu/drm/xen/xen_drm_front_kms.c -index 21ad1c359b613..e4dedbb184ab7 100644 ---- a/drivers/gpu/drm/xen/xen_drm_front_kms.c -+++ b/drivers/gpu/drm/xen/xen_drm_front_kms.c -@@ -60,7 +60,7 @@ fb_create(struct drm_device *dev, struct drm_file *filp, - int ret; - - fb = drm_gem_fb_create_with_funcs(dev, filp, mode_cmd, &fb_funcs); -- if (IS_ERR_OR_NULL(fb)) -+ if (IS_ERR(fb)) - return fb; - - gem_obj = drm_gem_object_lookup(filp, mode_cmd->handles[0]); -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 73e4590ea9c94..09df5ecc2c79b 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -771,6 +771,7 @@ - #define USB_DEVICE_ID_LOGITECH_G27_WHEEL 0xc29b - #define USB_DEVICE_ID_LOGITECH_WII_WHEEL 0xc29c - #define USB_DEVICE_ID_LOGITECH_ELITE_KBD 0xc30a -+#define USB_DEVICE_ID_LOGITECH_GROUP_AUDIO 0x0882 - #define USB_DEVICE_ID_S510_RECEIVER 0xc50c - #define USB_DEVICE_ID_S510_RECEIVER_2 0xc517 - #define USB_DEVICE_ID_LOGITECH_CORDLESS_DESKTOP_LX500 0xc512 -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index a49fa2b047cba..b3dd60897ffda 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -179,6 +179,7 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD2, USB_DEVICE_ID_SMARTJOY_DUAL_PLUS), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET }, - - { 0 } - }; -diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index b525b2715e074..592176aff0270 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-core.c -+++ b/drivers/hid/i2c-hid/i2c-hid-core.c -@@ -422,6 +422,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) - dev_err(&client->dev, "failed to change power setting.\n"); - - set_pwr_exit: -+ -+ /* -+ * The HID over I2C specification states that if a DEVICE needs time -+ * after the PWR_ON request, it should utilise CLOCK stretching. -+ * However, it has been observered that the Windows driver provides a -+ * 1ms sleep between the PWR_ON and RESET requests. -+ * According to Goodix Windows even waits 60 ms after (other?) -+ * PWR_ON requests. Testing has confirmed that several devices -+ * will not work properly without a delay after a PWR_ON request. -+ */ -+ if (!ret && power_state == I2C_HID_PWR_ON) -+ msleep(60); -+ - return ret; - } - -@@ -443,15 +456,6 @@ static int i2c_hid_hwreset(struct i2c_client *client) - if (ret) - goto out_unlock; - -- /* -- * The HID over I2C specification states that if a DEVICE needs time -- * after the PWR_ON request, it should utilise CLOCK stretching. -- * However, it has been observered that the Windows driver provides a -- * 1ms sleep between the PWR_ON and RESET requests and that some devices -- * rely on this. -- */ -- usleep_range(1000, 5000); -- - i2c_hid_dbg(ihid, "resetting...\n"); - - ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); -diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c -index 35b1fa6d962ec..4711fb191a072 100644 ---- a/drivers/hid/usbhid/hiddev.c -+++ b/drivers/hid/usbhid/hiddev.c -@@ -519,12 +519,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, - - switch (cmd) { - case HIDIOCGUSAGE: -+ if (uref->usage_index >= field->report_count) -+ goto inval; - uref->value = field->value[uref->usage_index]; - if (copy_to_user(user_arg, uref, sizeof(*uref))) - goto fault; - goto goodreturn; - - case HIDIOCSUSAGE: -+ if (uref->usage_index >= field->report_count) -+ goto inval; - field->value[uref->usage_index] = uref->value; - goto goodreturn; - -diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c -index dfb122b5e1b76..b812b199e5e5b 100644 ---- a/drivers/hwmon/nct7904.c -+++ b/drivers/hwmon/nct7904.c -@@ -197,7 +197,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, - if (ret < 0) - return ret; - cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); -- if (cnt == 0x1fff) -+ if (cnt == 0 || cnt == 0x1fff) - rpm = 0; - else - rpm = 1350000 / cnt; -@@ -209,7 +209,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, - if (ret < 0) - return ret; - cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); -- if (cnt == 0x1fff) -+ if (cnt == 0 || cnt == 0x1fff) - rpm = 0; - else - rpm = 1350000 / cnt; -diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c -index 0b90aa0318df3..9c162a01a5849 100644 ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -587,6 +587,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) - /* master sent stop */ - if (ssr_filtered & SSR) { - i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); -+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ - rcar_i2c_write(priv, ICSIER, SAR); - rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); - } -diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c -index cc193f2ba5d37..def62d5b42ca7 100644 ---- a/drivers/i2c/i2c-core-base.c -+++ b/drivers/i2c/i2c-core-base.c -@@ -354,7 +354,7 @@ static int i2c_device_probe(struct device *dev) - * or ACPI ID table is supplied for the probing device. - */ - if (!driver->id_table && -- !i2c_acpi_match_device(dev->driver->acpi_match_table, client) && -+ !acpi_driver_match_device(dev, dev->driver) && - !i2c_of_match_device(dev->driver->of_match_table, client)) { - status = -ENODEV; - goto put_sync_adapter; -diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c -index 0e6a9536eca62..612cbf668adf8 100644 ---- a/drivers/iommu/iova.c -+++ b/drivers/iommu/iova.c -@@ -811,7 +811,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad) - for (i = 0 ; i < mag->size; ++i) { - struct iova *iova = private_find_iova(iovad, mag->pfns[i]); - -- BUG_ON(!iova); -+ if (WARN_ON(!iova)) -+ continue; -+ - private_free_iova(iovad, iova); - } - -diff --git a/drivers/irqchip/irq-stm32-exti.c b/drivers/irqchip/irq-stm32-exti.c -index e00f2fa27f00e..a8322a4e18d36 100644 ---- a/drivers/irqchip/irq-stm32-exti.c -+++ b/drivers/irqchip/irq-stm32-exti.c -@@ -431,6 +431,16 @@ static void stm32_irq_ack(struct irq_data *d) - irq_gc_unlock(gc); - } - -+/* directly set the target bit without reading first. */ -+static inline void stm32_exti_write_bit(struct irq_data *d, u32 reg) -+{ -+ struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d); -+ void __iomem *base = chip_data->host_data->base; -+ u32 val = BIT(d->hwirq % IRQS_PER_BANK); -+ -+ writel_relaxed(val, base + reg); -+} -+ - static inline u32 stm32_exti_set_bit(struct irq_data *d, u32 reg) - { - struct stm32_exti_chip_data *chip_data = irq_data_get_irq_chip_data(d); -@@ -464,9 +474,9 @@ static void stm32_exti_h_eoi(struct irq_data *d) - - raw_spin_lock(&chip_data->rlock); - -- stm32_exti_set_bit(d, stm32_bank->rpr_ofst); -+ stm32_exti_write_bit(d, stm32_bank->rpr_ofst); - if (stm32_bank->fpr_ofst != UNDEF_REG) -- stm32_exti_set_bit(d, stm32_bank->fpr_ofst); -+ stm32_exti_write_bit(d, stm32_bank->fpr_ofst); - - raw_spin_unlock(&chip_data->rlock); - -diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c -index 12d6764844724..ed75636a6fb34 100644 ---- a/drivers/media/cec/cec-api.c -+++ b/drivers/media/cec/cec-api.c -@@ -147,7 +147,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap, - struct cec_log_addrs log_addrs; - - mutex_lock(&adap->lock); -- log_addrs = adap->log_addrs; -+ /* -+ * We use memcpy here instead of assignment since there is a -+ * hole at the end of struct cec_log_addrs that an assignment -+ * might ignore. So when we do copy_to_user() we could leak -+ * one byte of memory. -+ */ -+ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs)); - if (!adap->is_configured) - memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID, - sizeof(log_addrs.log_addr)); -diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c -index d0cdee1c6eb0b..bf36b1e22b635 100644 ---- a/drivers/media/pci/ttpci/av7110.c -+++ b/drivers/media/pci/ttpci/av7110.c -@@ -406,14 +406,15 @@ static void debiirq(unsigned long cookie) - case DATA_CI_GET: - { - u8 *data = av7110->debi_virt; -+ u8 data_0 = data[0]; - -- if ((data[0] < 2) && data[2] == 0xff) { -+ if (data_0 < 2 && data[2] == 0xff) { - int flags = 0; - if (data[5] > 0) - flags |= CA_CI_MODULE_PRESENT; - if (data[5] > 5) - flags |= CA_CI_MODULE_READY; -- av7110->ci_slot[data[0]].flags = flags; -+ av7110->ci_slot[data_0].flags = flags; - } else - ci_get_data(&av7110->ci_rbuffer, - av7110->debi_virt, -diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c -index 71f4fe882d138..74f68ac3c9a75 100644 ---- a/drivers/media/platform/davinci/vpif_capture.c -+++ b/drivers/media/platform/davinci/vpif_capture.c -@@ -1482,8 +1482,6 @@ probe_out: - /* Unregister video device */ - video_unregister_device(&ch->video_dev); - } -- kfree(vpif_obj.sd); -- v4l2_device_unregister(&vpif_obj.v4l2_dev); - - return err; - } -diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c -index 18ca12d78314c..66703989ae185 100644 ---- a/drivers/media/rc/gpio-ir-tx.c -+++ b/drivers/media/rc/gpio-ir-tx.c -@@ -79,13 +79,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf, - // space - edge = ktime_add_us(edge, txbuf[i]); - delta = ktime_us_delta(edge, ktime_get()); -- if (delta > 10) { -- spin_unlock_irqrestore(&gpio_ir->lock, flags); -- usleep_range(delta, delta + 10); -- spin_lock_irqsave(&gpio_ir->lock, flags); -- } else if (delta > 0) { -+ if (delta > 0) - udelay(delta); -- } - } else { - // pulse - ktime_t last = ktime_add_us(edge, txbuf[i]); -diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c -index b33030e3385c7..da91965b8f7b2 100644 ---- a/drivers/mfd/intel-lpss-pci.c -+++ b/drivers/mfd/intel-lpss-pci.c -@@ -196,6 +196,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { - { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info }, - { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info }, - { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info }, -+ /* EBG */ -+ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info }, -+ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info }, - /* GLK */ - { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info }, - { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info }, -@@ -225,6 +228,22 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { - { PCI_VDEVICE(INTEL, 0x34ea), (kernel_ulong_t)&bxt_i2c_info }, - { PCI_VDEVICE(INTEL, 0x34eb), (kernel_ulong_t)&bxt_i2c_info }, - { PCI_VDEVICE(INTEL, 0x34fb), (kernel_ulong_t)&spt_info }, -+ /* TGL-H */ -+ { PCI_VDEVICE(INTEL, 0x43a7), (kernel_ulong_t)&bxt_uart_info }, -+ { PCI_VDEVICE(INTEL, 0x43a8), (kernel_ulong_t)&bxt_uart_info }, -+ { PCI_VDEVICE(INTEL, 0x43a9), (kernel_ulong_t)&bxt_uart_info }, -+ { PCI_VDEVICE(INTEL, 0x43aa), (kernel_ulong_t)&bxt_info }, -+ { PCI_VDEVICE(INTEL, 0x43ab), (kernel_ulong_t)&bxt_info }, -+ { PCI_VDEVICE(INTEL, 0x43ad), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43ae), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43d8), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43da), (kernel_ulong_t)&bxt_uart_info }, -+ { PCI_VDEVICE(INTEL, 0x43e8), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43e9), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43ea), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43eb), (kernel_ulong_t)&bxt_i2c_info }, -+ { PCI_VDEVICE(INTEL, 0x43fb), (kernel_ulong_t)&bxt_info }, -+ { PCI_VDEVICE(INTEL, 0x43fd), (kernel_ulong_t)&bxt_info }, - /* EHL */ - { PCI_VDEVICE(INTEL, 0x4b28), (kernel_ulong_t)&bxt_uart_info }, - { PCI_VDEVICE(INTEL, 0x4b29), (kernel_ulong_t)&bxt_uart_info }, -diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c -index 4d0d13d5d0998..635345bced313 100644 ---- a/drivers/net/ethernet/amazon/ena/ena_netdev.c -+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c -@@ -2924,7 +2924,7 @@ static int check_missing_comp_in_tx_queue(struct ena_adapter *adapter, - } - - u64_stats_update_begin(&tx_ring->syncp); -- tx_ring->tx_stats.missed_tx = missed_tx; -+ tx_ring->tx_stats.missed_tx += missed_tx; - u64_stats_update_end(&tx_ring->syncp); - - return rc; -@@ -3848,6 +3848,9 @@ static void ena_keep_alive_wd(void *adapter_data, - rx_drops = ((u64)desc->rx_drops_high << 32) | desc->rx_drops_low; - - u64_stats_update_begin(&adapter->syncp); -+ /* These stats are accumulated by the device, so the counters indicate -+ * all drops since last reset. -+ */ - adapter->dev_stats.rx_drops = rx_drops; - u64_stats_update_end(&adapter->syncp); - } -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 2580bcd850253..3978d82c95989 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -751,8 +751,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) - continue; - - err = gfar_parse_group(child, priv, model); -- if (err) -+ if (err) { -+ of_node_put(child); - goto err_grp_init; -+ } - } - } else { /* SQ_SG_MODE */ - err = gfar_parse_group(np, priv, model); -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c -index ccd852ad62a4b..d50c5b55da180 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c -@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid, - } - - /* alloc the udl from per cpu ddp pool */ -- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp); -+ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp); - if (!ddp->udl) { - e_err(drv, "failed allocated ddp context\n"); - goto out_noddp_unmap; -diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c -index b805abc9ec3b4..5fbabae2909ee 100644 ---- a/drivers/net/ipvlan/ipvlan_main.c -+++ b/drivers/net/ipvlan/ipvlan_main.c -@@ -106,12 +106,21 @@ static void ipvlan_port_destroy(struct net_device *dev) - kfree(port); - } - -+#define IPVLAN_ALWAYS_ON_OFLOADS \ -+ (NETIF_F_SG | NETIF_F_HW_CSUM | \ -+ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL) -+ -+#define IPVLAN_ALWAYS_ON \ -+ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED) -+ - #define IPVLAN_FEATURES \ -- (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ -+ (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ - NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \ - NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \ - NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER) - -+ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */ -+ - #define IPVLAN_STATE_MASK \ - ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT)) - -@@ -125,7 +134,9 @@ static int ipvlan_init(struct net_device *dev) - dev->state = (dev->state & ~IPVLAN_STATE_MASK) | - (phy_dev->state & IPVLAN_STATE_MASK); - dev->features = phy_dev->features & IPVLAN_FEATURES; -- dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED; -+ dev->features |= IPVLAN_ALWAYS_ON; -+ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES; -+ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS; - dev->hw_enc_features |= dev->features; - dev->gso_max_size = phy_dev->gso_max_size; - dev->gso_max_segs = phy_dev->gso_max_segs; -@@ -225,7 +236,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev, - { - struct ipvl_dev *ipvlan = netdev_priv(dev); - -- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES); -+ features |= NETIF_F_ALL_FOR_ALL; -+ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES); -+ features = netdev_increment_features(ipvlan->phy_dev->features, -+ features, features); -+ features |= IPVLAN_ALWAYS_ON; -+ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON); -+ -+ return features; - } - - static void ipvlan_change_rx_flags(struct net_device *dev, int change) -@@ -732,10 +750,9 @@ static int ipvlan_device_event(struct notifier_block *unused, - - case NETDEV_FEAT_CHANGE: - list_for_each_entry(ipvlan, &port->ipvlans, pnode) { -- ipvlan->dev->features = dev->features & IPVLAN_FEATURES; - ipvlan->dev->gso_max_size = dev->gso_max_size; - ipvlan->dev->gso_max_segs = dev->gso_max_segs; -- netdev_features_change(ipvlan->dev); -+ netdev_update_features(ipvlan->dev); - } - break; - -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 9d3209ae41cfb..07622cf8765ae 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -1259,6 +1259,9 @@ static void macvlan_port_destroy(struct net_device *dev) - static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], - struct netlink_ext_ack *extack) - { -+ struct nlattr *nla, *head; -+ int rem, len; -+ - if (tb[IFLA_ADDRESS]) { - if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) - return -EINVAL; -@@ -1306,6 +1309,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], - return -EADDRNOTAVAIL; - } - -+ if (data[IFLA_MACVLAN_MACADDR_DATA]) { -+ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]); -+ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); -+ -+ nla_for_each_attr(nla, head, len, rem) { -+ if (nla_type(nla) != IFLA_MACVLAN_MACADDR || -+ nla_len(nla) != ETH_ALEN) -+ return -EINVAL; -+ -+ if (!is_valid_ether_addr(nla_data(nla))) -+ return -EADDRNOTAVAIL; -+ } -+ } -+ - if (data[IFLA_MACVLAN_MACADDR_COUNT]) - return -EINVAL; - -@@ -1362,10 +1379,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode, - len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); - - nla_for_each_attr(nla, head, len, rem) { -- if (nla_type(nla) != IFLA_MACVLAN_MACADDR || -- nla_len(nla) != ETH_ALEN) -- continue; -- - addr = nla_data(nla); - ret = macvlan_hash_add_source(vlan, addr); - if (ret) -diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h -index 2ae57c1de7b55..ae4c9edc445c3 100644 ---- a/drivers/net/wireless/ath/ath10k/hw.h -+++ b/drivers/net/wireless/ath/ath10k/hw.h -@@ -810,7 +810,7 @@ ath10k_is_rssi_enable(struct ath10k_hw_params *hw, - - #define TARGET_10_4_TX_DBG_LOG_SIZE 1024 - #define TARGET_10_4_NUM_WDS_ENTRIES 32 --#define TARGET_10_4_DMA_BURST_SIZE 0 -+#define TARGET_10_4_DMA_BURST_SIZE 1 - #define TARGET_10_4_MAC_AGGR_DELIM 0 - #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1 - #define TARGET_10_4_VOW_CONFIG 0 -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -index e3ebb7abbdaed..4ca50353538ef 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -82,6 +82,8 @@ - - #define BRCMF_ND_INFO_TIMEOUT msecs_to_jiffies(2000) - -+#define BRCMF_PS_MAX_TIMEOUT_MS 2000 -+ - #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \ - (sizeof(struct brcmf_assoc_params_le) - sizeof(u16)) - -@@ -2789,6 +2791,12 @@ brcmf_cfg80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *ndev, - else - bphy_err(drvr, "error (%d)\n", err); - } -+ -+ err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret", -+ min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS)); -+ if (err) -+ bphy_err(drvr, "Unable to set pm timeout, (%d)\n", err); -+ - done: - brcmf_dbg(TRACE, "Exit\n"); - return err; -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c -index c66c6dc003783..bad06939a247c 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.c -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c -@@ -718,8 +718,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw) - - usb_anchor_urb(urb, &rtlusb->rx_submitted); - err = usb_submit_urb(urb, GFP_KERNEL); -- if (err) -+ if (err) { -+ usb_unanchor_urb(urb); -+ usb_free_urb(urb); - goto err_out; -+ } - usb_free_urb(urb); - } - return 0; -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 83ac88924f253..dce4d6782ceb1 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -1740,7 +1740,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, - if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) { - dev_err(ctrl->dev, - "FCP Op failed - cmdiu dma mapping failed.\n"); -- ret = EFAULT; -+ ret = -EFAULT; - goto out_on_error; - } - -@@ -1750,7 +1750,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, - if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) { - dev_err(ctrl->dev, - "FCP Op failed - rspiu dma mapping failed.\n"); -- ret = EFAULT; -+ ret = -EFAULT; - } - - atomic_set(&op->state, FCPOP_STATE_IDLE); -diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c -index 484aad0d0c9c6..0a458f7880887 100644 ---- a/drivers/nvme/host/multipath.c -+++ b/drivers/nvme/host/multipath.c -@@ -249,12 +249,17 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, - fallback = ns; - } - -- /* No optimized path found, re-check the current path */ -+ /* -+ * The loop above skips the current path for round-robin semantics. -+ * Fall back to the current path if either: -+ * - no other optimized path found and current is optimized, -+ * - no other usable path found and current is usable. -+ */ - if (!nvme_path_is_disabled(old) && -- old->ana_state == NVME_ANA_OPTIMIZED) { -- found = old; -- goto out; -- } -+ (old->ana_state == NVME_ANA_OPTIMIZED || -+ (!fallback && old->ana_state == NVME_ANA_NONOPTIMIZED))) -+ return old; -+ - if (!fallback) - return NULL; - found = fallback; -diff --git a/drivers/pci/controller/dwc/pcie-qcom.c b/drivers/pci/controller/dwc/pcie-qcom.c -index 270d502b8cd50..374db5d59cf87 100644 ---- a/drivers/pci/controller/dwc/pcie-qcom.c -+++ b/drivers/pci/controller/dwc/pcie-qcom.c -@@ -103,11 +103,14 @@ struct qcom_pcie_resources_2_1_0 { - struct clk *iface_clk; - struct clk *core_clk; - struct clk *phy_clk; -+ struct clk *aux_clk; -+ struct clk *ref_clk; - struct reset_control *pci_reset; - struct reset_control *axi_reset; - struct reset_control *ahb_reset; - struct reset_control *por_reset; - struct reset_control *phy_reset; -+ struct reset_control *ext_reset; - struct regulator_bulk_data supplies[QCOM_PCIE_2_1_0_MAX_SUPPLY]; - }; - -@@ -253,6 +256,14 @@ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie) - if (IS_ERR(res->phy_clk)) - return PTR_ERR(res->phy_clk); - -+ res->aux_clk = devm_clk_get_optional(dev, "aux"); -+ if (IS_ERR(res->aux_clk)) -+ return PTR_ERR(res->aux_clk); -+ -+ res->ref_clk = devm_clk_get_optional(dev, "ref"); -+ if (IS_ERR(res->ref_clk)) -+ return PTR_ERR(res->ref_clk); -+ - res->pci_reset = devm_reset_control_get_exclusive(dev, "pci"); - if (IS_ERR(res->pci_reset)) - return PTR_ERR(res->pci_reset); -@@ -269,6 +280,10 @@ static int qcom_pcie_get_resources_2_1_0(struct qcom_pcie *pcie) - if (IS_ERR(res->por_reset)) - return PTR_ERR(res->por_reset); - -+ res->ext_reset = devm_reset_control_get_optional_exclusive(dev, "ext"); -+ if (IS_ERR(res->ext_reset)) -+ return PTR_ERR(res->ext_reset); -+ - res->phy_reset = devm_reset_control_get_exclusive(dev, "phy"); - return PTR_ERR_OR_ZERO(res->phy_reset); - } -@@ -277,14 +292,17 @@ static void qcom_pcie_deinit_2_1_0(struct qcom_pcie *pcie) - { - struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0; - -+ clk_disable_unprepare(res->phy_clk); - reset_control_assert(res->pci_reset); - reset_control_assert(res->axi_reset); - reset_control_assert(res->ahb_reset); - reset_control_assert(res->por_reset); -- reset_control_assert(res->pci_reset); -+ reset_control_assert(res->ext_reset); -+ reset_control_assert(res->phy_reset); - clk_disable_unprepare(res->iface_clk); - clk_disable_unprepare(res->core_clk); -- clk_disable_unprepare(res->phy_clk); -+ clk_disable_unprepare(res->aux_clk); -+ clk_disable_unprepare(res->ref_clk); - regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies); - } - -@@ -315,24 +333,36 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) - goto err_assert_ahb; - } - -- ret = clk_prepare_enable(res->phy_clk); -- if (ret) { -- dev_err(dev, "cannot prepare/enable phy clock\n"); -- goto err_clk_phy; -- } -- - ret = clk_prepare_enable(res->core_clk); - if (ret) { - dev_err(dev, "cannot prepare/enable core clock\n"); - goto err_clk_core; - } - -+ ret = clk_prepare_enable(res->aux_clk); -+ if (ret) { -+ dev_err(dev, "cannot prepare/enable aux clock\n"); -+ goto err_clk_aux; -+ } -+ -+ ret = clk_prepare_enable(res->ref_clk); -+ if (ret) { -+ dev_err(dev, "cannot prepare/enable ref clock\n"); -+ goto err_clk_ref; -+ } -+ - ret = reset_control_deassert(res->ahb_reset); - if (ret) { - dev_err(dev, "cannot deassert ahb reset\n"); - goto err_deassert_ahb; - } - -+ ret = reset_control_deassert(res->ext_reset); -+ if (ret) { -+ dev_err(dev, "cannot deassert ext reset\n"); -+ goto err_deassert_ahb; -+ } -+ - /* enable PCIe clocks and resets */ - val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL); - val &= ~BIT(0); -@@ -387,6 +417,12 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) - return ret; - } - -+ ret = clk_prepare_enable(res->phy_clk); -+ if (ret) { -+ dev_err(dev, "cannot prepare/enable phy clock\n"); -+ goto err_deassert_ahb; -+ } -+ - /* wait for clock acquisition */ - usleep_range(1000, 1500); - -@@ -400,10 +436,12 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie) - return 0; - - err_deassert_ahb: -+ clk_disable_unprepare(res->ref_clk); -+err_clk_ref: -+ clk_disable_unprepare(res->aux_clk); -+err_clk_aux: - clk_disable_unprepare(res->core_clk); - err_clk_core: -- clk_disable_unprepare(res->phy_clk); --err_clk_phy: - clk_disable_unprepare(res->iface_clk); - err_assert_ahb: - regulator_bulk_disable(ARRAY_SIZE(res->supplies), res->supplies); -diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c -index ae4aa0e1f2f42..1f087746b7bb0 100644 ---- a/drivers/pci/slot.c -+++ b/drivers/pci/slot.c -@@ -304,13 +304,16 @@ placeholder: - slot_name = make_slot_name(name); - if (!slot_name) { - err = -ENOMEM; -+ kfree(slot); - goto err; - } - - err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL, - "%s", slot_name); -- if (err) -+ if (err) { -+ kobject_put(&slot->kobj); - goto err; -+ } - - INIT_LIST_HEAD(&slot->list); - list_add(&slot->list, &parent->slots); -@@ -329,7 +332,6 @@ out: - mutex_unlock(&pci_slot_mutex); - return slot; - err: -- kfree(slot); - slot = ERR_PTR(err); - goto out; - } -diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c -index 831850435c23b..5734a78dbb8e6 100644 ---- a/drivers/s390/cio/css.c -+++ b/drivers/s390/cio/css.c -@@ -677,6 +677,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) - rc = css_evaluate_known_subchannel(sch, 1); - if (rc == -EAGAIN) - css_schedule_eval(sch->schid); -+ /* -+ * The loop might take long time for platforms with lots of -+ * known devices. Allow scheduling here. -+ */ -+ cond_resched(); - } - return 0; - } -diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c -index 1791a393795da..07a0dadc75bf5 100644 ---- a/drivers/scsi/fcoe/fcoe_ctlr.c -+++ b/drivers/scsi/fcoe/fcoe_ctlr.c -@@ -255,9 +255,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new) - WARN_ON(!fcf_dev); - new->fcf_dev = NULL; - fcoe_fcf_device_delete(fcf_dev); -- kfree(new); - mutex_unlock(&cdev->lock); - } -+ kfree(new); - } - - /** -diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c -index b766463579800..d0296f7cf45fc 100644 ---- a/drivers/scsi/lpfc/lpfc_vport.c -+++ b/drivers/scsi/lpfc/lpfc_vport.c -@@ -642,27 +642,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport) - vport->port_state < LPFC_VPORT_READY) - return -EAGAIN; - } -+ - /* -- * This is a bit of a mess. We want to ensure the shost doesn't get -- * torn down until we're done with the embedded lpfc_vport structure. -- * -- * Beyond holding a reference for this function, we also need a -- * reference for outstanding I/O requests we schedule during delete -- * processing. But once we scsi_remove_host() we can no longer obtain -- * a reference through scsi_host_get(). -- * -- * So we take two references here. We release one reference at the -- * bottom of the function -- after delinking the vport. And we -- * release the other at the completion of the unreg_vpi that get's -- * initiated after we've disposed of all other resources associated -- * with the port. -+ * Take early refcount for outstanding I/O requests we schedule during -+ * delete processing for unreg_vpi. Always keep this before -+ * scsi_remove_host() as we can no longer obtain a reference through -+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. - */ - if (!scsi_host_get(shost)) - return VPORT_INVAL; -- if (!scsi_host_get(shost)) { -- scsi_host_put(shost); -- return VPORT_INVAL; -- } -+ - lpfc_free_sysfs_attr(vport); - - lpfc_debugfs_terminate(vport); -@@ -809,8 +798,9 @@ skip_logo: - if (!(vport->vpi_state & LPFC_VPI_REGISTERED) || - lpfc_mbx_unreg_vpi(vport)) - scsi_host_put(shost); -- } else -+ } else { - scsi_host_put(shost); -+ } - - lpfc_free_vpi(phba, vport->vpi); - vport->work_port_events = 0; -diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c -index a44de4c5dcf6c..fc6e12fb7d77b 100644 ---- a/drivers/scsi/qla2xxx/qla_gs.c -+++ b/drivers/scsi/qla2xxx/qla_gs.c -@@ -3673,10 +3673,22 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp) - } - - if (fcport->scan_state != QLA_FCPORT_FOUND) { -+ bool do_delete = false; -+ -+ if (fcport->scan_needed && -+ fcport->disc_state == DSC_LOGIN_PEND) { -+ /* Cable got disconnected after we sent -+ * a login. Do delete to prevent timeout. -+ */ -+ fcport->logout_on_delete = 1; -+ do_delete = true; -+ } -+ - fcport->scan_needed = 0; -- if ((qla_dual_mode_enabled(vha) || -- qla_ini_mode_enabled(vha)) && -- atomic_read(&fcport->state) == FCS_ONLINE) { -+ if (((qla_dual_mode_enabled(vha) || -+ qla_ini_mode_enabled(vha)) && -+ atomic_read(&fcport->state) == FCS_ONLINE) || -+ do_delete) { - if (fcport->loop_id != FC_NO_LOOP_ID) { - if (fcport->flags & FCF_FCP2_DEVICE) - fcport->logout_on_delete = 0; -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index 62a16463f0254..c1631e42d35d1 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -335,14 +335,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) - if (time_after(jiffies, wait_time)) - break; - -- /* -- * Check if it's UNLOADING, cause we cannot poll in -- * this case, or else a NULL pointer dereference -- * is triggered. -- */ -- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) -- return QLA_FUNCTION_TIMEOUT; -- - /* Check for pending interrupts. */ - qla2x00_poll(ha->rsp_q_map[0]); - -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 941aa53363f56..f4815a4084d8c 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -535,6 +535,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, - struct nvme_private *priv = fd->private; - struct qla_nvme_rport *qla_rport = rport->private; - -+ if (!priv) { -+ /* nvme association has been torn down */ -+ return rval; -+ } -+ - fcport = qla_rport->fcport; - - if (!qpair || !fcport || (qpair && !qpair->fw_started) || -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index d91c95d9981ac..67b1e74fcd1e6 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -1993,6 +1993,11 @@ skip_pio: - /* Determine queue resources */ - ha->max_req_queues = ha->max_rsp_queues = 1; - ha->msix_count = QLA_BASE_VECTORS; -+ -+ /* Check if FW supports MQ or not */ -+ if (!(ha->fw_attributes & BIT_6)) -+ goto mqiobase_exit; -+ - if (!ql2xmqsupport || !ql2xnvmeenable || - (!IS_QLA25XX(ha) && !IS_QLA81XX(ha))) - goto mqiobase_exit; -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index cb8a892e2d393..b75e6e4d58c06 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -1262,7 +1262,7 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) - - qla24xx_chk_fcp_state(sess); - -- ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, -+ ql_dbg(ql_dbg_disc, sess->vha, 0xe001, - "Scheduling sess %p for deletion %8phC\n", - sess, sess->port_name); - -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index a5c78b38d3022..dbad926e8f87f 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -3174,7 +3174,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport, - pr_err("%s could not find host no %u\n", - __func__, ev->u.set_flashnode.host_no); - err = -ENODEV; -- goto put_host; -+ goto exit_set_fnode; - } - - idx = ev->u.set_flashnode.flashnode_idx; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index b41b88bcab3d9..5e502e1605549 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -1516,6 +1516,7 @@ unblock_reqs: - int ufshcd_hold(struct ufs_hba *hba, bool async) - { - int rc = 0; -+ bool flush_result; - unsigned long flags; - - if (!ufshcd_is_clkgating_allowed(hba)) -@@ -1547,7 +1548,9 @@ start: - break; - } - spin_unlock_irqrestore(hba->host->host_lock, flags); -- flush_work(&hba->clk_gating.ungate_work); -+ flush_result = flush_work(&hba->clk_gating.ungate_work); -+ if (hba->clk_gating.is_suspended && !flush_result) -+ goto out; - spin_lock_irqsave(hba->host->host_lock, flags); - goto start; - } -@@ -5609,7 +5612,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) - */ - static irqreturn_t ufshcd_intr(int irq, void *__hba) - { -- u32 intr_status, enabled_intr_status; -+ u32 intr_status, enabled_intr_status = 0; - irqreturn_t retval = IRQ_NONE; - struct ufs_hba *hba = __hba; - int retries = hba->nutrs; -@@ -5623,7 +5626,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) - * read, make sure we handle them by checking the interrupt status - * again in a loop until we process all of the reqs before returning. - */ -- do { -+ while (intr_status && retries--) { - enabled_intr_status = - intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); - if (intr_status) -@@ -5634,7 +5637,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) - } - - intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); -- } while (intr_status && --retries); -+ } - - spin_unlock(hba->host->host_lock); - return retval; -@@ -6137,7 +6140,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) - /* command completed already */ - dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n", - __func__, tag); -- goto out; -+ goto cleanup; - } else { - dev_err(hba->dev, - "%s: no response from device. tag = %d, err %d\n", -@@ -6171,6 +6174,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) - goto out; - } - -+cleanup: - scsi_dma_unmap(cmd); - - spin_lock_irqsave(host->host_lock, flags); -diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c -index 7e92ab0cc9920..8146c2d91d307 100644 ---- a/drivers/spi/spi-stm32.c -+++ b/drivers/spi/spi-stm32.c -@@ -443,7 +443,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, - { - u32 div, mbrdiv; - -- div = DIV_ROUND_UP(spi->clk_rate, speed_hz); -+ /* Ensure spi->clk_rate is even */ -+ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); - - /* - * SPI framework set xfer->speed_hz to master->max_speed_hz if -@@ -469,20 +470,27 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, - /** - * stm32h7_spi_prepare_fthlv - Determine FIFO threshold level - * @spi: pointer to the spi controller data structure -+ * @xfer_len: length of the message to be transferred - */ --static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) -+static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi, u32 xfer_len) - { -- u32 fthlv, half_fifo; -+ u32 fthlv, half_fifo, packet; - - /* data packet should not exceed 1/2 of fifo space */ - half_fifo = (spi->fifo_size / 2); - -+ /* data_packet should not exceed transfer length */ -+ if (half_fifo > xfer_len) -+ packet = xfer_len; -+ else -+ packet = half_fifo; -+ - if (spi->cur_bpw <= 8) -- fthlv = half_fifo; -+ fthlv = packet; - else if (spi->cur_bpw <= 16) -- fthlv = half_fifo / 2; -+ fthlv = packet / 2; - else -- fthlv = half_fifo / 4; -+ fthlv = packet / 4; - - /* align packet size with data registers access */ - if (spi->cur_bpw > 8) -@@ -490,6 +498,9 @@ static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) - else - fthlv -= (fthlv % 4); /* multiple of 4 */ - -+ if (!fthlv) -+ fthlv = 1; -+ - return fthlv; - } - -@@ -962,13 +973,13 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) - if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) - stm32h7_spi_read_rxfifo(spi, false); - -- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR); -+ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR); - - spin_unlock_irqrestore(&spi->lock, flags); - - if (end) { -- spi_finalize_current_transfer(master); - stm32h7_spi_disable(spi); -+ spi_finalize_current_transfer(master); - } - - return IRQ_HANDLED; -@@ -1396,7 +1407,7 @@ static void stm32h7_spi_set_bpw(struct stm32_spi *spi) - cfg1_setb |= (bpw << STM32H7_SPI_CFG1_DSIZE_SHIFT) & - STM32H7_SPI_CFG1_DSIZE; - -- spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi); -+ spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi, spi->cur_xferlen); - fthlv = spi->cur_fthlv - 1; - - cfg1_clrb |= STM32H7_SPI_CFG1_FTHLV; -@@ -1579,39 +1590,33 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, - unsigned long flags; - unsigned int comm_type; - int nb_words, ret = 0; -+ int mbr; - - spin_lock_irqsave(&spi->lock, flags); - -- if (spi->cur_bpw != transfer->bits_per_word) { -- spi->cur_bpw = transfer->bits_per_word; -- spi->cfg->set_bpw(spi); -- } -+ spi->cur_xferlen = transfer->len; - -- if (spi->cur_speed != transfer->speed_hz) { -- int mbr; -+ spi->cur_bpw = transfer->bits_per_word; -+ spi->cfg->set_bpw(spi); - -- /* Update spi->cur_speed with real clock speed */ -- mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, -- spi->cfg->baud_rate_div_min, -- spi->cfg->baud_rate_div_max); -- if (mbr < 0) { -- ret = mbr; -- goto out; -- } -- -- transfer->speed_hz = spi->cur_speed; -- stm32_spi_set_mbr(spi, mbr); -+ /* Update spi->cur_speed with real clock speed */ -+ mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, -+ spi->cfg->baud_rate_div_min, -+ spi->cfg->baud_rate_div_max); -+ if (mbr < 0) { -+ ret = mbr; -+ goto out; - } - -- comm_type = stm32_spi_communication_type(spi_dev, transfer); -- if (spi->cur_comm != comm_type) { -- ret = spi->cfg->set_mode(spi, comm_type); -+ transfer->speed_hz = spi->cur_speed; -+ stm32_spi_set_mbr(spi, mbr); - -- if (ret < 0) -- goto out; -+ comm_type = stm32_spi_communication_type(spi_dev, transfer); -+ ret = spi->cfg->set_mode(spi, comm_type); -+ if (ret < 0) -+ goto out; - -- spi->cur_comm = comm_type; -- } -+ spi->cur_comm = comm_type; - - if (spi->cfg->set_data_idleness) - spi->cfg->set_data_idleness(spi, transfer->len); -@@ -1629,8 +1634,6 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, - goto out; - } - -- spi->cur_xferlen = transfer->len; -- - dev_dbg(spi->dev, "transfer communication mode set to %d\n", - spi->cur_comm); - dev_dbg(spi->dev, -diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h -index 8533444159635..e7b3c6e5d5744 100644 ---- a/drivers/target/target_core_internal.h -+++ b/drivers/target/target_core_internal.h -@@ -138,6 +138,7 @@ int init_se_kmem_caches(void); - void release_se_kmem_caches(void); - u32 scsi_get_new_index(scsi_index_t); - void transport_subsystem_check_init(void); -+void transport_uninit_session(struct se_session *); - unsigned char *transport_dump_cmd_direction(struct se_cmd *); - void transport_dump_dev_state(struct se_device *, char *, int *); - void transport_dump_dev_info(struct se_device *, struct se_lun *, -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 7c78a5d02c083..b1f4be055f838 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -236,6 +236,11 @@ int transport_init_session(struct se_session *se_sess) - } - EXPORT_SYMBOL(transport_init_session); - -+void transport_uninit_session(struct se_session *se_sess) -+{ -+ percpu_ref_exit(&se_sess->cmd_count); -+} -+ - /** - * transport_alloc_session - allocate a session object and initialize it - * @sup_prot_ops: bitmask that defines which T10-PI modes are supported. -@@ -579,7 +584,7 @@ void transport_free_session(struct se_session *se_sess) - sbitmap_queue_free(&se_sess->sess_tag_pool); - kvfree(se_sess->sess_cmd_map); - } -- percpu_ref_exit(&se_sess->cmd_count); -+ transport_uninit_session(se_sess); - kmem_cache_free(se_sess_cache, se_sess); - } - EXPORT_SYMBOL(transport_free_session); -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index d766fb14942b3..8888cdf3eead9 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -1220,7 +1220,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) - - struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; - -- tcmu_flush_dcache_range(entry, sizeof(*entry)); -+ /* -+ * Flush max. up to end of cmd ring since current entry might -+ * be a padding that is shorter than sizeof(*entry) -+ */ -+ size_t ring_left = head_to_end(udev->cmdr_last_cleaned, -+ udev->cmdr_size); -+ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ? -+ ring_left : sizeof(*entry)); - - if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) { - UPDATE_HEAD(udev->cmdr_last_cleaned, -diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c -index b9b1e92c6f8db..9d24e85b08631 100644 ---- a/drivers/target/target_core_xcopy.c -+++ b/drivers/target/target_core_xcopy.c -@@ -479,7 +479,7 @@ int target_xcopy_setup_pt(void) - memset(&xcopy_pt_sess, 0, sizeof(struct se_session)); - ret = transport_init_session(&xcopy_pt_sess); - if (ret < 0) -- return ret; -+ goto destroy_wq; - - xcopy_pt_nacl.se_tpg = &xcopy_pt_tpg; - xcopy_pt_nacl.nacl_sess = &xcopy_pt_sess; -@@ -488,12 +488,19 @@ int target_xcopy_setup_pt(void) - xcopy_pt_sess.se_node_acl = &xcopy_pt_nacl; - - return 0; -+ -+destroy_wq: -+ destroy_workqueue(xcopy_wq); -+ xcopy_wq = NULL; -+ return ret; - } - - void target_xcopy_release_pt(void) - { -- if (xcopy_wq) -+ if (xcopy_wq) { - destroy_workqueue(xcopy_wq); -+ transport_uninit_session(&xcopy_pt_sess); -+ } - } - - /* -diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c -index 9e2dbe43667ae..93367dea4d8a5 100644 ---- a/drivers/tty/serial/8250/8250_exar.c -+++ b/drivers/tty/serial/8250/8250_exar.c -@@ -725,6 +725,24 @@ static const struct exar8250_board pbn_exar_XR17V35x = { - .exit = pci_xr17v35x_exit, - }; - -+static const struct exar8250_board pbn_fastcom35x_2 = { -+ .num_ports = 2, -+ .setup = pci_xr17v35x_setup, -+ .exit = pci_xr17v35x_exit, -+}; -+ -+static const struct exar8250_board pbn_fastcom35x_4 = { -+ .num_ports = 4, -+ .setup = pci_xr17v35x_setup, -+ .exit = pci_xr17v35x_exit, -+}; -+ -+static const struct exar8250_board pbn_fastcom35x_8 = { -+ .num_ports = 8, -+ .setup = pci_xr17v35x_setup, -+ .exit = pci_xr17v35x_exit, -+}; -+ - static const struct exar8250_board pbn_exar_XR17V4358 = { - .num_ports = 12, - .setup = pci_xr17v35x_setup, -@@ -795,9 +813,9 @@ static const struct pci_device_id exar_pci_tbl[] = { - EXAR_DEVICE(EXAR, EXAR_XR17V358, pbn_exar_XR17V35x), - EXAR_DEVICE(EXAR, EXAR_XR17V4358, pbn_exar_XR17V4358), - EXAR_DEVICE(EXAR, EXAR_XR17V8358, pbn_exar_XR17V8358), -- EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_exar_XR17V35x), -- EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_exar_XR17V35x), -- EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_exar_XR17V35x), -+ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_fastcom35x_2), -+ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_fastcom35x_4), -+ EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_fastcom35x_8), - - EXAR_DEVICE(COMMTECH, COMMTECH_4222PCI335, pbn_fastcom335_2), - EXAR_DEVICE(COMMTECH, COMMTECH_4224PCI335, pbn_fastcom335_4), -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index dbb27303a6b49..90f09ed6e5ad3 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2198,6 +2198,10 @@ int serial8250_do_startup(struct uart_port *port) - - if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) { - unsigned char iir1; -+ -+ if (port->irqflags & IRQF_SHARED) -+ disable_irq_nosync(port->irq); -+ - /* - * Test for UARTs that do not reassert THRE when the - * transmitter is idle and the interrupt has already -@@ -2207,8 +2211,6 @@ int serial8250_do_startup(struct uart_port *port) - * allow register changes to become visible. - */ - spin_lock_irqsave(&port->lock, flags); -- if (up->port.irqflags & IRQF_SHARED) -- disable_irq_nosync(port->irq); - - wait_for_xmitr(up, UART_LSR_THRE); - serial_port_out_sync(port, UART_IER, UART_IER_THRI); -@@ -2220,9 +2222,10 @@ int serial8250_do_startup(struct uart_port *port) - iir = serial_port_in(port, UART_IIR); - serial_port_out(port, UART_IER, 0); - -+ spin_unlock_irqrestore(&port->lock, flags); -+ - if (port->irqflags & IRQF_SHARED) - enable_irq(port->irq); -- spin_unlock_irqrestore(&port->lock, flags); - - /* - * If the interrupt is not reasserted, or we otherwise -diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c -index de3e8c24c03e7..a8a538b34b535 100644 ---- a/drivers/tty/serial/amba-pl011.c -+++ b/drivers/tty/serial/amba-pl011.c -@@ -2252,9 +2252,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count) - clk_disable(uap->clk); - } - --static void __init --pl011_console_get_options(struct uart_amba_port *uap, int *baud, -- int *parity, int *bits) -+static void pl011_console_get_options(struct uart_amba_port *uap, int *baud, -+ int *parity, int *bits) - { - if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) { - unsigned int lcr_h, ibrd, fbrd; -@@ -2287,7 +2286,7 @@ pl011_console_get_options(struct uart_amba_port *uap, int *baud, - } - } - --static int __init pl011_console_setup(struct console *co, char *options) -+static int pl011_console_setup(struct console *co, char *options) - { - struct uart_amba_port *uap; - int baud = 38400; -@@ -2355,8 +2354,8 @@ static int __init pl011_console_setup(struct console *co, char *options) - * - * Returns 0 if console matches; otherwise non-zero to use default matching - */ --static int __init pl011_console_match(struct console *co, char *name, int idx, -- char *options) -+static int pl011_console_match(struct console *co, char *name, int idx, -+ char *options) - { - unsigned char iotype; - resource_size_t addr; -@@ -2594,7 +2593,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, - - static int pl011_register_port(struct uart_amba_port *uap) - { -- int ret; -+ int ret, i; - - /* Ensure interrupts from this UART are masked and cleared */ - pl011_write(0, uap, REG_IMSC); -@@ -2605,6 +2604,9 @@ static int pl011_register_port(struct uart_amba_port *uap) - if (ret < 0) { - dev_err(uap->port.dev, - "Failed to register AMBA-PL011 driver\n"); -+ for (i = 0; i < ARRAY_SIZE(amba_ports); i++) -+ if (amba_ports[i] == uap) -+ amba_ports[i] = NULL; - return ret; - } - } -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 83fd51607741b..71f99e9217592 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1791,9 +1791,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, - ourport->tx_irq = ret + 1; - } - -- ret = platform_get_irq(platdev, 1); -- if (ret > 0) -- ourport->tx_irq = ret; -+ if (!s3c24xx_serial_has_interrupt_mask(port)) { -+ ret = platform_get_irq(platdev, 1); -+ if (ret > 0) -+ ourport->tx_irq = ret; -+ } - /* - * DMA is currently supported only on DT platforms, if DMA properties - * are specified. -diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c -index 2f72514d63edd..bf83e6c212f59 100644 ---- a/drivers/tty/serial/stm32-usart.c -+++ b/drivers/tty/serial/stm32-usart.c -@@ -937,7 +937,7 @@ static int stm32_init_port(struct stm32_port *stm32port, - stm32_init_rs485(port, pdev); - - if (stm32port->info->cfg.has_wakeup) { -- stm32port->wakeirq = platform_get_irq(pdev, 1); -+ stm32port->wakeirq = platform_get_irq_optional(pdev, 1); - if (stm32port->wakeirq <= 0 && stm32port->wakeirq != -ENXIO) - return stm32port->wakeirq ? : -ENODEV; - } -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 8051c70326277..d07a9c9c76081 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -1196,7 +1196,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - unsigned int old_rows, old_row_size, first_copied_row; - unsigned int new_cols, new_rows, new_row_size, new_screen_size; - unsigned int user; -- unsigned short *newscreen; -+ unsigned short *oldscreen, *newscreen; - struct uni_screen *new_uniscr = NULL; - - WARN_CONSOLE_UNLOCKED(); -@@ -1294,10 +1294,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, - if (new_scr_end > new_origin) - scr_memsetw((void *)new_origin, vc->vc_video_erase_char, - new_scr_end - new_origin); -- kfree(vc->vc_screenbuf); -+ oldscreen = vc->vc_screenbuf; - vc->vc_screenbuf = newscreen; - vc->vc_screenbuf_size = new_screen_size; - set_origin(vc); -+ kfree(oldscreen); - - /* do part of a reset_terminal() */ - vc->vc_top = 0; -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index daf61c28ba766..cbc85c995d92d 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -893,12 +893,22 @@ int vt_ioctl(struct tty_struct *tty, - console_lock(); - vcp = vc_cons[i].d; - if (vcp) { -+ int ret; -+ int save_scan_lines = vcp->vc_scan_lines; -+ int save_font_height = vcp->vc_font.height; -+ - if (v.v_vlin) - vcp->vc_scan_lines = v.v_vlin; - if (v.v_clin) - vcp->vc_font.height = v.v_clin; - vcp->vc_resize_user = 1; -- vc_resize(vcp, v.v_cols, v.v_rows); -+ ret = vc_resize(vcp, v.v_cols, v.v_rows); -+ if (ret) { -+ vcp->vc_scan_lines = save_scan_lines; -+ vcp->vc_font.height = save_font_height; -+ console_unlock(); -+ return ret; -+ } - } - console_unlock(); - } -diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c -index 856c34010021b..9900888afbcd8 100644 ---- a/drivers/usb/cdns3/gadget.c -+++ b/drivers/usb/cdns3/gadget.c -@@ -189,10 +189,10 @@ int cdns3_allocate_trb_pool(struct cdns3_endpoint *priv_ep) - GFP_DMA32 | GFP_ATOMIC); - if (!priv_ep->trb_pool) - return -ENOMEM; -- } else { -- memset(priv_ep->trb_pool, 0, ring_size); - } - -+ memset(priv_ep->trb_pool, 0, ring_size); -+ - if (!priv_ep->num) - return 0; - -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index d5187b50fc828..7499ba118665a 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -378,21 +378,19 @@ static void acm_ctrl_irq(struct urb *urb) - if (current_size < expected_size) { - /* notification is transmitted fragmented, reassemble */ - if (acm->nb_size < expected_size) { -- if (acm->nb_size) { -- kfree(acm->notification_buffer); -- acm->nb_size = 0; -- } -+ u8 *new_buffer; - alloc_size = roundup_pow_of_two(expected_size); -- /* -- * kmalloc ensures a valid notification_buffer after a -- * use of kfree in case the previous allocation was too -- * small. Final freeing is done on disconnect. -- */ -- acm->notification_buffer = -- kmalloc(alloc_size, GFP_ATOMIC); -- if (!acm->notification_buffer) -+ /* Final freeing is done on disconnect. */ -+ new_buffer = krealloc(acm->notification_buffer, -+ alloc_size, GFP_ATOMIC); -+ if (!new_buffer) { -+ acm->nb_index = 0; - goto exit; -+ } -+ -+ acm->notification_buffer = new_buffer; - acm->nb_size = alloc_size; -+ dr = (struct usb_cdc_notification *)acm->notification_buffer; - } - - copy_size = min(current_size, -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index c96c50faccf72..2f068e525a374 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -370,6 +370,10 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x0926, 0x0202), .driver_info = - USB_QUIRK_ENDPOINT_BLACKLIST }, - -+ /* Sound Devices MixPre-D */ -+ { USB_DEVICE(0x0926, 0x0208), .driver_info = -+ USB_QUIRK_ENDPOINT_BLACKLIST }, -+ - /* Keytouch QWERTY Panel keyboard */ - { USB_DEVICE(0x0926, 0x3333), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -@@ -465,6 +469,8 @@ static const struct usb_device_id usb_quirk_list[] = { - - { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, - -+ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* DJI CineSSD */ - { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, - -@@ -509,6 +515,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { - */ - static const struct usb_device_id usb_endpoint_blacklist[] = { - { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0202, 1), .driver_info = 0x85 }, -+ { USB_DEVICE_INTERFACE_NUMBER(0x0926, 0x0208, 1), .driver_info = 0x85 }, - { } - }; - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 17340864a5408..4225544342519 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1017,26 +1017,24 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, - * dwc3_prepare_one_trb - setup one TRB from one request - * @dep: endpoint for which this request is prepared - * @req: dwc3_request pointer -+ * @trb_length: buffer size of the TRB - * @chain: should this TRB be chained to the next? - * @node: only for isochronous endpoints. First TRB needs different type. - */ - static void dwc3_prepare_one_trb(struct dwc3_ep *dep, -- struct dwc3_request *req, unsigned chain, unsigned node) -+ struct dwc3_request *req, unsigned int trb_length, -+ unsigned chain, unsigned node) - { - struct dwc3_trb *trb; -- unsigned int length; - dma_addr_t dma; - unsigned stream_id = req->request.stream_id; - unsigned short_not_ok = req->request.short_not_ok; - unsigned no_interrupt = req->request.no_interrupt; - -- if (req->request.num_sgs > 0) { -- length = sg_dma_len(req->start_sg); -+ if (req->request.num_sgs > 0) - dma = sg_dma_address(req->start_sg); -- } else { -- length = req->request.length; -+ else - dma = req->request.dma; -- } - - trb = &dep->trb_pool[dep->trb_enqueue]; - -@@ -1048,7 +1046,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep, - - req->num_trbs++; - -- __dwc3_prepare_one_trb(dep, trb, dma, length, chain, node, -+ __dwc3_prepare_one_trb(dep, trb, dma, trb_length, chain, node, - stream_id, short_not_ok, no_interrupt); - } - -@@ -1058,16 +1056,27 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, - struct scatterlist *sg = req->start_sg; - struct scatterlist *s; - int i; -- -+ unsigned int length = req->request.length; - unsigned int remaining = req->request.num_mapped_sgs - - req->num_queued_sgs; - -+ /* -+ * If we resume preparing the request, then get the remaining length of -+ * the request and resume where we left off. -+ */ -+ for_each_sg(req->request.sg, s, req->num_queued_sgs, i) -+ length -= sg_dma_len(s); -+ - for_each_sg(sg, s, remaining, i) { -- unsigned int length = req->request.length; - unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc); - unsigned int rem = length % maxp; -+ unsigned int trb_length; - unsigned chain = true; - -+ trb_length = min_t(unsigned int, length, sg_dma_len(s)); -+ -+ length -= trb_length; -+ - /* - * IOMMU driver is coalescing the list of sgs which shares a - * page boundary into one and giving it to USB driver. With -@@ -1075,7 +1084,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, - * sgs passed. So mark the chain bit to false if it isthe last - * mapped sg. - */ -- if (i == remaining - 1) -+ if ((i == remaining - 1) || !length) - chain = false; - - if (rem && usb_endpoint_dir_out(dep->endpoint.desc) && !chain) { -@@ -1085,7 +1094,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, - req->needs_extra_trb = true; - - /* prepare normal TRB */ -- dwc3_prepare_one_trb(dep, req, true, i); -+ dwc3_prepare_one_trb(dep, req, trb_length, true, i); - - /* Now prepare one extra TRB to align transfer size */ - trb = &dep->trb_pool[dep->trb_enqueue]; -@@ -1095,8 +1104,37 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, - req->request.stream_id, - req->request.short_not_ok, - req->request.no_interrupt); -+ } else if (req->request.zero && req->request.length && -+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) && -+ !rem && !chain) { -+ struct dwc3 *dwc = dep->dwc; -+ struct dwc3_trb *trb; -+ -+ req->needs_extra_trb = true; -+ -+ /* Prepare normal TRB */ -+ dwc3_prepare_one_trb(dep, req, trb_length, true, i); -+ -+ /* Prepare one extra TRB to handle ZLP */ -+ trb = &dep->trb_pool[dep->trb_enqueue]; -+ req->num_trbs++; -+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0, -+ !req->direction, 1, -+ req->request.stream_id, -+ req->request.short_not_ok, -+ req->request.no_interrupt); -+ -+ /* Prepare one more TRB to handle MPS alignment */ -+ if (!req->direction) { -+ trb = &dep->trb_pool[dep->trb_enqueue]; -+ req->num_trbs++; -+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp, -+ false, 1, req->request.stream_id, -+ req->request.short_not_ok, -+ req->request.no_interrupt); -+ } - } else { -- dwc3_prepare_one_trb(dep, req, chain, i); -+ dwc3_prepare_one_trb(dep, req, trb_length, chain, i); - } - - /* -@@ -1111,6 +1149,16 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep, - - req->num_queued_sgs++; - -+ /* -+ * The number of pending SG entries may not correspond to the -+ * number of mapped SG entries. If all the data are queued, then -+ * don't include unused SG entries. -+ */ -+ if (length == 0) { -+ req->num_pending_sgs -= req->request.num_mapped_sgs - req->num_queued_sgs; -+ break; -+ } -+ - if (!dwc3_calc_trbs_left(dep)) - break; - } -@@ -1130,7 +1178,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, - req->needs_extra_trb = true; - - /* prepare normal TRB */ -- dwc3_prepare_one_trb(dep, req, true, 0); -+ dwc3_prepare_one_trb(dep, req, length, true, 0); - - /* Now prepare one extra TRB to align transfer size */ - trb = &dep->trb_pool[dep->trb_enqueue]; -@@ -1140,6 +1188,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, - req->request.short_not_ok, - req->request.no_interrupt); - } else if (req->request.zero && req->request.length && -+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) && - (IS_ALIGNED(req->request.length, maxp))) { - struct dwc3 *dwc = dep->dwc; - struct dwc3_trb *trb; -@@ -1147,17 +1196,27 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep, - req->needs_extra_trb = true; - - /* prepare normal TRB */ -- dwc3_prepare_one_trb(dep, req, true, 0); -+ dwc3_prepare_one_trb(dep, req, length, true, 0); - -- /* Now prepare one extra TRB to handle ZLP */ -+ /* Prepare one extra TRB to handle ZLP */ - trb = &dep->trb_pool[dep->trb_enqueue]; - req->num_trbs++; - __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0, -- false, 1, req->request.stream_id, -+ !req->direction, 1, req->request.stream_id, - req->request.short_not_ok, - req->request.no_interrupt); -+ -+ /* Prepare one more TRB to handle MPS alignment for OUT */ -+ if (!req->direction) { -+ trb = &dep->trb_pool[dep->trb_enqueue]; -+ req->num_trbs++; -+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp, -+ false, 1, req->request.stream_id, -+ req->request.short_not_ok, -+ req->request.no_interrupt); -+ } - } else { -- dwc3_prepare_one_trb(dep, req, false, 0); -+ dwc3_prepare_one_trb(dep, req, length, false, 0); - } - } - -@@ -2559,8 +2618,17 @@ static int dwc3_gadget_ep_cleanup_completed_request(struct dwc3_ep *dep, - status); - - if (req->needs_extra_trb) { -+ unsigned int maxp = usb_endpoint_maxp(dep->endpoint.desc); -+ - ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event, - status); -+ -+ /* Reclaim MPS padding TRB for ZLP */ -+ if (!req->direction && req->request.zero && req->request.length && -+ !usb_endpoint_xfer_isoc(dep->endpoint.desc) && -+ (IS_ALIGNED(req->request.length, maxp))) -+ ret = dwc3_gadget_ep_reclaim_trb_linear(dep, req, event, status); -+ - req->needs_extra_trb = false; - } - -diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c -index 1d900081b1f0c..b4206b0dede54 100644 ---- a/drivers/usb/gadget/function/f_ncm.c -+++ b/drivers/usb/gadget/function/f_ncm.c -@@ -1181,12 +1181,15 @@ static int ncm_unwrap_ntb(struct gether *port, - int ndp_index; - unsigned dg_len, dg_len2; - unsigned ndp_len; -+ unsigned block_len; - struct sk_buff *skb2; - int ret = -EINVAL; -- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); -+ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); -+ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize); - const struct ndp_parser_opts *opts = ncm->parser_opts; - unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; - int dgram_counter; -+ bool ndp_after_header; - - /* dwSignature */ - if (get_unaligned_le32(tmp) != opts->nth_sign) { -@@ -1205,25 +1208,37 @@ static int ncm_unwrap_ntb(struct gether *port, - } - tmp++; /* skip wSequence */ - -+ block_len = get_ncm(&tmp, opts->block_length); - /* (d)wBlockLength */ -- if (get_ncm(&tmp, opts->block_length) > max_size) { -+ if (block_len > ntb_max) { - INFO(port->func.config->cdev, "OUT size exceeded\n"); - goto err; - } - - ndp_index = get_ncm(&tmp, opts->ndp_index); -+ ndp_after_header = false; - - /* Run through all the NDP's in the NTB */ - do { -- /* NCM 3.2 */ -- if (((ndp_index % 4) != 0) && -- (ndp_index < opts->nth_size)) { -+ /* -+ * NCM 3.2 -+ * dwNdpIndex -+ */ -+ if (((ndp_index % 4) != 0) || -+ (ndp_index < opts->nth_size) || -+ (ndp_index > (block_len - -+ opts->ndp_size))) { - INFO(port->func.config->cdev, "Bad index: %#X\n", - ndp_index); - goto err; - } -+ if (ndp_index == opts->nth_size) -+ ndp_after_header = true; - -- /* walk through NDP */ -+ /* -+ * walk through NDP -+ * dwSignature -+ */ - tmp = (void *)(skb->data + ndp_index); - if (get_unaligned_le32(tmp) != ncm->ndp_sign) { - INFO(port->func.config->cdev, "Wrong NDP SIGN\n"); -@@ -1234,14 +1249,15 @@ static int ncm_unwrap_ntb(struct gether *port, - ndp_len = get_unaligned_le16(tmp++); - /* - * NCM 3.3.1 -+ * wLength - * entry is 2 items - * item size is 16/32 bits, opts->dgram_item_len * 2 bytes - * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry - * Each entry is a dgram index and a dgram length. - */ - if ((ndp_len < opts->ndp_size -- + 2 * 2 * (opts->dgram_item_len * 2)) -- || (ndp_len % opts->ndplen_align != 0)) { -+ + 2 * 2 * (opts->dgram_item_len * 2)) || -+ (ndp_len % opts->ndplen_align != 0)) { - INFO(port->func.config->cdev, "Bad NDP length: %#X\n", - ndp_len); - goto err; -@@ -1258,8 +1274,21 @@ static int ncm_unwrap_ntb(struct gether *port, - - do { - index = index2; -+ /* wDatagramIndex[0] */ -+ if ((index < opts->nth_size) || -+ (index > block_len - opts->dpe_size)) { -+ INFO(port->func.config->cdev, -+ "Bad index: %#X\n", index); -+ goto err; -+ } -+ - dg_len = dg_len2; -- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */ -+ /* -+ * wDatagramLength[0] -+ * ethernet hdr + crc or larger than max frame size -+ */ -+ if ((dg_len < 14 + crc_len) || -+ (dg_len > frame_max)) { - INFO(port->func.config->cdev, - "Bad dgram length: %#X\n", dg_len); - goto err; -@@ -1283,6 +1312,37 @@ static int ncm_unwrap_ntb(struct gether *port, - index2 = get_ncm(&tmp, opts->dgram_item_len); - dg_len2 = get_ncm(&tmp, opts->dgram_item_len); - -+ if (index2 == 0 || dg_len2 == 0) -+ break; -+ -+ /* wDatagramIndex[1] */ -+ if (ndp_after_header) { -+ if (index2 < opts->nth_size + opts->ndp_size) { -+ INFO(port->func.config->cdev, -+ "Bad index: %#X\n", index2); -+ goto err; -+ } -+ } else { -+ if (index2 < opts->nth_size + opts->dpe_size) { -+ INFO(port->func.config->cdev, -+ "Bad index: %#X\n", index2); -+ goto err; -+ } -+ } -+ if (index2 > block_len - opts->dpe_size) { -+ INFO(port->func.config->cdev, -+ "Bad index: %#X\n", index2); -+ goto err; -+ } -+ -+ /* wDatagramLength[1] */ -+ if ((dg_len2 < 14 + crc_len) || -+ (dg_len2 > frame_max)) { -+ INFO(port->func.config->cdev, -+ "Bad dgram length: %#X\n", dg_len); -+ goto err; -+ } -+ - /* - * Copy the data into a new skb. - * This ensures the truesize is correct -@@ -1299,9 +1359,6 @@ static int ncm_unwrap_ntb(struct gether *port, - ndp_len -= 2 * (opts->dgram_item_len * 2); - - dgram_counter++; -- -- if (index2 == 0 || dg_len2 == 0) -- break; - } while (ndp_len > 2 * (opts->dgram_item_len * 2)); - } while (ndp_index); - -diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c -index 7f01f78b1d238..f6d203fec4955 100644 ---- a/drivers/usb/gadget/function/f_tcm.c -+++ b/drivers/usb/gadget/function/f_tcm.c -@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) - goto err_sts; - - return 0; -+ - err_sts: -- usb_ep_free_request(fu->ep_status, stream->req_status); -- stream->req_status = NULL; --err_out: - usb_ep_free_request(fu->ep_out, stream->req_out); - stream->req_out = NULL; -+err_out: -+ usb_ep_free_request(fu->ep_in, stream->req_in); -+ stream->req_in = NULL; - out: - return -ENOMEM; - } -diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h -index eaa13fd3dc7f3..e313c3b8dcb19 100644 ---- a/drivers/usb/gadget/u_f.h -+++ b/drivers/usb/gadget/u_f.h -@@ -14,6 +14,7 @@ - #define __U_F_H__ - - #include -+#include - - /* Variable Length Array Macros **********************************************/ - #define vla_group(groupname) size_t groupname##__next = 0 -@@ -21,21 +22,36 @@ - - #define vla_item(groupname, type, name, n) \ - size_t groupname##_##name##__offset = ({ \ -- size_t align_mask = __alignof__(type) - 1; \ -- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ -- size_t size = (n) * sizeof(type); \ -- groupname##__next = offset + size; \ -+ size_t offset = 0; \ -+ if (groupname##__next != SIZE_MAX) { \ -+ size_t align_mask = __alignof__(type) - 1; \ -+ size_t size = array_size(n, sizeof(type)); \ -+ offset = (groupname##__next + align_mask) & \ -+ ~align_mask; \ -+ if (check_add_overflow(offset, size, \ -+ &groupname##__next)) { \ -+ groupname##__next = SIZE_MAX; \ -+ offset = 0; \ -+ } \ -+ } \ - offset; \ - }) - - #define vla_item_with_sz(groupname, type, name, n) \ -- size_t groupname##_##name##__sz = (n) * sizeof(type); \ -- size_t groupname##_##name##__offset = ({ \ -- size_t align_mask = __alignof__(type) - 1; \ -- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ -- size_t size = groupname##_##name##__sz; \ -- groupname##__next = offset + size; \ -- offset; \ -+ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \ -+ size_t groupname##_##name##__offset = ({ \ -+ size_t offset = 0; \ -+ if (groupname##__next != SIZE_MAX) { \ -+ size_t align_mask = __alignof__(type) - 1; \ -+ offset = (groupname##__next + align_mask) & \ -+ ~align_mask; \ -+ if (check_add_overflow(offset, groupname##_##name##__sz,\ -+ &groupname##__next)) { \ -+ groupname##__next = SIZE_MAX; \ -+ offset = 0; \ -+ } \ -+ } \ -+ offset; \ - }) - - #define vla_ptr(ptr, groupname, name) \ -diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c -index d5ce98e205c73..d8b6c9f5695c9 100644 ---- a/drivers/usb/host/ohci-exynos.c -+++ b/drivers/usb/host/ohci-exynos.c -@@ -171,9 +171,8 @@ static int exynos_ohci_probe(struct platform_device *pdev) - hcd->rsrc_len = resource_size(res); - - irq = platform_get_irq(pdev, 0); -- if (!irq) { -- dev_err(&pdev->dev, "Failed to get IRQ\n"); -- err = -ENODEV; -+ if (irq < 0) { -+ err = irq; - goto fail_io; - } - -diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c -index 76c3f29562d2b..448d7b11dec4c 100644 ---- a/drivers/usb/host/xhci-debugfs.c -+++ b/drivers/usb/host/xhci-debugfs.c -@@ -273,7 +273,7 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused) - - static int xhci_endpoint_context_show(struct seq_file *s, void *unused) - { -- int dci; -+ int ep_index; - dma_addr_t dma; - struct xhci_hcd *xhci; - struct xhci_ep_ctx *ep_ctx; -@@ -282,9 +282,9 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused) - - xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus)); - -- for (dci = 1; dci < 32; dci++) { -- ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, dci); -- dma = dev->out_ctx->dma + dci * CTX_SIZE(xhci->hcc_params); -+ for (ep_index = 0; ep_index < 31; ep_index++) { -+ ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index); -+ dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params); - seq_printf(s, "%pad: %s\n", &dma, - xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info), - le32_to_cpu(ep_ctx->ep_info2), -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index 3196de2931b12..933936abb6fb7 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -738,15 +738,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, - { - u32 pls = status_reg & PORT_PLS_MASK; - -- /* resume state is a xHCI internal state. -- * Do not report it to usb core, instead, pretend to be U3, -- * thus usb core knows it's not ready for transfer -- */ -- if (pls == XDEV_RESUME) { -- *status |= USB_SS_PORT_LS_U3; -- return; -- } -- - /* When the CAS bit is set then warm reset - * should be performed on port - */ -@@ -768,6 +759,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, - */ - pls |= USB_PORT_STAT_CONNECTION; - } else { -+ /* -+ * Resume state is an xHCI internal state. Do not report it to -+ * usb core, instead, pretend to be U3, thus usb core knows -+ * it's not ready for transfer. -+ */ -+ if (pls == XDEV_RESUME) { -+ *status |= USB_SS_PORT_LS_U3; -+ return; -+ } -+ - /* - * If CAS bit isn't set but the Port is already at - * Compliance Mode, fake a connection so the USB core -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index 11a65854d3f09..bad154f446f8d 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -3236,10 +3236,11 @@ static void xhci_endpoint_reset(struct usb_hcd *hcd, - - wait_for_completion(cfg_cmd->completion); - -- ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE; - xhci_free_command(xhci, cfg_cmd); - cleanup: - xhci_free_command(xhci, stop_cmd); -+ if (ep->ep_state & EP_SOFT_CLEAR_TOGGLE) -+ ep->ep_state &= ~EP_SOFT_CLEAR_TOGGLE; - } - - static int xhci_check_streams_endpoint(struct xhci_hcd *xhci, -diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c -index 407fe7570f3bc..f8686139d6f39 100644 ---- a/drivers/usb/misc/lvstest.c -+++ b/drivers/usb/misc/lvstest.c -@@ -426,7 +426,7 @@ static int lvs_rh_probe(struct usb_interface *intf, - USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT); - if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) { - dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret); -- return ret; -+ return ret < 0 ? ret : -EINVAL; - } - - /* submit urb to poll interrupt endpoint */ -diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c -index fc8a5da4a07c9..0734e6dd93862 100644 ---- a/drivers/usb/misc/sisusbvga/sisusb.c -+++ b/drivers/usb/misc/sisusbvga/sisusb.c -@@ -761,7 +761,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, - u8 swap8, fromkern = kernbuffer ? 1 : 0; - u16 swap16; - u32 swap32, flag = (length >> 28) & 1; -- char buf[4]; -+ u8 buf[4]; - - /* if neither kernbuffer not userbuffer are given, assume - * data in obuf -diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c -index be0505b8b5d4e..785080f790738 100644 ---- a/drivers/usb/misc/yurex.c -+++ b/drivers/usb/misc/yurex.c -@@ -492,7 +492,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, - prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE); - dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__, - dev->cntl_buffer[0]); -- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL); -+ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC); - if (retval >= 0) - timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); - finish_wait(&dev->waitq, &wait); -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index f6c3681fa2e9e..88275842219ef 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2328,7 +2328,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, - "JMicron", - "USB to ATA/ATAPI Bridge", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, -- US_FL_BROKEN_FUA ), -+ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ), - - /* Reported by Andrey Rahmatullin */ - UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index 37157ed9a881a..dcdfcdfd2ad13 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -28,6 +28,13 @@ - * and don't forget to CC: the USB development list - */ - -+/* Reported-by: Till Dörges */ -+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999, -+ "Sony", -+ "PSZ-HA*", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_REPORT_OPCODES), -+ - /* Reported-by: Julian Groß */ - UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999, - "LaCie", -@@ -80,6 +87,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_BROKEN_FUA), - -+/* Reported-by: Thinh Nguyen */ -+UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, -+ "PNY", -+ "Pro Elite SSD", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_ATA_1X), -+ - /* Reported-by: Hans de Goede */ - UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, - "VIA", -diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c -index 22070cfea1d06..31f00d72f1493 100644 ---- a/drivers/video/fbdev/core/fbcon.c -+++ b/drivers/video/fbdev/core/fbcon.c -@@ -2185,6 +2185,9 @@ static void updatescrollmode(struct fbcon_display *p, - } - } - -+#define PITCH(w) (((w) + 7) >> 3) -+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ -+ - static int fbcon_resize(struct vc_data *vc, unsigned int width, - unsigned int height, unsigned int user) - { -@@ -2194,6 +2197,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, - struct fb_var_screeninfo var = info->var; - int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; - -+ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { -+ int size; -+ int pitch = PITCH(vc->vc_font.width); -+ -+ /* -+ * If user font, ensure that a possible change to user font -+ * height or width will not allow a font data out-of-bounds access. -+ * NOTE: must use original charcount in calculation as font -+ * charcount can change and cannot be used to determine the -+ * font data allocated size. -+ */ -+ if (pitch <= 0) -+ return -EINVAL; -+ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data)); -+ if (size > FNTSIZE(vc->vc_font.data)) -+ return -EINVAL; -+ } -+ - virt_w = FBCON_SWAP(ops->rotate, width, height); - virt_h = FBCON_SWAP(ops->rotate, height, width); - virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width, -@@ -2645,7 +2666,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, - int size; - int i, csum; - u8 *new_data, *data = font->data; -- int pitch = (font->width+7) >> 3; -+ int pitch = PITCH(font->width); - - /* Is there a reason why fbconsole couldn't handle any charcount >256? - * If not this check should be changed to charcount < 256 */ -@@ -2661,7 +2682,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, - if (fbcon_invalid_charcount(info, charcount)) - return -EINVAL; - -- size = h * pitch * charcount; -+ size = CALC_FONTSZ(h, pitch, charcount); - - new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); - -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index e72738371ecbe..97abcd497c7e0 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -952,7 +952,6 @@ static int fb_check_caps(struct fb_info *info, struct fb_var_screeninfo *var, - int - fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) - { -- int flags = info->flags; - int ret = 0; - u32 activate; - struct fb_var_screeninfo old_var; -@@ -1047,9 +1046,6 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) - event.data = &mode; - fb_notifier_call_chain(FB_EVENT_MODE_CHANGE, &event); - -- if (flags & FBINFO_MISC_USEREVENT) -- fbcon_update_vcs(info, activate & FB_ACTIVATE_ALL); -- - return 0; - } - EXPORT_SYMBOL(fb_set_var); -@@ -1100,9 +1096,9 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd, - return -EFAULT; - console_lock(); - lock_fb_info(info); -- info->flags |= FBINFO_MISC_USEREVENT; - ret = fb_set_var(info, &var); -- info->flags &= ~FBINFO_MISC_USEREVENT; -+ if (!ret) -+ fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); - unlock_fb_info(info); - console_unlock(); - if (!ret && copy_to_user(argp, &var, sizeof(var))) -diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c -index d54c88f88991d..65dae05fff8e6 100644 ---- a/drivers/video/fbdev/core/fbsysfs.c -+++ b/drivers/video/fbdev/core/fbsysfs.c -@@ -91,9 +91,9 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var) - - var->activate |= FB_ACTIVATE_FORCE; - console_lock(); -- fb_info->flags |= FBINFO_MISC_USEREVENT; - err = fb_set_var(fb_info, var); -- fb_info->flags &= ~FBINFO_MISC_USEREVENT; -+ if (!err) -+ fbcon_update_vcs(fb_info, var->activate & FB_ACTIVATE_ALL); - console_unlock(); - if (err) - return err; -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -index 376ee5bc3ddc9..34e8171856e95 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c -@@ -520,8 +520,11 @@ int dispc_runtime_get(void) - DSSDBG("dispc_runtime_get\n"); - - r = pm_runtime_get_sync(&dispc.pdev->dev); -- WARN_ON(r < 0); -- return r < 0 ? r : 0; -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&dispc.pdev->dev); -+ return r; -+ } -+ return 0; - } - EXPORT_SYMBOL(dispc_runtime_get); - -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c -index d620376216e1d..6f9c25fec9946 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c -@@ -1137,8 +1137,11 @@ static int dsi_runtime_get(struct platform_device *dsidev) - DSSDBG("dsi_runtime_get\n"); - - r = pm_runtime_get_sync(&dsi->pdev->dev); -- WARN_ON(r < 0); -- return r < 0 ? r : 0; -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&dsi->pdev->dev); -+ return r; -+ } -+ return 0; - } - - static void dsi_runtime_put(struct platform_device *dsidev) -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c -index bfc5c4c5a26ad..a6b1c1598040d 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c -@@ -768,8 +768,11 @@ int dss_runtime_get(void) - DSSDBG("dss_runtime_get\n"); - - r = pm_runtime_get_sync(&dss.pdev->dev); -- WARN_ON(r < 0); -- return r < 0 ? r : 0; -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&dss.pdev->dev); -+ return r; -+ } -+ return 0; - } - - void dss_runtime_put(void) -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c -index 7060ae56c062c..4804aab342981 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c -@@ -39,9 +39,10 @@ static int hdmi_runtime_get(void) - DSSDBG("hdmi_runtime_get\n"); - - r = pm_runtime_get_sync(&hdmi.pdev->dev); -- WARN_ON(r < 0); -- if (r < 0) -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&hdmi.pdev->dev); - return r; -+ } - - return 0; - } -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c -index ac49531e47327..a06b6f1355bdb 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c -@@ -43,9 +43,10 @@ static int hdmi_runtime_get(void) - DSSDBG("hdmi_runtime_get\n"); - - r = pm_runtime_get_sync(&hdmi.pdev->dev); -- WARN_ON(r < 0); -- if (r < 0) -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&hdmi.pdev->dev); - return r; -+ } - - return 0; - } -diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c -index f81e2a46366dd..3717dac3dcc83 100644 ---- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c -+++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c -@@ -391,8 +391,11 @@ static int venc_runtime_get(void) - DSSDBG("venc_runtime_get\n"); - - r = pm_runtime_get_sync(&venc.pdev->dev); -- WARN_ON(r < 0); -- return r < 0 ? r : 0; -+ if (WARN_ON(r < 0)) { -+ pm_runtime_put_sync(&venc.pdev->dev); -+ return r; -+ } -+ return 0; - } - - static void venc_runtime_put(void) -diff --git a/drivers/video/fbdev/ps3fb.c b/drivers/video/fbdev/ps3fb.c -index 5ed2db39d8236..ce90483c50209 100644 ---- a/drivers/video/fbdev/ps3fb.c -+++ b/drivers/video/fbdev/ps3fb.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -824,12 +825,12 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd, - var = info->var; - fb_videomode_to_var(&var, vmode); - console_lock(); -- info->flags |= FBINFO_MISC_USEREVENT; - /* Force, in case only special bits changed */ - var.activate |= FB_ACTIVATE_FORCE; - par->new_mode_id = val; - retval = fb_set_var(info, &var); -- info->flags &= ~FBINFO_MISC_USEREVENT; -+ if (!retval) -+ fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); - console_unlock(); - } - break; -diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c -index 6c8843968a52d..55f2b834cf130 100644 ---- a/drivers/xen/events/events_base.c -+++ b/drivers/xen/events/events_base.c -@@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn) - /* Get info for IRQ */ - struct irq_info *info_for_irq(unsigned irq) - { -- return irq_get_handler_data(irq); -+ return irq_get_chip_data(irq); - } - - /* Constructors for packed IRQ information. */ -@@ -376,7 +376,7 @@ static void xen_irq_init(unsigned irq) - info->type = IRQT_UNBOUND; - info->refcnt = -1; - -- irq_set_handler_data(irq, info); -+ irq_set_chip_data(irq, info); - - list_add_tail(&info->list, &xen_irq_list_head); - } -@@ -425,14 +425,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) - - static void xen_free_irq(unsigned irq) - { -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (WARN_ON(!info)) - return; - - list_del(&info->list); - -- irq_set_handler_data(irq, NULL); -+ irq_set_chip_data(irq, NULL); - - WARN_ON(info->refcnt > 0); - -@@ -602,7 +602,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); - static void __unbind_from_irq(unsigned int irq) - { - int evtchn = evtchn_from_irq(irq); -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (info->refcnt > 0) { - info->refcnt--; -@@ -1106,7 +1106,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, - - void unbind_from_irqhandler(unsigned int irq, void *dev_id) - { -- struct irq_info *info = irq_get_handler_data(irq); -+ struct irq_info *info = irq_get_chip_data(irq); - - if (WARN_ON(!info)) - return; -@@ -1140,7 +1140,7 @@ int evtchn_make_refcounted(unsigned int evtchn) - if (irq == -1) - return -ENOENT; - -- info = irq_get_handler_data(irq); -+ info = irq_get_chip_data(irq); - - if (!info) - return -ENOENT; -@@ -1168,7 +1168,7 @@ int evtchn_get(unsigned int evtchn) - if (irq == -1) - goto done; - -- info = irq_get_handler_data(irq); -+ info = irq_get_chip_data(irq); - - if (!info) - goto done; -diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c -index 831a2b25ba79f..196f9f64d075c 100644 ---- a/fs/binfmt_flat.c -+++ b/fs/binfmt_flat.c -@@ -571,7 +571,7 @@ static int load_flat_file(struct linux_binprm *bprm, - goto err; - } - -- len = data_len + extra; -+ len = data_len + extra + MAX_SHARED_LIBS * sizeof(unsigned long); - len = PAGE_ALIGN(len); - realdatastart = vm_mmap(NULL, 0, len, - PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, 0); -@@ -585,7 +585,9 @@ static int load_flat_file(struct linux_binprm *bprm, - vm_munmap(textpos, text_len); - goto err; - } -- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN); -+ datapos = ALIGN(realdatastart + -+ MAX_SHARED_LIBS * sizeof(unsigned long), -+ FLAT_DATA_ALIGN); - - pr_debug("Allocated data+bss+stack (%u bytes): %lx\n", - data_len + bss_len + stack_len, datapos); -@@ -615,7 +617,7 @@ static int load_flat_file(struct linux_binprm *bprm, - memp_size = len; - } else { - -- len = text_len + data_len + extra; -+ len = text_len + data_len + extra + MAX_SHARED_LIBS * sizeof(u32); - len = PAGE_ALIGN(len); - textpos = vm_mmap(NULL, 0, len, - PROT_READ | PROT_EXEC | PROT_WRITE, MAP_PRIVATE, 0); -@@ -630,7 +632,9 @@ static int load_flat_file(struct linux_binprm *bprm, - } - - realdatastart = textpos + ntohl(hdr->data_start); -- datapos = ALIGN(realdatastart, FLAT_DATA_ALIGN); -+ datapos = ALIGN(realdatastart + -+ MAX_SHARED_LIBS * sizeof(u32), -+ FLAT_DATA_ALIGN); - - reloc = (__be32 __user *) - (datapos + (ntohl(hdr->reloc_start) - text_len)); -@@ -647,9 +651,8 @@ static int load_flat_file(struct linux_binprm *bprm, - (text_len + full_data - - sizeof(struct flat_hdr)), - 0); -- if (datapos != realdatastart) -- memmove((void *)datapos, (void *)realdatastart, -- full_data); -+ memmove((void *) datapos, (void *) realdatastart, -+ full_data); - #else - /* - * This is used on MMU systems mainly for testing. -@@ -705,7 +708,8 @@ static int load_flat_file(struct linux_binprm *bprm, - if (IS_ERR_VALUE(result)) { - ret = result; - pr_err("Unable to read code+data+bss, errno %d\n", ret); -- vm_munmap(textpos, text_len + data_len + extra); -+ vm_munmap(textpos, text_len + data_len + extra + -+ MAX_SHARED_LIBS * sizeof(u32)); - goto err; - } - } -diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h -index 18357b054a91e..9a690c10afaa0 100644 ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -2415,7 +2415,7 @@ int btrfs_pin_extent_for_log_replay(struct btrfs_fs_info *fs_info, - u64 bytenr, u64 num_bytes); - int btrfs_exclude_logged_extents(struct extent_buffer *eb); - int btrfs_cross_ref_exist(struct btrfs_root *root, -- u64 objectid, u64 offset, u64 bytenr); -+ u64 objectid, u64 offset, u64 bytenr, bool strict); - struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans, - struct btrfs_root *root, - u64 parent, u64 root_objectid, -@@ -2821,7 +2821,7 @@ struct extent_map *btrfs_get_extent_fiemap(struct btrfs_inode *inode, - u64 start, u64 len); - noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - u64 *orig_start, u64 *orig_block_len, -- u64 *ram_bytes); -+ u64 *ram_bytes, bool strict); - - void __btrfs_del_delalloc_inode(struct btrfs_root *root, - struct btrfs_inode *inode); -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index ad1c8e3b8133a..dd6fb2ee80409 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -4477,6 +4477,7 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache) - cache->io_ctl.inode = NULL; - iput(inode); - } -+ ASSERT(cache->io_ctl.pages == NULL); - btrfs_put_block_group(cache); - } - -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index a36bd4507bacd..ef05cbacef73f 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -2320,7 +2320,8 @@ static noinline int check_delayed_ref(struct btrfs_root *root, - - static noinline int check_committed_ref(struct btrfs_root *root, - struct btrfs_path *path, -- u64 objectid, u64 offset, u64 bytenr) -+ u64 objectid, u64 offset, u64 bytenr, -+ bool strict) - { - struct btrfs_fs_info *fs_info = root->fs_info; - struct btrfs_root *extent_root = fs_info->extent_root; -@@ -2362,9 +2363,13 @@ static noinline int check_committed_ref(struct btrfs_root *root, - btrfs_extent_inline_ref_size(BTRFS_EXTENT_DATA_REF_KEY)) - goto out; - -- /* If extent created before last snapshot => it's definitely shared */ -- if (btrfs_extent_generation(leaf, ei) <= -- btrfs_root_last_snapshot(&root->root_item)) -+ /* -+ * If extent created before last snapshot => it's shared unless the -+ * snapshot has been deleted. Use the heuristic if strict is false. -+ */ -+ if (!strict && -+ (btrfs_extent_generation(leaf, ei) <= -+ btrfs_root_last_snapshot(&root->root_item))) - goto out; - - iref = (struct btrfs_extent_inline_ref *)(ei + 1); -@@ -2389,7 +2394,7 @@ out: - } - - int btrfs_cross_ref_exist(struct btrfs_root *root, u64 objectid, u64 offset, -- u64 bytenr) -+ u64 bytenr, bool strict) - { - struct btrfs_path *path; - int ret; -@@ -2400,7 +2405,7 @@ int btrfs_cross_ref_exist(struct btrfs_root *root, u64 objectid, u64 offset, - - do { - ret = check_committed_ref(root, path, objectid, -- offset, bytenr); -+ offset, bytenr, strict); - if (ret && ret != -ENOENT) - goto out; - -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 3cfbccacef7fd..4e4ddd5629e55 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -1568,7 +1568,7 @@ static noinline int check_can_nocow(struct btrfs_inode *inode, loff_t pos, - - num_bytes = lockend - lockstart + 1; - ret = can_nocow_extent(&inode->vfs_inode, lockstart, &num_bytes, -- NULL, NULL, NULL); -+ NULL, NULL, NULL, false); - if (ret <= 0) { - ret = 0; - btrfs_end_write_no_snapshotting(root); -@@ -3130,14 +3130,14 @@ reserve_space: - if (ret < 0) - goto out; - space_reserved = true; -- ret = btrfs_qgroup_reserve_data(inode, &data_reserved, -- alloc_start, bytes_to_reserve); -- if (ret) -- goto out; - ret = btrfs_punch_hole_lock_range(inode, lockstart, lockend, - &cached_state); - if (ret) - goto out; -+ ret = btrfs_qgroup_reserve_data(inode, &data_reserved, -+ alloc_start, bytes_to_reserve); -+ if (ret) -+ goto out; - ret = btrfs_prealloc_file_range(inode, mode, alloc_start, - alloc_end - alloc_start, - i_blocksize(inode), -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index 8bfc0f348ad55..6e6be922b937d 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -1166,7 +1166,6 @@ static int __btrfs_wait_cache_io(struct btrfs_root *root, - ret = update_cache_item(trans, root, inode, path, offset, - io_ctl->entries, io_ctl->bitmaps); - out: -- io_ctl_free(io_ctl); - if (ret) { - invalidate_inode_pages2(inode->i_mapping); - BTRFS_I(inode)->generation = 0; -@@ -1329,6 +1328,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, - * them out later - */ - io_ctl_drop_pages(io_ctl); -+ io_ctl_free(io_ctl); - - unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0, - i_size_read(inode) - 1, &cached_state); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index fa7f3a59813ea..9ac40991a6405 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -1578,7 +1578,7 @@ next_slot: - goto out_check; - ret = btrfs_cross_ref_exist(root, ino, - found_key.offset - -- extent_offset, disk_bytenr); -+ extent_offset, disk_bytenr, false); - if (ret) { - /* - * ret could be -EIO if the above fails to read -@@ -7529,7 +7529,7 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode, - */ - noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - u64 *orig_start, u64 *orig_block_len, -- u64 *ram_bytes) -+ u64 *ram_bytes, bool strict) - { - struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); - struct btrfs_path *path; -@@ -7607,8 +7607,9 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - * Do the same check as in btrfs_cross_ref_exist but without the - * unnecessary search. - */ -- if (btrfs_file_extent_generation(leaf, fi) <= -- btrfs_root_last_snapshot(&root->root_item)) -+ if (!strict && -+ (btrfs_file_extent_generation(leaf, fi) <= -+ btrfs_root_last_snapshot(&root->root_item))) - goto out; - - backref_offset = btrfs_file_extent_offset(leaf, fi); -@@ -7644,7 +7645,8 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, - */ - - ret = btrfs_cross_ref_exist(root, btrfs_ino(BTRFS_I(inode)), -- key.offset - backref_offset, disk_bytenr); -+ key.offset - backref_offset, disk_bytenr, -+ strict); - if (ret) { - ret = 0; - goto out; -@@ -7865,7 +7867,7 @@ static int btrfs_get_blocks_direct_write(struct extent_map **map, - block_start = em->block_start + (start - em->start); - - if (can_nocow_extent(inode, start, &len, &orig_start, -- &orig_block_len, &ram_bytes) == 1 && -+ &orig_block_len, &ram_bytes, false) == 1 && - btrfs_inc_nocow_writers(fs_info, block_start)) { - struct extent_map *em2; - -@@ -9568,7 +9570,7 @@ void btrfs_destroy_inode(struct inode *inode) - btrfs_put_ordered_extent(ordered); - } - } -- btrfs_qgroup_check_reserved_leak(inode); -+ btrfs_qgroup_check_reserved_leak(BTRFS_I(inode)); - inode_tree_del(inode); - btrfs_drop_extent_cache(BTRFS_I(inode), 0, (u64)-1, 0); - } -@@ -11030,7 +11032,7 @@ static int btrfs_swap_activate(struct swap_info_struct *sis, struct file *file, - free_extent_map(em); - em = NULL; - -- ret = can_nocow_extent(inode, start, &len, NULL, NULL, NULL); -+ ret = can_nocow_extent(inode, start, &len, NULL, NULL, NULL, true); - if (ret < 0) { - goto out; - } else if (ret) { -diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c -index b94f6f99e90d0..04fd02e6124dd 100644 ---- a/fs/btrfs/qgroup.c -+++ b/fs/btrfs/qgroup.c -@@ -3769,7 +3769,7 @@ void btrfs_qgroup_convert_reserved_meta(struct btrfs_root *root, int num_bytes) - * Check qgroup reserved space leaking, normally at destroy inode - * time - */ --void btrfs_qgroup_check_reserved_leak(struct inode *inode) -+void btrfs_qgroup_check_reserved_leak(struct btrfs_inode *inode) - { - struct extent_changeset changeset; - struct ulist_node *unode; -@@ -3777,19 +3777,19 @@ void btrfs_qgroup_check_reserved_leak(struct inode *inode) - int ret; - - extent_changeset_init(&changeset); -- ret = clear_record_extent_bits(&BTRFS_I(inode)->io_tree, 0, (u64)-1, -+ ret = clear_record_extent_bits(&inode->io_tree, 0, (u64)-1, - EXTENT_QGROUP_RESERVED, &changeset); - - WARN_ON(ret < 0); - if (WARN_ON(changeset.bytes_changed)) { - ULIST_ITER_INIT(&iter); - while ((unode = ulist_next(&changeset.range_changed, &iter))) { -- btrfs_warn(BTRFS_I(inode)->root->fs_info, -- "leaking qgroup reserved space, ino: %lu, start: %llu, end: %llu", -- inode->i_ino, unode->val, unode->aux); -+ btrfs_warn(inode->root->fs_info, -+ "leaking qgroup reserved space, ino: %llu, start: %llu, end: %llu", -+ btrfs_ino(inode), unode->val, unode->aux); - } -- btrfs_qgroup_free_refroot(BTRFS_I(inode)->root->fs_info, -- BTRFS_I(inode)->root->root_key.objectid, -+ btrfs_qgroup_free_refroot(inode->root->fs_info, -+ inode->root->root_key.objectid, - changeset.bytes_changed, BTRFS_QGROUP_RSV_DATA); - - } -diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h -index 17e8ac992c502..b0420c4f5d0ef 100644 ---- a/fs/btrfs/qgroup.h -+++ b/fs/btrfs/qgroup.h -@@ -399,7 +399,7 @@ void btrfs_qgroup_free_meta_all_pertrans(struct btrfs_root *root); - */ - void btrfs_qgroup_convert_reserved_meta(struct btrfs_root *root, int num_bytes); - --void btrfs_qgroup_check_reserved_leak(struct inode *inode); -+void btrfs_qgroup_check_reserved_leak(struct btrfs_inode *inode); - - /* btrfs_qgroup_swapped_blocks related functions */ - void btrfs_qgroup_init_swapped_blocks( -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index a1498df419b4f..6a2ae208ff80a 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -544,6 +544,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char *options, - } else if (strncmp(args[0].from, "lzo", 3) == 0) { - compress_type = "lzo"; - info->compress_type = BTRFS_COMPRESS_LZO; -+ info->compress_level = 0; - btrfs_set_opt(info->mount_opt, COMPRESS); - btrfs_clear_opt(info->mount_opt, NODATACOW); - btrfs_clear_opt(info->mount_opt, NODATASUM); -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 3c090549ed07d..7042b84edc89d 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -3473,11 +3473,13 @@ fail: - btrfs_free_path(path); - out_unlock: - mutex_unlock(&dir->log_mutex); -- if (ret == -ENOSPC) { -+ if (err == -ENOSPC) { - btrfs_set_log_full_commit(trans); -- ret = 0; -- } else if (ret < 0) -- btrfs_abort_transaction(trans, ret); -+ err = 0; -+ } else if (err < 0 && err != -ENOENT) { -+ /* ENOENT can be returned if the entry hasn't been fsynced yet */ -+ btrfs_abort_transaction(trans, err); -+ } - - btrfs_end_log_trans(root); - -@@ -4994,6 +4996,138 @@ static int log_conflicting_inodes(struct btrfs_trans_handle *trans, - return ret; - } - -+static int copy_inode_items_to_log(struct btrfs_trans_handle *trans, -+ struct btrfs_inode *inode, -+ struct btrfs_key *min_key, -+ const struct btrfs_key *max_key, -+ struct btrfs_path *path, -+ struct btrfs_path *dst_path, -+ const u64 logged_isize, -+ const bool recursive_logging, -+ const int inode_only, -+ struct btrfs_log_ctx *ctx, -+ bool *need_log_inode_item) -+{ -+ struct btrfs_root *root = inode->root; -+ int ins_start_slot = 0; -+ int ins_nr = 0; -+ int ret; -+ -+ while (1) { -+ ret = btrfs_search_forward(root, min_key, path, trans->transid); -+ if (ret < 0) -+ return ret; -+ if (ret > 0) { -+ ret = 0; -+ break; -+ } -+again: -+ /* Note, ins_nr might be > 0 here, cleanup outside the loop */ -+ if (min_key->objectid != max_key->objectid) -+ break; -+ if (min_key->type > max_key->type) -+ break; -+ -+ if (min_key->type == BTRFS_INODE_ITEM_KEY) -+ *need_log_inode_item = false; -+ -+ if ((min_key->type == BTRFS_INODE_REF_KEY || -+ min_key->type == BTRFS_INODE_EXTREF_KEY) && -+ inode->generation == trans->transid && -+ !recursive_logging) { -+ u64 other_ino = 0; -+ u64 other_parent = 0; -+ -+ ret = btrfs_check_ref_name_override(path->nodes[0], -+ path->slots[0], min_key, inode, -+ &other_ino, &other_parent); -+ if (ret < 0) { -+ return ret; -+ } else if (ret > 0 && ctx && -+ other_ino != btrfs_ino(BTRFS_I(ctx->inode))) { -+ if (ins_nr > 0) { -+ ins_nr++; -+ } else { -+ ins_nr = 1; -+ ins_start_slot = path->slots[0]; -+ } -+ ret = copy_items(trans, inode, dst_path, path, -+ ins_start_slot, ins_nr, -+ inode_only, logged_isize); -+ if (ret < 0) -+ return ret; -+ ins_nr = 0; -+ -+ ret = log_conflicting_inodes(trans, root, path, -+ ctx, other_ino, other_parent); -+ if (ret) -+ return ret; -+ btrfs_release_path(path); -+ goto next_key; -+ } -+ } -+ -+ /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ -+ if (min_key->type == BTRFS_XATTR_ITEM_KEY) { -+ if (ins_nr == 0) -+ goto next_slot; -+ ret = copy_items(trans, inode, dst_path, path, -+ ins_start_slot, -+ ins_nr, inode_only, logged_isize); -+ if (ret < 0) -+ return ret; -+ ins_nr = 0; -+ goto next_slot; -+ } -+ -+ if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) { -+ ins_nr++; -+ goto next_slot; -+ } else if (!ins_nr) { -+ ins_start_slot = path->slots[0]; -+ ins_nr = 1; -+ goto next_slot; -+ } -+ -+ ret = copy_items(trans, inode, dst_path, path, ins_start_slot, -+ ins_nr, inode_only, logged_isize); -+ if (ret < 0) -+ return ret; -+ ins_nr = 1; -+ ins_start_slot = path->slots[0]; -+next_slot: -+ path->slots[0]++; -+ if (path->slots[0] < btrfs_header_nritems(path->nodes[0])) { -+ btrfs_item_key_to_cpu(path->nodes[0], min_key, -+ path->slots[0]); -+ goto again; -+ } -+ if (ins_nr) { -+ ret = copy_items(trans, inode, dst_path, path, -+ ins_start_slot, ins_nr, inode_only, -+ logged_isize); -+ if (ret < 0) -+ return ret; -+ ins_nr = 0; -+ } -+ btrfs_release_path(path); -+next_key: -+ if (min_key->offset < (u64)-1) { -+ min_key->offset++; -+ } else if (min_key->type < max_key->type) { -+ min_key->type++; -+ min_key->offset = 0; -+ } else { -+ break; -+ } -+ } -+ if (ins_nr) -+ ret = copy_items(trans, inode, dst_path, path, ins_start_slot, -+ ins_nr, inode_only, logged_isize); -+ -+ return ret; -+} -+ - /* log a single inode in the tree log. - * At least one parent directory for this inode must exist in the tree - * or be logged already. -@@ -5015,17 +5149,13 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - const loff_t end, - struct btrfs_log_ctx *ctx) - { -- struct btrfs_fs_info *fs_info = root->fs_info; - struct btrfs_path *path; - struct btrfs_path *dst_path; - struct btrfs_key min_key; - struct btrfs_key max_key; - struct btrfs_root *log = root->log_root; - int err = 0; -- int ret; -- int nritems; -- int ins_start_slot = 0; -- int ins_nr; -+ int ret = 0; - bool fast_search = false; - u64 ino = btrfs_ino(inode); - struct extent_map_tree *em_tree = &inode->extent_tree; -@@ -5061,15 +5191,19 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - max_key.offset = (u64)-1; - - /* -- * Only run delayed items if we are a dir or a new file. -- * Otherwise commit the delayed inode only, which is needed in -- * order for the log replay code to mark inodes for link count -- * fixup (create temporary BTRFS_TREE_LOG_FIXUP_OBJECTID items). -+ * Only run delayed items if we are a directory. We want to make sure -+ * all directory indexes hit the fs/subvolume tree so we can find them -+ * and figure out which index ranges have to be logged. -+ * -+ * Otherwise commit the delayed inode only if the full sync flag is set, -+ * as we want to make sure an up to date version is in the subvolume -+ * tree so copy_inode_items_to_log() / copy_items() can find it and copy -+ * it to the log tree. For a non full sync, we always log the inode item -+ * based on the in-memory struct btrfs_inode which is always up to date. - */ -- if (S_ISDIR(inode->vfs_inode.i_mode) || -- inode->generation > fs_info->last_trans_committed) -+ if (S_ISDIR(inode->vfs_inode.i_mode)) - ret = btrfs_commit_inode_delayed_items(trans, inode); -- else -+ else if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC, &inode->runtime_flags)) - ret = btrfs_commit_inode_delayed_inode(inode); - - if (ret) { -@@ -5156,139 +5290,12 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, - goto out_unlock; - } - -- while (1) { -- ins_nr = 0; -- ret = btrfs_search_forward(root, &min_key, -- path, trans->transid); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- if (ret != 0) -- break; --again: -- /* note, ins_nr might be > 0 here, cleanup outside the loop */ -- if (min_key.objectid != ino) -- break; -- if (min_key.type > max_key.type) -- break; -- -- if (min_key.type == BTRFS_INODE_ITEM_KEY) -- need_log_inode_item = false; -- -- if ((min_key.type == BTRFS_INODE_REF_KEY || -- min_key.type == BTRFS_INODE_EXTREF_KEY) && -- inode->generation == trans->transid && -- !recursive_logging) { -- u64 other_ino = 0; -- u64 other_parent = 0; -- -- ret = btrfs_check_ref_name_override(path->nodes[0], -- path->slots[0], &min_key, inode, -- &other_ino, &other_parent); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } else if (ret > 0 && ctx && -- other_ino != btrfs_ino(BTRFS_I(ctx->inode))) { -- if (ins_nr > 0) { -- ins_nr++; -- } else { -- ins_nr = 1; -- ins_start_slot = path->slots[0]; -- } -- ret = copy_items(trans, inode, dst_path, path, -- ins_start_slot, -- ins_nr, inode_only, -- logged_isize); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- ins_nr = 0; -- -- err = log_conflicting_inodes(trans, root, path, -- ctx, other_ino, other_parent); -- if (err) -- goto out_unlock; -- btrfs_release_path(path); -- goto next_key; -- } -- } -- -- /* Skip xattrs, we log them later with btrfs_log_all_xattrs() */ -- if (min_key.type == BTRFS_XATTR_ITEM_KEY) { -- if (ins_nr == 0) -- goto next_slot; -- ret = copy_items(trans, inode, dst_path, path, -- ins_start_slot, -- ins_nr, inode_only, logged_isize); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- ins_nr = 0; -- goto next_slot; -- } -- -- if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) { -- ins_nr++; -- goto next_slot; -- } else if (!ins_nr) { -- ins_start_slot = path->slots[0]; -- ins_nr = 1; -- goto next_slot; -- } -- -- ret = copy_items(trans, inode, dst_path, path, -- ins_start_slot, ins_nr, inode_only, -- logged_isize); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- ins_nr = 1; -- ins_start_slot = path->slots[0]; --next_slot: -- -- nritems = btrfs_header_nritems(path->nodes[0]); -- path->slots[0]++; -- if (path->slots[0] < nritems) { -- btrfs_item_key_to_cpu(path->nodes[0], &min_key, -- path->slots[0]); -- goto again; -- } -- if (ins_nr) { -- ret = copy_items(trans, inode, dst_path, path, -- ins_start_slot, -- ins_nr, inode_only, logged_isize); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- ins_nr = 0; -- } -- btrfs_release_path(path); --next_key: -- if (min_key.offset < (u64)-1) { -- min_key.offset++; -- } else if (min_key.type < max_key.type) { -- min_key.type++; -- min_key.offset = 0; -- } else { -- break; -- } -- } -- if (ins_nr) { -- ret = copy_items(trans, inode, dst_path, path, -- ins_start_slot, ins_nr, inode_only, -- logged_isize); -- if (ret < 0) { -- err = ret; -- goto out_unlock; -- } -- ins_nr = 0; -- } -+ err = copy_inode_items_to_log(trans, inode, &min_key, &max_key, -+ path, dst_path, logged_isize, -+ recursive_logging, inode_only, ctx, -+ &need_log_inode_item); -+ if (err) -+ goto out_unlock; - - btrfs_release_path(path); - btrfs_release_path(dst_path); -diff --git a/fs/buffer.c b/fs/buffer.c -index 79c9562434a8d..22d8ac4a8c40a 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -3170,6 +3170,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) - WARN_ON(atomic_read(&bh->b_count) < 1); - lock_buffer(bh); - if (test_clear_buffer_dirty(bh)) { -+ /* -+ * The bh should be mapped, but it might not be if the -+ * device was hot-removed. Not much we can do but fail the I/O. -+ */ -+ if (!buffer_mapped(bh)) { -+ unlock_buffer(bh); -+ return -EIO; -+ } -+ - get_bh(bh); - bh->b_end_io = end_buffer_write_sync; - ret = submit_bh(REQ_OP_WRITE, op_flags, bh); -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index ce54a1b12819b..4a6b14a2bd7f9 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -1260,6 +1260,7 @@ static ssize_t ceph_read_iter(struct kiocb *iocb, struct iov_iter *to) - struct inode *inode = file_inode(filp); - struct ceph_inode_info *ci = ceph_inode(inode); - struct page *pinned_page = NULL; -+ bool direct_lock = iocb->ki_flags & IOCB_DIRECT; - ssize_t ret; - int want, got = 0; - int retry_op = 0, read = 0; -@@ -1268,7 +1269,7 @@ again: - dout("aio_read %p %llx.%llx %llu~%u trying to get caps on %p\n", - inode, ceph_vinop(inode), iocb->ki_pos, (unsigned)len, inode); - -- if (iocb->ki_flags & IOCB_DIRECT) -+ if (direct_lock) - ceph_start_io_direct(inode); - else - ceph_start_io_read(inode); -@@ -1325,7 +1326,7 @@ again: - } - ceph_put_cap_refs(ci, got); - -- if (iocb->ki_flags & IOCB_DIRECT) -+ if (direct_lock) - ceph_end_io_direct(inode); - else - ceph_end_io_read(inode); -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index b0077f5a31688..0f21073a51a1b 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -4068,6 +4068,9 @@ static void delayed_work(struct work_struct *work) - - dout("mdsc delayed_work\n"); - -+ if (mdsc->stopping) -+ return; -+ - mutex_lock(&mdsc->mutex); - renew_interval = mdsc->mdsmap->m_session_timeout >> 2; - renew_caps = time_after_eq(jiffies, HZ*renew_interval + -@@ -4433,7 +4436,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc) - static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) - { - dout("stop\n"); -- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */ -+ /* -+ * Make sure the delayed work stopped before releasing -+ * the resources. -+ * -+ * Because the cancel_delayed_work_sync() will only -+ * guarantee that the work finishes executing. But the -+ * delayed work will re-arm itself again after that. -+ */ -+ flush_delayed_work(&mdsc->delayed_work); -+ - if (mdsc->mdsmap) - ceph_mdsmap_destroy(mdsc->mdsmap); - kfree(mdsc->sessions); -diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c -index ceb54ccc937e9..97c56d061e615 100644 ---- a/fs/ext4/block_validity.c -+++ b/fs/ext4/block_validity.c -@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb) - int flex_size = ext4_flex_bg_size(sbi); - int ret; - -- if (!test_opt(sb, BLOCK_VALIDITY)) { -- if (sbi->system_blks) -- ext4_release_system_zone(sb); -- return 0; -- } -- if (sbi->system_blks) -- return 0; -- - system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL); - if (!system_blks) - return -ENOMEM; -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index f7c20bb20da37..4aae7e3e89a12 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -66,10 +66,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, - unsigned long journal_devnum); - static int ext4_show_options(struct seq_file *seq, struct dentry *root); - static int ext4_commit_super(struct super_block *sb, int sync); --static void ext4_mark_recovery_complete(struct super_block *sb, -+static int ext4_mark_recovery_complete(struct super_block *sb, - struct ext4_super_block *es); --static void ext4_clear_journal_err(struct super_block *sb, -- struct ext4_super_block *es); -+static int ext4_clear_journal_err(struct super_block *sb, -+ struct ext4_super_block *es); - static int ext4_sync_fs(struct super_block *sb, int wait); - static int ext4_remount(struct super_block *sb, int *flags, char *data); - static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf); -@@ -4563,11 +4563,13 @@ no_journal: - - ext4_set_resv_clusters(sb); - -- err = ext4_setup_system_zone(sb); -- if (err) { -- ext4_msg(sb, KERN_ERR, "failed to initialize system " -- "zone (%d)", err); -- goto failed_mount4a; -+ if (test_opt(sb, BLOCK_VALIDITY)) { -+ err = ext4_setup_system_zone(sb); -+ if (err) { -+ ext4_msg(sb, KERN_ERR, "failed to initialize system " -+ "zone (%d)", err); -+ goto failed_mount4a; -+ } - } - - ext4_ext_init(sb); -@@ -4635,7 +4637,9 @@ no_journal: - EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; - if (needs_recovery) { - ext4_msg(sb, KERN_INFO, "recovery complete"); -- ext4_mark_recovery_complete(sb, es); -+ err = ext4_mark_recovery_complete(sb, es); -+ if (err) -+ goto failed_mount8; - } - if (EXT4_SB(sb)->s_journal) { - if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) -@@ -4678,10 +4682,8 @@ cantfind_ext4: - ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); - goto failed_mount; - --#ifdef CONFIG_QUOTA - failed_mount8: - ext4_unregister_sysfs(sb); --#endif - failed_mount7: - ext4_unregister_li_request(sb); - failed_mount6: -@@ -4820,7 +4822,8 @@ static journal_t *ext4_get_journal(struct super_block *sb, - struct inode *journal_inode; - journal_t *journal; - -- BUG_ON(!ext4_has_feature_journal(sb)); -+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) -+ return NULL; - - journal_inode = ext4_get_journal_inode(sb, journal_inum); - if (!journal_inode) -@@ -4850,7 +4853,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, - struct ext4_super_block *es; - struct block_device *bdev; - -- BUG_ON(!ext4_has_feature_journal(sb)); -+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) -+ return NULL; - - bdev = ext4_blkdev_get(j_dev, sb); - if (bdev == NULL) -@@ -4941,8 +4945,10 @@ static int ext4_load_journal(struct super_block *sb, - dev_t journal_dev; - int err = 0; - int really_read_only; -+ int journal_dev_ro; - -- BUG_ON(!ext4_has_feature_journal(sb)); -+ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) -+ return -EFSCORRUPTED; - - if (journal_devnum && - journal_devnum != le32_to_cpu(es->s_journal_dev)) { -@@ -4952,7 +4958,31 @@ static int ext4_load_journal(struct super_block *sb, - } else - journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev)); - -- really_read_only = bdev_read_only(sb->s_bdev); -+ if (journal_inum && journal_dev) { -+ ext4_msg(sb, KERN_ERR, -+ "filesystem has both journal inode and journal device!"); -+ return -EINVAL; -+ } -+ -+ if (journal_inum) { -+ journal = ext4_get_journal(sb, journal_inum); -+ if (!journal) -+ return -EINVAL; -+ } else { -+ journal = ext4_get_dev_journal(sb, journal_dev); -+ if (!journal) -+ return -EINVAL; -+ } -+ -+ journal_dev_ro = bdev_read_only(journal->j_dev); -+ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro; -+ -+ if (journal_dev_ro && !sb_rdonly(sb)) { -+ ext4_msg(sb, KERN_ERR, -+ "journal device read-only, try mounting with '-o ro'"); -+ err = -EROFS; -+ goto err_out; -+ } - - /* - * Are we loading a blank journal or performing recovery after a -@@ -4967,27 +4997,14 @@ static int ext4_load_journal(struct super_block *sb, - ext4_msg(sb, KERN_ERR, "write access " - "unavailable, cannot proceed " - "(try mounting with noload)"); -- return -EROFS; -+ err = -EROFS; -+ goto err_out; - } - ext4_msg(sb, KERN_INFO, "write access will " - "be enabled during recovery"); - } - } - -- if (journal_inum && journal_dev) { -- ext4_msg(sb, KERN_ERR, "filesystem has both journal " -- "and inode journals!"); -- return -EINVAL; -- } -- -- if (journal_inum) { -- if (!(journal = ext4_get_journal(sb, journal_inum))) -- return -EINVAL; -- } else { -- if (!(journal = ext4_get_dev_journal(sb, journal_dev))) -- return -EINVAL; -- } -- - if (!(journal->j_flags & JBD2_BARRIER)) - ext4_msg(sb, KERN_INFO, "barriers disabled"); - -@@ -5007,12 +5024,16 @@ static int ext4_load_journal(struct super_block *sb, - - if (err) { - ext4_msg(sb, KERN_ERR, "error loading journal"); -- jbd2_journal_destroy(journal); -- return err; -+ goto err_out; - } - - EXT4_SB(sb)->s_journal = journal; -- ext4_clear_journal_err(sb, es); -+ err = ext4_clear_journal_err(sb, es); -+ if (err) { -+ EXT4_SB(sb)->s_journal = NULL; -+ jbd2_journal_destroy(journal); -+ return err; -+ } - - if (!really_read_only && journal_devnum && - journal_devnum != le32_to_cpu(es->s_journal_dev)) { -@@ -5023,6 +5044,10 @@ static int ext4_load_journal(struct super_block *sb, - } - - return 0; -+ -+err_out: -+ jbd2_journal_destroy(journal); -+ return err; - } - - static int ext4_commit_super(struct super_block *sb, int sync) -@@ -5034,13 +5059,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) - if (!sbh || block_device_ejected(sb)) - return error; - -- /* -- * The superblock bh should be mapped, but it might not be if the -- * device was hot-removed. Not much we can do but fail the I/O. -- */ -- if (!buffer_mapped(sbh)) -- return error; -- - /* - * If the file system is mounted read-only, don't update the - * superblock write time. This avoids updating the superblock -@@ -5108,26 +5126,32 @@ static int ext4_commit_super(struct super_block *sb, int sync) - * remounting) the filesystem readonly, then we will end up with a - * consistent fs on disk. Record that fact. - */ --static void ext4_mark_recovery_complete(struct super_block *sb, -- struct ext4_super_block *es) -+static int ext4_mark_recovery_complete(struct super_block *sb, -+ struct ext4_super_block *es) - { -+ int err; - journal_t *journal = EXT4_SB(sb)->s_journal; - - if (!ext4_has_feature_journal(sb)) { -- BUG_ON(journal != NULL); -- return; -+ if (journal != NULL) { -+ ext4_error(sb, "Journal got removed while the fs was " -+ "mounted!"); -+ return -EFSCORRUPTED; -+ } -+ return 0; - } - jbd2_journal_lock_updates(journal); -- if (jbd2_journal_flush(journal) < 0) -+ err = jbd2_journal_flush(journal); -+ if (err < 0) - goto out; - - if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) { - ext4_clear_feature_journal_needs_recovery(sb); - ext4_commit_super(sb, 1); - } -- - out: - jbd2_journal_unlock_updates(journal); -+ return err; - } - - /* -@@ -5135,14 +5159,17 @@ out: - * has recorded an error from a previous lifetime, move that error to the - * main filesystem now. - */ --static void ext4_clear_journal_err(struct super_block *sb, -+static int ext4_clear_journal_err(struct super_block *sb, - struct ext4_super_block *es) - { - journal_t *journal; - int j_errno; - const char *errstr; - -- BUG_ON(!ext4_has_feature_journal(sb)); -+ if (!ext4_has_feature_journal(sb)) { -+ ext4_error(sb, "Journal got removed while the fs was mounted!"); -+ return -EFSCORRUPTED; -+ } - - journal = EXT4_SB(sb)->s_journal; - -@@ -5167,6 +5194,7 @@ static void ext4_clear_journal_err(struct super_block *sb, - jbd2_journal_clear_err(journal); - jbd2_journal_update_sb_errno(journal); - } -+ return 0; - } - - /* -@@ -5309,7 +5337,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - { - struct ext4_super_block *es; - struct ext4_sb_info *sbi = EXT4_SB(sb); -- unsigned long old_sb_flags; -+ unsigned long old_sb_flags, vfs_flags; - struct ext4_mount_options old_opts; - int enable_quota = 0; - ext4_group_t g; -@@ -5352,6 +5380,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - if (sbi->s_journal && sbi->s_journal->j_task->io_context) - journal_ioprio = sbi->s_journal->j_task->io_context->ioprio; - -+ /* -+ * Some options can be enabled by ext4 and/or by VFS mount flag -+ * either way we need to make sure it matches in both *flags and -+ * s_flags. Copy those selected flags from *flags to s_flags -+ */ -+ vfs_flags = SB_LAZYTIME | SB_I_VERSION; -+ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); -+ - if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { - err = -EINVAL; - goto restore_opts; -@@ -5405,9 +5441,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); - } - -- if (*flags & SB_LAZYTIME) -- sb->s_flags |= SB_LAZYTIME; -- - if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) { - if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) { - err = -EROFS; -@@ -5437,8 +5470,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - (sbi->s_mount_state & EXT4_VALID_FS)) - es->s_state = cpu_to_le16(sbi->s_mount_state); - -- if (sbi->s_journal) -+ if (sbi->s_journal) { -+ /* -+ * We let remount-ro finish even if marking fs -+ * as clean failed... -+ */ - ext4_mark_recovery_complete(sb, es); -+ } - if (sbi->s_mmp_tsk) - kthread_stop(sbi->s_mmp_tsk); - } else { -@@ -5486,8 +5524,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - * been changed by e2fsck since we originally mounted - * the partition.) - */ -- if (sbi->s_journal) -- ext4_clear_journal_err(sb, es); -+ if (sbi->s_journal) { -+ err = ext4_clear_journal_err(sb, es); -+ if (err) -+ goto restore_opts; -+ } - sbi->s_mount_state = le16_to_cpu(es->s_state); - - err = ext4_setup_super(sb, es, 0); -@@ -5517,7 +5558,17 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - ext4_register_li_request(sb, first_not_zeroed); - } - -- ext4_setup_system_zone(sb); -+ /* -+ * Handle creation of system zone data early because it can fail. -+ * Releasing of existing data is done when we are sure remount will -+ * succeed. -+ */ -+ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) { -+ err = ext4_setup_system_zone(sb); -+ if (err) -+ goto restore_opts; -+ } -+ - if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) { - err = ext4_commit_super(sb, 1); - if (err) -@@ -5538,8 +5589,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) - } - } - #endif -+ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) -+ ext4_release_system_zone(sb); -+ -+ /* -+ * Some options can be enabled by ext4 and/or by VFS mount flag -+ * either way we need to make sure it matches in both *flags and -+ * s_flags. Copy those selected flags from s_flags to *flags -+ */ -+ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags); - -- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME); - ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data); - kfree(orig_data); - return 0; -@@ -5553,6 +5612,8 @@ restore_opts: - sbi->s_commit_interval = old_opts.s_commit_interval; - sbi->s_min_batch_time = old_opts.s_min_batch_time; - sbi->s_max_batch_time = old_opts.s_max_batch_time; -+ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) -+ ext4_release_system_zone(sb); - #ifdef CONFIG_QUOTA - sbi->s_jquota_fmt = old_opts.s_jquota_fmt; - for (i = 0; i < EXT4_MAXQUOTAS; i++) { -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 03693d6b1c104..b3b7e63394be7 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -3061,7 +3061,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid); - void f2fs_alloc_nid_done(struct f2fs_sb_info *sbi, nid_t nid); - void f2fs_alloc_nid_failed(struct f2fs_sb_info *sbi, nid_t nid); - int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink); --void f2fs_recover_inline_xattr(struct inode *inode, struct page *page); -+int f2fs_recover_inline_xattr(struct inode *inode, struct page *page); - int f2fs_recover_xattr_data(struct inode *inode, struct page *page); - int f2fs_recover_inode_page(struct f2fs_sb_info *sbi, struct page *page); - int f2fs_restore_node_summary(struct f2fs_sb_info *sbi, -@@ -3487,7 +3487,7 @@ int f2fs_read_inline_data(struct inode *inode, struct page *page); - int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page); - int f2fs_convert_inline_inode(struct inode *inode); - int f2fs_write_inline_data(struct inode *inode, struct page *page); --bool f2fs_recover_inline_data(struct inode *inode, struct page *npage); -+int f2fs_recover_inline_data(struct inode *inode, struct page *npage); - struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir, - struct fscrypt_name *fname, struct page **res_page); - int f2fs_make_empty_inline_dir(struct inode *inode, struct inode *parent, -diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c -index 896db0416f0e6..183388393c6a8 100644 ---- a/fs/f2fs/inline.c -+++ b/fs/f2fs/inline.c -@@ -252,7 +252,7 @@ int f2fs_write_inline_data(struct inode *inode, struct page *page) - return 0; - } - --bool f2fs_recover_inline_data(struct inode *inode, struct page *npage) -+int f2fs_recover_inline_data(struct inode *inode, struct page *npage) - { - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - struct f2fs_inode *ri = NULL; -@@ -274,7 +274,8 @@ bool f2fs_recover_inline_data(struct inode *inode, struct page *npage) - ri && (ri->i_inline & F2FS_INLINE_DATA)) { - process_inline: - ipage = f2fs_get_node_page(sbi, inode->i_ino); -- f2fs_bug_on(sbi, IS_ERR(ipage)); -+ if (IS_ERR(ipage)) -+ return PTR_ERR(ipage); - - f2fs_wait_on_page_writeback(ipage, NODE, true, true); - -@@ -287,21 +288,25 @@ process_inline: - - set_page_dirty(ipage); - f2fs_put_page(ipage, 1); -- return true; -+ return 1; - } - - if (f2fs_has_inline_data(inode)) { - ipage = f2fs_get_node_page(sbi, inode->i_ino); -- f2fs_bug_on(sbi, IS_ERR(ipage)); -+ if (IS_ERR(ipage)) -+ return PTR_ERR(ipage); - f2fs_truncate_inline_inode(inode, ipage, 0); - clear_inode_flag(inode, FI_INLINE_DATA); - f2fs_put_page(ipage, 1); - } else if (ri && (ri->i_inline & F2FS_INLINE_DATA)) { -- if (f2fs_truncate_blocks(inode, 0, false)) -- return false; -+ int ret; -+ -+ ret = f2fs_truncate_blocks(inode, 0, false); -+ if (ret) -+ return ret; - goto process_inline; - } -- return false; -+ return 0; - } - - struct f2fs_dir_entry *f2fs_find_in_inline_dir(struct inode *dir, -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 90a20bd129614..daeac4268c1ab 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -2512,7 +2512,7 @@ int f2fs_try_to_free_nids(struct f2fs_sb_info *sbi, int nr_shrink) - return nr - nr_shrink; - } - --void f2fs_recover_inline_xattr(struct inode *inode, struct page *page) -+int f2fs_recover_inline_xattr(struct inode *inode, struct page *page) - { - void *src_addr, *dst_addr; - size_t inline_size; -@@ -2520,7 +2520,8 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page) - struct f2fs_inode *ri; - - ipage = f2fs_get_node_page(F2FS_I_SB(inode), inode->i_ino); -- f2fs_bug_on(F2FS_I_SB(inode), IS_ERR(ipage)); -+ if (IS_ERR(ipage)) -+ return PTR_ERR(ipage); - - ri = F2FS_INODE(page); - if (ri->i_inline & F2FS_INLINE_XATTR) { -@@ -2539,6 +2540,7 @@ void f2fs_recover_inline_xattr(struct inode *inode, struct page *page) - update_inode: - f2fs_update_inode(inode, ipage); - f2fs_put_page(ipage, 1); -+ return 0; - } - - int f2fs_recover_xattr_data(struct inode *inode, struct page *page) -diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c -index 783773e4560de..5f230e981c483 100644 ---- a/fs/f2fs/recovery.c -+++ b/fs/f2fs/recovery.c -@@ -514,7 +514,9 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, - - /* step 1: recover xattr */ - if (IS_INODE(page)) { -- f2fs_recover_inline_xattr(inode, page); -+ err = f2fs_recover_inline_xattr(inode, page); -+ if (err) -+ goto out; - } else if (f2fs_has_xattr_block(ofs_of_node(page))) { - err = f2fs_recover_xattr_data(inode, page); - if (!err) -@@ -523,8 +525,12 @@ static int do_recover_data(struct f2fs_sb_info *sbi, struct inode *inode, - } - - /* step 2: recover inline data */ -- if (f2fs_recover_inline_data(inode, page)) -+ err = f2fs_recover_inline_data(inode, page); -+ if (err) { -+ if (err == 1) -+ err = 0; - goto out; -+ } - - /* step 3: recover data indices */ - start = f2fs_start_bidx_of_node(ofs_of_node(page), inode); -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index f4b882ee48ddf..fa461db696e79 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1075,6 +1075,9 @@ static void f2fs_put_super(struct super_block *sb) - int i; - bool dropped; - -+ /* unregister procfs/sysfs entries in advance to avoid race case */ -+ f2fs_unregister_sysfs(sbi); -+ - f2fs_quota_off_umount(sb); - - /* prevent remaining shrinker jobs */ -@@ -1138,8 +1141,6 @@ static void f2fs_put_super(struct super_block *sb) - - kvfree(sbi->ckpt); - -- f2fs_unregister_sysfs(sbi); -- - sb->s_fs_info = NULL; - if (sbi->s_chksum_driver) - crypto_free_shash(sbi->s_chksum_driver); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index 76ac9c7d32ec7..5f6400ba82c00 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -42,7 +42,6 @@ - struct wb_writeback_work { - long nr_pages; - struct super_block *sb; -- unsigned long *older_than_this; - enum writeback_sync_modes sync_mode; - unsigned int tagged_writepages:1; - unsigned int for_kupdate:1; -@@ -144,7 +143,9 @@ static void inode_io_list_del_locked(struct inode *inode, - struct bdi_writeback *wb) - { - assert_spin_locked(&wb->list_lock); -+ assert_spin_locked(&inode->i_lock); - -+ inode->i_state &= ~I_SYNC_QUEUED; - list_del_init(&inode->i_io_list); - wb_io_lists_depopulated(wb); - } -@@ -1123,7 +1124,9 @@ void inode_io_list_del(struct inode *inode) - struct bdi_writeback *wb; - - wb = inode_to_wb_and_lock_list(inode); -+ spin_lock(&inode->i_lock); - inode_io_list_del_locked(inode, wb); -+ spin_unlock(&inode->i_lock); - spin_unlock(&wb->list_lock); - } - -@@ -1172,8 +1175,10 @@ void sb_clear_inode_writeback(struct inode *inode) - * the case then the inode must have been redirtied while it was being written - * out and we don't reset its dirtied_when. - */ --static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) -+static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb) - { -+ assert_spin_locked(&inode->i_lock); -+ - if (!list_empty(&wb->b_dirty)) { - struct inode *tail; - -@@ -1182,6 +1187,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) - inode->dirtied_when = jiffies; - } - inode_io_list_move_locked(inode, wb, &wb->b_dirty); -+ inode->i_state &= ~I_SYNC_QUEUED; -+} -+ -+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) -+{ -+ spin_lock(&inode->i_lock); -+ redirty_tail_locked(inode, wb); -+ spin_unlock(&inode->i_lock); - } - - /* -@@ -1220,16 +1233,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t) - #define EXPIRE_DIRTY_ATIME 0x0001 - - /* -- * Move expired (dirtied before work->older_than_this) dirty inodes from -+ * Move expired (dirtied before dirtied_before) dirty inodes from - * @delaying_queue to @dispatch_queue. - */ - static int move_expired_inodes(struct list_head *delaying_queue, - struct list_head *dispatch_queue, -- int flags, -- struct wb_writeback_work *work) -+ int flags, unsigned long dirtied_before) - { -- unsigned long *older_than_this = NULL; -- unsigned long expire_time; - LIST_HEAD(tmp); - struct list_head *pos, *node; - struct super_block *sb = NULL; -@@ -1237,21 +1247,17 @@ static int move_expired_inodes(struct list_head *delaying_queue, - int do_sb_sort = 0; - int moved = 0; - -- if ((flags & EXPIRE_DIRTY_ATIME) == 0) -- older_than_this = work->older_than_this; -- else if (!work->for_sync) { -- expire_time = jiffies - (dirtytime_expire_interval * HZ); -- older_than_this = &expire_time; -- } - while (!list_empty(delaying_queue)) { - inode = wb_inode(delaying_queue->prev); -- if (older_than_this && -- inode_dirtied_after(inode, *older_than_this)) -+ if (inode_dirtied_after(inode, dirtied_before)) - break; - list_move(&inode->i_io_list, &tmp); - moved++; -+ spin_lock(&inode->i_lock); - if (flags & EXPIRE_DIRTY_ATIME) -- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state); -+ inode->i_state |= I_DIRTY_TIME_EXPIRED; -+ inode->i_state |= I_SYNC_QUEUED; -+ spin_unlock(&inode->i_lock); - if (sb_is_blkdev_sb(inode->i_sb)) - continue; - if (sb && sb != inode->i_sb) -@@ -1289,18 +1295,22 @@ out: - * | - * +--> dequeue for IO - */ --static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work) -+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work, -+ unsigned long dirtied_before) - { - int moved; -+ unsigned long time_expire_jif = dirtied_before; - - assert_spin_locked(&wb->list_lock); - list_splice_init(&wb->b_more_io, &wb->b_io); -- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work); -+ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before); -+ if (!work->for_sync) -+ time_expire_jif = jiffies - dirtytime_expire_interval * HZ; - moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io, -- EXPIRE_DIRTY_ATIME, work); -+ EXPIRE_DIRTY_ATIME, time_expire_jif); - if (moved) - wb_io_lists_populated(wb); -- trace_writeback_queue_io(wb, work, moved); -+ trace_writeback_queue_io(wb, work, dirtied_before, moved); - } - - static int write_inode(struct inode *inode, struct writeback_control *wbc) -@@ -1394,7 +1404,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * writeback is not making progress due to locked - * buffers. Skip this inode for now. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - return; - } - -@@ -1414,7 +1424,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * retrying writeback of the dirty page/inode - * that cannot be performed immediately. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - } - } else if (inode->i_state & I_DIRTY) { - /* -@@ -1422,10 +1432,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, - * such as delayed allocation during submission or metadata - * updates after data IO completion. - */ -- redirty_tail(inode, wb); -+ redirty_tail_locked(inode, wb); - } else if (inode->i_state & I_DIRTY_TIME) { - inode->dirtied_when = jiffies; - inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); -+ inode->i_state &= ~I_SYNC_QUEUED; - } else { - /* The inode is clean. Remove from writeback lists. */ - inode_io_list_del_locked(inode, wb); -@@ -1669,8 +1680,8 @@ static long writeback_sb_inodes(struct super_block *sb, - */ - spin_lock(&inode->i_lock); - if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) { -+ redirty_tail_locked(inode, wb); - spin_unlock(&inode->i_lock); -- redirty_tail(inode, wb); - continue; - } - if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) { -@@ -1811,7 +1822,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, - blk_start_plug(&plug); - spin_lock(&wb->list_lock); - if (list_empty(&wb->b_io)) -- queue_io(wb, &work); -+ queue_io(wb, &work, jiffies); - __writeback_inodes_wb(wb, &work); - spin_unlock(&wb->list_lock); - blk_finish_plug(&plug); -@@ -1831,7 +1842,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, - * takes longer than a dirty_writeback_interval interval, then leave a - * one-second gap. - * -- * older_than_this takes precedence over nr_to_write. So we'll only write back -+ * dirtied_before takes precedence over nr_to_write. So we'll only write back - * all dirty pages if they are all attached to "old" mappings. - */ - static long wb_writeback(struct bdi_writeback *wb, -@@ -1839,14 +1850,11 @@ static long wb_writeback(struct bdi_writeback *wb, - { - unsigned long wb_start = jiffies; - long nr_pages = work->nr_pages; -- unsigned long oldest_jif; -+ unsigned long dirtied_before = jiffies; - struct inode *inode; - long progress; - struct blk_plug plug; - -- oldest_jif = jiffies; -- work->older_than_this = &oldest_jif; -- - blk_start_plug(&plug); - spin_lock(&wb->list_lock); - for (;;) { -@@ -1880,14 +1888,14 @@ static long wb_writeback(struct bdi_writeback *wb, - * safe. - */ - if (work->for_kupdate) { -- oldest_jif = jiffies - -+ dirtied_before = jiffies - - msecs_to_jiffies(dirty_expire_interval * 10); - } else if (work->for_background) -- oldest_jif = jiffies; -+ dirtied_before = jiffies; - - trace_writeback_start(wb, work); - if (list_empty(&wb->b_io)) -- queue_io(wb, work); -+ queue_io(wb, work, dirtied_before); - if (work->sb) - progress = writeback_sb_inodes(work->sb, wb, work); - else -@@ -2289,11 +2297,12 @@ void __mark_inode_dirty(struct inode *inode, int flags) - inode->i_state |= flags; - - /* -- * If the inode is being synced, just update its dirty state. -- * The unlocker will place the inode on the appropriate -- * superblock list, based upon its state. -+ * If the inode is queued for writeback by flush worker, just -+ * update its dirty state. Once the flush worker is done with -+ * the inode it will place it on the appropriate superblock -+ * list, based upon its state. - */ -- if (inode->i_state & I_SYNC) -+ if (inode->i_state & I_SYNC_QUEUED) - goto out_unlock_inode; - - /* -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 40306c1eab07c..5fff7cb3582f0 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -1284,6 +1284,12 @@ hugetlbfs_fill_super(struct super_block *sb, struct fs_context *fc) - sb->s_magic = HUGETLBFS_MAGIC; - sb->s_op = &hugetlbfs_ops; - sb->s_time_gran = 1; -+ -+ /* -+ * Due to the special and limited functionality of hugetlbfs, it does -+ * not work well as a stacking filesystem. -+ */ -+ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH; - sb->s_root = d_make_root(hugetlbfs_get_root(sb, ctx)); - if (!sb->s_root) - goto out_free; -diff --git a/fs/io_uring.c b/fs/io_uring.c -index fada14ee1cdcb..2a539b794f3b0 100644 ---- a/fs/io_uring.c -+++ b/fs/io_uring.c -@@ -2378,6 +2378,15 @@ static bool io_add_to_prev_work(struct async_list *list, struct io_kiocb *req) - list_del_init(&req->list); - ret = false; - } -+ -+ if (ret) { -+ struct io_ring_ctx *ctx = req->ctx; -+ -+ spin_lock_irq(&ctx->task_lock); -+ list_add(&req->task_list, &ctx->task_list); -+ req->work_task = NULL; -+ spin_unlock_irq(&ctx->task_lock); -+ } - spin_unlock(&list->lock); - return ret; - } -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index de992a70ddfef..90453309345d5 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1983,6 +1983,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) - */ - static void __jbd2_journal_unfile_buffer(struct journal_head *jh) - { -+ J_ASSERT_JH(jh, jh->b_transaction != NULL); -+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); -+ - __jbd2_journal_temp_unlink_buffer(jh); - jh->b_transaction = NULL; - jbd2_journal_put_journal_head(jh); -@@ -2074,6 +2077,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, - { - struct buffer_head *head; - struct buffer_head *bh; -+ bool has_write_io_error = false; - int ret = 0; - - J_ASSERT(PageLocked(page)); -@@ -2098,11 +2102,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, - jbd_unlock_bh_state(bh); - if (buffer_jbd(bh)) - goto busy; -+ -+ /* -+ * If we free a metadata buffer which has been failed to -+ * write out, the jbd2 checkpoint procedure will not detect -+ * this failure and may lead to filesystem inconsistency -+ * after cleanup journal tail. -+ */ -+ if (buffer_write_io_error(bh)) { -+ pr_err("JBD2: Error while async write back metadata bh %llu.", -+ (unsigned long long)bh->b_blocknr); -+ has_write_io_error = true; -+ } - } while ((bh = bh->b_this_page) != head); - - ret = try_to_free_buffers(page); - - busy: -+ if (has_write_io_error) -+ jbd2_journal_abort(journal, -EIO); -+ - return ret; - } - -@@ -2530,6 +2549,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) - - was_dirty = test_clear_buffer_jbddirty(bh); - __jbd2_journal_temp_unlink_buffer(jh); -+ -+ /* -+ * b_transaction must be set, otherwise the new b_transaction won't -+ * be holding jh reference -+ */ -+ J_ASSERT_JH(jh, jh->b_transaction != NULL); -+ - /* - * We set b_transaction here because b_next_transaction will inherit - * our jh reference and thus __jbd2_journal_file_buffer() must not -diff --git a/fs/xfs/libxfs/xfs_trans_inode.c b/fs/xfs/libxfs/xfs_trans_inode.c -index a9ad90926b873..6c7354abd0aea 100644 ---- a/fs/xfs/libxfs/xfs_trans_inode.c -+++ b/fs/xfs/libxfs/xfs_trans_inode.c -@@ -36,6 +36,7 @@ xfs_trans_ijoin( - - ASSERT(iip->ili_lock_flags == 0); - iip->ili_lock_flags = lock_flags; -+ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE)); - - /* - * Get a log_item_desc to point at the new item. -@@ -91,6 +92,7 @@ xfs_trans_log_inode( - - ASSERT(ip->i_itemp != NULL); - ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); -+ ASSERT(!xfs_iflags_test(ip, XFS_ISTALE)); - - /* - * Don't bother with i_lock for the I_DIRTY_TIME check here, as races -diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c -index d95dc9b0f0bba..a1135b86e79f9 100644 ---- a/fs/xfs/xfs_icache.c -+++ b/fs/xfs/xfs_icache.c -@@ -1132,7 +1132,7 @@ restart: - goto out_ifunlock; - xfs_iunpin_wait(ip); - } -- if (xfs_iflags_test(ip, XFS_ISTALE) || xfs_inode_clean(ip)) { -+ if (xfs_inode_clean(ip)) { - xfs_ifunlock(ip); - goto reclaim; - } -@@ -1219,6 +1219,7 @@ reclaim: - xfs_ilock(ip, XFS_ILOCK_EXCL); - xfs_qm_dqdetach(ip); - xfs_iunlock(ip, XFS_ILOCK_EXCL); -+ ASSERT(xfs_inode_clean(ip)); - - __xfs_inode_free(ip); - return error; -diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c -index 18f4b262e61ce..b339ff93df997 100644 ---- a/fs/xfs/xfs_inode.c -+++ b/fs/xfs/xfs_inode.c -@@ -1761,10 +1761,31 @@ xfs_inactive_ifree( - return error; - } - -+ /* -+ * We do not hold the inode locked across the entire rolling transaction -+ * here. We only need to hold it for the first transaction that -+ * xfs_ifree() builds, which may mark the inode XFS_ISTALE if the -+ * underlying cluster buffer is freed. Relogging an XFS_ISTALE inode -+ * here breaks the relationship between cluster buffer invalidation and -+ * stale inode invalidation on cluster buffer item journal commit -+ * completion, and can result in leaving dirty stale inodes hanging -+ * around in memory. -+ * -+ * We have no need for serialising this inode operation against other -+ * operations - we freed the inode and hence reallocation is required -+ * and that will serialise on reallocating the space the deferops need -+ * to free. Hence we can unlock the inode on the first commit of -+ * the transaction rather than roll it right through the deferops. This -+ * avoids relogging the XFS_ISTALE inode. -+ * -+ * We check that xfs_ifree() hasn't grown an internal transaction roll -+ * by asserting that the inode is still locked when it returns. -+ */ - xfs_ilock(ip, XFS_ILOCK_EXCL); -- xfs_trans_ijoin(tp, ip, 0); -+ xfs_trans_ijoin(tp, ip, XFS_ILOCK_EXCL); - - error = xfs_ifree(tp, ip); -+ ASSERT(xfs_isilocked(ip, XFS_ILOCK_EXCL)); - if (error) { - /* - * If we fail to free the inode, shut down. The cancel -@@ -1777,7 +1798,6 @@ xfs_inactive_ifree( - xfs_force_shutdown(mp, SHUTDOWN_META_IO_ERROR); - } - xfs_trans_cancel(tp); -- xfs_iunlock(ip, XFS_ILOCK_EXCL); - return error; - } - -@@ -1795,7 +1815,6 @@ xfs_inactive_ifree( - xfs_notice(mp, "%s: xfs_trans_commit returned error %d", - __func__, error); - -- xfs_iunlock(ip, XFS_ILOCK_EXCL); - return 0; - } - -diff --git a/include/linux/efi.h b/include/linux/efi.h -index d87acf62958e2..13ed2c6b13f8b 100644 ---- a/include/linux/efi.h -+++ b/include/linux/efi.h -@@ -1039,7 +1039,11 @@ extern void *efi_get_pal_addr (void); - extern void efi_map_pal_code (void); - extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg); - extern void efi_gettimeofday (struct timespec64 *ts); -+#ifdef CONFIG_EFI - extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */ -+#else -+static inline void efi_enter_virtual_mode (void) {} -+#endif - #ifdef CONFIG_X86 - extern efi_status_t efi_query_variable_store(u32 attributes, - unsigned long size, -diff --git a/include/linux/fb.h b/include/linux/fb.h -index 756706b666a10..8221838fefd98 100644 ---- a/include/linux/fb.h -+++ b/include/linux/fb.h -@@ -400,8 +400,6 @@ struct fb_tile_ops { - #define FBINFO_HWACCEL_YPAN 0x2000 /* optional */ - #define FBINFO_HWACCEL_YWRAP 0x4000 /* optional */ - --#define FBINFO_MISC_USEREVENT 0x10000 /* event request -- from userspace */ - #define FBINFO_MISC_TILEBLITTING 0x20000 /* use tile blitting */ - - /* A driver may set this flag to indicate that it does want a set_par to be -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 5bd384dbdca58..4c82683e034a7 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2140,6 +2140,10 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp) - * - * I_CREATING New object's inode in the middle of setting up. - * -+ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists. -+ * Used to detect that mark_inode_dirty() should not move -+ * inode between dirty lists. -+ * - * Q: What is the difference between I_WILL_FREE and I_FREEING? - */ - #define I_DIRTY_SYNC (1 << 0) -@@ -2157,11 +2161,11 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp) - #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP) - #define I_LINKABLE (1 << 10) - #define I_DIRTY_TIME (1 << 11) --#define __I_DIRTY_TIME_EXPIRED 12 --#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED) -+#define I_DIRTY_TIME_EXPIRED (1 << 12) - #define I_WB_SWITCH (1 << 13) - #define I_OVL_INUSE (1 << 14) - #define I_CREATING (1 << 15) -+#define I_SYNC_QUEUED (1 << 17) - - #define I_DIRTY_INODE (I_DIRTY_SYNC | I_DIRTY_DATASYNC) - #define I_DIRTY (I_DIRTY_INODE | I_DIRTY_PAGES) -diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h -index aac42c28fe62d..9b67394471e1c 100644 ---- a/include/linux/netfilter_ipv6.h -+++ b/include/linux/netfilter_ipv6.h -@@ -58,7 +58,6 @@ struct nf_ipv6_ops { - int (*output)(struct net *, struct sock *, struct sk_buff *)); - int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry); - #if IS_MODULE(CONFIG_IPV6) -- int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user); - int (*br_fragment)(struct net *net, struct sock *sk, - struct sk_buff *skb, - struct nf_bridge_frag_data *data, -@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst, - - #include - --static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb, -- u32 user) --{ --#if IS_MODULE(CONFIG_IPV6) -- const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops(); -- -- if (!v6_ops) -- return 1; -- -- return v6_ops->br_defrag(net, skb, user); --#elif IS_BUILTIN(CONFIG_IPV6) -- return nf_ct_frag6_gather(net, skb, user); --#else -- return 1; --#endif --} -- - int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - struct nf_bridge_frag_data *data, - int (*output)(struct net *, struct sock *sk, -diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h -index 66282552db207..67434278b81dd 100644 ---- a/include/trace/events/writeback.h -+++ b/include/trace/events/writeback.h -@@ -499,8 +499,9 @@ DEFINE_WBC_EVENT(wbc_writepage); - TRACE_EVENT(writeback_queue_io, - TP_PROTO(struct bdi_writeback *wb, - struct wb_writeback_work *work, -+ unsigned long dirtied_before, - int moved), -- TP_ARGS(wb, work, moved), -+ TP_ARGS(wb, work, dirtied_before, moved), - TP_STRUCT__entry( - __array(char, name, 32) - __field(unsigned long, older) -@@ -510,19 +511,17 @@ TRACE_EVENT(writeback_queue_io, - __field(unsigned int, cgroup_ino) - ), - TP_fast_assign( -- unsigned long *older_than_this = work->older_than_this; - strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32); -- __entry->older = older_than_this ? *older_than_this : 0; -- __entry->age = older_than_this ? -- (jiffies - *older_than_this) * 1000 / HZ : -1; -+ __entry->older = dirtied_before; -+ __entry->age = (jiffies - dirtied_before) * 1000 / HZ; - __entry->moved = moved; - __entry->reason = work->reason; - __entry->cgroup_ino = __trace_wb_assign_cgroup(wb); - ), - TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u", - __entry->name, -- __entry->older, /* older_than_this in jiffies */ -- __entry->age, /* older_than_this in relative milliseconds */ -+ __entry->older, /* dirtied_before in jiffies */ -+ __entry->age, /* dirtied_before in relative milliseconds */ - __entry->moved, - __print_symbolic(__entry->reason, WB_WORK_REASON), - __entry->cgroup_ino -diff --git a/kernel/Makefile b/kernel/Makefile -index daad787fb795d..42557f251fea6 100644 ---- a/kernel/Makefile -+++ b/kernel/Makefile -@@ -128,7 +128,7 @@ $(obj)/config_data.gz: $(KCONFIG_CONFIG) FORCE - $(obj)/kheaders.o: $(obj)/kheaders_data.tar.xz - - quiet_cmd_genikh = CHK $(obj)/kheaders_data.tar.xz -- cmd_genikh = $(BASH) $(srctree)/kernel/gen_kheaders.sh $@ -+ cmd_genikh = $(CONFIG_SHELL) $(srctree)/kernel/gen_kheaders.sh $@ - $(obj)/kheaders_data.tar.xz: FORCE - $(call cmd,genikh) - -diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh -index 5a0fc0b0403a6..c1510f0ab3ea5 100755 ---- a/kernel/gen_kheaders.sh -+++ b/kernel/gen_kheaders.sh -@@ -1,4 +1,4 @@ --#!/bin/bash -+#!/bin/sh - # SPDX-License-Identifier: GPL-2.0 - - # This script generates an archive consisting of kernel headers -@@ -21,30 +21,38 @@ arch/$SRCARCH/include/ - # Uncomment it for debugging. - # if [ ! -f /tmp/iter ]; then iter=1; echo 1 > /tmp/iter; - # else iter=$(($(cat /tmp/iter) + 1)); echo $iter > /tmp/iter; fi --# find $src_file_list -name "*.h" | xargs ls -l > /tmp/src-ls-$iter --# find $obj_file_list -name "*.h" | xargs ls -l > /tmp/obj-ls-$iter -+# find $all_dirs -name "*.h" | xargs ls -l > /tmp/ls-$iter -+ -+all_dirs= -+if [ "$building_out_of_srctree" ]; then -+ for d in $dir_list; do -+ all_dirs="$all_dirs $srctree/$d" -+ done -+fi -+all_dirs="$all_dirs $dir_list" - - # include/generated/compile.h is ignored because it is touched even when none --# of the source files changed. This causes pointless regeneration, so let us --# ignore them for md5 calculation. --pushd $srctree > /dev/null --src_files_md5="$(find $dir_list -name "*.h" | -- grep -v "include/generated/compile.h" | -- grep -v "include/generated/autoconf.h" | -- xargs ls -l | md5sum | cut -d ' ' -f1)" --popd > /dev/null --obj_files_md5="$(find $dir_list -name "*.h" | -- grep -v "include/generated/compile.h" | -- grep -v "include/generated/autoconf.h" | -+# of the source files changed. -+# -+# When Kconfig regenerates include/generated/autoconf.h, its timestamp is -+# updated, but the contents might be still the same. When any CONFIG option is -+# changed, Kconfig touches the corresponding timestamp file include/config/*.h. -+# Hence, the md5sum detects the configuration change anyway. We do not need to -+# check include/generated/autoconf.h explicitly. -+# -+# Ignore them for md5 calculation to avoid pointless regeneration. -+headers_md5="$(find $all_dirs -name "*.h" | -+ grep -v "include/generated/compile.h" | -+ grep -v "include/generated/autoconf.h" | - xargs ls -l | md5sum | cut -d ' ' -f1)" -+ - # Any changes to this script will also cause a rebuild of the archive. - this_file_md5="$(ls -l $sfile | md5sum | cut -d ' ' -f1)" - if [ -f $tarfile ]; then tarfile_md5="$(md5sum $tarfile | cut -d ' ' -f1)"; fi - if [ -f kernel/kheaders.md5 ] && -- [ "$(cat kernel/kheaders.md5|head -1)" == "$src_files_md5" ] && -- [ "$(cat kernel/kheaders.md5|head -2|tail -1)" == "$obj_files_md5" ] && -- [ "$(cat kernel/kheaders.md5|head -3|tail -1)" == "$this_file_md5" ] && -- [ "$(cat kernel/kheaders.md5|tail -1)" == "$tarfile_md5" ]; then -+ [ "$(head -n 1 kernel/kheaders.md5)" = "$headers_md5" ] && -+ [ "$(head -n 2 kernel/kheaders.md5 | tail -n 1)" = "$this_file_md5" ] && -+ [ "$(tail -n 1 kernel/kheaders.md5)" = "$tarfile_md5" ]; then - exit - fi - -@@ -55,14 +63,17 @@ fi - rm -rf $cpio_dir - mkdir $cpio_dir - --pushd $srctree > /dev/null --for f in $dir_list; -- do find "$f" -name "*.h"; --done | cpio --quiet -pd $cpio_dir --popd > /dev/null -+if [ "$building_out_of_srctree" ]; then -+ ( -+ cd $srctree -+ for f in $dir_list -+ do find "$f" -name "*.h"; -+ done | cpio --quiet -pd $cpio_dir -+ ) -+fi - --# The second CPIO can complain if files already exist which can --# happen with out of tree builds. Just silence CPIO for now. -+# The second CPIO can complain if files already exist which can happen with out -+# of tree builds having stale headers in srctree. Just silence CPIO for now. - for f in $dir_list; - do find "$f" -name "*.h"; - done | cpio --quiet -pd $cpio_dir >/dev/null 2>&1 -@@ -77,10 +88,9 @@ find $cpio_dir -type f -print0 | - find $cpio_dir -printf "./%P\n" | LC_ALL=C sort | \ - tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \ - --owner=0 --group=0 --numeric-owner --no-recursion \ -- -Jcf $tarfile -C $cpio_dir/ -T - > /dev/null -+ -I $XZ -cf $tarfile -C $cpio_dir/ -T - > /dev/null - --echo "$src_files_md5" > kernel/kheaders.md5 --echo "$obj_files_md5" >> kernel/kheaders.md5 -+echo $headers_md5 > kernel/kheaders.md5 - echo "$this_file_md5" >> kernel/kheaders.md5 - echo "$(md5sum $tarfile | cut -d ' ' -f1)" >> kernel/kheaders.md5 - -diff --git a/kernel/irq/matrix.c b/kernel/irq/matrix.c -index 30cc217b86318..651a4ad6d711f 100644 ---- a/kernel/irq/matrix.c -+++ b/kernel/irq/matrix.c -@@ -380,6 +380,13 @@ int irq_matrix_alloc(struct irq_matrix *m, const struct cpumask *msk, - unsigned int cpu, bit; - struct cpumap *cm; - -+ /* -+ * Not required in theory, but matrix_find_best_cpu() uses -+ * for_each_cpu() which ignores the cpumask on UP . -+ */ -+ if (cpumask_empty(msk)) -+ return -EINVAL; -+ - cpu = matrix_find_best_cpu(m, msk); - if (cpu == UINT_MAX) - return -ENOSPC; -diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c -index 9bb6d2497b040..581f818181386 100644 ---- a/kernel/locking/lockdep_proc.c -+++ b/kernel/locking/lockdep_proc.c -@@ -400,7 +400,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt) - seq_time(m, lt->min); - seq_time(m, lt->max); - seq_time(m, lt->total); -- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0); -+ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0); - } - - static void seq_stats(struct seq_file *m, struct lock_stat_data *data) -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index b34b5c6e25248..352239c411a44 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -794,6 +794,26 @@ unsigned int sysctl_sched_uclamp_util_max = SCHED_CAPACITY_SCALE; - /* All clamps are required to be less or equal than these values */ - static struct uclamp_se uclamp_default[UCLAMP_CNT]; - -+/* -+ * This static key is used to reduce the uclamp overhead in the fast path. It -+ * primarily disables the call to uclamp_rq_{inc, dec}() in -+ * enqueue/dequeue_task(). -+ * -+ * This allows users to continue to enable uclamp in their kernel config with -+ * minimum uclamp overhead in the fast path. -+ * -+ * As soon as userspace modifies any of the uclamp knobs, the static key is -+ * enabled, since we have an actual users that make use of uclamp -+ * functionality. -+ * -+ * The knobs that would enable this static key are: -+ * -+ * * A task modifying its uclamp value with sched_setattr(). -+ * * An admin modifying the sysctl_sched_uclamp_{min, max} via procfs. -+ * * An admin modifying the cgroup cpu.uclamp.{min, max} -+ */ -+DEFINE_STATIC_KEY_FALSE(sched_uclamp_used); -+ - /* Integer rounded range for each bucket */ - #define UCLAMP_BUCKET_DELTA DIV_ROUND_CLOSEST(SCHED_CAPACITY_SCALE, UCLAMP_BUCKETS) - -@@ -990,10 +1010,38 @@ static inline void uclamp_rq_dec_id(struct rq *rq, struct task_struct *p, - - lockdep_assert_held(&rq->lock); - -+ /* -+ * If sched_uclamp_used was enabled after task @p was enqueued, -+ * we could end up with unbalanced call to uclamp_rq_dec_id(). -+ * -+ * In this case the uc_se->active flag should be false since no uclamp -+ * accounting was performed at enqueue time and we can just return -+ * here. -+ * -+ * Need to be careful of the following enqeueue/dequeue ordering -+ * problem too -+ * -+ * enqueue(taskA) -+ * // sched_uclamp_used gets enabled -+ * enqueue(taskB) -+ * dequeue(taskA) -+ * // Must not decrement bukcet->tasks here -+ * dequeue(taskB) -+ * -+ * where we could end up with stale data in uc_se and -+ * bucket[uc_se->bucket_id]. -+ * -+ * The following check here eliminates the possibility of such race. -+ */ -+ if (unlikely(!uc_se->active)) -+ return; -+ - bucket = &uc_rq->bucket[uc_se->bucket_id]; -+ - SCHED_WARN_ON(!bucket->tasks); - if (likely(bucket->tasks)) - bucket->tasks--; -+ - uc_se->active = false; - - /* -@@ -1021,6 +1069,15 @@ static inline void uclamp_rq_inc(struct rq *rq, struct task_struct *p) - { - enum uclamp_id clamp_id; - -+ /* -+ * Avoid any overhead until uclamp is actually used by the userspace. -+ * -+ * The condition is constructed such that a NOP is generated when -+ * sched_uclamp_used is disabled. -+ */ -+ if (!static_branch_unlikely(&sched_uclamp_used)) -+ return; -+ - if (unlikely(!p->sched_class->uclamp_enabled)) - return; - -@@ -1036,6 +1093,15 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p) - { - enum uclamp_id clamp_id; - -+ /* -+ * Avoid any overhead until uclamp is actually used by the userspace. -+ * -+ * The condition is constructed such that a NOP is generated when -+ * sched_uclamp_used is disabled. -+ */ -+ if (!static_branch_unlikely(&sched_uclamp_used)) -+ return; -+ - if (unlikely(!p->sched_class->uclamp_enabled)) - return; - -@@ -1145,8 +1211,10 @@ int sysctl_sched_uclamp_handler(struct ctl_table *table, int write, - update_root_tg = true; - } - -- if (update_root_tg) -+ if (update_root_tg) { -+ static_branch_enable(&sched_uclamp_used); - uclamp_update_root_tg(); -+ } - - /* - * We update all RUNNABLE tasks only when task groups are in use. -@@ -1181,6 +1249,15 @@ static int uclamp_validate(struct task_struct *p, - if (upper_bound > SCHED_CAPACITY_SCALE) - return -EINVAL; - -+ /* -+ * We have valid uclamp attributes; make sure uclamp is enabled. -+ * -+ * We need to do that here, because enabling static branches is a -+ * blocking operation which obviously cannot be done while holding -+ * scheduler locks. -+ */ -+ static_branch_enable(&sched_uclamp_used); -+ - return 0; - } - -@@ -7294,6 +7371,8 @@ static ssize_t cpu_uclamp_write(struct kernfs_open_file *of, char *buf, - if (req.ret) - return req.ret; - -+ static_branch_enable(&sched_uclamp_used); -+ - mutex_lock(&uclamp_mutex); - rcu_read_lock(); - -diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c -index b6f56e7c8dd16..4cb80e6042c4f 100644 ---- a/kernel/sched/cpufreq_schedutil.c -+++ b/kernel/sched/cpufreq_schedutil.c -@@ -210,7 +210,7 @@ unsigned long schedutil_cpu_util(int cpu, unsigned long util_cfs, - unsigned long dl_util, util, irq; - struct rq *rq = cpu_rq(cpu); - -- if (!IS_BUILTIN(CONFIG_UCLAMP_TASK) && -+ if (!uclamp_is_used() && - type == FREQUENCY_UTIL && rt_rq_is_runnable(&rq->rt)) { - return max; - } -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 570659f1c6e22..9f2a9e34a78d5 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -841,6 +841,8 @@ struct uclamp_rq { - unsigned int value; - struct uclamp_bucket bucket[UCLAMP_BUCKETS]; - }; -+ -+DECLARE_STATIC_KEY_FALSE(sched_uclamp_used); - #endif /* CONFIG_UCLAMP_TASK */ - - /* -@@ -2319,12 +2321,35 @@ static inline void cpufreq_update_util(struct rq *rq, unsigned int flags) {} - #ifdef CONFIG_UCLAMP_TASK - unsigned int uclamp_eff_value(struct task_struct *p, enum uclamp_id clamp_id); - -+/** -+ * uclamp_util_with - clamp @util with @rq and @p effective uclamp values. -+ * @rq: The rq to clamp against. Must not be NULL. -+ * @util: The util value to clamp. -+ * @p: The task to clamp against. Can be NULL if you want to clamp -+ * against @rq only. -+ * -+ * Clamps the passed @util to the max(@rq, @p) effective uclamp values. -+ * -+ * If sched_uclamp_used static key is disabled, then just return the util -+ * without any clamping since uclamp aggregation at the rq level in the fast -+ * path is disabled, rendering this operation a NOP. -+ * -+ * Use uclamp_eff_value() if you don't care about uclamp values at rq level. It -+ * will return the correct effective uclamp value of the task even if the -+ * static key is disabled. -+ */ - static __always_inline - unsigned int uclamp_util_with(struct rq *rq, unsigned int util, - struct task_struct *p) - { -- unsigned int min_util = READ_ONCE(rq->uclamp[UCLAMP_MIN].value); -- unsigned int max_util = READ_ONCE(rq->uclamp[UCLAMP_MAX].value); -+ unsigned int min_util; -+ unsigned int max_util; -+ -+ if (!static_branch_likely(&sched_uclamp_used)) -+ return util; -+ -+ min_util = READ_ONCE(rq->uclamp[UCLAMP_MIN].value); -+ max_util = READ_ONCE(rq->uclamp[UCLAMP_MAX].value); - - if (p) { - min_util = max(min_util, uclamp_eff_value(p, UCLAMP_MIN)); -@@ -2346,6 +2371,19 @@ static inline unsigned int uclamp_util(struct rq *rq, unsigned int util) - { - return uclamp_util_with(rq, util, NULL); - } -+ -+/* -+ * When uclamp is compiled in, the aggregation at rq level is 'turned off' -+ * by default in the fast path and only gets turned on once userspace performs -+ * an operation that requires it. -+ * -+ * Returns true if userspace opted-in to use uclamp and aggregation at rq level -+ * hence is active. -+ */ -+static inline bool uclamp_is_used(void) -+{ -+ return static_branch_likely(&sched_uclamp_used); -+} - #else /* CONFIG_UCLAMP_TASK */ - static inline unsigned int uclamp_util_with(struct rq *rq, unsigned int util, - struct task_struct *p) -@@ -2356,6 +2394,11 @@ static inline unsigned int uclamp_util(struct rq *rq, unsigned int util) - { - return util; - } -+ -+static inline bool uclamp_is_used(void) -+{ -+ return false; -+} - #endif /* CONFIG_UCLAMP_TASK */ - - #ifdef arch_scale_freq_capacity -diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c -index a4c8f9d9522e4..884333b9fc767 100644 ---- a/kernel/trace/blktrace.c -+++ b/kernel/trace/blktrace.c -@@ -535,6 +535,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, - #endif - bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root); - -+ /* -+ * As blktrace relies on debugfs for its interface the debugfs directory -+ * is required, contrary to the usual mantra of not checking for debugfs -+ * files or directories. -+ */ -+ if (IS_ERR_OR_NULL(dir)) { -+ pr_warn("debugfs_dir not present for %s so skipping\n", -+ buts->name); -+ ret = -ENOENT; -+ goto err; -+ } -+ - bt->dev = dev; - atomic_set(&bt->dropped, 0); - INIT_LIST_HEAD(&bt->running_list); -diff --git a/mm/cma.c b/mm/cma.c -index 7fe0b8356775f..7de520c0a1db6 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -93,19 +93,15 @@ static void cma_clear_bitmap(struct cma *cma, unsigned long pfn, - mutex_unlock(&cma->lock); - } - --static int __init cma_activate_area(struct cma *cma) -+static void __init cma_activate_area(struct cma *cma) - { -- int bitmap_size = BITS_TO_LONGS(cma_bitmap_maxno(cma)) * sizeof(long); - unsigned long base_pfn = cma->base_pfn, pfn = base_pfn; - unsigned i = cma->count >> pageblock_order; - struct zone *zone; - -- cma->bitmap = kzalloc(bitmap_size, GFP_KERNEL); -- -- if (!cma->bitmap) { -- cma->count = 0; -- return -ENOMEM; -- } -+ cma->bitmap = bitmap_zalloc(cma_bitmap_maxno(cma), GFP_KERNEL); -+ if (!cma->bitmap) -+ goto out_error; - - WARN_ON_ONCE(!pfn_valid(pfn)); - zone = page_zone(pfn_to_page(pfn)); -@@ -135,25 +131,22 @@ static int __init cma_activate_area(struct cma *cma) - spin_lock_init(&cma->mem_head_lock); - #endif - -- return 0; -+ return; - - not_in_zone: -- pr_err("CMA area %s could not be activated\n", cma->name); -- kfree(cma->bitmap); -+ bitmap_free(cma->bitmap); -+out_error: - cma->count = 0; -- return -EINVAL; -+ pr_err("CMA area %s could not be activated\n", cma->name); -+ return; - } - - static int __init cma_init_reserved_areas(void) - { - int i; - -- for (i = 0; i < cma_area_count; i++) { -- int ret = cma_activate_area(&cma_areas[i]); -- -- if (ret) -- return ret; -- } -+ for (i = 0; i < cma_area_count; i++) -+ cma_activate_area(&cma_areas[i]); - - return 0; - } -diff --git a/mm/mmu_context.c b/mm/mmu_context.c -index 3e612ae748e96..a1da47e027479 100644 ---- a/mm/mmu_context.c -+++ b/mm/mmu_context.c -@@ -25,13 +25,16 @@ void use_mm(struct mm_struct *mm) - struct task_struct *tsk = current; - - task_lock(tsk); -+ /* Hold off tlb flush IPIs while switching mm's */ -+ local_irq_disable(); - active_mm = tsk->active_mm; - if (active_mm != mm) { - mmgrab(mm); - tsk->active_mm = mm; - } - tsk->mm = mm; -- switch_mm(active_mm, mm, tsk); -+ switch_mm_irqs_off(active_mm, mm, tsk); -+ local_irq_enable(); - task_unlock(tsk); - #ifdef finish_arch_post_lock_switch - finish_arch_post_lock_switch(); -@@ -56,9 +59,11 @@ void unuse_mm(struct mm_struct *mm) - - task_lock(tsk); - sync_mm_rss(mm); -+ local_irq_disable(); - tsk->mm = NULL; - /* active_mm is still 'mm' */ - enter_lazy_tlb(mm, tsk); -+ local_irq_enable(); - task_unlock(tsk); - } - EXPORT_SYMBOL_GPL(unuse_mm); -diff --git a/mm/shuffle.c b/mm/shuffle.c -index b3fe97fd66541..56958ffa5a3a9 100644 ---- a/mm/shuffle.c -+++ b/mm/shuffle.c -@@ -58,25 +58,25 @@ module_param_call(shuffle, shuffle_store, shuffle_show, &shuffle_param, 0400); - * For two pages to be swapped in the shuffle, they must be free (on a - * 'free_area' lru), have the same order, and have the same migratetype. - */ --static struct page * __meminit shuffle_valid_page(unsigned long pfn, int order) -+static struct page * __meminit shuffle_valid_page(struct zone *zone, -+ unsigned long pfn, int order) - { -- struct page *page; -+ struct page *page = pfn_to_online_page(pfn); - - /* - * Given we're dealing with randomly selected pfns in a zone we - * need to ask questions like... - */ - -- /* ...is the pfn even in the memmap? */ -- if (!pfn_valid_within(pfn)) -+ /* ... is the page managed by the buddy? */ -+ if (!page) - return NULL; - -- /* ...is the pfn in a present section or a hole? */ -- if (!pfn_present(pfn)) -+ /* ... is the page assigned to the same zone? */ -+ if (page_zone(page) != zone) - return NULL; - - /* ...is the page free and currently on a free_area list? */ -- page = pfn_to_page(pfn); - if (!PageBuddy(page)) - return NULL; - -@@ -123,7 +123,7 @@ void __meminit __shuffle_zone(struct zone *z) - * page_j randomly selected in the span @zone_start_pfn to - * @spanned_pages. - */ -- page_i = shuffle_valid_page(i, order); -+ page_i = shuffle_valid_page(z, i, order); - if (!page_i) - continue; - -@@ -137,7 +137,7 @@ void __meminit __shuffle_zone(struct zone *z) - j = z->zone_start_pfn + - ALIGN_DOWN(get_random_long() % z->spanned_pages, - order_pages); -- page_j = shuffle_valid_page(j, order); -+ page_j = shuffle_valid_page(z, j, order); - if (page_j && page_j != page_i) - break; - } -diff --git a/mm/vmalloc.c b/mm/vmalloc.c -index ad4d00bd79147..5797e1eeaa7e6 100644 ---- a/mm/vmalloc.c -+++ b/mm/vmalloc.c -@@ -85,6 +85,8 @@ static void vunmap_pmd_range(pud_t *pud, unsigned long addr, unsigned long end) - if (pmd_none_or_clear_bad(pmd)) - continue; - vunmap_pte_range(pmd, addr, next); -+ -+ cond_resched(); - } while (pmd++, addr = next, addr != end); - } - -diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c -index 8096732223828..8d033a75a766e 100644 ---- a/net/bridge/netfilter/nf_conntrack_bridge.c -+++ b/net/bridge/netfilter/nf_conntrack_bridge.c -@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb, - static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, - const struct nf_hook_state *state) - { -+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) - u16 zone_id = NF_CT_DEFAULT_ZONE_ID; - enum ip_conntrack_info ctinfo; - struct br_input_skb_cb cb; -@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, - - br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm)); - -- err = nf_ipv6_br_defrag(state->net, skb, -- IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); -+ err = nf_ct_frag6_gather(state->net, skb, -+ IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); - /* queued */ - if (err == -EINPROGRESS) - return NF_STOLEN; - - br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size); - return err == 0 ? NF_ACCEPT : NF_DROP; -+#else -+ return NF_ACCEPT; -+#endif - } - - static int nf_ct_br_ip_check(const struct sk_buff *skb) -diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c -index dbd215cbc53d8..a8dd956b5e8e1 100644 ---- a/net/can/j1939/transport.c -+++ b/net/can/j1939/transport.c -@@ -1803,7 +1803,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, - } - - tpdat = se_skb->data; -- memcpy(&tpdat[offset], &dat[1], nbytes); -+ if (!session->transmission) { -+ memcpy(&tpdat[offset], &dat[1], nbytes); -+ } else { -+ int err; -+ -+ err = memcmp(&tpdat[offset], &dat[1], nbytes); -+ if (err) -+ netdev_err_once(priv->ndev, -+ "%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n", -+ __func__, session, -+ nbytes, &dat[1], -+ nbytes, &tpdat[offset]); -+ } -+ - if (packet == session->pkt.rx) - session->pkt.rx++; - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 973a71f4bc898..f80b6999ca1cb 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -5317,8 +5317,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) - skb = skb_share_check(skb, GFP_ATOMIC); - if (unlikely(!skb)) - goto err_free; -- -- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) -+ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ -+ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) - goto err_free; - - vhdr = (struct vlan_hdr *)skb->data; -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index a01f500d6a6ba..afa2c5049845f 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -403,7 +403,7 @@ static int nh_check_attr_group(struct net *net, struct nlattr *tb[], - struct nexthop_grp *nhg; - unsigned int i, j; - -- if (len & (sizeof(struct nexthop_grp) - 1)) { -+ if (!len || len & (sizeof(struct nexthop_grp) - 1)) { - NL_SET_ERR_MSG(extack, - "Invalid length for nexthop group attribute"); - return -EINVAL; -@@ -1105,6 +1105,9 @@ static struct nexthop *nexthop_create_group(struct net *net, - struct nexthop *nh; - int i; - -+ if (WARN_ON(!num_nh)) -+ return ERR_PTR(-EINVAL); -+ - nh = nexthop_alloc(); - if (!nh) - return ERR_PTR(-ENOMEM); -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index b5dd20c4599bb..8dcf7bacc99a6 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -860,7 +860,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb, - struct metadata_dst *tun_dst, - bool log_ecn_err) - { -- return __ip6_tnl_rcv(t, skb, tpi, tun_dst, ip6ip6_dscp_ecn_decapsulate, -+ int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t, -+ const struct ipv6hdr *ipv6h, -+ struct sk_buff *skb); -+ -+ dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate; -+ if (tpi->proto == htons(ETH_P_IP)) -+ dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate; -+ -+ return __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate, - log_ecn_err); - } - EXPORT_SYMBOL(ip6_tnl_rcv); -diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c -index 409e79b84a830..6d0e942d082d4 100644 ---- a/net/ipv6/netfilter.c -+++ b/net/ipv6/netfilter.c -@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = { - .route_input = ip6_route_input, - .fragment = ip6_fragment, - .reroute = nf_ip6_reroute, --#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) -- .br_defrag = nf_ct_frag6_gather, --#endif - #if IS_MODULE(CONFIG_IPV6) - .br_fragment = br_ip6_fragment, - #endif -diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c -index 1ce1e710d0252..a699e318b9a01 100644 ---- a/net/qrtr/qrtr.c -+++ b/net/qrtr/qrtr.c -@@ -547,23 +547,25 @@ static void qrtr_port_remove(struct qrtr_sock *ipc) - */ - static int qrtr_port_assign(struct qrtr_sock *ipc, int *port) - { -+ u32 min_port; - int rc; - - mutex_lock(&qrtr_port_lock); - if (!*port) { -- rc = idr_alloc(&qrtr_ports, ipc, -- QRTR_MIN_EPH_SOCKET, QRTR_MAX_EPH_SOCKET + 1, -- GFP_ATOMIC); -- if (rc >= 0) -- *port = rc; -+ min_port = QRTR_MIN_EPH_SOCKET; -+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, QRTR_MAX_EPH_SOCKET, GFP_ATOMIC); -+ if (!rc) -+ *port = min_port; - } else if (*port < QRTR_MIN_EPH_SOCKET && !capable(CAP_NET_ADMIN)) { - rc = -EACCES; - } else if (*port == QRTR_PORT_CTRL) { -- rc = idr_alloc(&qrtr_ports, ipc, 0, 1, GFP_ATOMIC); -+ min_port = 0; -+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, 0, GFP_ATOMIC); - } else { -- rc = idr_alloc(&qrtr_ports, ipc, *port, *port + 1, GFP_ATOMIC); -- if (rc >= 0) -- *port = rc; -+ min_port = *port; -+ rc = idr_alloc_u32(&qrtr_ports, ipc, &min_port, *port, GFP_ATOMIC); -+ if (!rc) -+ *port = min_port; - } - mutex_unlock(&qrtr_port_lock); - -diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c -index e0060aefbf9d8..e32c4732ddf83 100644 ---- a/net/sched/act_ct.c -+++ b/net/sched/act_ct.c -@@ -186,7 +186,7 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb, - memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm)); - err = nf_ct_frag6_gather(net, skb, user); - if (err && err != -EINPROGRESS) -- goto out_free; -+ return err; - #else - err = -EOPNOTSUPP; - goto out_free; -diff --git a/net/sctp/stream.c b/net/sctp/stream.c -index e13cbd5c01932..cd20638b61514 100644 ---- a/net/sctp/stream.c -+++ b/net/sctp/stream.c -@@ -88,12 +88,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt, - int ret; - - if (outcnt <= stream->outcnt) -- return 0; -+ goto out; - - ret = genradix_prealloc(&stream->out, outcnt, gfp); - if (ret) - return ret; - -+out: - stream->outcnt = outcnt; - return 0; - } -@@ -104,12 +105,13 @@ static int sctp_stream_alloc_in(struct sctp_stream *stream, __u16 incnt, - int ret; - - if (incnt <= stream->incnt) -- return 0; -+ goto out; - - ret = genradix_prealloc(&stream->in, incnt, gfp); - if (ret) - return ret; - -+out: - stream->incnt = incnt; - return 0; - } -diff --git a/net/smc/smc_diag.c b/net/smc/smc_diag.c -index e1f64f4ba2361..da9ba6d1679b7 100644 ---- a/net/smc/smc_diag.c -+++ b/net/smc/smc_diag.c -@@ -170,13 +170,15 @@ static int __smc_diag_dump(struct sock *sk, struct sk_buff *skb, - (req->diag_ext & (1 << (SMC_DIAG_DMBINFO - 1))) && - !list_empty(&smc->conn.lgr->list)) { - struct smc_connection *conn = &smc->conn; -- struct smcd_diag_dmbinfo dinfo = { -- .linkid = *((u32 *)conn->lgr->id), -- .peer_gid = conn->lgr->peer_gid, -- .my_gid = conn->lgr->smcd->local_gid, -- .token = conn->rmb_desc->token, -- .peer_token = conn->peer_token -- }; -+ struct smcd_diag_dmbinfo dinfo; -+ -+ memset(&dinfo, 0, sizeof(dinfo)); -+ -+ dinfo.linkid = *((u32 *)conn->lgr->id); -+ dinfo.peer_gid = conn->lgr->peer_gid; -+ dinfo.my_gid = conn->lgr->smcd->local_gid; -+ dinfo.token = conn->rmb_desc->token; -+ dinfo.peer_token = conn->peer_token; - - if (nla_put(skb, SMC_DIAG_DMBINFO, sizeof(dinfo), &dinfo) < 0) - goto errout; -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index d4d2928424e2f..11be9a84f8de9 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -255,8 +255,9 @@ err_out: - static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - struct tipc_nl_compat_msg *msg) - { -- int err; -+ struct nlmsghdr *nlh; - struct sk_buff *arg; -+ int err; - - if (msg->req_type && (!msg->req_size || - !TLV_CHECK_TYPE(msg->req, msg->req_type))) -@@ -285,6 +286,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - return -ENOMEM; - } - -+ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI); -+ if (!nlh) { -+ kfree_skb(arg); -+ kfree_skb(msg->rep); -+ msg->rep = NULL; -+ return -EMSGSIZE; -+ } -+ nlmsg_end(arg, nlh); -+ - err = __tipc_nl_compat_dumpit(cmd, msg, arg); - if (err) { - kfree_skb(msg->rep); -diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib -index 342618a2bccb4..a6d0044328b1f 100644 ---- a/scripts/Makefile.lib -+++ b/scripts/Makefile.lib -@@ -230,7 +230,7 @@ cmd_objcopy = $(OBJCOPY) $(OBJCOPYFLAGS) $(OBJCOPYFLAGS_$(@F)) $< $@ - # --------------------------------------------------------------------------- - - quiet_cmd_gzip = GZIP $@ -- cmd_gzip = cat $(real-prereqs) | gzip -n -f -9 > $@ -+ cmd_gzip = cat $(real-prereqs) | $(KGZIP) -n -f -9 > $@ - - # DTC - # --------------------------------------------------------------------------- -@@ -322,19 +322,19 @@ printf "%08x\n" $$dec_size | \ - ) - - quiet_cmd_bzip2 = BZIP2 $@ -- cmd_bzip2 = { cat $(real-prereqs) | bzip2 -9; $(size_append); } > $@ -+ cmd_bzip2 = { cat $(real-prereqs) | $(KBZIP2) -9; $(size_append); } > $@ - - # Lzma - # --------------------------------------------------------------------------- - - quiet_cmd_lzma = LZMA $@ -- cmd_lzma = { cat $(real-prereqs) | lzma -9; $(size_append); } > $@ -+ cmd_lzma = { cat $(real-prereqs) | $(LZMA) -9; $(size_append); } > $@ - - quiet_cmd_lzo = LZO $@ -- cmd_lzo = { cat $(real-prereqs) | lzop -9; $(size_append); } > $@ -+ cmd_lzo = { cat $(real-prereqs) | $(KLZOP) -9; $(size_append); } > $@ - - quiet_cmd_lz4 = LZ4 $@ -- cmd_lz4 = { cat $(real-prereqs) | lz4c -l -c1 stdin stdout; \ -+ cmd_lz4 = { cat $(real-prereqs) | $(LZ4) -l -c1 stdin stdout; \ - $(size_append); } > $@ - - # U-Boot mkimage -@@ -381,7 +381,7 @@ quiet_cmd_xzkern = XZKERN $@ - $(size_append); } > $@ - - quiet_cmd_xzmisc = XZMISC $@ -- cmd_xzmisc = cat $(real-prereqs) | xz --check=crc32 --lzma2=dict=1MiB > $@ -+ cmd_xzmisc = cat $(real-prereqs) | $(XZ) --check=crc32 --lzma2=dict=1MiB > $@ - - # ASM offsets - # --------------------------------------------------------------------------- -diff --git a/scripts/Makefile.package b/scripts/Makefile.package -index 56eadcc48d46d..35a617c296115 100644 ---- a/scripts/Makefile.package -+++ b/scripts/Makefile.package -@@ -45,7 +45,7 @@ if test "$(objtree)" != "$(srctree)"; then \ - false; \ - fi ; \ - $(srctree)/scripts/setlocalversion --save-scmversion; \ --tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \ -+tar -I $(KGZIP) -c $(RCS_TAR_IGNORE) -f $(2).tar.gz \ - --transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \ - rm -f $(objtree)/.scmversion - -@@ -127,9 +127,9 @@ util/PERF-VERSION-GEN $(CURDIR)/$(perf-tar)/); \ - tar rf $(perf-tar).tar $(perf-tar)/HEAD $(perf-tar)/PERF-VERSION-FILE; \ - rm -r $(perf-tar); \ - $(if $(findstring tar-src,$@),, \ --$(if $(findstring bz2,$@),bzip2, \ --$(if $(findstring gz,$@),gzip, \ --$(if $(findstring xz,$@),xz, \ -+$(if $(findstring bz2,$@),$(KBZIP2), \ -+$(if $(findstring gz,$@),$(KGZIP), \ -+$(if $(findstring xz,$@),$(XZ), \ - $(error unknown target $@)))) \ - -f -9 $(perf-tar).tar) - -diff --git a/scripts/package/buildtar b/scripts/package/buildtar -index 2f66c81e4021b..3d541cee16ed0 100755 ---- a/scripts/package/buildtar -+++ b/scripts/package/buildtar -@@ -28,15 +28,15 @@ case "${1}" in - opts= - ;; - targz-pkg) -- opts=--gzip -+ opts="-I ${KGZIP}" - tarball=${tarball}.gz - ;; - tarbz2-pkg) -- opts=--bzip2 -+ opts="-I ${KBZIP2}" - tarball=${tarball}.bz2 - ;; - tarxz-pkg) -- opts=--xz -+ opts="-I ${XZ}" - tarball=${tarball}.xz - ;; - *) -diff --git a/scripts/xz_wrap.sh b/scripts/xz_wrap.sh -index 7a2d372f4885a..76e9cbcfbeab4 100755 ---- a/scripts/xz_wrap.sh -+++ b/scripts/xz_wrap.sh -@@ -20,4 +20,4 @@ case $SRCARCH in - sparc) BCJ=--sparc ;; - esac - --exec xz --check=crc32 $BCJ --lzma2=$LZMA2OPTS,dict=32MiB -+exec $XZ --check=crc32 $BCJ --lzma2=$LZMA2OPTS,dict=32MiB -diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c -index 5b888b795f7ee..c07a9e735733a 100644 ---- a/sound/pci/cs46xx/cs46xx_lib.c -+++ b/sound/pci/cs46xx/cs46xx_lib.c -@@ -766,7 +766,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned - rate = 48000 / 9; - - /* -- * We can not capture at at rate greater than the Input Rate (48000). -+ * We can not capture at a rate greater than the Input Rate (48000). - * Return an error if an attempt is made to stray outside that limit. - */ - if (rate > 48000) -diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c -index 715ead59613da..0bef823c5f61f 100644 ---- a/sound/pci/cs46xx/dsp_spos_scb_lib.c -+++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c -@@ -1716,7 +1716,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip) - struct dsp_spos_instance * ins = chip->dsp_spos_instance; - - if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) { -- /* remove AsynchFGTxSCB and and PCMSerialInput_II */ -+ /* remove AsynchFGTxSCB and PCMSerialInput_II */ - cs46xx_dsp_disable_spdif_out (chip); - - /* save state */ -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 801abf0fc98b3..103011e7285a3 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -3420,7 +3420,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save); - * @nid: NID to check / update - * - * Check whether the given NID is in the amp list. If it's in the list, -- * check the current AMP status, and update the the power-status according -+ * check the current AMP status, and update the power-status according - * to the mute status. - * - * This function is supposed to be set or called from the check_power_status -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 6815f9dc8545d..e1750bdbe51f6 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -813,7 +813,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, - } - } - --/* sync power of each widget in the the given path */ -+/* sync power of each widget in the given path */ - static hda_nid_t path_power_update(struct hda_codec *codec, - struct nid_path *path, - bool allow_powerdown) -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 7353d2ec359ae..3a456410937b5 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2671,6 +2671,8 @@ static const struct pci_device_id azx_ids[] = { - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI }, - /* Zhaoxin */ - { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN }, -+ /* Loongson */ -+ { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC }, - { 0, } - }; - MODULE_DEVICE_TABLE(pci, azx_ids); -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index 908b68fda24c9..ec9460f3a288e 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -176,6 +176,7 @@ struct hdmi_spec { - bool use_jack_detect; /* jack detection enabled */ - bool use_acomp_notifier; /* use eld_notify callback for hotplug */ - bool acomp_registered; /* audio component registered in this driver */ -+ bool force_connect; /* force connectivity */ - struct drm_audio_component_audio_ops drm_audio_ops; - int (*port2pin)(struct hda_codec *, int); /* reverse port/pin mapping */ - -@@ -1711,7 +1712,8 @@ static int hdmi_add_pin(struct hda_codec *codec, hda_nid_t pin_nid) - * all device entries on the same pin - */ - config = snd_hda_codec_get_pincfg(codec, pin_nid); -- if (get_defcfg_connect(config) == AC_JACK_PORT_NONE) -+ if (get_defcfg_connect(config) == AC_JACK_PORT_NONE && -+ !spec->force_connect) - return 0; - - /* -@@ -1815,11 +1817,19 @@ static int hdmi_add_cvt(struct hda_codec *codec, hda_nid_t cvt_nid) - return 0; - } - -+static const struct snd_pci_quirk force_connect_list[] = { -+ SND_PCI_QUIRK(0x103c, 0x870f, "HP", 1), -+ SND_PCI_QUIRK(0x103c, 0x871a, "HP", 1), -+ {} -+}; -+ - static int hdmi_parse_codec(struct hda_codec *codec) - { -+ struct hdmi_spec *spec = codec->spec; - hda_nid_t start_nid; - unsigned int caps; - int i, nodes; -+ const struct snd_pci_quirk *q; - - nodes = snd_hda_get_sub_nodes(codec, codec->core.afg, &start_nid); - if (!start_nid || nodes < 0) { -@@ -1827,6 +1837,11 @@ static int hdmi_parse_codec(struct hda_codec *codec) - return -EINVAL; - } - -+ q = snd_pci_quirk_lookup(codec->bus->pci, force_connect_list); -+ -+ if (q && q->value) -+ spec->force_connect = true; -+ - /* - * hdmi_add_pin() assumes total amount of converters to - * be known, so first discover all converters -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 06bbcfbb28153..d1b74c7cacd76 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -6137,6 +6137,7 @@ enum { - ALC269_FIXUP_CZC_L101, - ALC269_FIXUP_LEMOTE_A1802, - ALC269_FIXUP_LEMOTE_A190X, -+ ALC256_FIXUP_INTEL_NUC8_RUGGED, - }; - - static const struct hda_fixup alc269_fixups[] = { -@@ -7458,6 +7459,15 @@ static const struct hda_fixup alc269_fixups[] = { - }, - .chain_id = ALC269_FIXUP_DMIC, - }, -+ [ALC256_FIXUP_INTEL_NUC8_RUGGED] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x1b, 0x01a1913c }, /* use as headset mic, without its own jack detect */ -+ { } -+ }, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_HEADSET_MODE -+ }, - }; - - static const struct snd_pci_quirk alc269_fixup_tbl[] = { -@@ -7757,6 +7767,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE), - SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802), - SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X), -+ SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED), - - #if 0 - /* Below is a quirk table taken from the old code. -@@ -7928,6 +7939,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, - {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, - {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, -+ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, - {} - }; - #define ALC225_STANDARD_PINS \ -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index 4b9300babc7d0..bfd3fe5eff31c 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -832,7 +832,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec, - static struct snd_kcontrol_new beep_vol_ctl = - HDA_CODEC_VOLUME(NULL, 0, 0, 0); - -- /* check for mute support for the the amp */ -+ /* check for mute support for the amp */ - if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) { - const struct snd_kcontrol_new *temp; - if (spec->anabeep_nid == nid) -diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c -index 98f8ac6587962..243f757da3edb 100644 ---- a/sound/pci/ice1712/prodigy192.c -+++ b/sound/pci/ice1712/prodigy192.c -@@ -32,7 +32,7 @@ - * Experimentally I found out that only a combination of - * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 - - * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct -- * sampling rate. That means the the FPGA doubles the -+ * sampling rate. That means that the FPGA doubles the - * MCK01 rate. - * - * Copyright (c) 2003 Takashi Iwai -diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c -index c3f8721624cd4..b90421a1d909a 100644 ---- a/sound/pci/oxygen/xonar_dg.c -+++ b/sound/pci/oxygen/xonar_dg.c -@@ -29,7 +29,7 @@ - * GPIO 4 <- headphone detect - * GPIO 5 -> enable ADC analog circuit for the left channel - * GPIO 6 -> enable ADC analog circuit for the right channel -- * GPIO 7 -> switch green rear output jack between CS4245 and and the first -+ * GPIO 7 -> switch green rear output jack between CS4245 and the first - * channel of CS4361 (mechanical relay) - * GPIO 8 -> enable output to speakers - * -diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c -index 18535b326680a..04f23477039a5 100644 ---- a/sound/soc/codecs/wm8958-dsp2.c -+++ b/sound/soc/codecs/wm8958-dsp2.c -@@ -416,8 +416,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w, - struct snd_kcontrol *kcontrol, int event) - { - struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); -+ struct wm8994 *control = dev_get_drvdata(component->dev->parent); - int i; - -+ if (control->type != WM8958) -+ return 0; -+ - switch (event) { - case SND_SOC_DAPM_POST_PMU: - case SND_SOC_DAPM_PRE_PMU: -diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c -index 869fe0068cbd3..bb668551dd4b2 100644 ---- a/sound/soc/img/img-i2s-in.c -+++ b/sound/soc/img/img-i2s-in.c -@@ -343,8 +343,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK; - - ret = pm_runtime_get_sync(i2s->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(i2s->dev); - return ret; -+ } - - for (i = 0; i < i2s->active_channels; i++) - img_i2s_in_ch_disable(i2s, i); -diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c -index 5ddbe3a31c2e9..4da49a42e8547 100644 ---- a/sound/soc/img/img-parallel-out.c -+++ b/sound/soc/img/img-parallel-out.c -@@ -163,8 +163,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt) - } - - ret = pm_runtime_get_sync(prl->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(prl->dev); - return ret; -+ } - - reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL); - reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set; -diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c -index 635eacbd28d47..156e3b9d613c6 100644 ---- a/sound/soc/tegra/tegra30_ahub.c -+++ b/sound/soc/tegra/tegra30_ahub.c -@@ -643,8 +643,10 @@ static int tegra30_ahub_resume(struct device *dev) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(dev); - return ret; -+ } - ret = regcache_sync(ahub->regmap_ahub); - ret |= regcache_sync(ahub->regmap_apbif); - pm_runtime_put(dev); -diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c -index e6d548fa980b6..8894b7c16a01a 100644 ---- a/sound/soc/tegra/tegra30_i2s.c -+++ b/sound/soc/tegra/tegra30_i2s.c -@@ -538,8 +538,10 @@ static int tegra30_i2s_resume(struct device *dev) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put(dev); - return ret; -+ } - ret = regcache_sync(i2s->regmap); - pm_runtime_put(dev); - -diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h -index 1573229d8cf4c..8c3b3a291ddbf 100644 ---- a/sound/usb/quirks-table.h -+++ b/sound/usb/quirks-table.h -@@ -2695,6 +2695,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), - .ifnum = QUIRK_ANY_INTERFACE, - .type = QUIRK_COMPOSITE, - .data = (const struct snd_usb_audio_quirk[]) { -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_STANDARD_MIXER, -+ }, - { - .ifnum = 0, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, -@@ -2707,6 +2711,32 @@ YAMAHA_DEVICE(0x7010, "UB99"), - .attributes = UAC_EP_CS_ATTR_SAMPLE_RATE, - .endpoint = 0x01, - .ep_attr = USB_ENDPOINT_XFER_ISOC, -+ .datainterval = 1, -+ .maxpacksize = 0x024c, -+ .rates = SNDRV_PCM_RATE_44100 | -+ SNDRV_PCM_RATE_48000, -+ .rate_min = 44100, -+ .rate_max = 48000, -+ .nr_rates = 2, -+ .rate_table = (unsigned int[]) { -+ 44100, 48000 -+ } -+ } -+ }, -+ { -+ .ifnum = 0, -+ .type = QUIRK_AUDIO_FIXED_ENDPOINT, -+ .data = &(const struct audioformat) { -+ .formats = SNDRV_PCM_FMTBIT_S24_3LE, -+ .channels = 2, -+ .iface = 0, -+ .altsetting = 1, -+ .altset_idx = 1, -+ .attributes = 0, -+ .endpoint = 0x82, -+ .ep_attr = USB_ENDPOINT_XFER_ISOC, -+ .datainterval = 1, -+ .maxpacksize = 0x0126, - .rates = SNDRV_PCM_RATE_44100 | - SNDRV_PCM_RATE_48000, - .rate_min = 44100, -@@ -3675,8 +3705,8 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */ - * they pretend to be 96kHz mono as a workaround for stereo being broken - * by that... - * -- * They also have swapped L-R channels, but that's for userspace to deal -- * with. -+ * They also have an issue with initial stream alignment that causes the -+ * channels to be swapped and out of phase, which is dealt with in quirks.c. - */ - { - .match_flags = USB_DEVICE_ID_MATCH_DEVICE | -diff --git a/tools/testing/selftests/net/icmp_redirect.sh b/tools/testing/selftests/net/icmp_redirect.sh -index 18c5de53558af..bf361f30d6ef9 100755 ---- a/tools/testing/selftests/net/icmp_redirect.sh -+++ b/tools/testing/selftests/net/icmp_redirect.sh -@@ -180,6 +180,8 @@ setup() - ;; - r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1 - ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1 -+ ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0 -+ ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0 - - ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1 - ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10 -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -index a2d7b0e3dca97..a26ac122c759f 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c -@@ -91,8 +91,6 @@ int back_to_back_ebbs(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -index bc893813483ee..bb9f587fa76e8 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c -@@ -42,8 +42,6 @@ int cycles(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -index dcd351d203289..9ae795ce314e6 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c -@@ -99,8 +99,6 @@ int cycles_with_freeze(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - printf("EBBs while frozen %d\n", ebbs_while_frozen); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -index 94c99c12c0f23..4b45a2e70f62b 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c -@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -index dfbc5c3ad52d7..21537d6eb6b7d 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c -@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -index ca2f7d729155b..b208bf6ad58d3 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c -@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - FAIL_IF(ebb_state.stats.ebb_count == 0); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -index ac3e6e182614a..ba2681a12cc7b 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c -@@ -75,7 +75,6 @@ static int test_body(void) - ebb_freeze_pmcs(); - ebb_global_disable(); - -- count_pmc(4, sample_period); - mtspr(SPRN_PMC4, 0xdead); - - dump_summary_ebb_state(); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -index b8242e9d97d2d..791d37ba327b5 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c -@@ -70,13 +70,6 @@ int multi_counter(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- count_pmc(2, sample_period); -- count_pmc(3, sample_period); -- count_pmc(4, sample_period); -- count_pmc(5, sample_period); -- count_pmc(6, sample_period); -- - dump_ebb_state(); - - for (i = 0; i < 6; i++) -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -index a05c0e18ded63..9b0f70d597020 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c -@@ -61,8 +61,6 @@ static int cycles_child(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_summary_ebb_state(); - - event_close(&event); -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -index 153ebc92234fd..2904c741e04e5 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c -@@ -82,8 +82,6 @@ static int test_body(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(1, sample_period); -- - dump_ebb_state(); - - if (mmcr0_mismatch) -diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -index eadad75ed7e6f..b29f8ba22d1e6 100644 ---- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c -@@ -76,8 +76,6 @@ int pmc56_overflow(void) - ebb_global_disable(); - ebb_freeze_pmcs(); - -- count_pmc(2, sample_period); -- - dump_ebb_state(); - - printf("PMC5/6 overflow %d\n", pmc56_overflowed); diff --git a/patch/kernel/odroidxu4-current/patch-5.4.62-63.patch b/patch/kernel/odroidxu4-current/patch-5.4.62-63.patch deleted file mode 100644 index bcca67e606..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.62-63.patch +++ /dev/null @@ -1,931 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt b/Documentation/devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt -index 2cf3affa1be70..96c0b1440c9c5 100644 ---- a/Documentation/devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt -+++ b/Documentation/devicetree/bindings/mmc/nvidia,tegra20-sdhci.txt -@@ -15,8 +15,15 @@ Required properties: - - "nvidia,tegra210-sdhci": for Tegra210 - - "nvidia,tegra186-sdhci": for Tegra186 - - "nvidia,tegra194-sdhci": for Tegra194 --- clocks : Must contain one entry, for the module clock. -- See ../clocks/clock-bindings.txt for details. -+- clocks: For Tegra210, Tegra186 and Tegra194 must contain two entries. -+ One for the module clock and one for the timeout clock. -+ For all other Tegra devices, must contain a single entry for -+ the module clock. See ../clocks/clock-bindings.txt for details. -+- clock-names: For Tegra210, Tegra186 and Tegra194 must contain the -+ strings 'sdhci' and 'tmclk' to represent the module and -+ the timeout clocks, respectively. -+ For all other Tegra devices must contain the string 'sdhci' -+ to represent the module clock. - - resets : Must contain an entry for each entry in reset-names. - See ../reset/reset.txt for details. - - reset-names : Must include the following entries: -@@ -99,7 +106,7 @@ Optional properties for Tegra210, Tegra186 and Tegra194: - - Example: - sdhci@700b0000 { -- compatible = "nvidia,tegra210-sdhci", "nvidia,tegra124-sdhci"; -+ compatible = "nvidia,tegra124-sdhci"; - reg = <0x0 0x700b0000 0x0 0x200>; - interrupts = ; - clocks = <&tegra_car TEGRA210_CLK_SDMMC1>; -@@ -115,3 +122,22 @@ sdhci@700b0000 { - nvidia,pad-autocal-pull-down-offset-1v8 = <0x7b>; - status = "disabled"; - }; -+ -+sdhci@700b0000 { -+ compatible = "nvidia,tegra210-sdhci"; -+ reg = <0x0 0x700b0000 0x0 0x200>; -+ interrupts = ; -+ clocks = <&tegra_car TEGRA210_CLK_SDMMC1>, -+ <&tegra_car TEGRA210_CLK_SDMMC_LEGACY>; -+ clock-names = "sdhci", "tmclk"; -+ resets = <&tegra_car 14>; -+ reset-names = "sdhci"; -+ pinctrl-names = "sdmmc-3v3", "sdmmc-1v8"; -+ pinctrl-0 = <&sdmmc1_3v3>; -+ pinctrl-1 = <&sdmmc1_1v8>; -+ nvidia,pad-autocal-pull-up-offset-3v3 = <0x00>; -+ nvidia,pad-autocal-pull-down-offset-3v3 = <0x7d>; -+ nvidia,pad-autocal-pull-up-offset-1v8 = <0x7b>; -+ nvidia,pad-autocal-pull-down-offset-1v8 = <0x7b>; -+ status = "disabled"; -+}; -diff --git a/Makefile b/Makefile -index aece56450bd9d..418814b108ae6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 62 -+SUBLEVEL = 63 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -index 47cd831fcf445..9abf0cb1dd67f 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi -@@ -309,8 +309,9 @@ - compatible = "nvidia,tegra186-sdhci"; - reg = <0x0 0x03400000 0x0 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA186_CLK_SDMMC1>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA186_CLK_SDMMC1>, -+ <&bpmp TEGRA186_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - resets = <&bpmp TEGRA186_RESET_SDMMC1>; - reset-names = "sdhci"; - iommus = <&smmu TEGRA186_SID_SDMMC1>; -@@ -335,8 +336,9 @@ - compatible = "nvidia,tegra186-sdhci"; - reg = <0x0 0x03420000 0x0 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA186_CLK_SDMMC2>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA186_CLK_SDMMC2>, -+ <&bpmp TEGRA186_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - resets = <&bpmp TEGRA186_RESET_SDMMC2>; - reset-names = "sdhci"; - iommus = <&smmu TEGRA186_SID_SDMMC2>; -@@ -356,8 +358,9 @@ - compatible = "nvidia,tegra186-sdhci"; - reg = <0x0 0x03440000 0x0 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA186_CLK_SDMMC3>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA186_CLK_SDMMC3>, -+ <&bpmp TEGRA186_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - resets = <&bpmp TEGRA186_RESET_SDMMC3>; - reset-names = "sdhci"; - iommus = <&smmu TEGRA186_SID_SDMMC3>; -@@ -379,8 +382,9 @@ - compatible = "nvidia,tegra186-sdhci"; - reg = <0x0 0x03460000 0x0 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA186_CLK_SDMMC4>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA186_CLK_SDMMC4>, -+ <&bpmp TEGRA186_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - assigned-clocks = <&bpmp TEGRA186_CLK_SDMMC4>, - <&bpmp TEGRA186_CLK_PLLC4_VCO>; - assigned-clock-parents = <&bpmp TEGRA186_CLK_PLLC4_VCO>; -diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -index 2f3926719434a..5728255bd0c1a 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -@@ -403,8 +403,9 @@ - compatible = "nvidia,tegra194-sdhci", "nvidia,tegra186-sdhci"; - reg = <0x03400000 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA194_CLK_SDMMC1>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA194_CLK_SDMMC1>, -+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - resets = <&bpmp TEGRA194_RESET_SDMMC1>; - reset-names = "sdhci"; - nvidia,pad-autocal-pull-up-offset-3v3-timeout = -@@ -425,8 +426,9 @@ - compatible = "nvidia,tegra194-sdhci", "nvidia,tegra186-sdhci"; - reg = <0x03440000 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA194_CLK_SDMMC3>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA194_CLK_SDMMC3>, -+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - resets = <&bpmp TEGRA194_RESET_SDMMC3>; - reset-names = "sdhci"; - nvidia,pad-autocal-pull-up-offset-1v8 = <0x00>; -@@ -448,8 +450,9 @@ - compatible = "nvidia,tegra194-sdhci", "nvidia,tegra186-sdhci"; - reg = <0x03460000 0x10000>; - interrupts = ; -- clocks = <&bpmp TEGRA194_CLK_SDMMC4>; -- clock-names = "sdhci"; -+ clocks = <&bpmp TEGRA194_CLK_SDMMC4>, -+ <&bpmp TEGRA194_CLK_SDMMC_LEGACY_TM>; -+ clock-names = "sdhci", "tmclk"; - assigned-clocks = <&bpmp TEGRA194_CLK_SDMMC4>, - <&bpmp TEGRA194_CLK_PLLC4>; - assigned-clock-parents = -diff --git a/arch/arm64/boot/dts/nvidia/tegra210.dtsi b/arch/arm64/boot/dts/nvidia/tegra210.dtsi -index 659753118e96f..078d2506365c0 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi -@@ -1116,8 +1116,9 @@ - compatible = "nvidia,tegra210-sdhci", "nvidia,tegra124-sdhci"; - reg = <0x0 0x700b0000 0x0 0x200>; - interrupts = ; -- clocks = <&tegra_car TEGRA210_CLK_SDMMC1>; -- clock-names = "sdhci"; -+ clocks = <&tegra_car TEGRA210_CLK_SDMMC1>, -+ <&tegra_car TEGRA210_CLK_SDMMC_LEGACY>; -+ clock-names = "sdhci", "tmclk"; - resets = <&tegra_car 14>; - reset-names = "sdhci"; - pinctrl-names = "sdmmc-3v3", "sdmmc-1v8", -@@ -1144,8 +1145,9 @@ - compatible = "nvidia,tegra210-sdhci", "nvidia,tegra124-sdhci"; - reg = <0x0 0x700b0200 0x0 0x200>; - interrupts = ; -- clocks = <&tegra_car TEGRA210_CLK_SDMMC2>; -- clock-names = "sdhci"; -+ clocks = <&tegra_car TEGRA210_CLK_SDMMC2>, -+ <&tegra_car TEGRA210_CLK_SDMMC_LEGACY>; -+ clock-names = "sdhci", "tmclk"; - resets = <&tegra_car 9>; - reset-names = "sdhci"; - pinctrl-names = "sdmmc-1v8-drv"; -@@ -1161,8 +1163,9 @@ - compatible = "nvidia,tegra210-sdhci", "nvidia,tegra124-sdhci"; - reg = <0x0 0x700b0400 0x0 0x200>; - interrupts = ; -- clocks = <&tegra_car TEGRA210_CLK_SDMMC3>; -- clock-names = "sdhci"; -+ clocks = <&tegra_car TEGRA210_CLK_SDMMC3>, -+ <&tegra_car TEGRA210_CLK_SDMMC_LEGACY>; -+ clock-names = "sdhci", "tmclk"; - resets = <&tegra_car 69>; - reset-names = "sdhci"; - pinctrl-names = "sdmmc-3v3", "sdmmc-1v8", -@@ -1184,8 +1187,9 @@ - compatible = "nvidia,tegra210-sdhci", "nvidia,tegra124-sdhci"; - reg = <0x0 0x700b0600 0x0 0x200>; - interrupts = ; -- clocks = <&tegra_car TEGRA210_CLK_SDMMC4>; -- clock-names = "sdhci"; -+ clocks = <&tegra_car TEGRA210_CLK_SDMMC4>, -+ <&tegra_car TEGRA210_CLK_SDMMC_LEGACY>; -+ clock-names = "sdhci", "tmclk"; - resets = <&tegra_car 15>; - reset-names = "sdhci"; - pinctrl-names = "sdmmc-3v3-drv", "sdmmc-1v8-drv"; -diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h -index ddf9d762ac622..a4ffd9b55e72c 100644 ---- a/arch/arm64/include/asm/kvm_arm.h -+++ b/arch/arm64/include/asm/kvm_arm.h -@@ -72,11 +72,12 @@ - * IMO: Override CPSR.I and enable signaling with VI - * FMO: Override CPSR.F and enable signaling with VF - * SWIO: Turn set/way invalidates into set/way clean+invalidate -+ * PTW: Take a stage2 fault if a stage1 walk steps in device memory - */ - #define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \ - HCR_TVM | HCR_BSU_IS | HCR_FB | HCR_TAC | \ - HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_TLOR | \ -- HCR_FMO | HCR_IMO) -+ HCR_FMO | HCR_IMO | HCR_PTW ) - #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF) - #define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK) - #define HCR_HOST_VHE_FLAGS (HCR_RW | HCR_TGE | HCR_E2H) -diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h -index 44a243754c1b8..64d79b2884344 100644 ---- a/arch/arm64/include/asm/kvm_asm.h -+++ b/arch/arm64/include/asm/kvm_asm.h -@@ -88,6 +88,34 @@ extern u32 __kvm_get_mdcr_el2(void); - *__hyp_this_cpu_ptr(sym); \ - }) - -+#define __KVM_EXTABLE(from, to) \ -+ " .pushsection __kvm_ex_table, \"a\"\n" \ -+ " .align 3\n" \ -+ " .long (" #from " - .), (" #to " - .)\n" \ -+ " .popsection\n" -+ -+ -+#define __kvm_at(at_op, addr) \ -+( { \ -+ int __kvm_at_err = 0; \ -+ u64 spsr, elr; \ -+ asm volatile( \ -+ " mrs %1, spsr_el2\n" \ -+ " mrs %2, elr_el2\n" \ -+ "1: at "at_op", %3\n" \ -+ " isb\n" \ -+ " b 9f\n" \ -+ "2: msr spsr_el2, %1\n" \ -+ " msr elr_el2, %2\n" \ -+ " mov %w0, %4\n" \ -+ "9:\n" \ -+ __KVM_EXTABLE(1b, 2b) \ -+ : "+r" (__kvm_at_err), "=&r" (spsr), "=&r" (elr) \ -+ : "r" (addr), "i" (-EFAULT)); \ -+ __kvm_at_err; \ -+} ) -+ -+ - #else /* __ASSEMBLY__ */ - - .macro hyp_adr_this_cpu reg, sym, tmp -@@ -113,6 +141,21 @@ extern u32 __kvm_get_mdcr_el2(void); - kern_hyp_va \vcpu - .endm - -+/* -+ * KVM extable for unexpected exceptions. -+ * In the same format _asm_extable, but output to a different section so that -+ * it can be mapped to EL2. The KVM version is not sorted. The caller must -+ * ensure: -+ * x18 has the hypervisor value to allow any Shadow-Call-Stack instrumented -+ * code to write to it, and that SPSR_EL2 and ELR_EL2 are restored by the fixup. -+ */ -+.macro _kvm_extable, from, to -+ .pushsection __kvm_ex_table, "a" -+ .align 3 -+ .long (\from - .), (\to - .) -+ .popsection -+.endm -+ - #endif - - #endif /* __ARM_KVM_ASM_H__ */ -diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S -index 8d0374ffdd2d6..4f77de8ce1384 100644 ---- a/arch/arm64/kernel/vmlinux.lds.S -+++ b/arch/arm64/kernel/vmlinux.lds.S -@@ -24,6 +24,13 @@ ENTRY(_text) - - jiffies = jiffies_64; - -+ -+#define HYPERVISOR_EXTABLE \ -+ . = ALIGN(SZ_8); \ -+ __start___kvm_ex_table = .; \ -+ *(__kvm_ex_table) \ -+ __stop___kvm_ex_table = .; -+ - #define HYPERVISOR_TEXT \ - /* \ - * Align to 4 KB so that \ -@@ -39,6 +46,7 @@ jiffies = jiffies_64; - __hyp_idmap_text_end = .; \ - __hyp_text_start = .; \ - *(.hyp.text) \ -+ HYPERVISOR_EXTABLE \ - __hyp_text_end = .; - - #define IDMAP_TEXT \ -diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S -index e5cc8d66bf537..dc3d7bc2292fd 100644 ---- a/arch/arm64/kvm/hyp/entry.S -+++ b/arch/arm64/kvm/hyp/entry.S -@@ -173,20 +173,23 @@ alternative_endif - // This is our single instruction exception window. A pending - // SError is guaranteed to occur at the earliest when we unmask - // it, and at the latest just after the ISB. -- .global abort_guest_exit_start - abort_guest_exit_start: - - isb - -- .global abort_guest_exit_end - abort_guest_exit_end: - - msr daifset, #4 // Mask aborts -+ ret -+ -+ _kvm_extable abort_guest_exit_start, 9997f -+ _kvm_extable abort_guest_exit_end, 9997f -+9997: -+ msr daifset, #4 // Mask aborts -+ mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT) - -- // If the exception took place, restore the EL1 exception -- // context so that we can report some information. -- // Merge the exception code with the SError pending bit. -- tbz x0, #ARM_EXIT_WITH_SERROR_BIT, 1f -+ // restore the EL1 exception context so that we can report some -+ // information. Merge the exception code with the SError pending bit. - msr elr_el2, x2 - msr esr_el2, x3 - msr spsr_el2, x4 -diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S -index ffa68d5713f1d..f36aad0f207bb 100644 ---- a/arch/arm64/kvm/hyp/hyp-entry.S -+++ b/arch/arm64/kvm/hyp/hyp-entry.S -@@ -15,6 +15,30 @@ - #include - #include - -+.macro save_caller_saved_regs_vect -+ /* x0 and x1 were saved in the vector entry */ -+ stp x2, x3, [sp, #-16]! -+ stp x4, x5, [sp, #-16]! -+ stp x6, x7, [sp, #-16]! -+ stp x8, x9, [sp, #-16]! -+ stp x10, x11, [sp, #-16]! -+ stp x12, x13, [sp, #-16]! -+ stp x14, x15, [sp, #-16]! -+ stp x16, x17, [sp, #-16]! -+.endm -+ -+.macro restore_caller_saved_regs_vect -+ ldp x16, x17, [sp], #16 -+ ldp x14, x15, [sp], #16 -+ ldp x12, x13, [sp], #16 -+ ldp x10, x11, [sp], #16 -+ ldp x8, x9, [sp], #16 -+ ldp x6, x7, [sp], #16 -+ ldp x4, x5, [sp], #16 -+ ldp x2, x3, [sp], #16 -+ ldp x0, x1, [sp], #16 -+.endm -+ - .text - .pushsection .hyp.text, "ax" - -@@ -142,13 +166,19 @@ el1_error: - b __guest_exit - - el2_sync: -- /* Check for illegal exception return, otherwise panic */ -+ /* Check for illegal exception return */ - mrs x0, spsr_el2 -+ tbnz x0, #20, 1f - -- /* if this was something else, then panic! */ -- tst x0, #PSR_IL_BIT -- b.eq __hyp_panic -+ save_caller_saved_regs_vect -+ stp x29, x30, [sp, #-16]! -+ bl kvm_unexpected_el2_exception -+ ldp x29, x30, [sp], #16 -+ restore_caller_saved_regs_vect - -+ eret -+ -+1: - /* Let's attempt a recovery from the illegal exception return */ - get_vcpu_ptr x1, x0 - mov x0, #ARM_EXCEPTION_IL -@@ -156,27 +186,14 @@ el2_sync: - - - el2_error: -- ldp x0, x1, [sp], #16 -+ save_caller_saved_regs_vect -+ stp x29, x30, [sp, #-16]! -+ -+ bl kvm_unexpected_el2_exception -+ -+ ldp x29, x30, [sp], #16 -+ restore_caller_saved_regs_vect - -- /* -- * Only two possibilities: -- * 1) Either we come from the exit path, having just unmasked -- * PSTATE.A: change the return code to an EL2 fault, and -- * carry on, as we're already in a sane state to handle it. -- * 2) Or we come from anywhere else, and that's a bug: we panic. -- * -- * For (1), x0 contains the original return code and x1 doesn't -- * contain anything meaningful at that stage. We can reuse them -- * as temp registers. -- * For (2), who cares? -- */ -- mrs x0, elr_el2 -- adr x1, abort_guest_exit_start -- cmp x0, x1 -- adr x1, abort_guest_exit_end -- ccmp x0, x1, #4, ne -- b.ne __hyp_panic -- mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT) - eret - sb - -diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c -index 6f4838b475d0d..65660b6144740 100644 ---- a/arch/arm64/kvm/hyp/switch.c -+++ b/arch/arm64/kvm/hyp/switch.c -@@ -14,6 +14,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -25,6 +26,9 @@ - #include - #include - -+extern struct exception_table_entry __start___kvm_ex_table; -+extern struct exception_table_entry __stop___kvm_ex_table; -+ - /* Check whether the FP regs were dirtied while in the host-side run loop: */ - static bool __hyp_text update_fp_enabled(struct kvm_vcpu *vcpu) - { -@@ -257,10 +261,10 @@ static bool __hyp_text __translate_far_to_hpfar(u64 far, u64 *hpfar) - * saved the guest context yet, and we may return early... - */ - par = read_sysreg(par_el1); -- asm volatile("at s1e1r, %0" : : "r" (far)); -- isb(); -- -- tmp = read_sysreg(par_el1); -+ if (!__kvm_at("s1e1r", far)) -+ tmp = read_sysreg(par_el1); -+ else -+ tmp = SYS_PAR_EL1_F; /* back to the guest */ - write_sysreg(par, par_el1); - - if (unlikely(tmp & SYS_PAR_EL1_F)) -@@ -791,3 +795,30 @@ void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt) - - unreachable(); - } -+ -+asmlinkage void __hyp_text kvm_unexpected_el2_exception(void) -+{ -+ unsigned long addr, fixup; -+ struct kvm_cpu_context *host_ctxt; -+ struct exception_table_entry *entry, *end; -+ unsigned long elr_el2 = read_sysreg(elr_el2); -+ -+ entry = hyp_symbol_addr(__start___kvm_ex_table); -+ end = hyp_symbol_addr(__stop___kvm_ex_table); -+ host_ctxt = &__hyp_this_cpu_ptr(kvm_host_data)->host_ctxt; -+ -+ while (entry < end) { -+ addr = (unsigned long)&entry->insn + entry->insn; -+ fixup = (unsigned long)&entry->fixup + entry->fixup; -+ -+ if (addr != elr_el2) { -+ entry++; -+ continue; -+ } -+ -+ write_sysreg(fixup, elr_el2); -+ return; -+ } -+ -+ hyp_panic(host_ctxt); -+} -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -index 7e4e2959bf4f7..0c9c40720ca9a 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -@@ -12,6 +12,7 @@ - - #include "common.xml.h" - #include "state.xml.h" -+#include "state_blt.xml.h" - #include "state_hi.xml.h" - #include "state_3d.xml.h" - #include "cmdstream.xml.h" -@@ -233,6 +234,8 @@ void etnaviv_buffer_end(struct etnaviv_gpu *gpu) - struct etnaviv_cmdbuf *buffer = &gpu->buffer; - unsigned int waitlink_offset = buffer->user_size - 16; - u32 link_target, flush = 0; -+ bool has_blt = !!(gpu->identity.minor_features5 & -+ chipMinorFeatures5_BLT_ENGINE); - - lockdep_assert_held(&gpu->lock); - -@@ -248,16 +251,38 @@ void etnaviv_buffer_end(struct etnaviv_gpu *gpu) - if (flush) { - unsigned int dwords = 7; - -+ if (has_blt) -+ dwords += 10; -+ - link_target = etnaviv_buffer_reserve(gpu, buffer, dwords); - - CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); - CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); -+ if (has_blt) { -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); -+ CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x0); -+ } - CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE, flush); -- if (gpu->exec_state == ETNA_PIPE_3D) -- CMD_LOAD_STATE(buffer, VIVS_TS_FLUSH_CACHE, -- VIVS_TS_FLUSH_CACHE_FLUSH); -+ if (gpu->exec_state == ETNA_PIPE_3D) { -+ if (has_blt) { -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x0); -+ } else { -+ CMD_LOAD_STATE(buffer, VIVS_TS_FLUSH_CACHE, -+ VIVS_TS_FLUSH_CACHE_FLUSH); -+ } -+ } - CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); - CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); -+ if (has_blt) { -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); -+ CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x0); -+ } - CMD_END(buffer); - - etnaviv_buffer_replace_wait(buffer, waitlink_offset, -@@ -323,6 +348,8 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state, - bool switch_mmu_context = gpu->mmu_context != mmu_context; - unsigned int new_flush_seq = READ_ONCE(gpu->mmu_context->flush_seq); - bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq; -+ bool has_blt = !!(gpu->identity.minor_features5 & -+ chipMinorFeatures5_BLT_ENGINE); - - lockdep_assert_held(&gpu->lock); - -@@ -433,6 +460,15 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state, - * 2 semaphore stall + 1 event + 1 wait + 1 link. - */ - return_dwords = 7; -+ -+ /* -+ * When the BLT engine is present we need 6 more dwords in the return -+ * target: 3 enable/flush/disable + 4 enable/semaphore stall/disable, -+ * but we don't need the normal TS flush state. -+ */ -+ if (has_blt) -+ return_dwords += 6; -+ - return_target = etnaviv_buffer_reserve(gpu, buffer, return_dwords); - CMD_LINK(cmdbuf, return_dwords, return_target); - -@@ -447,11 +483,25 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state, - CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE, - VIVS_GL_FLUSH_CACHE_DEPTH | - VIVS_GL_FLUSH_CACHE_COLOR); -- CMD_LOAD_STATE(buffer, VIVS_TS_FLUSH_CACHE, -- VIVS_TS_FLUSH_CACHE_FLUSH); -+ if (has_blt) { -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x0); -+ } else { -+ CMD_LOAD_STATE(buffer, VIVS_TS_FLUSH_CACHE, -+ VIVS_TS_FLUSH_CACHE_FLUSH); -+ } - } - CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); - CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_PE); -+ -+ if (has_blt) { -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); -+ CMD_SEM(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_STALL(buffer, SYNC_RECIPIENT_FE, SYNC_RECIPIENT_BLT); -+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x0); -+ } -+ - CMD_LOAD_STATE(buffer, VIVS_GL_EVENT, VIVS_GL_EVENT_EVENT_ID(event) | - VIVS_GL_EVENT_FROM_PE); - CMD_WAIT(buffer); -diff --git a/drivers/gpu/drm/etnaviv/state_blt.xml.h b/drivers/gpu/drm/etnaviv/state_blt.xml.h -index daae55995def0..0e8bcf9dcc93b 100644 ---- a/drivers/gpu/drm/etnaviv/state_blt.xml.h -+++ b/drivers/gpu/drm/etnaviv/state_blt.xml.h -@@ -46,6 +46,8 @@ DEALINGS IN THE SOFTWARE. - - /* This is a cut-down version of the state_blt.xml.h file */ - -+#define VIVS_BLT_SET_COMMAND 0x000140ac -+ - #define VIVS_BLT_ENABLE 0x000140b8 - #define VIVS_BLT_ENABLE_ENABLE 0x00000001 - -diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c -index dfb29e6eeff1e..30c5ddd6d081c 100644 ---- a/drivers/gpu/drm/scheduler/sched_main.c -+++ b/drivers/gpu/drm/scheduler/sched_main.c -@@ -496,8 +496,10 @@ void drm_sched_resubmit_jobs(struct drm_gpu_scheduler *sched) - fence = sched->ops->run_job(s_job); - - if (IS_ERR_OR_NULL(fence)) { -+ if (IS_ERR(fence)) -+ dma_fence_set_error(&s_fence->finished, PTR_ERR(fence)); -+ - s_job->s_fence->parent = NULL; -- dma_fence_set_error(&s_fence->finished, PTR_ERR(fence)); - } else { - s_job->s_fence->parent = fence; - } -@@ -748,8 +750,9 @@ static int drm_sched_main(void *param) - r); - dma_fence_put(fence); - } else { -+ if (IS_ERR(fence)) -+ dma_fence_set_error(&s_fence->finished, PTR_ERR(fence)); - -- dma_fence_set_error(&s_fence->finished, PTR_ERR(fence)); - drm_sched_process_job(NULL, &sched_job->cb); - } - -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 359616e3efbbb..d2ecc9c452554 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1597,6 +1597,17 @@ static void hid_output_field(const struct hid_device *hid, - } - } - -+/* -+ * Compute the size of a report. -+ */ -+static size_t hid_compute_report_size(struct hid_report *report) -+{ -+ if (report->size) -+ return ((report->size - 1) >> 3) + 1; -+ -+ return 0; -+} -+ - /* - * Create a report. 'data' has to be allocated using - * hid_alloc_report_buf() so that it has proper size. -@@ -1609,7 +1620,7 @@ void hid_output_report(struct hid_report *report, __u8 *data) - if (report->id > 0) - *data++ = report->id; - -- memset(data, 0, ((report->size - 1) >> 3) + 1); -+ memset(data, 0, hid_compute_report_size(report)); - for (n = 0; n < report->maxfield; n++) - hid_output_field(report->device, report->field[n], data); - } -@@ -1739,7 +1750,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, - csize--; - } - -- rsize = ((report->size - 1) >> 3) + 1; -+ rsize = hid_compute_report_size(report); - - if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE) - rsize = HID_MAX_BUFFER_SIZE - 1; -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index e8641ce677e47..e3d475f4baf66 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -1132,6 +1132,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - } - - mapped: -+ /* Mapping failed, bail out */ -+ if (!bit) -+ return; -+ - if (device->driver->input_mapped && - device->driver->input_mapped(device, hidinput, field, usage, - &bit, &max) < 0) { -diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c -index 39e4da7468e11..128d8f4319b9f 100644 ---- a/drivers/hid/hid-multitouch.c -+++ b/drivers/hid/hid-multitouch.c -@@ -864,6 +864,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, - code = BTN_0 + ((usage->hid - 1) & HID_USAGE); - - hid_map_usage(hi, usage, bit, max, EV_KEY, code); -+ if (!*bit) -+ return -1; - input_set_capability(hi->input, EV_KEY, code); - return 1; - -diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c -index a25c3a4d3f6cb..e37d271ca9636 100644 ---- a/drivers/mmc/host/sdhci-tegra.c -+++ b/drivers/mmc/host/sdhci-tegra.c -@@ -1370,7 +1370,6 @@ static const struct sdhci_ops tegra210_sdhci_ops = { - - static const struct sdhci_pltfm_data sdhci_tegra210_pdata = { - .quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL | -- SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | - SDHCI_QUIRK_SINGLE_POWER_WRITE | - SDHCI_QUIRK_NO_HISPD_BIT | - SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | -@@ -1407,7 +1406,6 @@ static const struct sdhci_ops tegra186_sdhci_ops = { - - static const struct sdhci_pltfm_data sdhci_tegra186_pdata = { - .quirks = SDHCI_QUIRK_BROKEN_TIMEOUT_VAL | -- SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | - SDHCI_QUIRK_SINGLE_POWER_WRITE | - SDHCI_QUIRK_NO_HISPD_BIT | - SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index 8888cdf3eead9..ea925b102b322 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -676,8 +676,10 @@ static void scatter_data_area(struct tcmu_dev *udev, - from = kmap_atomic(sg_page(sg)) + sg->offset; - while (sg_remaining > 0) { - if (block_remaining == 0) { -- if (to) -+ if (to) { -+ flush_dcache_page(page); - kunmap_atomic(to); -+ } - - block_remaining = DATA_BLOCK_SIZE; - dbi = tcmu_cmd_get_dbi(tcmu_cmd); -@@ -722,7 +724,6 @@ static void scatter_data_area(struct tcmu_dev *udev, - memcpy(to + offset, - from + sg->length - sg_remaining, - copy_bytes); -- tcmu_flush_dcache_range(to, copy_bytes); - } - - sg_remaining -= copy_bytes; -@@ -731,8 +732,10 @@ static void scatter_data_area(struct tcmu_dev *udev, - kunmap_atomic(from - sg->offset); - } - -- if (to) -+ if (to) { -+ flush_dcache_page(page); - kunmap_atomic(to); -+ } - } - - static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd, -@@ -778,13 +781,13 @@ static void gather_data_area(struct tcmu_dev *udev, struct tcmu_cmd *cmd, - dbi = tcmu_cmd_get_dbi(cmd); - page = tcmu_get_block_page(udev, dbi); - from = kmap_atomic(page); -+ flush_dcache_page(page); - } - copy_bytes = min_t(size_t, sg_remaining, - block_remaining); - if (read_len < copy_bytes) - copy_bytes = read_len; - offset = DATA_BLOCK_SIZE - block_remaining; -- tcmu_flush_dcache_range(from, copy_bytes); - memcpy(to + sg->length - sg_remaining, from + offset, - copy_bytes); - -@@ -1007,7 +1010,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err) - entry->hdr.cmd_id = 0; /* not used for PAD */ - entry->hdr.kflags = 0; - entry->hdr.uflags = 0; -- tcmu_flush_dcache_range(entry, sizeof(*entry)); -+ tcmu_flush_dcache_range(entry, sizeof(entry->hdr)); - - UPDATE_HEAD(mb->cmd_head, pad_size, udev->cmdr_size); - tcmu_flush_dcache_range(mb, sizeof(*mb)); -@@ -1072,7 +1075,7 @@ static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err) - cdb_off = CMDR_OFF + cmd_head + base_command_size; - memcpy((void *) mb + cdb_off, se_cmd->t_task_cdb, scsi_command_size(se_cmd->t_task_cdb)); - entry->req.cdb_off = cdb_off; -- tcmu_flush_dcache_range(entry, sizeof(*entry)); -+ tcmu_flush_dcache_range(entry, command_size); - - UPDATE_HEAD(mb->cmd_head, command_size, udev->cmdr_size); - tcmu_flush_dcache_range(mb, sizeof(*mb)); -diff --git a/include/linux/hid.h b/include/linux/hid.h -index 875f71132b142..c7044a14200ea 100644 ---- a/include/linux/hid.h -+++ b/include/linux/hid.h -@@ -959,34 +959,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { - * @max: maximal valid usage->code to consider later (out parameter) - * @type: input event type (EV_KEY, EV_REL, ...) - * @c: code which corresponds to this usage and type -+ * -+ * The value pointed to by @bit will be set to NULL if either @type is -+ * an unhandled event type, or if @c is out of range for @type. This -+ * can be used as an error condition. - */ - static inline void hid_map_usage(struct hid_input *hidinput, - struct hid_usage *usage, unsigned long **bit, int *max, -- __u8 type, __u16 c) -+ __u8 type, unsigned int c) - { - struct input_dev *input = hidinput->input; -- -- usage->type = type; -- usage->code = c; -+ unsigned long *bmap = NULL; -+ unsigned int limit = 0; - - switch (type) { - case EV_ABS: -- *bit = input->absbit; -- *max = ABS_MAX; -+ bmap = input->absbit; -+ limit = ABS_MAX; - break; - case EV_REL: -- *bit = input->relbit; -- *max = REL_MAX; -+ bmap = input->relbit; -+ limit = REL_MAX; - break; - case EV_KEY: -- *bit = input->keybit; -- *max = KEY_MAX; -+ bmap = input->keybit; -+ limit = KEY_MAX; - break; - case EV_LED: -- *bit = input->ledbit; -- *max = LED_MAX; -+ bmap = input->ledbit; -+ limit = LED_MAX; - break; - } -+ -+ if (unlikely(c > limit || !bmap)) { -+ pr_warn_ratelimited("%s: Invalid code %d type %d\n", -+ input->name, c, type); -+ *bit = NULL; -+ return; -+ } -+ -+ usage->type = type; -+ usage->code = c; -+ *max = limit; -+ *bit = bmap; - } - - /** -@@ -1000,7 +1015,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, - __u8 type, __u16 c) - { - hid_map_usage(hidinput, usage, bit, max, type, c); -- clear_bit(c, *bit); -+ if (*bit) -+ clear_bit(usage->code, *bit); - } - - /** -diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt -index c6f9f31b60398..15fd108afbe63 100644 ---- a/tools/perf/Documentation/perf-record.txt -+++ b/tools/perf/Documentation/perf-record.txt -@@ -33,6 +33,10 @@ OPTIONS - - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a - hexadecimal event descriptor. - -+ - a symbolic or raw PMU event followed by an optional colon -+ and a list of event modifiers, e.g., cpu-cycles:p. See the -+ linkperf:perf-list[1] man page for details on event modifiers. -+ - - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where - 'param1', 'param2', etc are defined as formats for the PMU in - /sys/bus/event_source/devices//format/*. -diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt -index 930c51c01201a..9abf1cf217e28 100644 ---- a/tools/perf/Documentation/perf-stat.txt -+++ b/tools/perf/Documentation/perf-stat.txt -@@ -39,6 +39,10 @@ report:: - - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a - hexadecimal event descriptor. - -+ - a symbolic or raw PMU event followed by an optional colon -+ and a list of event modifiers, e.g., cpu-cycles:p. See the -+ linkperf:perf-list[1] man page for details on event modifiers. -+ - - a symbolically formed event like 'pmu/param1=0x3,param2/' where - param1 and param2 are defined as formats for the PMU in - /sys/bus/event_source/devices//format/* diff --git a/patch/kernel/odroidxu4-current/patch-5.4.63-64.patch b/patch/kernel/odroidxu4-current/patch-5.4.63-64.patch deleted file mode 100644 index 92e487b997..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.63-64.patch +++ /dev/null @@ -1,4987 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/mmc/mtk-sd.txt b/Documentation/devicetree/bindings/mmc/mtk-sd.txt -index 8a532f4453f26..09aecec47003a 100644 ---- a/Documentation/devicetree/bindings/mmc/mtk-sd.txt -+++ b/Documentation/devicetree/bindings/mmc/mtk-sd.txt -@@ -49,6 +49,8 @@ Optional properties: - error caused by stop clock(fifo full) - Valid range = [0:0x7]. if not present, default value is 0. - applied to compatible "mediatek,mt2701-mmc". -+- resets: Phandle and reset specifier pair to softreset line of MSDC IP. -+- reset-names: Should be "hrst". - - Examples: - mmc0: mmc@11230000 { -diff --git a/Documentation/filesystems/affs.txt b/Documentation/filesystems/affs.txt -index 71b63c2b98410..a8f1a58e36922 100644 ---- a/Documentation/filesystems/affs.txt -+++ b/Documentation/filesystems/affs.txt -@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows: - - - R maps to r for user, group and others. On directories, R implies x. - -- - If both W and D are allowed, w will be set. -+ - W maps to w. - - - E maps to x. - -- - H and P are always retained and ignored under Linux. -+ - D is ignored. - -- - A is always reset when a file is written to. -+ - H, S and P are always retained and ignored under Linux. -+ -+ - A is cleared when a file is written to. - - User id and group id will be used unless set[gu]id are given as mount - options. Since most of the Amiga file systems are single user systems -@@ -111,11 +113,13 @@ Linux -> Amiga: - - The Linux rwxrwxrwx file mode is handled as follows: - -- - r permission will set R for user, group and others. -+ - r permission will allow R for user, group and others. -+ -+ - w permission will allow W for user, group and others. - -- - w permission will set W and D for user, group and others. -+ - x permission of the user will allow E for plain files. - -- - x permission of the user will set E for plain files. -+ - D will be allowed for user, group and others. - - - All other flags (suid, sgid, ...) are ignored and will - not be retained. -diff --git a/Makefile b/Makefile -index 418814b108ae6..7bdfb21bb9269 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 63 -+SUBLEVEL = 64 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/kernel/perf_event.c b/arch/arc/kernel/perf_event.c -index 661fd842ea97d..79849f37e782c 100644 ---- a/arch/arc/kernel/perf_event.c -+++ b/arch/arc/kernel/perf_event.c -@@ -562,7 +562,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev) - { - struct arc_reg_pct_build pct_bcr; - struct arc_reg_cc_build cc_bcr; -- int i, has_interrupts; -+ int i, has_interrupts, irq; - int counter_size; /* in bits */ - - union cc_name { -@@ -637,13 +637,7 @@ static int arc_pmu_device_probe(struct platform_device *pdev) - .attr_groups = arc_pmu->attr_groups, - }; - -- if (has_interrupts) { -- int irq = platform_get_irq(pdev, 0); -- -- if (irq < 0) { -- pr_err("Cannot get IRQ number for the platform\n"); -- return -ENODEV; -- } -+ if (has_interrupts && (irq = platform_get_irq(pdev, 0) >= 0)) { - - arc_pmu->irq = irq; - -@@ -652,9 +646,9 @@ static int arc_pmu_device_probe(struct platform_device *pdev) - this_cpu_ptr(&arc_pmu_cpu)); - - on_each_cpu(arc_cpu_pmu_irq_init, &irq, 1); -- -- } else -+ } else { - arc_pmu->pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT; -+ } - - /* - * perf parser doesn't really like '-' symbol in events name, so let's -diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi -index dac51e98204c0..7cd8c3f52b471 100644 ---- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi -@@ -686,6 +686,8 @@ - clocks = <&pericfg CLK_PERI_MSDC30_0_PD>, - <&topckgen CLK_TOP_MSDC50_0_SEL>; - clock-names = "source", "hclk"; -+ resets = <&pericfg MT7622_PERI_MSDC0_SW_RST>; -+ reset-names = "hrst"; - status = "disabled"; - }; - -diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c -index 712c15de6ab9f..6b304acf506fe 100644 ---- a/arch/mips/kernel/smp-bmips.c -+++ b/arch/mips/kernel/smp-bmips.c -@@ -241,6 +241,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle) - */ - static void bmips_init_secondary(void) - { -+ bmips_cpu_setup(); -+ - switch (current_cpu_type()) { - case CPU_BMIPS4350: - case CPU_BMIPS4380: -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index 6a25364600266..8282d0feb0b21 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -1240,6 +1240,18 @@ static int enable_restore_fp_context(int msa) - err = own_fpu_inatomic(1); - if (msa && !err) { - enable_msa(); -+ /* -+ * with MSA enabled, userspace can see MSACSR -+ * and MSA regs, but the values in them are from -+ * other task before current task, restore them -+ * from saved fp/msa context -+ */ -+ write_msa_csr(current->thread.fpu.msacsr); -+ /* -+ * own_fpu_inatomic(1) just restore low 64bit, -+ * fix the high 64bit -+ */ -+ init_msa_upper(); - set_thread_flag(TIF_USEDMSA); - set_thread_flag(TIF_MSA_CTX_LIVE); - } -diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c -index 89b9c851d8227..c4785a456dedc 100644 ---- a/arch/mips/mm/c-r4k.c -+++ b/arch/mips/mm/c-r4k.c -@@ -1676,7 +1676,11 @@ static void setup_scache(void) - printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n", - scache_size >> 10, - way_string[c->scache.ways], c->scache.linesz); -+ -+ if (current_cpu_type() == CPU_BMIPS5000) -+ c->options |= MIPS_CPU_INCLUSIVE_CACHES; - } -+ - #else - if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT)) - panic("Dunno how to handle MIPS32 / MIPS64 second level cache"); -diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h -index 50b4ce8cddfdc..918f0ba4f4d20 100644 ---- a/arch/s390/include/asm/percpu.h -+++ b/arch/s390/include/asm/percpu.h -@@ -29,7 +29,7 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ old__, new__, prev__; \ - pcp_op_T__ *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - prev__ = *ptr__; \ - do { \ -@@ -37,7 +37,7 @@ - new__ = old__ op (val); \ - prev__ = cmpxchg(ptr__, old__, new__); \ - } while (prev__ != old__); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - new__; \ - }) - -@@ -68,7 +68,7 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - if (__builtin_constant_p(val__) && \ - ((szcast)val__ > -129) && ((szcast)val__ < 128)) { \ -@@ -84,7 +84,7 @@ - : [val__] "d" (val__) \ - : "cc"); \ - } \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - } - - #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int) -@@ -95,14 +95,14 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - asm volatile( \ - op " %[old__],%[val__],%[ptr__]\n" \ - : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ - : [val__] "d" (val__) \ - : "cc"); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - old__ + val__; \ - }) - -@@ -114,14 +114,14 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ val__ = (val); \ - pcp_op_T__ old__, *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - asm volatile( \ - op " %[old__],%[val__],%[ptr__]\n" \ - : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ - : [val__] "d" (val__) \ - : "cc"); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - } - - #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, "lan") -@@ -136,10 +136,10 @@ - typedef typeof(pcp) pcp_op_T__; \ - pcp_op_T__ ret__; \ - pcp_op_T__ *ptr__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - ret__ = cmpxchg(ptr__, oval, nval); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -@@ -152,10 +152,10 @@ - ({ \ - typeof(pcp) *ptr__; \ - typeof(pcp) ret__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - ptr__ = raw_cpu_ptr(&(pcp)); \ - ret__ = xchg(ptr__, nval); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -@@ -171,11 +171,11 @@ - typeof(pcp1) *p1__; \ - typeof(pcp2) *p2__; \ - int ret__; \ -- preempt_disable(); \ -+ preempt_disable_notrace(); \ - p1__ = raw_cpu_ptr(&(pcp1)); \ - p2__ = raw_cpu_ptr(&(pcp2)); \ - ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__); \ -- preempt_enable(); \ -+ preempt_enable_notrace(); \ - ret__; \ - }) - -diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h -index 332eb35258676..902be2e6e96cf 100644 ---- a/arch/x86/include/asm/ptrace.h -+++ b/arch/x86/include/asm/ptrace.h -@@ -309,8 +309,8 @@ static inline unsigned long regs_get_kernel_argument(struct pt_regs *regs, - static const unsigned int argument_offs[] = { - #ifdef __i386__ - offsetof(struct pt_regs, ax), -- offsetof(struct pt_regs, cx), - offsetof(struct pt_regs, dx), -+ offsetof(struct pt_regs, cx), - #define NR_REG_ARGUMENTS 3 - #else - offsetof(struct pt_regs, di), -diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c -index abffa0be80da1..87282258d5bea 100644 ---- a/arch/x86/mm/numa_emulation.c -+++ b/arch/x86/mm/numa_emulation.c -@@ -321,7 +321,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei, - u64 addr, u64 max_addr, u64 size) - { - return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size, -- 0, NULL, NUMA_NO_NODE); -+ 0, NULL, 0); - } - - int __init setup_emu2phys_nid(int *dfl_phys_nid) -diff --git a/block/blk-core.c b/block/blk-core.c -index d5e668ec751b5..ca6b677356864 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -502,6 +502,7 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id) - goto fail_stats; - - q->backing_dev_info->ra_pages = VM_READAHEAD_PAGES; -+ q->backing_dev_info->io_pages = VM_READAHEAD_PAGES; - q->backing_dev_info->capabilities = BDI_CAP_CGROUP_WRITEBACK; - q->backing_dev_info->name = "block"; - q->node = node_id; -diff --git a/block/blk-iocost.c b/block/blk-iocost.c -index dcc6685d5becc..ef287c33d6d97 100644 ---- a/block/blk-iocost.c -+++ b/block/blk-iocost.c -@@ -2074,14 +2074,15 @@ static void ioc_pd_free(struct blkg_policy_data *pd) - { - struct ioc_gq *iocg = pd_to_iocg(pd); - struct ioc *ioc = iocg->ioc; -+ unsigned long flags; - - if (ioc) { -- spin_lock(&ioc->lock); -+ spin_lock_irqsave(&ioc->lock, flags); - if (!list_empty(&iocg->active_list)) { - propagate_active_weight(iocg, 0, 0); - list_del_init(&iocg->active_list); - } -- spin_unlock(&ioc->lock); -+ spin_unlock_irqrestore(&ioc->lock, flags); - - hrtimer_cancel(&iocg->waitq_timer); - hrtimer_cancel(&iocg->delay_timer); -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 35f75c691d7cf..066b37963ad5f 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4474,9 +4474,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ - { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, - -- /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on -- SD7SN6S256G and SD8SN8U256G */ -- { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, }, -+ /* Sandisk SD7/8/9s lock up hard on large trims */ -+ { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, }, - - /* devices which puke on READ_NATIVE_MAX */ - { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, }, -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 5596c9b6ebf23..464efedc778b0 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2374,6 +2374,7 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf) - - static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) - { -+ struct ata_device *dev = args->dev; - u16 min_io_sectors; - - rbuf[1] = 0xb0; -@@ -2399,7 +2400,12 @@ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) - * with the unmap bit set. - */ - if (ata_id_has_trim(args->id)) { -- put_unaligned_be64(65535 * ATA_MAX_TRIM_RNUM, &rbuf[36]); -+ u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM; -+ -+ if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M) -+ max_blocks = 128 << (20 - SECTOR_SHIFT); -+ -+ put_unaligned_be64(max_blocks, &rbuf[36]); - put_unaligned_be32(1, &rbuf[28]); - } - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 7b61d53ba050e..7c577cabb9c3b 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1349,6 +1349,8 @@ static void nbd_set_cmd_timeout(struct nbd_device *nbd, u64 timeout) - nbd->tag_set.timeout = timeout * HZ; - if (timeout) - blk_queue_rq_timeout(nbd->disk->queue, timeout * HZ); -+ else -+ blk_queue_rq_timeout(nbd->disk->queue, 30 * HZ); - } - - /* Must be called with config_lock held */ -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index 29d2d7a21bd7b..73f08cda21e0e 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -148,7 +148,8 @@ static void enter_s2idle_proper(struct cpuidle_driver *drv, - */ - stop_critical_timings(); - drv->states[index].enter_s2idle(dev, drv, index); -- WARN_ON(!irqs_disabled()); -+ if (WARN_ON_ONCE(!irqs_disabled())) -+ local_irq_disable(); - /* - * timekeeping_resume() that will be called by tick_unfreeze() for the - * first CPU executing it calls functions containing RCU read-side -diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c -index 672c73b4a2d4f..ff366c2f58c18 100644 ---- a/drivers/dma/at_hdmac.c -+++ b/drivers/dma/at_hdmac.c -@@ -1667,6 +1667,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, - return NULL; - - dmac_pdev = of_find_device_by_node(dma_spec->np); -+ if (!dmac_pdev) -+ return NULL; - - dma_cap_zero(mask); - dma_cap_set(DMA_SLAVE, mask); -diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c -index ff392c01bad1f..7f9a86c3c58ff 100644 ---- a/drivers/dma/dw-edma/dw-edma-core.c -+++ b/drivers/dma/dw-edma/dw-edma-core.c -@@ -391,7 +391,7 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) - if (xfer->cyclic) { - burst->dar = xfer->xfer.cyclic.paddr; - } else { -- burst->dar = sg_dma_address(sg); -+ burst->dar = dst_addr; - /* Unlike the typical assumption by other - * drivers/IPs the peripheral memory isn't - * a FIFO memory, in this case, it's a -@@ -399,14 +399,13 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) - * and destination addresses are increased - * by the same portion (data length) - */ -- src_addr += sg_dma_len(sg); - } - } else { - burst->dar = dst_addr; - if (xfer->cyclic) { - burst->sar = xfer->xfer.cyclic.paddr; - } else { -- burst->sar = sg_dma_address(sg); -+ burst->sar = src_addr; - /* Unlike the typical assumption by other - * drivers/IPs the peripheral memory isn't - * a FIFO memory, in this case, it's a -@@ -414,12 +413,14 @@ dw_edma_device_transfer(struct dw_edma_transfer *xfer) - * and destination addresses are increased - * by the same portion (data length) - */ -- dst_addr += sg_dma_len(sg); - } - } - -- if (!xfer->cyclic) -+ if (!xfer->cyclic) { -+ src_addr += sg_dma_len(sg); -+ dst_addr += sg_dma_len(sg); - sg = sg_next(sg); -+ } - } - - return vchan_tx_prep(&chan->vc, &desc->vd, xfer->flags); -diff --git a/drivers/dma/fsldma.h b/drivers/dma/fsldma.h -index 56f18ae992332..308bed0a560ac 100644 ---- a/drivers/dma/fsldma.h -+++ b/drivers/dma/fsldma.h -@@ -205,10 +205,10 @@ struct fsldma_chan { - #else - static u64 fsl_ioread64(const u64 __iomem *addr) - { -- u32 fsl_addr = lower_32_bits(addr); -- u64 fsl_addr_hi = (u64)in_le32((u32 *)(fsl_addr + 1)) << 32; -+ u32 val_lo = in_le32((u32 __iomem *)addr); -+ u32 val_hi = in_le32((u32 __iomem *)addr + 1); - -- return fsl_addr_hi | in_le32((u32 *)fsl_addr); -+ return ((u64)val_hi << 32) + val_lo; - } - - static void fsl_iowrite64(u64 val, u64 __iomem *addr) -@@ -219,10 +219,10 @@ static void fsl_iowrite64(u64 val, u64 __iomem *addr) - - static u64 fsl_ioread64be(const u64 __iomem *addr) - { -- u32 fsl_addr = lower_32_bits(addr); -- u64 fsl_addr_hi = (u64)in_be32((u32 *)fsl_addr) << 32; -+ u32 val_hi = in_be32((u32 __iomem *)addr); -+ u32 val_lo = in_be32((u32 __iomem *)addr + 1); - -- return fsl_addr_hi | in_be32((u32 *)(fsl_addr + 1)); -+ return ((u64)val_hi << 32) + val_lo; - } - - static void fsl_iowrite64be(u64 val, u64 __iomem *addr) -diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c -index c2d779daa4b51..4bbf4172b9bf9 100644 ---- a/drivers/dma/of-dma.c -+++ b/drivers/dma/of-dma.c -@@ -69,12 +69,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, - return NULL; - - chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); -- if (chan) { -- chan->router = ofdma->dma_router; -- chan->route_data = route_data; -- } else { -+ if (IS_ERR_OR_NULL(chan)) { - ofdma->dma_router->route_free(ofdma->dma_router->dev, - route_data); -+ } else { -+ chan->router = ofdma->dma_router; -+ chan->route_data = route_data; - } - - /* -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 6cce9ef61b294..cd81d10974a29 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -2788,6 +2788,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, - while (burst != (1 << desc->rqcfg.brst_size)) - desc->rqcfg.brst_size++; - -+ desc->rqcfg.brst_len = get_burst_len(desc, len); - /* - * If burst size is smaller than bus width then make sure we only - * transfer one at a time to avoid a burst stradling an MFIFO entry. -@@ -2795,7 +2796,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, - if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) - desc->rqcfg.brst_len = 1; - -- desc->rqcfg.brst_len = get_burst_len(desc, len); - desc->bytes_requested = len; - - desc->txd.flags = flags; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 247f53d41993d..60e50181f6d39 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -2043,12 +2043,18 @@ static int amdgpu_dm_mode_config_init(struct amdgpu_device *adev) - &dm_atomic_state_funcs); - - r = amdgpu_display_modeset_create_props(adev); -- if (r) -+ if (r) { -+ dc_release_state(state->context); -+ kfree(state); - return r; -+ } - - r = amdgpu_dm_audio_init(adev); -- if (r) -+ if (r) { -+ dc_release_state(state->context); -+ kfree(state); - return r; -+ } - - return 0; - } -@@ -2064,6 +2070,8 @@ static void amdgpu_dm_update_backlight_caps(struct amdgpu_display_manager *dm) - #if defined(CONFIG_ACPI) - struct amdgpu_dm_backlight_caps caps; - -+ memset(&caps, 0, sizeof(caps)); -+ - if (dm->backlight_caps.caps_valid) - return; - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 28a6c7b2ef4bb..2f858507ca702 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -101,7 +101,7 @@ static ssize_t dm_dp_aux_transfer(struct drm_dp_aux *aux, - result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload, - &operation_result); - -- if (payload.write) -+ if (payload.write && result >= 0) - result = msg->size; - - if (result < 0) -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c -index 1599bb9711111..e860ae05feda1 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c -@@ -1151,6 +1151,7 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont - bool video_large = false; - bool desktop_large = false; - bool dcc_disabled = false; -+ bool mpo_enabled = false; - - for (i = 0; i < context->stream_count; i++) { - if (context->stream_status[i].plane_count == 0) -@@ -1159,6 +1160,9 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont - if (context->stream_status[i].plane_count > 2) - return DC_FAIL_UNSUPPORTED_1; - -+ if (context->stream_status[i].plane_count > 1) -+ mpo_enabled = true; -+ - for (j = 0; j < context->stream_status[i].plane_count; j++) { - struct dc_plane_state *plane = - context->stream_status[i].plane_states[j]; -@@ -1182,6 +1186,10 @@ static enum dc_status dcn10_validate_global(struct dc *dc, struct dc_state *cont - } - } - -+ /* Disable MPO in multi-display configurations. */ -+ if (context->stream_count > 1 && mpo_enabled) -+ return DC_FAIL_UNSUPPORTED_1; -+ - /* - * Workaround: On DCN10 there is UMC issue that causes underflow when - * playing 4k video on 4k desktop with video downscaled and single channel -diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -index 36a17caa3761d..e8d01abf27fa8 100644 ---- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_thermal.c -@@ -375,8 +375,18 @@ static int vega10_thermal_set_temperature_range(struct pp_hwmgr *hwmgr, - /* compare them in unit celsius degree */ - if (low < range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES) - low = range->min / PP_TEMPERATURE_UNITS_PER_CENTIGRADES; -- if (high > tdp_table->usSoftwareShutdownTemp) -- high = tdp_table->usSoftwareShutdownTemp; -+ -+ /* -+ * As a common sense, usSoftwareShutdownTemp should be bigger -+ * than ThotspotLimit. For any invalid usSoftwareShutdownTemp, -+ * we will just use the max possible setting VEGA10_THERMAL_MAXIMUM_ALERT_TEMP -+ * to avoid false alarms. -+ */ -+ if ((tdp_table->usSoftwareShutdownTemp > -+ range->hotspot_crit_max / PP_TEMPERATURE_UNITS_PER_CENTIGRADES)) { -+ if (high > tdp_table->usSoftwareShutdownTemp) -+ high = tdp_table->usSoftwareShutdownTemp; -+ } - - if (low > high) - return -EINVAL; -diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -index 9ea748667fab0..40431a09dc97c 100644 ---- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c -@@ -199,12 +199,22 @@ static int a6xx_gmu_start(struct a6xx_gmu *gmu) - { - int ret; - u32 val; -+ u32 mask, reset_val; -+ -+ val = gmu_read(gmu, REG_A6XX_GMU_CM3_DTCM_START + 0xff8); -+ if (val <= 0x20010004) { -+ mask = 0xffffffff; -+ reset_val = 0xbabeface; -+ } else { -+ mask = 0x1ff; -+ reset_val = 0x100; -+ } - - gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 1); - gmu_write(gmu, REG_A6XX_GMU_CM3_SYSRESET, 0); - - ret = gmu_poll_timeout(gmu, REG_A6XX_GMU_CM3_FW_INIT_RESULT, val, -- val == 0xbabeface, 100, 10000); -+ (val & mask) == reset_val, 100, 10000); - - if (ret) - DRM_DEV_ERROR(gmu->dev, "GMU firmware initialization timed out\n"); -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c -index 58d5acbcfc5c2..b984bafd27e25 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c -@@ -853,9 +853,9 @@ static int dpu_plane_atomic_check(struct drm_plane *plane, - crtc_state = drm_atomic_get_new_crtc_state(state->state, - state->crtc); - -- min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxdwnscale); -+ min_scale = FRAC_16_16(1, pdpu->pipe_sblk->maxupscale); - ret = drm_atomic_helper_check_plane_state(state, crtc_state, min_scale, -- pdpu->pipe_sblk->maxupscale << 16, -+ pdpu->pipe_sblk->maxdwnscale << 16, - true, true); - if (ret) { - DPU_ERROR_PLANE(pdpu, "Check plane state failed (%d)\n", ret); -diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c -index 5ccfad794c6a5..561bfa48841c3 100644 ---- a/drivers/gpu/drm/msm/msm_atomic.c -+++ b/drivers/gpu/drm/msm/msm_atomic.c -@@ -27,6 +27,34 @@ int msm_atomic_prepare_fb(struct drm_plane *plane, - return msm_framebuffer_prepare(new_state->fb, kms->aspace); - } - -+/* -+ * Helpers to control vblanks while we flush.. basically just to ensure -+ * that vblank accounting is switched on, so we get valid seqn/timestamp -+ * on pageflip events (if requested) -+ */ -+ -+static void vblank_get(struct msm_kms *kms, unsigned crtc_mask) -+{ -+ struct drm_crtc *crtc; -+ -+ for_each_crtc_mask(kms->dev, crtc, crtc_mask) { -+ if (!crtc->state->active) -+ continue; -+ drm_crtc_vblank_get(crtc); -+ } -+} -+ -+static void vblank_put(struct msm_kms *kms, unsigned crtc_mask) -+{ -+ struct drm_crtc *crtc; -+ -+ for_each_crtc_mask(kms->dev, crtc, crtc_mask) { -+ if (!crtc->state->active) -+ continue; -+ drm_crtc_vblank_put(crtc); -+ } -+} -+ - static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx) - { - unsigned crtc_mask = BIT(crtc_idx); -@@ -44,6 +72,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx) - - kms->funcs->enable_commit(kms); - -+ vblank_get(kms, crtc_mask); -+ - /* - * Flush hardware updates: - */ -@@ -58,6 +88,8 @@ static void msm_atomic_async_commit(struct msm_kms *kms, int crtc_idx) - kms->funcs->wait_flush(kms, crtc_mask); - trace_msm_atomic_wait_flush_finish(crtc_mask); - -+ vblank_put(kms, crtc_mask); -+ - mutex_lock(&kms->commit_lock); - kms->funcs->complete_commit(kms, crtc_mask); - mutex_unlock(&kms->commit_lock); -@@ -221,6 +253,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state) - */ - kms->pending_crtc_mask &= ~crtc_mask; - -+ vblank_get(kms, crtc_mask); -+ - /* - * Flush hardware updates: - */ -@@ -235,6 +269,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state) - kms->funcs->wait_flush(kms, crtc_mask); - trace_msm_atomic_wait_flush_finish(crtc_mask); - -+ vblank_put(kms, crtc_mask); -+ - mutex_lock(&kms->commit_lock); - kms->funcs->complete_commit(kms, crtc_mask); - mutex_unlock(&kms->commit_lock); -diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index b73fbb65e14b2..4558d66761b3c 100644 ---- a/drivers/gpu/drm/msm/msm_drv.c -+++ b/drivers/gpu/drm/msm/msm_drv.c -@@ -1321,6 +1321,13 @@ static int msm_pdev_remove(struct platform_device *pdev) - return 0; - } - -+static void msm_pdev_shutdown(struct platform_device *pdev) -+{ -+ struct drm_device *drm = platform_get_drvdata(pdev); -+ -+ drm_atomic_helper_shutdown(drm); -+} -+ - static const struct of_device_id dt_match[] = { - { .compatible = "qcom,mdp4", .data = (void *)KMS_MDP4 }, - { .compatible = "qcom,mdss", .data = (void *)KMS_MDP5 }, -@@ -1332,6 +1339,7 @@ MODULE_DEVICE_TABLE(of, dt_match); - static struct platform_driver msm_platform_driver = { - .probe = msm_pdev_probe, - .remove = msm_pdev_remove, -+ .shutdown = msm_pdev_shutdown, - .driver = { - .name = "msm", - .of_match_table = dt_match, -diff --git a/drivers/gpu/drm/omapdrm/omap_crtc.c b/drivers/gpu/drm/omapdrm/omap_crtc.c -index 3c5ddbf30e974..f5e18802e7bc6 100644 ---- a/drivers/gpu/drm/omapdrm/omap_crtc.c -+++ b/drivers/gpu/drm/omapdrm/omap_crtc.c -@@ -451,11 +451,12 @@ static void omap_crtc_atomic_enable(struct drm_crtc *crtc, - if (omap_state->manually_updated) - return; - -- spin_lock_irq(&crtc->dev->event_lock); - drm_crtc_vblank_on(crtc); -+ - ret = drm_crtc_vblank_get(crtc); - WARN_ON(ret != 0); - -+ spin_lock_irq(&crtc->dev->event_lock); - omap_crtc_arm_event(crtc); - spin_unlock_irq(&crtc->dev->event_lock); - } -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 09df5ecc2c79b..fbc93d8dda5ed 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -730,6 +730,9 @@ - #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 - #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 - #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d -+#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 -+#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e -+#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093 0x6093 - - #define USB_VENDOR_ID_LG 0x1fd2 - #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064 -diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c -index b3dd60897ffda..8a739ec50cc00 100644 ---- a/drivers/hid/hid-quirks.c -+++ b/drivers/hid/hid-quirks.c -@@ -105,6 +105,9 @@ static const struct hid_device_id hid_quirks[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M406XE), HID_QUIRK_MULTI_INPUT }, - { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUSE_ID2), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E), HID_QUIRK_ALWAYS_POLL }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6093), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077), HID_QUIRK_ALWAYS_POLL }, - { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS), HID_QUIRK_NOGET }, -diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c -index 183ff3d251299..006bc07bcd301 100644 ---- a/drivers/hwmon/applesmc.c -+++ b/drivers/hwmon/applesmc.c -@@ -748,15 +748,18 @@ static ssize_t applesmc_light_show(struct device *dev, - } - - ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length); -+ if (ret) -+ goto out; - /* newer macbooks report a single 10-bit bigendian value */ - if (data_length == 10) { - left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2; - goto out; - } - left = buffer[2]; -+ -+ ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); - if (ret) - goto out; -- ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); - right = buffer[2]; - - out: -@@ -805,12 +808,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev, - to_index(attr)); - - ret = applesmc_read_key(newkey, buffer, 2); -- speed = ((buffer[0] << 8 | buffer[1]) >> 2); -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); -+ -+ speed = ((buffer[0] << 8 | buffer[1]) >> 2); -+ return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); - } - - static ssize_t applesmc_store_fan_speed(struct device *dev, -@@ -846,12 +848,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev, - u8 buffer[2]; - - ret = applesmc_read_key(FANS_MANUAL, buffer, 2); -- manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); -+ -+ manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; -+ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); - } - - static ssize_t applesmc_store_fan_manual(struct device *dev, -@@ -867,10 +868,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev, - return -EINVAL; - - ret = applesmc_read_key(FANS_MANUAL, buffer, 2); -- val = (buffer[0] << 8 | buffer[1]); - if (ret) - goto out; - -+ val = (buffer[0] << 8 | buffer[1]); -+ - if (input) - val = val | (0x01 << to_index(attr)); - else -@@ -946,13 +948,12 @@ static ssize_t applesmc_key_count_show(struct device *dev, - u32 count; - - ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4); -- count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + -- ((u32)buffer[2]<<8) + buffer[3]; -- - if (ret) - return ret; -- else -- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); -+ -+ count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + -+ ((u32)buffer[2]<<8) + buffer[3]; -+ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); - } - - static ssize_t applesmc_key_at_index_read_show(struct device *dev, -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index 3a7094f4813f2..cdafc652d9d1a 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -4431,6 +4431,7 @@ int amd_iommu_deactivate_guest_mode(void *data) - struct amd_ir_data *ir_data = (struct amd_ir_data *)data; - struct irte_ga *entry = (struct irte_ga *) ir_data->entry; - struct irq_cfg *cfg = ir_data->cfg; -+ u64 valid = entry->lo.fields_remap.valid; - - if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || - !entry || !entry->lo.fields_vapic.guest_mode) -@@ -4439,6 +4440,7 @@ int amd_iommu_deactivate_guest_mode(void *data) - entry->lo.val = 0; - entry->hi.val = 0; - -+ entry->lo.fields_remap.valid = valid; - entry->lo.fields_remap.dm = apic->irq_dest_mode; - entry->lo.fields_remap.int_type = apic->irq_delivery_mode; - entry->hi.fields.vector = cfg->vector; -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index cdc1f4736a116..2ffec65df3889 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -123,29 +123,29 @@ static inline unsigned int level_to_offset_bits(int level) - return (level - 1) * LEVEL_STRIDE; - } - --static inline int pfn_level_offset(unsigned long pfn, int level) -+static inline int pfn_level_offset(u64 pfn, int level) - { - return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK; - } - --static inline unsigned long level_mask(int level) -+static inline u64 level_mask(int level) - { -- return -1UL << level_to_offset_bits(level); -+ return -1ULL << level_to_offset_bits(level); - } - --static inline unsigned long level_size(int level) -+static inline u64 level_size(int level) - { -- return 1UL << level_to_offset_bits(level); -+ return 1ULL << level_to_offset_bits(level); - } - --static inline unsigned long align_to_level(unsigned long pfn, int level) -+static inline u64 align_to_level(u64 pfn, int level) - { - return (pfn + level_size(level) - 1) & level_mask(level); - } - - static inline unsigned long lvl_to_nr_pages(unsigned int lvl) - { -- return 1 << min_t(int, (lvl - 1) * LEVEL_STRIDE, MAX_AGAW_PFN_WIDTH); -+ return 1UL << min_t(int, (lvl - 1) * LEVEL_STRIDE, MAX_AGAW_PFN_WIDTH); - } - - /* VT-d pages must always be _smaller_ than MM pages. Otherwise things -diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c -index 6bfb283e6f287..f697f3a1d46bc 100644 ---- a/drivers/iommu/intel_irq_remapping.c -+++ b/drivers/iommu/intel_irq_remapping.c -@@ -507,12 +507,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu) - - /* Enable interrupt-remapping */ - iommu->gcmd |= DMA_GCMD_IRE; -- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */ - writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); -- - IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, - readl, (sts & DMA_GSTS_IRES), sts); - -+ /* Block compatibility-format MSIs */ -+ if (sts & DMA_GSTS_CFIS) { -+ iommu->gcmd &= ~DMA_GCMD_CFI; -+ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); -+ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, -+ readl, !(sts & DMA_GSTS_CFIS), sts); -+ } -+ - /* - * With CFI clear in the Global Command register, we should be - * protected from dangerous (i.e. compatibility) interrupts -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index 151aa95775be2..af6d4f898e4c1 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -537,12 +537,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd, - CACHE_MAX_CONCURRENT_LOCKS); - if (IS_ERR(cmd->bm)) { - DMERR("could not create block manager"); -- return PTR_ERR(cmd->bm); -+ r = PTR_ERR(cmd->bm); -+ cmd->bm = NULL; -+ return r; - } - - r = __open_or_format_metadata(cmd, may_format_device); -- if (r) -+ if (r) { - dm_block_manager_destroy(cmd->bm); -+ cmd->bm = NULL; -+ } - - return r; - } -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index ffbda729e26e9..1af82fbbac0c4 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -720,7 +720,7 @@ static int crypt_iv_eboiv_gen(struct crypt_config *cc, u8 *iv, - u8 buf[MAX_CIPHER_BLOCKSIZE] __aligned(__alignof__(__le64)); - struct skcipher_request *req; - struct scatterlist src, dst; -- struct crypto_wait wait; -+ DECLARE_CRYPTO_WAIT(wait); - int err; - - req = skcipher_request_alloc(any_tfm(cc), GFP_NOIO); -diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c -index 1f63084ef3291..d6edfe84e7490 100644 ---- a/drivers/md/dm-integrity.c -+++ b/drivers/md/dm-integrity.c -@@ -2365,6 +2365,7 @@ next_chunk: - range.logical_sector = le64_to_cpu(ic->sb->recalc_sector); - if (unlikely(range.logical_sector >= ic->provided_data_sectors)) { - if (ic->mode == 'B') { -+ block_bitmap_op(ic, ic->recalc_bitmap, 0, ic->provided_data_sectors, BITMAP_OP_CLEAR); - DEBUG_print("queue_delayed_work: bitmap_flush_work\n"); - queue_delayed_work(ic->commit_wq, &ic->bitmap_flush_work, 0); - } -@@ -2442,6 +2443,17 @@ next_chunk: - goto err; - } - -+ if (ic->mode == 'B') { -+ sector_t start, end; -+ start = (range.logical_sector >> -+ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) << -+ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); -+ end = ((range.logical_sector + range.n_sectors) >> -+ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit)) << -+ (ic->sb->log2_sectors_per_block + ic->log2_blocks_per_bitmap_bit); -+ block_bitmap_op(ic, ic->recalc_bitmap, start, end - start, BITMAP_OP_CLEAR); -+ } -+ - advance_and_next: - cond_resched(); - -diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c -index f2de4c73cc8fa..54ecfea2cf47b 100644 ---- a/drivers/md/dm-mpath.c -+++ b/drivers/md/dm-mpath.c -@@ -1190,17 +1190,25 @@ static void multipath_wait_for_pg_init_completion(struct multipath *m) - static void flush_multipath_work(struct multipath *m) - { - if (m->hw_handler_name) { -- set_bit(MPATHF_PG_INIT_DISABLED, &m->flags); -- smp_mb__after_atomic(); -+ unsigned long flags; -+ -+ if (!atomic_read(&m->pg_init_in_progress)) -+ goto skip; -+ -+ spin_lock_irqsave(&m->lock, flags); -+ if (atomic_read(&m->pg_init_in_progress) && -+ !test_and_set_bit(MPATHF_PG_INIT_DISABLED, &m->flags)) { -+ spin_unlock_irqrestore(&m->lock, flags); - -- if (atomic_read(&m->pg_init_in_progress)) - flush_workqueue(kmpath_handlerd); -- multipath_wait_for_pg_init_completion(m); -+ multipath_wait_for_pg_init_completion(m); - -- clear_bit(MPATHF_PG_INIT_DISABLED, &m->flags); -- smp_mb__after_atomic(); -+ spin_lock_irqsave(&m->lock, flags); -+ clear_bit(MPATHF_PG_INIT_DISABLED, &m->flags); -+ } -+ spin_unlock_irqrestore(&m->lock, flags); - } -- -+skip: - if (m->queue_mode == DM_TYPE_BIO_BASED) - flush_work(&m->process_queued_bios); - flush_work(&m->trigger_event); -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 4cd8868f80040..a5ed59eafdc51 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -739,12 +739,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f - THIN_MAX_CONCURRENT_LOCKS); - if (IS_ERR(pmd->bm)) { - DMERR("could not create block manager"); -- return PTR_ERR(pmd->bm); -+ r = PTR_ERR(pmd->bm); -+ pmd->bm = NULL; -+ return r; - } - - r = __open_or_format_metadata(pmd, format_device); -- if (r) -+ if (r) { - dm_block_manager_destroy(pmd->bm); -+ pmd->bm = NULL; -+ } - - return r; - } -@@ -954,7 +958,7 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd) - } - - pmd_write_lock_in_core(pmd); -- if (!dm_bm_is_read_only(pmd->bm) && !pmd->fail_io) { -+ if (!pmd->fail_io && !dm_bm_is_read_only(pmd->bm)) { - r = __commit_transaction(pmd); - if (r < 0) - DMWARN("%s: __commit_transaction() failed, error = %d", -diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c -index ed2f711c24c48..4e414b06192eb 100644 ---- a/drivers/md/dm-writecache.c -+++ b/drivers/md/dm-writecache.c -@@ -224,6 +224,7 @@ static int persistent_memory_claim(struct dm_writecache *wc) - pfn_t pfn; - int id; - struct page **pages; -+ sector_t offset; - - wc->memory_vmapped = false; - -@@ -242,9 +243,16 @@ static int persistent_memory_claim(struct dm_writecache *wc) - goto err1; - } - -+ offset = get_start_sect(wc->ssd_dev->bdev); -+ if (offset & (PAGE_SIZE / 512 - 1)) { -+ r = -EINVAL; -+ goto err1; -+ } -+ offset >>= PAGE_SHIFT - 9; -+ - id = dax_read_lock(); - -- da = dax_direct_access(wc->ssd_dev->dax_dev, 0, p, &wc->memory_map, &pfn); -+ da = dax_direct_access(wc->ssd_dev->dax_dev, offset, p, &wc->memory_map, &pfn); - if (da < 0) { - wc->memory_map = NULL; - r = da; -@@ -266,7 +274,7 @@ static int persistent_memory_claim(struct dm_writecache *wc) - i = 0; - do { - long daa; -- daa = dax_direct_access(wc->ssd_dev->dax_dev, i, p - i, -+ daa = dax_direct_access(wc->ssd_dev->dax_dev, offset + i, p - i, - NULL, &pfn); - if (daa <= 0) { - r = daa ? daa : -EINVAL; -diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c -index 749ec268d957d..54c089a50b152 100644 ---- a/drivers/md/persistent-data/dm-block-manager.c -+++ b/drivers/md/persistent-data/dm-block-manager.c -@@ -493,7 +493,7 @@ int dm_bm_write_lock(struct dm_block_manager *bm, - void *p; - int r; - -- if (bm->read_only) -+ if (dm_bm_is_read_only(bm)) - return -EPERM; - - p = dm_bufio_read(bm->bufio, b, (struct dm_buffer **) result); -@@ -562,7 +562,7 @@ int dm_bm_write_lock_zero(struct dm_block_manager *bm, - struct buffer_aux *aux; - void *p; - -- if (bm->read_only) -+ if (dm_bm_is_read_only(bm)) - return -EPERM; - - p = dm_bufio_new(bm->bufio, b, (struct dm_buffer **) result); -@@ -602,7 +602,7 @@ EXPORT_SYMBOL_GPL(dm_bm_unlock); - - int dm_bm_flush(struct dm_block_manager *bm) - { -- if (bm->read_only) -+ if (dm_bm_is_read_only(bm)) - return -EPERM; - - return dm_bufio_write_dirty_buffers(bm->bufio); -@@ -616,19 +616,21 @@ void dm_bm_prefetch(struct dm_block_manager *bm, dm_block_t b) - - bool dm_bm_is_read_only(struct dm_block_manager *bm) - { -- return bm->read_only; -+ return (bm ? bm->read_only : true); - } - EXPORT_SYMBOL_GPL(dm_bm_is_read_only); - - void dm_bm_set_read_only(struct dm_block_manager *bm) - { -- bm->read_only = true; -+ if (bm) -+ bm->read_only = true; - } - EXPORT_SYMBOL_GPL(dm_bm_set_read_only); - - void dm_bm_set_read_write(struct dm_block_manager *bm) - { -- bm->read_only = false; -+ if (bm) -+ bm->read_only = false; - } - EXPORT_SYMBOL_GPL(dm_bm_set_read_write); - -diff --git a/drivers/media/platform/vicodec/vicodec-core.c b/drivers/media/platform/vicodec/vicodec-core.c -index 84ec36156f73f..c77281d43f892 100644 ---- a/drivers/media/platform/vicodec/vicodec-core.c -+++ b/drivers/media/platform/vicodec/vicodec-core.c -@@ -2052,6 +2052,7 @@ static int vicodec_request_validate(struct media_request *req) - } - ctrl = v4l2_ctrl_request_hdl_ctrl_find(hdl, - vicodec_ctrl_stateless_state.id); -+ v4l2_ctrl_request_hdl_put(hdl); - if (!ctrl) { - v4l2_info(&ctx->dev->v4l2_dev, - "Missing required codec control\n"); -diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c -index 6f80c251f6413..e84f9dccf448a 100644 ---- a/drivers/media/rc/rc-main.c -+++ b/drivers/media/rc/rc-main.c -@@ -1256,6 +1256,10 @@ static ssize_t store_protocols(struct device *device, - } - - mutex_lock(&dev->lock); -+ if (!dev->registered) { -+ mutex_unlock(&dev->lock); -+ return -ENODEV; -+ } - - old_protocols = *current_protocols; - new_protocols = old_protocols; -@@ -1394,6 +1398,10 @@ static ssize_t store_filter(struct device *device, - return -EINVAL; - - mutex_lock(&dev->lock); -+ if (!dev->registered) { -+ mutex_unlock(&dev->lock); -+ return -ENODEV; -+ } - - new_filter = *filter; - if (fattr->mask) -@@ -1508,6 +1516,10 @@ static ssize_t store_wakeup_protocols(struct device *device, - int i; - - mutex_lock(&dev->lock); -+ if (!dev->registered) { -+ mutex_unlock(&dev->lock); -+ return -ENODEV; -+ } - - allowed = dev->allowed_wakeup_protocols; - -@@ -1565,25 +1577,25 @@ static void rc_dev_release(struct device *device) - kfree(dev); - } - --#define ADD_HOTPLUG_VAR(fmt, val...) \ -- do { \ -- int err = add_uevent_var(env, fmt, val); \ -- if (err) \ -- return err; \ -- } while (0) -- - static int rc_dev_uevent(struct device *device, struct kobj_uevent_env *env) - { - struct rc_dev *dev = to_rc_dev(device); -+ int ret = 0; - -- if (dev->rc_map.name) -- ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name); -- if (dev->driver_name) -- ADD_HOTPLUG_VAR("DRV_NAME=%s", dev->driver_name); -- if (dev->device_name) -- ADD_HOTPLUG_VAR("DEV_NAME=%s", dev->device_name); -+ mutex_lock(&dev->lock); - -- return 0; -+ if (!dev->registered) -+ ret = -ENODEV; -+ if (ret == 0 && dev->rc_map.name) -+ ret = add_uevent_var(env, "NAME=%s", dev->rc_map.name); -+ if (ret == 0 && dev->driver_name) -+ ret = add_uevent_var(env, "DRV_NAME=%s", dev->driver_name); -+ if (ret == 0 && dev->device_name) -+ ret = add_uevent_var(env, "DEV_NAME=%s", dev->device_name); -+ -+ mutex_unlock(&dev->lock); -+ -+ return ret; - } - - /* -@@ -1975,14 +1987,14 @@ void rc_unregister_device(struct rc_dev *dev) - del_timer_sync(&dev->timer_keyup); - del_timer_sync(&dev->timer_repeat); - -- rc_free_rx_device(dev); -- - mutex_lock(&dev->lock); - if (dev->users && dev->close) - dev->close(dev); - dev->registered = false; - mutex_unlock(&dev->lock); - -+ rc_free_rx_device(dev); -+ - /* - * lirc device should be freed with dev->registered = false, so - * that userspace polling will get notified. -diff --git a/drivers/misc/habanalabs/firmware_if.c b/drivers/misc/habanalabs/firmware_if.c -index ea2ca67fbfbfa..153858475abc1 100644 ---- a/drivers/misc/habanalabs/firmware_if.c -+++ b/drivers/misc/habanalabs/firmware_if.c -@@ -11,6 +11,7 @@ - #include - #include - -+#define FW_FILE_MAX_SIZE 0x1400000 /* maximum size of 20MB */ - /** - * hl_fw_push_fw_to_device() - Push FW code to device. - * @hdev: pointer to hl_device structure. -@@ -43,6 +44,14 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name, - - dev_dbg(hdev->dev, "%s firmware size == %zu\n", fw_name, fw_size); - -+ if (fw_size > FW_FILE_MAX_SIZE) { -+ dev_err(hdev->dev, -+ "FW file size %zu exceeds maximum of %u bytes\n", -+ fw_size, FW_FILE_MAX_SIZE); -+ rc = -EINVAL; -+ goto out; -+ } -+ - fw_data = (const u64 *) fw->data; - - memcpy_toio(dst, fw_data, fw_size); -diff --git a/drivers/misc/habanalabs/memory.c b/drivers/misc/habanalabs/memory.c -index 22566b75ca50c..acfccf32be6b9 100644 ---- a/drivers/misc/habanalabs/memory.c -+++ b/drivers/misc/habanalabs/memory.c -@@ -67,6 +67,11 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args, - num_pgs = (args->alloc.mem_size + (page_size - 1)) >> page_shift; - total_size = num_pgs << page_shift; - -+ if (!total_size) { -+ dev_err(hdev->dev, "Cannot allocate 0 bytes\n"); -+ return -EINVAL; -+ } -+ - contiguous = args->flags & HL_MEM_CONTIGUOUS; - - if (contiguous) { -@@ -94,7 +99,7 @@ static int alloc_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args, - phys_pg_pack->contiguous = contiguous; - - phys_pg_pack->pages = kvmalloc_array(num_pgs, sizeof(u64), GFP_KERNEL); -- if (!phys_pg_pack->pages) { -+ if (ZERO_OR_NULL_PTR(phys_pg_pack->pages)) { - rc = -ENOMEM; - goto pages_arr_err; - } -@@ -689,7 +694,7 @@ static int init_phys_pg_pack_from_userptr(struct hl_ctx *ctx, - - phys_pg_pack->pages = kvmalloc_array(total_npages, sizeof(u64), - GFP_KERNEL); -- if (!phys_pg_pack->pages) { -+ if (ZERO_OR_NULL_PTR(phys_pg_pack->pages)) { - rc = -ENOMEM; - goto page_pack_arr_mem_err; - } -diff --git a/drivers/misc/habanalabs/mmu.c b/drivers/misc/habanalabs/mmu.c -index 176c315836f12..d66e16de4cda3 100644 ---- a/drivers/misc/habanalabs/mmu.c -+++ b/drivers/misc/habanalabs/mmu.c -@@ -422,7 +422,7 @@ int hl_mmu_init(struct hl_device *hdev) - hdev->mmu_shadow_hop0 = kvmalloc_array(prop->max_asid, - prop->mmu_hop_table_size, - GFP_KERNEL | __GFP_ZERO); -- if (!hdev->mmu_shadow_hop0) { -+ if (ZERO_OR_NULL_PTR(hdev->mmu_shadow_hop0)) { - rc = -ENOMEM; - goto err_pool_add; - } -diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c -index c19f4c3f115a4..2d65b32d205a5 100644 ---- a/drivers/mmc/host/cqhci.c -+++ b/drivers/mmc/host/cqhci.c -@@ -299,16 +299,16 @@ static void __cqhci_disable(struct cqhci_host *cq_host) - cq_host->activated = false; - } - --int cqhci_suspend(struct mmc_host *mmc) -+int cqhci_deactivate(struct mmc_host *mmc) - { - struct cqhci_host *cq_host = mmc->cqe_private; - -- if (cq_host->enabled) -+ if (cq_host->enabled && cq_host->activated) - __cqhci_disable(cq_host); - - return 0; - } --EXPORT_SYMBOL(cqhci_suspend); -+EXPORT_SYMBOL(cqhci_deactivate); - - int cqhci_resume(struct mmc_host *mmc) - { -diff --git a/drivers/mmc/host/cqhci.h b/drivers/mmc/host/cqhci.h -index def76e9b5cacf..437700179de4d 100644 ---- a/drivers/mmc/host/cqhci.h -+++ b/drivers/mmc/host/cqhci.h -@@ -230,7 +230,11 @@ irqreturn_t cqhci_irq(struct mmc_host *mmc, u32 intmask, int cmd_error, - int data_error); - int cqhci_init(struct cqhci_host *cq_host, struct mmc_host *mmc, bool dma64); - struct cqhci_host *cqhci_pltfm_init(struct platform_device *pdev); --int cqhci_suspend(struct mmc_host *mmc); -+int cqhci_deactivate(struct mmc_host *mmc); -+static inline int cqhci_suspend(struct mmc_host *mmc) -+{ -+ return cqhci_deactivate(mmc); -+} - int cqhci_resume(struct mmc_host *mmc); - - #endif -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index 010fe29a48883..9d47a2bd2546b 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -412,6 +413,7 @@ struct msdc_host { - struct pinctrl_state *pins_uhs; - struct delayed_work req_timeout; - int irq; /* host interrupt */ -+ struct reset_control *reset; - - struct clk *src_clk; /* msdc source clock */ - struct clk *h_clk; /* msdc h_clk */ -@@ -1474,6 +1476,12 @@ static void msdc_init_hw(struct msdc_host *host) - u32 val; - u32 tune_reg = host->dev_comp->pad_tune_reg; - -+ if (host->reset) { -+ reset_control_assert(host->reset); -+ usleep_range(10, 50); -+ reset_control_deassert(host->reset); -+ } -+ - /* Configure to MMC/SD mode, clock free running */ - sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_MODE | MSDC_CFG_CKPDN); - -@@ -2232,6 +2240,11 @@ static int msdc_drv_probe(struct platform_device *pdev) - if (IS_ERR(host->src_clk_cg)) - host->src_clk_cg = NULL; - -+ host->reset = devm_reset_control_get_optional_exclusive(&pdev->dev, -+ "hrst"); -+ if (IS_ERR(host->reset)) -+ return PTR_ERR(host->reset); -+ - host->irq = platform_get_irq(pdev, 0); - if (host->irq < 0) { - ret = -EINVAL; -diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c -index 01fc437ed9659..5581a5c86fce3 100644 ---- a/drivers/mmc/host/sdhci-acpi.c -+++ b/drivers/mmc/host/sdhci-acpi.c -@@ -532,6 +532,11 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_qcom_sd = { - .caps = MMC_CAP_NONREMOVABLE, - }; - -+struct amd_sdhci_host { -+ bool tuned_clock; -+ bool dll_enabled; -+}; -+ - /* AMD sdhci reset dll register. */ - #define SDHCI_AMD_RESET_DLL_REGISTER 0x908 - -@@ -551,26 +556,66 @@ static void sdhci_acpi_amd_hs400_dll(struct sdhci_host *host) - } - - /* -- * For AMD Platform it is required to disable the tuning -- * bit first controller to bring to HS Mode from HS200 -- * mode, later enable to tune to HS400 mode. -+ * The initialization sequence for HS400 is: -+ * HS->HS200->Perform Tuning->HS->HS400 -+ * -+ * The re-tuning sequence is: -+ * HS400->DDR52->HS->HS200->Perform Tuning->HS->HS400 -+ * -+ * The AMD eMMC Controller can only use the tuned clock while in HS200 and HS400 -+ * mode. If we switch to a different mode, we need to disable the tuned clock. -+ * If we have previously performed tuning and switch back to HS200 or -+ * HS400, we can re-enable the tuned clock. -+ * - */ - static void amd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios) - { - struct sdhci_host *host = mmc_priv(mmc); -+ struct sdhci_acpi_host *acpi_host = sdhci_priv(host); -+ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host); - unsigned int old_timing = host->timing; -+ u16 val; - - sdhci_set_ios(mmc, ios); -- if (old_timing == MMC_TIMING_MMC_HS200 && -- ios->timing == MMC_TIMING_MMC_HS) -- sdhci_writew(host, 0x9, SDHCI_HOST_CONTROL2); -- if (old_timing != MMC_TIMING_MMC_HS400 && -- ios->timing == MMC_TIMING_MMC_HS400) { -- sdhci_writew(host, 0x80, SDHCI_HOST_CONTROL2); -- sdhci_acpi_amd_hs400_dll(host); -+ -+ if (old_timing != host->timing && amd_host->tuned_clock) { -+ if (host->timing == MMC_TIMING_MMC_HS400 || -+ host->timing == MMC_TIMING_MMC_HS200) { -+ val = sdhci_readw(host, SDHCI_HOST_CONTROL2); -+ val |= SDHCI_CTRL_TUNED_CLK; -+ sdhci_writew(host, val, SDHCI_HOST_CONTROL2); -+ } else { -+ val = sdhci_readw(host, SDHCI_HOST_CONTROL2); -+ val &= ~SDHCI_CTRL_TUNED_CLK; -+ sdhci_writew(host, val, SDHCI_HOST_CONTROL2); -+ } -+ -+ /* DLL is only required for HS400 */ -+ if (host->timing == MMC_TIMING_MMC_HS400 && -+ !amd_host->dll_enabled) { -+ sdhci_acpi_amd_hs400_dll(host); -+ amd_host->dll_enabled = true; -+ } - } - } - -+static int amd_sdhci_execute_tuning(struct mmc_host *mmc, u32 opcode) -+{ -+ int err; -+ struct sdhci_host *host = mmc_priv(mmc); -+ struct sdhci_acpi_host *acpi_host = sdhci_priv(host); -+ struct amd_sdhci_host *amd_host = sdhci_acpi_priv(acpi_host); -+ -+ amd_host->tuned_clock = false; -+ -+ err = sdhci_execute_tuning(mmc, opcode); -+ -+ if (!err && !host->tuning_err) -+ amd_host->tuned_clock = true; -+ -+ return err; -+} -+ - static const struct sdhci_ops sdhci_acpi_ops_amd = { - .set_clock = sdhci_set_clock, - .set_bus_width = sdhci_set_bus_width, -@@ -598,6 +643,7 @@ static int sdhci_acpi_emmc_amd_probe_slot(struct platform_device *pdev, - - host->mmc_host_ops.select_drive_strength = amd_select_drive_strength; - host->mmc_host_ops.set_ios = amd_set_ios; -+ host->mmc_host_ops.execute_tuning = amd_sdhci_execute_tuning; - return 0; - } - -@@ -609,6 +655,7 @@ static const struct sdhci_acpi_slot sdhci_acpi_slot_amd_emmc = { - SDHCI_QUIRK_32BIT_ADMA_SIZE, - .quirks2 = SDHCI_QUIRK2_BROKEN_64_BIT_DMA, - .probe_slot = sdhci_acpi_emmc_amd_probe_slot, -+ .priv_size = sizeof(struct amd_sdhci_host), - }; - - struct sdhci_acpi_uid_slot { -diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c -index 9b66e8b374ed7..425aa898e797a 100644 ---- a/drivers/mmc/host/sdhci-pci-core.c -+++ b/drivers/mmc/host/sdhci-pci-core.c -@@ -232,6 +232,14 @@ static void sdhci_pci_dumpregs(struct mmc_host *mmc) - sdhci_dumpregs(mmc_priv(mmc)); - } - -+static void sdhci_cqhci_reset(struct sdhci_host *host, u8 mask) -+{ -+ if ((host->mmc->caps2 & MMC_CAP2_CQE) && (mask & SDHCI_RESET_ALL) && -+ host->mmc->cqe_private) -+ cqhci_deactivate(host->mmc); -+ sdhci_reset(host, mask); -+} -+ - /*****************************************************************************\ - * * - * Hardware specific quirk handling * -@@ -722,7 +730,7 @@ static const struct sdhci_ops sdhci_intel_glk_ops = { - .set_power = sdhci_intel_set_power, - .enable_dma = sdhci_pci_enable_dma, - .set_bus_width = sdhci_set_bus_width, -- .reset = sdhci_reset, -+ .reset = sdhci_cqhci_reset, - .set_uhs_signaling = sdhci_set_uhs_signaling, - .hw_reset = sdhci_pci_hw_reset, - .irq = sdhci_cqhci_irq, -diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c -index e37d271ca9636..c105356ad4cb7 100644 ---- a/drivers/mmc/host/sdhci-tegra.c -+++ b/drivers/mmc/host/sdhci-tegra.c -@@ -100,6 +100,12 @@ - #define NVQUIRK_DIS_CARD_CLK_CONFIG_TAP BIT(8) - #define NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING BIT(9) - -+/* -+ * NVQUIRK_HAS_TMCLK is for SoC's having separate timeout clock for Tegra -+ * SDMMC hardware data timeout. -+ */ -+#define NVQUIRK_HAS_TMCLK BIT(10) -+ - /* SDMMC CQE Base Address for Tegra Host Ver 4.1 and Higher */ - #define SDHCI_TEGRA_CQE_BASE_ADDR 0xF000 - -@@ -130,6 +136,7 @@ struct sdhci_tegra_autocal_offsets { - struct sdhci_tegra { - const struct sdhci_tegra_soc_data *soc_data; - struct gpio_desc *power_gpio; -+ struct clk *tmclk; - bool ddr_signaling; - bool pad_calib_required; - bool pad_control_available; -@@ -1385,7 +1392,8 @@ static const struct sdhci_tegra_soc_data soc_data_tegra210 = { - NVQUIRK_HAS_PADCALIB | - NVQUIRK_DIS_CARD_CLK_CONFIG_TAP | - NVQUIRK_ENABLE_SDR50 | -- NVQUIRK_ENABLE_SDR104, -+ NVQUIRK_ENABLE_SDR104 | -+ NVQUIRK_HAS_TMCLK, - .min_tap_delay = 106, - .max_tap_delay = 185, - }; -@@ -1422,6 +1430,7 @@ static const struct sdhci_tegra_soc_data soc_data_tegra186 = { - NVQUIRK_DIS_CARD_CLK_CONFIG_TAP | - NVQUIRK_ENABLE_SDR50 | - NVQUIRK_ENABLE_SDR104 | -+ NVQUIRK_HAS_TMCLK | - NVQUIRK_CQHCI_DCMD_R1B_CMD_TIMING, - .min_tap_delay = 84, - .max_tap_delay = 136, -@@ -1434,7 +1443,8 @@ static const struct sdhci_tegra_soc_data soc_data_tegra194 = { - NVQUIRK_HAS_PADCALIB | - NVQUIRK_DIS_CARD_CLK_CONFIG_TAP | - NVQUIRK_ENABLE_SDR50 | -- NVQUIRK_ENABLE_SDR104, -+ NVQUIRK_ENABLE_SDR104 | -+ NVQUIRK_HAS_TMCLK, - .min_tap_delay = 96, - .max_tap_delay = 139, - }; -@@ -1562,6 +1572,43 @@ static int sdhci_tegra_probe(struct platform_device *pdev) - goto err_power_req; - } - -+ /* -+ * Tegra210 has a separate SDMMC_LEGACY_TM clock used for host -+ * timeout clock and SW can choose TMCLK or SDCLK for hardware -+ * data timeout through the bit USE_TMCLK_FOR_DATA_TIMEOUT of -+ * the register SDHCI_TEGRA_VENDOR_SYS_SW_CTRL. -+ * -+ * USE_TMCLK_FOR_DATA_TIMEOUT bit default is set to 1 and SDMMC uses -+ * 12Mhz TMCLK which is advertised in host capability register. -+ * With TMCLK of 12Mhz provides maximum data timeout period that can -+ * be achieved is 11s better than using SDCLK for data timeout. -+ * -+ * So, TMCLK is set to 12Mhz and kept enabled all the time on SoC's -+ * supporting separate TMCLK. -+ */ -+ -+ if (soc_data->nvquirks & NVQUIRK_HAS_TMCLK) { -+ clk = devm_clk_get(&pdev->dev, "tmclk"); -+ if (IS_ERR(clk)) { -+ rc = PTR_ERR(clk); -+ if (rc == -EPROBE_DEFER) -+ goto err_power_req; -+ -+ dev_warn(&pdev->dev, "failed to get tmclk: %d\n", rc); -+ clk = NULL; -+ } -+ -+ clk_set_rate(clk, 12000000); -+ rc = clk_prepare_enable(clk); -+ if (rc) { -+ dev_err(&pdev->dev, -+ "failed to enable tmclk: %d\n", rc); -+ goto err_power_req; -+ } -+ -+ tegra_host->tmclk = clk; -+ } -+ - clk = devm_clk_get(mmc_dev(host->mmc), NULL); - if (IS_ERR(clk)) { - rc = PTR_ERR(clk); -@@ -1605,6 +1652,7 @@ err_add_host: - err_rst_get: - clk_disable_unprepare(pltfm_host->clk); - err_clk_get: -+ clk_disable_unprepare(tegra_host->tmclk); - err_power_req: - err_parse_dt: - sdhci_pltfm_free(pdev); -@@ -1622,6 +1670,7 @@ static int sdhci_tegra_remove(struct platform_device *pdev) - reset_control_assert(tegra_host->rst); - usleep_range(2000, 4000); - clk_disable_unprepare(pltfm_host->clk); -+ clk_disable_unprepare(tegra_host->tmclk); - - sdhci_pltfm_free(pdev); - -diff --git a/drivers/net/dsa/microchip/ksz8795.c b/drivers/net/dsa/microchip/ksz8795.c -index 8d50aacd19e51..84c4319e3b31f 100644 ---- a/drivers/net/dsa/microchip/ksz8795.c -+++ b/drivers/net/dsa/microchip/ksz8795.c -@@ -1270,9 +1270,6 @@ static int ksz8795_switch_init(struct ksz_device *dev) - /* set the real number of ports */ - dev->ds->num_ports = dev->port_cnt; - -- /* set the real number of ports */ -- dev->ds->num_ports = dev->port_cnt; -- - return 0; - } - -diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c -index b15da9a8e3bb9..49ab1346dc3f7 100644 ---- a/drivers/net/dsa/microchip/ksz9477.c -+++ b/drivers/net/dsa/microchip/ksz9477.c -@@ -515,9 +515,6 @@ static int ksz9477_port_vlan_filtering(struct dsa_switch *ds, int port, - PORT_VLAN_LOOKUP_VID_0, false); - } - -- /* set the real number of ports */ -- dev->ds->num_ports = dev->port_cnt; -- - return 0; - } - -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index dc9a3bb241149..00d680cb44418 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -1456,7 +1456,7 @@ unsupported: - phylink_set(mask, 100baseT_Full); - - if (state->interface != PHY_INTERFACE_MODE_MII) { -- phylink_set(mask, 1000baseT_Half); -+ /* This switch only supports 1G full-duplex. */ - phylink_set(mask, 1000baseT_Full); - if (port == 5) - phylink_set(mask, 1000baseX_Full); -diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c -index 0187dbf3b87df..54cdafdd067db 100644 ---- a/drivers/net/ethernet/arc/emac_mdio.c -+++ b/drivers/net/ethernet/arc/emac_mdio.c -@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) - if (IS_ERR(data->reset_gpio)) { - error = PTR_ERR(data->reset_gpio); - dev_err(priv->dev, "Failed to request gpio: %d\n", error); -+ mdiobus_free(bus); - return error; - } - -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 4dfdb5a58025b..71eb8914e620b 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -2453,8 +2453,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) - priv->tx_rings = devm_kcalloc(&pdev->dev, txq, - sizeof(struct bcm_sysport_tx_ring), - GFP_KERNEL); -- if (!priv->tx_rings) -- return -ENOMEM; -+ if (!priv->tx_rings) { -+ ret = -ENOMEM; -+ goto err_free_netdev; -+ } - - priv->is_lite = params->is_lite; - priv->num_rx_desc_words = params->num_rx_desc_words; -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 2cbfe0cd7eefa..4030020f92be5 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -1143,6 +1143,9 @@ static int bnxt_discard_rx(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - - static void bnxt_queue_fw_reset_work(struct bnxt *bp, unsigned long delay) - { -+ if (!(test_bit(BNXT_STATE_IN_FW_RESET, &bp->state))) -+ return; -+ - if (BNXT_PF(bp)) - queue_delayed_work(bnxt_pf_wq, &bp->fw_reset_task, delay); - else -@@ -1159,10 +1162,12 @@ static void bnxt_queue_sp_work(struct bnxt *bp) - - static void bnxt_cancel_sp_work(struct bnxt *bp) - { -- if (BNXT_PF(bp)) -+ if (BNXT_PF(bp)) { - flush_workqueue(bnxt_pf_wq); -- else -+ } else { - cancel_work_sync(&bp->sp_task); -+ cancel_delayed_work_sync(&bp->fw_reset_task); -+ } - } - - static void bnxt_sched_reset(struct bnxt *bp, struct bnxt_rx_ring_info *rxr) -@@ -8933,16 +8938,19 @@ static ssize_t bnxt_show_temp(struct device *dev, - struct hwrm_temp_monitor_query_input req = {0}; - struct hwrm_temp_monitor_query_output *resp; - struct bnxt *bp = dev_get_drvdata(dev); -- u32 temp = 0; -+ u32 len = 0; - - resp = bp->hwrm_cmd_resp_addr; - bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); - mutex_lock(&bp->hwrm_cmd_lock); -- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) -- temp = resp->temp * 1000; /* display millidegree */ -+ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) -+ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ - mutex_unlock(&bp->hwrm_cmd_lock); - -- return sprintf(buf, "%u\n", temp); -+ if (len) -+ return len; -+ -+ return sprintf(buf, "unknown\n"); - } - static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); - -@@ -9124,15 +9132,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - } - } - -- bnxt_enable_napi(bp); -- bnxt_debug_dev_init(bp); -- - rc = bnxt_init_nic(bp, irq_re_init); - if (rc) { - netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); -- goto open_err; -+ goto open_err_irq; - } - -+ bnxt_enable_napi(bp); -+ bnxt_debug_dev_init(bp); -+ - if (link_re_init) { - mutex_lock(&bp->link_lock); - rc = bnxt_update_phy_setting(bp); -@@ -9163,10 +9171,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) - bnxt_vf_reps_open(bp); - return 0; - --open_err: -- bnxt_debug_dev_exit(bp); -- bnxt_disable_napi(bp); -- - open_err_irq: - bnxt_del_napi(bp); - -@@ -11386,6 +11390,7 @@ static void bnxt_remove_one(struct pci_dev *pdev) - unregister_netdev(dev); - bnxt_dl_unregister(bp); - bnxt_shutdown_tc(bp); -+ clear_bit(BNXT_STATE_IN_FW_RESET, &bp->state); - bnxt_cancel_sp_work(bp); - bp->sp_event = 0; - -@@ -11900,6 +11905,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - (long)pci_resource_start(pdev, 0), dev->dev_addr); - pcie_print_link_status(pdev); - -+ pci_save_state(pdev); - return 0; - - init_err_cleanup: -@@ -12066,6 +12072,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) - "Cannot re-enable PCI device after reset.\n"); - } else { - pci_set_master(pdev); -+ pci_restore_state(pdev); -+ pci_save_state(pdev); - - err = bnxt_hwrm_func_reset(bp); - if (!err && netif_running(netdev)) -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -index 1f512e7c3d434..fd01bcc8e28d4 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c -@@ -769,7 +769,7 @@ static void bnxt_get_channels(struct net_device *dev, - int max_tx_sch_inputs; - - /* Get the most up-to-date max_tx_sch_inputs. */ -- if (BNXT_NEW_RM(bp)) -+ if (netif_running(dev) && BNXT_NEW_RM(bp)) - bnxt_hwrm_func_resc_qcaps(bp, false); - max_tx_sch_inputs = hw_resc->max_tx_sch_inputs; - -@@ -2161,6 +2161,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data) - if (rc != 0) - return rc; - -+ if (!dir_entries || !entry_length) -+ return -EIO; -+ - /* Insert 2 bytes of directory info (count and size of entries) */ - if (len < 2) - return -EINVAL; -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index e12ba81288e64..70bd79dc43f2e 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -7227,8 +7227,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp) - - static inline void tg3_reset_task_cancel(struct tg3 *tp) - { -- cancel_work_sync(&tp->reset_task); -- tg3_flag_clear(tp, RESET_TASK_PENDING); -+ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags)) -+ cancel_work_sync(&tp->reset_task); - tg3_flag_clear(tp, TX_RECOVERY_PENDING); - } - -@@ -11219,18 +11219,27 @@ static void tg3_reset_task(struct work_struct *work) - - tg3_halt(tp, RESET_KIND_SHUTDOWN, 0); - err = tg3_init_hw(tp, true); -- if (err) -+ if (err) { -+ tg3_full_unlock(tp); -+ tp->irq_sync = 0; -+ tg3_napi_enable(tp); -+ /* Clear this flag so that tg3_reset_task_cancel() will not -+ * call cancel_work_sync() and wait forever. -+ */ -+ tg3_flag_clear(tp, RESET_TASK_PENDING); -+ dev_close(tp->dev); - goto out; -+ } - - tg3_netif_start(tp); - --out: - tg3_full_unlock(tp); - - if (!err) - tg3_phy_start(tp); - - tg3_flag_clear(tp, RESET_TASK_PENDING); -+out: - rtnl_unlock(); - } - -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c -index 3de8a5e83b6c7..d7fefdbf3e575 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.c -@@ -62,6 +62,7 @@ static struct thermal_zone_device_ops cxgb4_thermal_ops = { - int cxgb4_thermal_init(struct adapter *adap) - { - struct ch_thermal *ch_thermal = &adap->ch_thermal; -+ char ch_tz_name[THERMAL_NAME_LENGTH]; - int num_trip = CXGB4_NUM_TRIPS; - u32 param, val; - int ret; -@@ -82,7 +83,8 @@ int cxgb4_thermal_init(struct adapter *adap) - ch_thermal->trip_type = THERMAL_TRIP_CRITICAL; - } - -- ch_thermal->tzdev = thermal_zone_device_register("cxgb4", num_trip, -+ snprintf(ch_tz_name, sizeof(ch_tz_name), "cxgb4_%s", adap->name); -+ ch_thermal->tzdev = thermal_zone_device_register(ch_tz_name, num_trip, - 0, adap, - &cxgb4_thermal_ops, - NULL, 0, 0); -@@ -97,7 +99,9 @@ int cxgb4_thermal_init(struct adapter *adap) - - int cxgb4_thermal_remove(struct adapter *adap) - { -- if (adap->ch_thermal.tzdev) -+ if (adap->ch_thermal.tzdev) { - thermal_zone_device_unregister(adap->ch_thermal.tzdev); -+ adap->ch_thermal.tzdev = NULL; -+ } - return 0; - } -diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c -index 28d4c54505f9a..c9fb1ec625d8b 100644 ---- a/drivers/net/ethernet/cortina/gemini.c -+++ b/drivers/net/ethernet/cortina/gemini.c -@@ -2445,8 +2445,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) - port->reset = devm_reset_control_get_exclusive(dev, NULL); - if (IS_ERR(port->reset)) { - dev_err(dev, "no reset\n"); -- clk_disable_unprepare(port->pclk); -- return PTR_ERR(port->reset); -+ ret = PTR_ERR(port->reset); -+ goto unprepare; - } - reset_control_reset(port->reset); - usleep_range(100, 500); -@@ -2501,25 +2501,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) - IRQF_SHARED, - port_names[port->id], - port); -- if (ret) { -- clk_disable_unprepare(port->pclk); -- return ret; -- } -+ if (ret) -+ goto unprepare; - - ret = register_netdev(netdev); -- if (!ret) { -+ if (ret) -+ goto unprepare; -+ -+ netdev_info(netdev, -+ "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", -+ port->irq, &dmares->start, -+ &gmacres->start); -+ ret = gmac_setup_phy(netdev); -+ if (ret) - netdev_info(netdev, -- "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", -- port->irq, &dmares->start, -- &gmacres->start); -- ret = gmac_setup_phy(netdev); -- if (ret) -- netdev_info(netdev, -- "PHY init failed, deferring to ifup time\n"); -- return 0; -- } -+ "PHY init failed, deferring to ifup time\n"); -+ return 0; - -- port->netdev = NULL; -+unprepare: -+ clk_disable_unprepare(port->pclk); - return ret; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -index eb69e5c81a4d0..6d5d53cfc7ab4 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -@@ -2296,8 +2296,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev) - priv->enet_ver = AE_VERSION_1; - else if (acpi_dev_found(hns_enet_acpi_match[1].id)) - priv->enet_ver = AE_VERSION_2; -- else -- return -ENXIO; -+ else { -+ ret = -ENXIO; -+ goto out_read_prop_fail; -+ } - - /* try to find port-idx-in-ae first */ - ret = acpi_node_get_property_reference(dev->fwnode, -@@ -2313,7 +2315,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) - priv->fwnode = args.fwnode; - } else { - dev_err(dev, "cannot read cfg data from OF or acpi\n"); -- return -ENXIO; -+ ret = -ENXIO; -+ goto out_read_prop_fail; - } - - ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id); -diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c -index 1a11bc0e16123..cfa0bba3940fb 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mr.c -+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c -@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) - goto err_out; - - for (i = 0; i <= buddy->max_order; ++i) { -- s = BITS_TO_LONGS(1 << (buddy->max_order - i)); -+ s = BITS_TO_LONGS(1UL << (buddy->max_order - i)); - buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO); - if (!buddy->bits[i]) - goto err_out_free; -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 30cdabf64ccc1..907ae1359a7c1 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -1336,6 +1336,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, - return error; - } - -+/* MDIO bus init function */ -+static int ravb_mdio_init(struct ravb_private *priv) -+{ -+ struct platform_device *pdev = priv->pdev; -+ struct device *dev = &pdev->dev; -+ int error; -+ -+ /* Bitbang init */ -+ priv->mdiobb.ops = &bb_ops; -+ -+ /* MII controller setting */ -+ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -+ if (!priv->mii_bus) -+ return -ENOMEM; -+ -+ /* Hook up MII support for ethtool */ -+ priv->mii_bus->name = "ravb_mii"; -+ priv->mii_bus->parent = dev; -+ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -+ pdev->name, pdev->id); -+ -+ /* Register MDIO bus */ -+ error = of_mdiobus_register(priv->mii_bus, dev->of_node); -+ if (error) -+ goto out_free_bus; -+ -+ return 0; -+ -+out_free_bus: -+ free_mdio_bitbang(priv->mii_bus); -+ return error; -+} -+ -+/* MDIO bus release function */ -+static int ravb_mdio_release(struct ravb_private *priv) -+{ -+ /* Unregister mdio bus */ -+ mdiobus_unregister(priv->mii_bus); -+ -+ /* Free bitbang info */ -+ free_mdio_bitbang(priv->mii_bus); -+ -+ return 0; -+} -+ - /* Network device open function for Ethernet AVB */ - static int ravb_open(struct net_device *ndev) - { -@@ -1344,6 +1389,13 @@ static int ravb_open(struct net_device *ndev) - struct device *dev = &pdev->dev; - int error; - -+ /* MDIO bus init */ -+ error = ravb_mdio_init(priv); -+ if (error) { -+ netdev_err(ndev, "failed to initialize MDIO\n"); -+ return error; -+ } -+ - napi_enable(&priv->napi[RAVB_BE]); - napi_enable(&priv->napi[RAVB_NC]); - -@@ -1421,6 +1473,7 @@ out_free_irq: - out_napi_off: - napi_disable(&priv->napi[RAVB_NC]); - napi_disable(&priv->napi[RAVB_BE]); -+ ravb_mdio_release(priv); - return error; - } - -@@ -1730,6 +1783,8 @@ static int ravb_close(struct net_device *ndev) - ravb_ring_free(ndev, RAVB_BE); - ravb_ring_free(ndev, RAVB_NC); - -+ ravb_mdio_release(priv); -+ - return 0; - } - -@@ -1881,51 +1936,6 @@ static const struct net_device_ops ravb_netdev_ops = { - .ndo_set_features = ravb_set_features, - }; - --/* MDIO bus init function */ --static int ravb_mdio_init(struct ravb_private *priv) --{ -- struct platform_device *pdev = priv->pdev; -- struct device *dev = &pdev->dev; -- int error; -- -- /* Bitbang init */ -- priv->mdiobb.ops = &bb_ops; -- -- /* MII controller setting */ -- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); -- if (!priv->mii_bus) -- return -ENOMEM; -- -- /* Hook up MII support for ethtool */ -- priv->mii_bus->name = "ravb_mii"; -- priv->mii_bus->parent = dev; -- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", -- pdev->name, pdev->id); -- -- /* Register MDIO bus */ -- error = of_mdiobus_register(priv->mii_bus, dev->of_node); -- if (error) -- goto out_free_bus; -- -- return 0; -- --out_free_bus: -- free_mdio_bitbang(priv->mii_bus); -- return error; --} -- --/* MDIO bus release function */ --static int ravb_mdio_release(struct ravb_private *priv) --{ -- /* Unregister mdio bus */ -- mdiobus_unregister(priv->mii_bus); -- -- /* Free bitbang info */ -- free_mdio_bitbang(priv->mii_bus); -- -- return 0; --} -- - static const struct of_device_id ravb_match_table[] = { - { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, - { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, -@@ -2166,13 +2176,6 @@ static int ravb_probe(struct platform_device *pdev) - eth_hw_addr_random(ndev); - } - -- /* MDIO bus init */ -- error = ravb_mdio_init(priv); -- if (error) { -- dev_err(&pdev->dev, "failed to initialize MDIO\n"); -- goto out_dma_free; -- } -- - netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); - netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); - -@@ -2194,8 +2197,6 @@ static int ravb_probe(struct platform_device *pdev) - out_napi_del: - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -- ravb_mdio_release(priv); --out_dma_free: - dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, - priv->desc_bat_dma); - -@@ -2227,7 +2228,6 @@ static int ravb_remove(struct platform_device *pdev) - unregister_netdev(ndev); - netif_napi_del(&priv->napi[RAVB_NC]); - netif_napi_del(&priv->napi[RAVB_BE]); -- ravb_mdio_release(priv); - pm_runtime_disable(&pdev->dev); - free_netdev(ndev); - platform_set_drvdata(pdev, NULL); -diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c -index 39df8c8feb6ce..e7b4d93e3f288 100644 ---- a/drivers/net/ethernet/ti/cpsw.c -+++ b/drivers/net/ethernet/ti/cpsw.c -@@ -2209,7 +2209,7 @@ static int cpsw_ndo_vlan_rx_kill_vid(struct net_device *ndev, - HOST_PORT_NUM, ALE_VLAN, vid); - ret |= cpsw_ale_del_mcast(cpsw->ale, priv->ndev->broadcast, - 0, ALE_VLAN, vid); -- ret |= cpsw_ale_flush_multicast(cpsw->ale, 0, vid); -+ ret |= cpsw_ale_flush_multicast(cpsw->ale, ALE_PORT_HOST, vid); - err: - pm_runtime_put(cpsw->dev); - return ret; -diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c -index d89ec99abcd63..634bdea38ecb3 100644 ---- a/drivers/net/gtp.c -+++ b/drivers/net/gtp.c -@@ -1182,6 +1182,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, - goto nlmsg_failure; - - if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || -+ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || - nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) || - nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr)) - goto nla_put_failure; -diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c -index e39f41efda3ec..7bc6e8f856fe0 100644 ---- a/drivers/net/usb/asix_common.c -+++ b/drivers/net/usb/asix_common.c -@@ -296,7 +296,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal) - - netdev_dbg(dev->net, "asix_get_phy_addr()\n"); - -- if (ret < 0) { -+ if (ret < 2) { - netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret); - goto out; - } -diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c -index ff5681da8780d..3cb017fa3a790 100644 ---- a/drivers/nvme/host/core.c -+++ b/drivers/nvme/host/core.c -@@ -4012,7 +4012,7 @@ static void nvme_free_ctrl(struct device *dev) - container_of(dev, struct nvme_ctrl, ctrl_device); - struct nvme_subsystem *subsys = ctrl->subsys; - -- if (subsys && ctrl->instance != subsys->instance) -+ if (!subsys || ctrl->instance != subsys->instance) - ida_simple_remove(&nvme_instance_ida, ctrl->instance); - - kfree(ctrl->effects); -diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c -index 57a4062cbb59e..7d7176369edf7 100644 ---- a/drivers/nvme/target/core.c -+++ b/drivers/nvme/target/core.c -@@ -369,6 +369,9 @@ static void nvmet_keep_alive_timer(struct work_struct *work) - - static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl) - { -+ if (unlikely(ctrl->kato == 0)) -+ return; -+ - pr_debug("ctrl %d start keep-alive timer for %d secs\n", - ctrl->cntlid, ctrl->kato); - -@@ -378,6 +381,9 @@ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl) - - static void nvmet_stop_keep_alive_timer(struct nvmet_ctrl *ctrl) - { -+ if (unlikely(ctrl->kato == 0)) -+ return; -+ - pr_debug("ctrl %d stop keep-alive\n", ctrl->cntlid); - - cancel_delayed_work_sync(&ctrl->ka_work); -diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c -index ce8d819f86ccc..fc35f7ae67b0a 100644 ---- a/drivers/nvme/target/fc.c -+++ b/drivers/nvme/target/fc.c -@@ -1994,9 +1994,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod) - return; - if (fcpreq->fcp_error || - fcpreq->transferred_length != fcpreq->transfer_length) { -- spin_lock(&fod->flock); -+ spin_lock_irqsave(&fod->flock, flags); - fod->abort = true; -- spin_unlock(&fod->flock); -+ spin_unlock_irqrestore(&fod->flock, flags); - - nvmet_req_complete(&fod->req, NVME_SC_INTERNAL); - return; -diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c -index 3439f6ad63380..e80e82a276e93 100644 ---- a/drivers/staging/media/sunxi/cedrus/cedrus.c -+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c -@@ -159,6 +159,7 @@ static int cedrus_request_validate(struct media_request *req) - struct v4l2_ctrl *ctrl_test; - unsigned int count; - unsigned int i; -+ int ret = 0; - - list_for_each_entry(obj, &req->objects, list) { - struct vb2_buffer *vb; -@@ -203,12 +204,16 @@ static int cedrus_request_validate(struct media_request *req) - if (!ctrl_test) { - v4l2_info(&ctx->dev->v4l2_dev, - "Missing required codec control\n"); -- return -ENOENT; -+ ret = -ENOENT; -+ break; - } - } - - v4l2_ctrl_request_hdl_put(hdl); - -+ if (ret) -+ return ret; -+ - return vb2_request_validate(req); - } - -diff --git a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -index bf7bae42c141c..6dc879fea9c8a 100644 ---- a/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -+++ b/drivers/thermal/qcom/qcom-spmi-temp-alarm.c -@@ -1,6 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - /* -- * Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved. -+ * Copyright (c) 2011-2015, 2017, 2020, The Linux Foundation. All rights reserved. - */ - - #include -@@ -191,7 +191,7 @@ static int qpnp_tm_get_temp(void *data, int *temp) - chip->temp = mili_celsius; - } - -- *temp = chip->temp < 0 ? 0 : chip->temp; -+ *temp = chip->temp; - - return 0; - } -diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -index 63b02bfb2adf6..fdb8a495ab69a 100644 ---- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -+++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c -@@ -37,20 +37,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = { - - /* - * Temperature values in milli degree celsius -- * ADC code values from 530 to 923 -+ * ADC code values from 13 to 107, see TRM -+ * "18.4.10.2.3 ADC Codes Versus Temperature". - */ - static const int - omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = { -- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000, -- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000, -- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000, -- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000, -- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000, -- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000, -- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000, -- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000, -- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000, -- 117000, 118000, 120000, 122000, 123000, -+ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -+ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000, -+ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000, -+ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500, -+ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000, -+ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000, -+ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000, -+ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000, -+ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000, -+ 115000, 117000, 118500, 120000, 122000, 123500, 125000, - }; - - /* OMAP4430 data */ -diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -index a453ff8eb313e..9a3955c3853ba 100644 ---- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -+++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h -@@ -53,9 +53,13 @@ - * and thresholds for OMAP4430. - */ - --/* ADC conversion table limits */ --#define OMAP4430_ADC_START_VALUE 0 --#define OMAP4430_ADC_END_VALUE 127 -+/* -+ * ADC conversion table limits. Ignore values outside the TRM listed -+ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter -+ * "18.4.10.2.3 ADC Codes Versus Temperature". -+ */ -+#define OMAP4430_ADC_START_VALUE 13 -+#define OMAP4430_ADC_END_VALUE 107 - /* bandgap clock limits (no control on 4430) */ - #define OMAP4430_MAX_FREQ 32768 - #define OMAP4430_MIN_FREQ 32768 -diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c -index f98a79172ad23..0b184256034fb 100644 ---- a/drivers/tty/serial/qcom_geni_serial.c -+++ b/drivers/tty/serial/qcom_geni_serial.c -@@ -1063,7 +1063,7 @@ static unsigned int qcom_geni_serial_tx_empty(struct uart_port *uport) - } - - #ifdef CONFIG_SERIAL_QCOM_GENI_CONSOLE --static int __init qcom_geni_console_setup(struct console *co, char *options) -+static int qcom_geni_console_setup(struct console *co, char *options) - { - struct uart_port *uport; - struct qcom_geni_serial_port *port; -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 02206162eaa9e..0d16f9806655f 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -27,6 +27,7 @@ - #include - #include - #include -+#include - - #include "vfio_pci_private.h" - -@@ -177,6 +178,7 @@ no_mmap: - - static void vfio_pci_try_bus_reset(struct vfio_pci_device *vdev); - static void vfio_pci_disable(struct vfio_pci_device *vdev); -+static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data); - - /* - * INTx masking requires the ability to disable INTx signaling via PCI_COMMAND -@@ -688,6 +690,12 @@ int vfio_pci_register_dev_region(struct vfio_pci_device *vdev, - return 0; - } - -+struct vfio_devices { -+ struct vfio_device **devices; -+ int cur_index; -+ int max_index; -+}; -+ - static long vfio_pci_ioctl(void *device_data, - unsigned int cmd, unsigned long arg) - { -@@ -761,7 +769,7 @@ static long vfio_pci_ioctl(void *device_data, - { - void __iomem *io; - size_t size; -- u16 orig_cmd; -+ u16 cmd; - - info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); - info.flags = 0; -@@ -781,10 +789,7 @@ static long vfio_pci_ioctl(void *device_data, - * Is it really there? Enable memory decode for - * implicit access in pci_map_rom(). - */ -- pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd); -- pci_write_config_word(pdev, PCI_COMMAND, -- orig_cmd | PCI_COMMAND_MEMORY); -- -+ cmd = vfio_pci_memory_lock_and_enable(vdev); - io = pci_map_rom(pdev, &size); - if (io) { - info.flags = VFIO_REGION_INFO_FLAG_READ; -@@ -792,8 +797,8 @@ static long vfio_pci_ioctl(void *device_data, - } else { - info.size = 0; - } -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); - -- pci_write_config_word(pdev, PCI_COMMAND, orig_cmd); - break; - } - case VFIO_PCI_VGA_REGION_INDEX: -@@ -936,8 +941,16 @@ static long vfio_pci_ioctl(void *device_data, - return ret; - - } else if (cmd == VFIO_DEVICE_RESET) { -- return vdev->reset_works ? -- pci_try_reset_function(vdev->pdev) : -EINVAL; -+ int ret; -+ -+ if (!vdev->reset_works) -+ return -EINVAL; -+ -+ vfio_pci_zap_and_down_write_memory_lock(vdev); -+ ret = pci_try_reset_function(vdev->pdev); -+ up_write(&vdev->memory_lock); -+ -+ return ret; - - } else if (cmd == VFIO_DEVICE_GET_PCI_HOT_RESET_INFO) { - struct vfio_pci_hot_reset_info hdr; -@@ -1017,8 +1030,9 @@ reset_info_exit: - int32_t *group_fds; - struct vfio_pci_group_entry *groups; - struct vfio_pci_group_info info; -+ struct vfio_devices devs = { .cur_index = 0 }; - bool slot = false; -- int i, count = 0, ret = 0; -+ int i, group_idx, mem_idx = 0, count = 0, ret = 0; - - minsz = offsetofend(struct vfio_pci_hot_reset, count); - -@@ -1070,9 +1084,9 @@ reset_info_exit: - * user interface and store the group and iommu ID. This - * ensures the group is held across the reset. - */ -- for (i = 0; i < hdr.count; i++) { -+ for (group_idx = 0; group_idx < hdr.count; group_idx++) { - struct vfio_group *group; -- struct fd f = fdget(group_fds[i]); -+ struct fd f = fdget(group_fds[group_idx]); - if (!f.file) { - ret = -EBADF; - break; -@@ -1085,8 +1099,9 @@ reset_info_exit: - break; - } - -- groups[i].group = group; -- groups[i].id = vfio_external_user_iommu_id(group); -+ groups[group_idx].group = group; -+ groups[group_idx].id = -+ vfio_external_user_iommu_id(group); - } - - kfree(group_fds); -@@ -1105,13 +1120,63 @@ reset_info_exit: - ret = vfio_pci_for_each_slot_or_bus(vdev->pdev, - vfio_pci_validate_devs, - &info, slot); -- if (!ret) -- /* User has access, do the reset */ -- ret = pci_reset_bus(vdev->pdev); -+ if (ret) -+ goto hot_reset_release; -+ -+ devs.max_index = count; -+ devs.devices = kcalloc(count, sizeof(struct vfio_device *), -+ GFP_KERNEL); -+ if (!devs.devices) { -+ ret = -ENOMEM; -+ goto hot_reset_release; -+ } -+ -+ /* -+ * We need to get memory_lock for each device, but devices -+ * can share mmap_sem, therefore we need to zap and hold -+ * the vma_lock for each device, and only then get each -+ * memory_lock. -+ */ -+ ret = vfio_pci_for_each_slot_or_bus(vdev->pdev, -+ vfio_pci_try_zap_and_vma_lock_cb, -+ &devs, slot); -+ if (ret) -+ goto hot_reset_release; -+ -+ for (; mem_idx < devs.cur_index; mem_idx++) { -+ struct vfio_pci_device *tmp; -+ -+ tmp = vfio_device_data(devs.devices[mem_idx]); -+ -+ ret = down_write_trylock(&tmp->memory_lock); -+ if (!ret) { -+ ret = -EBUSY; -+ goto hot_reset_release; -+ } -+ mutex_unlock(&tmp->vma_lock); -+ } -+ -+ /* User has access, do the reset */ -+ ret = pci_reset_bus(vdev->pdev); - - hot_reset_release: -- for (i--; i >= 0; i--) -- vfio_group_put_external_user(groups[i].group); -+ for (i = 0; i < devs.cur_index; i++) { -+ struct vfio_device *device; -+ struct vfio_pci_device *tmp; -+ -+ device = devs.devices[i]; -+ tmp = vfio_device_data(device); -+ -+ if (i < mem_idx) -+ up_write(&tmp->memory_lock); -+ else -+ mutex_unlock(&tmp->vma_lock); -+ vfio_device_put(device); -+ } -+ kfree(devs.devices); -+ -+ for (group_idx--; group_idx >= 0; group_idx--) -+ vfio_group_put_external_user(groups[group_idx].group); - - kfree(groups); - return ret; -@@ -1192,6 +1257,202 @@ static ssize_t vfio_pci_write(void *device_data, const char __user *buf, - return vfio_pci_rw(device_data, (char __user *)buf, count, ppos, true); - } - -+/* Return 1 on zap and vma_lock acquired, 0 on contention (only with @try) */ -+static int vfio_pci_zap_and_vma_lock(struct vfio_pci_device *vdev, bool try) -+{ -+ struct vfio_pci_mmap_vma *mmap_vma, *tmp; -+ -+ /* -+ * Lock ordering: -+ * vma_lock is nested under mmap_sem for vm_ops callback paths. -+ * The memory_lock semaphore is used by both code paths calling -+ * into this function to zap vmas and the vm_ops.fault callback -+ * to protect the memory enable state of the device. -+ * -+ * When zapping vmas we need to maintain the mmap_sem => vma_lock -+ * ordering, which requires using vma_lock to walk vma_list to -+ * acquire an mm, then dropping vma_lock to get the mmap_sem and -+ * reacquiring vma_lock. This logic is derived from similar -+ * requirements in uverbs_user_mmap_disassociate(). -+ * -+ * mmap_sem must always be the top-level lock when it is taken. -+ * Therefore we can only hold the memory_lock write lock when -+ * vma_list is empty, as we'd need to take mmap_sem to clear -+ * entries. vma_list can only be guaranteed empty when holding -+ * vma_lock, thus memory_lock is nested under vma_lock. -+ * -+ * This enables the vm_ops.fault callback to acquire vma_lock, -+ * followed by memory_lock read lock, while already holding -+ * mmap_sem without risk of deadlock. -+ */ -+ while (1) { -+ struct mm_struct *mm = NULL; -+ -+ if (try) { -+ if (!mutex_trylock(&vdev->vma_lock)) -+ return 0; -+ } else { -+ mutex_lock(&vdev->vma_lock); -+ } -+ while (!list_empty(&vdev->vma_list)) { -+ mmap_vma = list_first_entry(&vdev->vma_list, -+ struct vfio_pci_mmap_vma, -+ vma_next); -+ mm = mmap_vma->vma->vm_mm; -+ if (mmget_not_zero(mm)) -+ break; -+ -+ list_del(&mmap_vma->vma_next); -+ kfree(mmap_vma); -+ mm = NULL; -+ } -+ if (!mm) -+ return 1; -+ mutex_unlock(&vdev->vma_lock); -+ -+ if (try) { -+ if (!down_read_trylock(&mm->mmap_sem)) { -+ mmput(mm); -+ return 0; -+ } -+ } else { -+ down_read(&mm->mmap_sem); -+ } -+ if (mmget_still_valid(mm)) { -+ if (try) { -+ if (!mutex_trylock(&vdev->vma_lock)) { -+ up_read(&mm->mmap_sem); -+ mmput(mm); -+ return 0; -+ } -+ } else { -+ mutex_lock(&vdev->vma_lock); -+ } -+ list_for_each_entry_safe(mmap_vma, tmp, -+ &vdev->vma_list, vma_next) { -+ struct vm_area_struct *vma = mmap_vma->vma; -+ -+ if (vma->vm_mm != mm) -+ continue; -+ -+ list_del(&mmap_vma->vma_next); -+ kfree(mmap_vma); -+ -+ zap_vma_ptes(vma, vma->vm_start, -+ vma->vm_end - vma->vm_start); -+ } -+ mutex_unlock(&vdev->vma_lock); -+ } -+ up_read(&mm->mmap_sem); -+ mmput(mm); -+ } -+} -+ -+void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device *vdev) -+{ -+ vfio_pci_zap_and_vma_lock(vdev, false); -+ down_write(&vdev->memory_lock); -+ mutex_unlock(&vdev->vma_lock); -+} -+ -+u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev) -+{ -+ u16 cmd; -+ -+ down_write(&vdev->memory_lock); -+ pci_read_config_word(vdev->pdev, PCI_COMMAND, &cmd); -+ if (!(cmd & PCI_COMMAND_MEMORY)) -+ pci_write_config_word(vdev->pdev, PCI_COMMAND, -+ cmd | PCI_COMMAND_MEMORY); -+ -+ return cmd; -+} -+ -+void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev, u16 cmd) -+{ -+ pci_write_config_word(vdev->pdev, PCI_COMMAND, cmd); -+ up_write(&vdev->memory_lock); -+} -+ -+/* Caller holds vma_lock */ -+static int __vfio_pci_add_vma(struct vfio_pci_device *vdev, -+ struct vm_area_struct *vma) -+{ -+ struct vfio_pci_mmap_vma *mmap_vma; -+ -+ mmap_vma = kmalloc(sizeof(*mmap_vma), GFP_KERNEL); -+ if (!mmap_vma) -+ return -ENOMEM; -+ -+ mmap_vma->vma = vma; -+ list_add(&mmap_vma->vma_next, &vdev->vma_list); -+ -+ return 0; -+} -+ -+/* -+ * Zap mmaps on open so that we can fault them in on access and therefore -+ * our vma_list only tracks mappings accessed since last zap. -+ */ -+static void vfio_pci_mmap_open(struct vm_area_struct *vma) -+{ -+ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); -+} -+ -+static void vfio_pci_mmap_close(struct vm_area_struct *vma) -+{ -+ struct vfio_pci_device *vdev = vma->vm_private_data; -+ struct vfio_pci_mmap_vma *mmap_vma; -+ -+ mutex_lock(&vdev->vma_lock); -+ list_for_each_entry(mmap_vma, &vdev->vma_list, vma_next) { -+ if (mmap_vma->vma == vma) { -+ list_del(&mmap_vma->vma_next); -+ kfree(mmap_vma); -+ break; -+ } -+ } -+ mutex_unlock(&vdev->vma_lock); -+} -+ -+static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf) -+{ -+ struct vm_area_struct *vma = vmf->vma; -+ struct vfio_pci_device *vdev = vma->vm_private_data; -+ vm_fault_t ret = VM_FAULT_NOPAGE; -+ -+ mutex_lock(&vdev->vma_lock); -+ down_read(&vdev->memory_lock); -+ -+ if (!__vfio_pci_memory_enabled(vdev)) { -+ ret = VM_FAULT_SIGBUS; -+ mutex_unlock(&vdev->vma_lock); -+ goto up_out; -+ } -+ -+ if (__vfio_pci_add_vma(vdev, vma)) { -+ ret = VM_FAULT_OOM; -+ mutex_unlock(&vdev->vma_lock); -+ goto up_out; -+ } -+ -+ mutex_unlock(&vdev->vma_lock); -+ -+ if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, -+ vma->vm_end - vma->vm_start, vma->vm_page_prot)) -+ ret = VM_FAULT_SIGBUS; -+ -+up_out: -+ up_read(&vdev->memory_lock); -+ return ret; -+} -+ -+static const struct vm_operations_struct vfio_pci_mmap_ops = { -+ .open = vfio_pci_mmap_open, -+ .close = vfio_pci_mmap_close, -+ .fault = vfio_pci_mmap_fault, -+}; -+ - static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) - { - struct vfio_pci_device *vdev = device_data; -@@ -1250,8 +1511,14 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) - vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); - vma->vm_pgoff = (pci_resource_start(pdev, index) >> PAGE_SHIFT) + pgoff; - -- return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, -- req_len, vma->vm_page_prot); -+ /* -+ * See remap_pfn_range(), called from vfio_pci_fault() but we can't -+ * change vm_flags within the fault handler. Set them now. -+ */ -+ vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; -+ vma->vm_ops = &vfio_pci_mmap_ops; -+ -+ return 0; - } - - static void vfio_pci_request(void *device_data, unsigned int count) -@@ -1327,6 +1594,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - spin_lock_init(&vdev->irqlock); - mutex_init(&vdev->ioeventfds_lock); - INIT_LIST_HEAD(&vdev->ioeventfds_list); -+ mutex_init(&vdev->vma_lock); -+ INIT_LIST_HEAD(&vdev->vma_list); -+ init_rwsem(&vdev->memory_lock); - - ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev); - if (ret) { -@@ -1516,12 +1786,6 @@ static void vfio_pci_reflck_put(struct vfio_pci_reflck *reflck) - kref_put_mutex(&reflck->kref, vfio_pci_reflck_release, &reflck_lock); - } - --struct vfio_devices { -- struct vfio_device **devices; -- int cur_index; -- int max_index; --}; -- - static int vfio_pci_get_unused_devs(struct pci_dev *pdev, void *data) - { - struct vfio_devices *devs = data; -@@ -1552,6 +1816,39 @@ static int vfio_pci_get_unused_devs(struct pci_dev *pdev, void *data) - return 0; - } - -+static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data) -+{ -+ struct vfio_devices *devs = data; -+ struct vfio_device *device; -+ struct vfio_pci_device *vdev; -+ -+ if (devs->cur_index == devs->max_index) -+ return -ENOSPC; -+ -+ device = vfio_device_get_from_dev(&pdev->dev); -+ if (!device) -+ return -EINVAL; -+ -+ if (pci_dev_driver(pdev) != &vfio_pci_driver) { -+ vfio_device_put(device); -+ return -EBUSY; -+ } -+ -+ vdev = vfio_device_data(device); -+ -+ /* -+ * Locking multiple devices is prone to deadlock, runaway and -+ * unwind if we hit contention. -+ */ -+ if (!vfio_pci_zap_and_vma_lock(vdev, true)) { -+ vfio_device_put(device); -+ return -EBUSY; -+ } -+ -+ devs->devices[devs->cur_index++] = device; -+ return 0; -+} -+ - /* - * If a bus or slot reset is available for the provided device and: - * - All of the devices affected by that bus or slot reset are unused -diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c -index d6359c37c9e55..927b608461c82 100644 ---- a/drivers/vfio/pci/vfio_pci_config.c -+++ b/drivers/vfio/pci/vfio_pci_config.c -@@ -395,6 +395,20 @@ static inline void p_setd(struct perm_bits *p, int off, u32 virt, u32 write) - *(__le32 *)(&p->write[off]) = cpu_to_le32(write); - } - -+/* Caller should hold memory_lock semaphore */ -+bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev) -+{ -+ struct pci_dev *pdev = vdev->pdev; -+ u16 cmd = le16_to_cpu(*(__le16 *)&vdev->vconfig[PCI_COMMAND]); -+ -+ /* -+ * SR-IOV VF memory enable is handled by the MSE bit in the -+ * PF SR-IOV capability, there's therefore no need to trigger -+ * faults based on the virtual value. -+ */ -+ return pdev->is_virtfn || (cmd & PCI_COMMAND_MEMORY); -+} -+ - /* - * Restore the *real* BARs after we detect a FLR or backdoor reset. - * (backdoor = some device specific technique that we didn't catch) -@@ -554,13 +568,18 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, - - new_cmd = le32_to_cpu(val); - -+ phys_io = !!(phys_cmd & PCI_COMMAND_IO); -+ virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO); -+ new_io = !!(new_cmd & PCI_COMMAND_IO); -+ - phys_mem = !!(phys_cmd & PCI_COMMAND_MEMORY); - virt_mem = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_MEMORY); - new_mem = !!(new_cmd & PCI_COMMAND_MEMORY); - -- phys_io = !!(phys_cmd & PCI_COMMAND_IO); -- virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO); -- new_io = !!(new_cmd & PCI_COMMAND_IO); -+ if (!new_mem) -+ vfio_pci_zap_and_down_write_memory_lock(vdev); -+ else -+ down_write(&vdev->memory_lock); - - /* - * If the user is writing mem/io enable (new_mem/io) and we -@@ -577,8 +596,11 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, - } - - count = vfio_default_config_write(vdev, pos, count, perm, offset, val); -- if (count < 0) -+ if (count < 0) { -+ if (offset == PCI_COMMAND) -+ up_write(&vdev->memory_lock); - return count; -+ } - - /* - * Save current memory/io enable bits in vconfig to allow for -@@ -589,6 +611,8 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, - - *virt_cmd &= cpu_to_le16(~mask); - *virt_cmd |= cpu_to_le16(new_cmd & mask); -+ -+ up_write(&vdev->memory_lock); - } - - /* Emulate INTx disable */ -@@ -826,8 +850,11 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos, - pos - offset + PCI_EXP_DEVCAP, - &cap); - -- if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) -+ if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) { -+ vfio_pci_zap_and_down_write_memory_lock(vdev); - pci_try_reset_function(vdev->pdev); -+ up_write(&vdev->memory_lock); -+ } - } - - /* -@@ -905,8 +932,11 @@ static int vfio_af_config_write(struct vfio_pci_device *vdev, int pos, - pos - offset + PCI_AF_CAP, - &cap); - -- if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) -+ if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) { -+ vfio_pci_zap_and_down_write_memory_lock(vdev); - pci_try_reset_function(vdev->pdev); -+ up_write(&vdev->memory_lock); -+ } - } - - return count; -@@ -1702,6 +1732,15 @@ int vfio_config_init(struct vfio_pci_device *vdev) - vconfig[PCI_INTERRUPT_PIN]); - - vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */ -+ -+ /* -+ * VFs do no implement the memory enable bit of the COMMAND -+ * register therefore we'll not have it set in our initial -+ * copy of config space after pci_enable_device(). For -+ * consistency with PFs, set the virtual enable bit here. -+ */ -+ *(__le16 *)&vconfig[PCI_COMMAND] |= -+ cpu_to_le16(PCI_COMMAND_MEMORY); - } - - if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx) -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index 2056f3f85f59b..1d9fb25929459 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -249,6 +249,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) - struct pci_dev *pdev = vdev->pdev; - unsigned int flag = msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI; - int ret; -+ u16 cmd; - - if (!is_irq_none(vdev)) - return -EINVAL; -@@ -258,13 +259,16 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) - return -ENOMEM; - - /* return the number of supported vectors if we can't get all: */ -+ cmd = vfio_pci_memory_lock_and_enable(vdev); - ret = pci_alloc_irq_vectors(pdev, 1, nvec, flag); - if (ret < nvec) { - if (ret > 0) - pci_free_irq_vectors(pdev); -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); - kfree(vdev->ctx); - return ret; - } -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); - - vdev->num_ctx = nvec; - vdev->irq_type = msix ? VFIO_PCI_MSIX_IRQ_INDEX : -@@ -287,6 +291,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - struct pci_dev *pdev = vdev->pdev; - struct eventfd_ctx *trigger; - int irq, ret; -+ u16 cmd; - - if (vector < 0 || vector >= vdev->num_ctx) - return -EINVAL; -@@ -295,7 +300,11 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - - if (vdev->ctx[vector].trigger) { - irq_bypass_unregister_producer(&vdev->ctx[vector].producer); -+ -+ cmd = vfio_pci_memory_lock_and_enable(vdev); - free_irq(irq, vdev->ctx[vector].trigger); -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); -+ - kfree(vdev->ctx[vector].name); - eventfd_ctx_put(vdev->ctx[vector].trigger); - vdev->ctx[vector].trigger = NULL; -@@ -323,6 +332,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - * such a reset it would be unsuccessful. To avoid this, restore the - * cached value of the message prior to enabling. - */ -+ cmd = vfio_pci_memory_lock_and_enable(vdev); - if (msix) { - struct msi_msg msg; - -@@ -332,6 +342,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, - - ret = request_irq(irq, vfio_msihandler, 0, - vdev->ctx[vector].name, trigger); -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); - if (ret) { - kfree(vdev->ctx[vector].name); - eventfd_ctx_put(trigger); -@@ -376,6 +387,7 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix) - { - struct pci_dev *pdev = vdev->pdev; - int i; -+ u16 cmd; - - for (i = 0; i < vdev->num_ctx; i++) { - vfio_virqfd_disable(&vdev->ctx[i].unmask); -@@ -384,7 +396,9 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix) - - vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix); - -+ cmd = vfio_pci_memory_lock_and_enable(vdev); - pci_free_irq_vectors(pdev); -+ vfio_pci_memory_unlock_and_restore(vdev, cmd); - - /* - * Both disable paths above use pci_intx_for_msi() to clear DisINTx -diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h -index ee6ee91718a4d..987b4d311fde9 100644 ---- a/drivers/vfio/pci/vfio_pci_private.h -+++ b/drivers/vfio/pci/vfio_pci_private.h -@@ -84,6 +84,11 @@ struct vfio_pci_reflck { - struct mutex lock; - }; - -+struct vfio_pci_mmap_vma { -+ struct vm_area_struct *vma; -+ struct list_head vma_next; -+}; -+ - struct vfio_pci_device { - struct pci_dev *pdev; - void __iomem *barmap[PCI_STD_RESOURCE_END + 1]; -@@ -122,6 +127,9 @@ struct vfio_pci_device { - struct list_head dummy_resources_list; - struct mutex ioeventfds_lock; - struct list_head ioeventfds_list; -+ struct mutex vma_lock; -+ struct list_head vma_list; -+ struct rw_semaphore memory_lock; - }; - - #define is_intx(vdev) (vdev->irq_type == VFIO_PCI_INTX_IRQ_INDEX) -@@ -164,6 +172,13 @@ extern int vfio_pci_register_dev_region(struct vfio_pci_device *vdev, - extern int vfio_pci_set_power_state(struct vfio_pci_device *vdev, - pci_power_t state); - -+extern bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev); -+extern void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device -+ *vdev); -+extern u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev); -+extern void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev, -+ u16 cmd); -+ - #ifdef CONFIG_VFIO_PCI_IGD - extern int vfio_pci_igd_init(struct vfio_pci_device *vdev); - #else -diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c -index 0120d8324a402..83f81d24df78e 100644 ---- a/drivers/vfio/pci/vfio_pci_rdwr.c -+++ b/drivers/vfio/pci/vfio_pci_rdwr.c -@@ -162,6 +162,7 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, - size_t x_start = 0, x_end = 0; - resource_size_t end; - void __iomem *io; -+ struct resource *res = &vdev->pdev->resource[bar]; - ssize_t done; - - if (pci_resource_start(pdev, bar)) -@@ -177,6 +178,14 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, - - count = min(count, (size_t)(end - pos)); - -+ if (res->flags & IORESOURCE_MEM) { -+ down_read(&vdev->memory_lock); -+ if (!__vfio_pci_memory_enabled(vdev)) { -+ up_read(&vdev->memory_lock); -+ return -EIO; -+ } -+ } -+ - if (bar == PCI_ROM_RESOURCE) { - /* - * The ROM can fill less space than the BAR, so we start the -@@ -184,13 +193,17 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, - * filling large ROM BARs much faster. - */ - io = pci_map_rom(pdev, &x_start); -- if (!io) -- return -ENOMEM; -+ if (!io) { -+ done = -ENOMEM; -+ goto out; -+ } - x_end = end; - } else { - int ret = vfio_pci_setup_barmap(vdev, bar); -- if (ret) -- return ret; -+ if (ret) { -+ done = ret; -+ goto out; -+ } - - io = vdev->barmap[bar]; - } -@@ -207,6 +220,9 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, - - if (bar == PCI_ROM_RESOURCE) - pci_unmap_rom(pdev, io); -+out: -+ if (res->flags & IORESOURCE_MEM) -+ up_read(&vdev->memory_lock); - - return done; - } -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index ca8c10aa4a4bc..c6220f57fdf3e 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -335,6 +335,32 @@ static int put_pfn(unsigned long pfn, int prot) - return 0; - } - -+static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm, -+ unsigned long vaddr, unsigned long *pfn, -+ bool write_fault) -+{ -+ int ret; -+ -+ ret = follow_pfn(vma, vaddr, pfn); -+ if (ret) { -+ bool unlocked = false; -+ -+ ret = fixup_user_fault(NULL, mm, vaddr, -+ FAULT_FLAG_REMOTE | -+ (write_fault ? FAULT_FLAG_WRITE : 0), -+ &unlocked); -+ if (unlocked) -+ return -EAGAIN; -+ -+ if (ret) -+ return ret; -+ -+ ret = follow_pfn(vma, vaddr, pfn); -+ } -+ -+ return ret; -+} -+ - static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, - int prot, unsigned long *pfn) - { -@@ -377,12 +403,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, - - vaddr = untagged_addr(vaddr); - -+retry: - vma = find_vma_intersection(mm, vaddr, vaddr + 1); - - if (vma && vma->vm_flags & VM_PFNMAP) { -- if (!follow_pfn(vma, vaddr, pfn) && -- is_invalid_reserved_pfn(*pfn)) -- ret = 0; -+ ret = follow_fault_pfn(vma, mm, vaddr, pfn, prot & IOMMU_WRITE); -+ if (ret == -EAGAIN) -+ goto retry; -+ -+ if (!ret && !is_invalid_reserved_pfn(*pfn)) -+ ret = -EFAULT; - } - - up_read(&mm->mmap_sem); -diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c -index a38292ef79f6d..f38bdaea0ef11 100644 ---- a/drivers/xen/xenbus/xenbus_client.c -+++ b/drivers/xen/xenbus/xenbus_client.c -@@ -363,8 +363,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr, - int i, j; - - for (i = 0; i < nr_pages; i++) { -- err = gnttab_grant_foreign_access(dev->otherend_id, -- virt_to_gfn(vaddr), 0); -+ unsigned long gfn; -+ -+ if (is_vmalloc_addr(vaddr)) -+ gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr)); -+ else -+ gfn = virt_to_gfn(vaddr); -+ -+ err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0); - if (err < 0) { - xenbus_dev_fatal(dev, err, - "granting access to ring page"); -diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c -index f708c45d5f664..29f11e10a7c7d 100644 ---- a/fs/affs/amigaffs.c -+++ b/fs/affs/amigaffs.c -@@ -420,24 +420,51 @@ affs_mode_to_prot(struct inode *inode) - u32 prot = AFFS_I(inode)->i_protect; - umode_t mode = inode->i_mode; - -+ /* -+ * First, clear all RWED bits for owner, group, other. -+ * Then, recalculate them afresh. -+ * -+ * We'll always clear the delete-inhibit bit for the owner, as that is -+ * the classic single-user mode AmigaOS protection bit and we need to -+ * stay compatible with all scenarios. -+ * -+ * Since multi-user AmigaOS is an extension, we'll only set the -+ * delete-allow bit if any of the other bits in the same user class -+ * (group/other) are used. -+ */ -+ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD -+ | FIBF_NOWRITE | FIBF_NODELETE -+ | FIBF_GRP_EXECUTE | FIBF_GRP_READ -+ | FIBF_GRP_WRITE | FIBF_GRP_DELETE -+ | FIBF_OTR_EXECUTE | FIBF_OTR_READ -+ | FIBF_OTR_WRITE | FIBF_OTR_DELETE); -+ -+ /* Classic single-user AmigaOS flags. These are inverted. */ - if (!(mode & 0100)) - prot |= FIBF_NOEXECUTE; - if (!(mode & 0400)) - prot |= FIBF_NOREAD; - if (!(mode & 0200)) - prot |= FIBF_NOWRITE; -+ -+ /* Multi-user extended flags. Not inverted. */ - if (mode & 0010) - prot |= FIBF_GRP_EXECUTE; - if (mode & 0040) - prot |= FIBF_GRP_READ; - if (mode & 0020) - prot |= FIBF_GRP_WRITE; -+ if (mode & 0070) -+ prot |= FIBF_GRP_DELETE; -+ - if (mode & 0001) - prot |= FIBF_OTR_EXECUTE; - if (mode & 0004) - prot |= FIBF_OTR_READ; - if (mode & 0002) - prot |= FIBF_OTR_WRITE; -+ if (mode & 0007) -+ prot |= FIBF_OTR_DELETE; - - AFFS_I(inode)->i_protect = prot; - } -diff --git a/fs/affs/file.c b/fs/affs/file.c -index a85817f54483f..ba084b0b214b9 100644 ---- a/fs/affs/file.c -+++ b/fs/affs/file.c -@@ -428,6 +428,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping, - return ret; - } - -+static int affs_write_end(struct file *file, struct address_space *mapping, -+ loff_t pos, unsigned int len, unsigned int copied, -+ struct page *page, void *fsdata) -+{ -+ struct inode *inode = mapping->host; -+ int ret; -+ -+ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata); -+ -+ /* Clear Archived bit on file writes, as AmigaOS would do */ -+ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { -+ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; -+ mark_inode_dirty(inode); -+ } -+ -+ return ret; -+} -+ - static sector_t _affs_bmap(struct address_space *mapping, sector_t block) - { - return generic_block_bmap(mapping,block,affs_get_block); -@@ -437,7 +455,7 @@ const struct address_space_operations affs_aops = { - .readpage = affs_readpage, - .writepage = affs_writepage, - .write_begin = affs_write_begin, -- .write_end = generic_write_end, -+ .write_end = affs_write_end, - .direct_IO = affs_direct_IO, - .bmap = _affs_bmap - }; -@@ -794,6 +812,12 @@ done: - if (tmp > inode->i_size) - inode->i_size = AFFS_I(inode)->mmu_private = tmp; - -+ /* Clear Archived bit on file writes, as AmigaOS would do */ -+ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { -+ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; -+ mark_inode_dirty(inode); -+ } -+ - err_first_bh: - unlock_page(page); - put_page(page); -diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c -index 02e976ca5732f..51ee3dd79700f 100644 ---- a/fs/afs/fs_probe.c -+++ b/fs/afs/fs_probe.c -@@ -92,8 +92,8 @@ responded: - } - } - -- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall); -- if (rtt_us < server->probe.rtt) { -+ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && -+ rtt_us < server->probe.rtt) { - server->probe.rtt = rtt_us; - alist->preferred = index; - have_result = true; -diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c -index e3aa013c21779..081b7e5b13f58 100644 ---- a/fs/afs/vl_probe.c -+++ b/fs/afs/vl_probe.c -@@ -92,8 +92,8 @@ responded: - } - } - -- rtt_us = rxrpc_kernel_get_srtt(call->net->socket, call->rxcall); -- if (rtt_us < server->probe.rtt) { -+ if (rxrpc_kernel_get_srtt(call->net->socket, call->rxcall, &rtt_us) && -+ rtt_us < server->probe.rtt) { - server->probe.rtt = rtt_us; - alist->preferred = index; - have_result = true; -diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c -index a989105d39c86..c05127f506373 100644 ---- a/fs/btrfs/ctree.c -+++ b/fs/btrfs/ctree.c -@@ -1339,6 +1339,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path, - btrfs_tree_read_unlock_blocking(eb); - free_extent_buffer(eb); - -+ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin), -+ eb_rewin, btrfs_header_level(eb_rewin)); - btrfs_tree_read_lock(eb_rewin); - __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm); - WARN_ON(btrfs_header_nritems(eb_rewin) > -@@ -1412,7 +1414,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - - if (!eb) - return NULL; -- btrfs_tree_read_lock(eb); - if (old_root) { - btrfs_set_header_bytenr(eb, eb->start); - btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV); -@@ -1420,6 +1421,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq) - btrfs_set_header_level(eb, old_root->level); - btrfs_set_header_generation(eb, old_generation); - } -+ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb, -+ btrfs_header_level(eb)); -+ btrfs_tree_read_lock(eb); - if (tm) - __tree_mod_log_rewind(fs_info, eb, time_seq, tm); - else -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index ef05cbacef73f..541497036cc24 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4446,7 +4446,7 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root, - return ERR_PTR(-EUCLEAN); - } - -- btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level); -+ btrfs_set_buffer_lockdep_class(owner, buf, level); - btrfs_tree_lock(buf); - btrfs_clean_tree_block(buf); - clear_bit(EXTENT_BUFFER_STALE, &buf->bflags); -diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c -index 5707bf0575d43..60c21cfb19480 100644 ---- a/fs/btrfs/extent_io.c -+++ b/fs/btrfs/extent_io.c -@@ -5607,9 +5607,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv, - } - } - --int read_extent_buffer_to_user(const struct extent_buffer *eb, -- void __user *dstv, -- unsigned long start, unsigned long len) -+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, -+ void __user *dstv, -+ unsigned long start, unsigned long len) - { - size_t cur; - size_t offset; -@@ -5630,7 +5630,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb, - - cur = min(len, (PAGE_SIZE - offset)); - kaddr = page_address(page); -- if (copy_to_user(dst, kaddr + offset, cur)) { -+ if (probe_user_write(dst, kaddr + offset, cur)) { - ret = -EFAULT; - break; - } -diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h -index cf3424d58fec7..bc858c8cef0a6 100644 ---- a/fs/btrfs/extent_io.h -+++ b/fs/btrfs/extent_io.h -@@ -457,9 +457,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv, - void read_extent_buffer(const struct extent_buffer *eb, void *dst, - unsigned long start, - unsigned long len); --int read_extent_buffer_to_user(const struct extent_buffer *eb, -- void __user *dst, unsigned long start, -- unsigned long len); -+int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, -+ void __user *dst, unsigned long start, -+ unsigned long len); - void write_extent_buffer_fsid(struct extent_buffer *eb, const void *src); - void write_extent_buffer_chunk_tree_uuid(struct extent_buffer *eb, - const void *src); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 88745b5182126..775fd5975191b 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2105,9 +2105,14 @@ static noinline int copy_to_sk(struct btrfs_path *path, - sh.len = item_len; - sh.transid = found_transid; - -- /* copy search result header */ -- if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) { -- ret = -EFAULT; -+ /* -+ * Copy search result header. If we fault then loop again so we -+ * can fault in the pages and -EFAULT there if there's a -+ * problem. Otherwise we'll fault and then copy the buffer in -+ * properly this next time through -+ */ -+ if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) { -+ ret = 0; - goto out; - } - -@@ -2115,10 +2120,14 @@ static noinline int copy_to_sk(struct btrfs_path *path, - - if (item_len) { - char __user *up = ubuf + *sk_offset; -- /* copy the item */ -- if (read_extent_buffer_to_user(leaf, up, -- item_off, item_len)) { -- ret = -EFAULT; -+ /* -+ * Copy the item, same behavior as above, but reset the -+ * * sk_offset so we copy the full thing again. -+ */ -+ if (read_extent_buffer_to_user_nofault(leaf, up, -+ item_off, item_len)) { -+ ret = 0; -+ *sk_offset -= sizeof(sh); - goto out; - } - -@@ -2206,6 +2215,10 @@ static noinline int search_ioctl(struct inode *inode, - key.offset = sk->min_offset; - - while (1) { -+ ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset); -+ if (ret) -+ break; -+ - ret = btrfs_search_forward(root, &key, path, sk->min_transid); - if (ret != 0) { - if (ret > 0) -diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c -index 498b824148187..93d7cb56e44b2 100644 ---- a/fs/btrfs/scrub.c -+++ b/fs/btrfs/scrub.c -@@ -3742,50 +3742,84 @@ static noinline_for_stack int scrub_supers(struct scrub_ctx *sctx, - return 0; - } - -+static void scrub_workers_put(struct btrfs_fs_info *fs_info) -+{ -+ if (refcount_dec_and_mutex_lock(&fs_info->scrub_workers_refcnt, -+ &fs_info->scrub_lock)) { -+ struct btrfs_workqueue *scrub_workers = NULL; -+ struct btrfs_workqueue *scrub_wr_comp = NULL; -+ struct btrfs_workqueue *scrub_parity = NULL; -+ -+ scrub_workers = fs_info->scrub_workers; -+ scrub_wr_comp = fs_info->scrub_wr_completion_workers; -+ scrub_parity = fs_info->scrub_parity_workers; -+ -+ fs_info->scrub_workers = NULL; -+ fs_info->scrub_wr_completion_workers = NULL; -+ fs_info->scrub_parity_workers = NULL; -+ mutex_unlock(&fs_info->scrub_lock); -+ -+ btrfs_destroy_workqueue(scrub_workers); -+ btrfs_destroy_workqueue(scrub_wr_comp); -+ btrfs_destroy_workqueue(scrub_parity); -+ } -+} -+ - /* - * get a reference count on fs_info->scrub_workers. start worker if necessary - */ - static noinline_for_stack int scrub_workers_get(struct btrfs_fs_info *fs_info, - int is_dev_replace) - { -+ struct btrfs_workqueue *scrub_workers = NULL; -+ struct btrfs_workqueue *scrub_wr_comp = NULL; -+ struct btrfs_workqueue *scrub_parity = NULL; - unsigned int flags = WQ_FREEZABLE | WQ_UNBOUND; - int max_active = fs_info->thread_pool_size; -+ int ret = -ENOMEM; - -- lockdep_assert_held(&fs_info->scrub_lock); -+ if (refcount_inc_not_zero(&fs_info->scrub_workers_refcnt)) -+ return 0; - -- if (refcount_read(&fs_info->scrub_workers_refcnt) == 0) { -- ASSERT(fs_info->scrub_workers == NULL); -- fs_info->scrub_workers = btrfs_alloc_workqueue(fs_info, "scrub", -- flags, is_dev_replace ? 1 : max_active, 4); -- if (!fs_info->scrub_workers) -- goto fail_scrub_workers; -- -- ASSERT(fs_info->scrub_wr_completion_workers == NULL); -- fs_info->scrub_wr_completion_workers = -- btrfs_alloc_workqueue(fs_info, "scrubwrc", flags, -- max_active, 2); -- if (!fs_info->scrub_wr_completion_workers) -- goto fail_scrub_wr_completion_workers; -+ scrub_workers = btrfs_alloc_workqueue(fs_info, "scrub", flags, -+ is_dev_replace ? 1 : max_active, 4); -+ if (!scrub_workers) -+ goto fail_scrub_workers; - -- ASSERT(fs_info->scrub_parity_workers == NULL); -- fs_info->scrub_parity_workers = -- btrfs_alloc_workqueue(fs_info, "scrubparity", flags, -+ scrub_wr_comp = btrfs_alloc_workqueue(fs_info, "scrubwrc", flags, - max_active, 2); -- if (!fs_info->scrub_parity_workers) -- goto fail_scrub_parity_workers; -+ if (!scrub_wr_comp) -+ goto fail_scrub_wr_completion_workers; - -+ scrub_parity = btrfs_alloc_workqueue(fs_info, "scrubparity", flags, -+ max_active, 2); -+ if (!scrub_parity) -+ goto fail_scrub_parity_workers; -+ -+ mutex_lock(&fs_info->scrub_lock); -+ if (refcount_read(&fs_info->scrub_workers_refcnt) == 0) { -+ ASSERT(fs_info->scrub_workers == NULL && -+ fs_info->scrub_wr_completion_workers == NULL && -+ fs_info->scrub_parity_workers == NULL); -+ fs_info->scrub_workers = scrub_workers; -+ fs_info->scrub_wr_completion_workers = scrub_wr_comp; -+ fs_info->scrub_parity_workers = scrub_parity; - refcount_set(&fs_info->scrub_workers_refcnt, 1); -- } else { -- refcount_inc(&fs_info->scrub_workers_refcnt); -+ mutex_unlock(&fs_info->scrub_lock); -+ return 0; - } -- return 0; -+ /* Other thread raced in and created the workers for us */ -+ refcount_inc(&fs_info->scrub_workers_refcnt); -+ mutex_unlock(&fs_info->scrub_lock); - -+ ret = 0; -+ btrfs_destroy_workqueue(scrub_parity); - fail_scrub_parity_workers: -- btrfs_destroy_workqueue(fs_info->scrub_wr_completion_workers); -+ btrfs_destroy_workqueue(scrub_wr_comp); - fail_scrub_wr_completion_workers: -- btrfs_destroy_workqueue(fs_info->scrub_workers); -+ btrfs_destroy_workqueue(scrub_workers); - fail_scrub_workers: -- return -ENOMEM; -+ return ret; - } - - int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, -@@ -3796,9 +3830,6 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - int ret; - struct btrfs_device *dev; - unsigned int nofs_flag; -- struct btrfs_workqueue *scrub_workers = NULL; -- struct btrfs_workqueue *scrub_wr_comp = NULL; -- struct btrfs_workqueue *scrub_parity = NULL; - - if (btrfs_fs_closing(fs_info)) - return -EAGAIN; -@@ -3845,13 +3876,17 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - if (IS_ERR(sctx)) - return PTR_ERR(sctx); - -+ ret = scrub_workers_get(fs_info, is_dev_replace); -+ if (ret) -+ goto out_free_ctx; -+ - mutex_lock(&fs_info->fs_devices->device_list_mutex); - dev = btrfs_find_device(fs_info->fs_devices, devid, NULL, NULL, true); - if (!dev || (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) && - !is_dev_replace)) { - mutex_unlock(&fs_info->fs_devices->device_list_mutex); - ret = -ENODEV; -- goto out_free_ctx; -+ goto out; - } - - if (!is_dev_replace && !readonly && -@@ -3860,7 +3895,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - btrfs_err_in_rcu(fs_info, "scrub: device %s is not writable", - rcu_str_deref(dev->name)); - ret = -EROFS; -- goto out_free_ctx; -+ goto out; - } - - mutex_lock(&fs_info->scrub_lock); -@@ -3869,7 +3904,7 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - mutex_unlock(&fs_info->scrub_lock); - mutex_unlock(&fs_info->fs_devices->device_list_mutex); - ret = -EIO; -- goto out_free_ctx; -+ goto out; - } - - down_read(&fs_info->dev_replace.rwsem); -@@ -3880,17 +3915,10 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - mutex_unlock(&fs_info->scrub_lock); - mutex_unlock(&fs_info->fs_devices->device_list_mutex); - ret = -EINPROGRESS; -- goto out_free_ctx; -+ goto out; - } - up_read(&fs_info->dev_replace.rwsem); - -- ret = scrub_workers_get(fs_info, is_dev_replace); -- if (ret) { -- mutex_unlock(&fs_info->scrub_lock); -- mutex_unlock(&fs_info->fs_devices->device_list_mutex); -- goto out_free_ctx; -- } -- - sctx->readonly = readonly; - dev->scrub_ctx = sctx; - mutex_unlock(&fs_info->fs_devices->device_list_mutex); -@@ -3943,24 +3971,14 @@ int btrfs_scrub_dev(struct btrfs_fs_info *fs_info, u64 devid, u64 start, - - mutex_lock(&fs_info->scrub_lock); - dev->scrub_ctx = NULL; -- if (refcount_dec_and_test(&fs_info->scrub_workers_refcnt)) { -- scrub_workers = fs_info->scrub_workers; -- scrub_wr_comp = fs_info->scrub_wr_completion_workers; -- scrub_parity = fs_info->scrub_parity_workers; -- -- fs_info->scrub_workers = NULL; -- fs_info->scrub_wr_completion_workers = NULL; -- fs_info->scrub_parity_workers = NULL; -- } - mutex_unlock(&fs_info->scrub_lock); - -- btrfs_destroy_workqueue(scrub_workers); -- btrfs_destroy_workqueue(scrub_wr_comp); -- btrfs_destroy_workqueue(scrub_parity); -+ scrub_workers_put(fs_info); - scrub_put_ctx(sctx); - - return ret; -- -+out: -+ scrub_workers_put(fs_info); - out_free_ctx: - scrub_free_ctx(sctx); - -diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c -index 0e44db066641e..91ea38506fbb7 100644 ---- a/fs/btrfs/tree-checker.c -+++ b/fs/btrfs/tree-checker.c -@@ -772,7 +772,7 @@ static int check_inode_item(struct extent_buffer *leaf, - /* Here we use super block generation + 1 to handle log tree */ - if (btrfs_inode_generation(leaf, iitem) > super_gen + 1) { - inode_item_err(fs_info, leaf, slot, -- "invalid inode generation: has %llu expect (0, %llu]", -+ "invalid inode transid: has %llu expect [0, %llu]", - btrfs_inode_generation(leaf, iitem), - super_gen + 1); - return -EUCLEAN; -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 196ddbcd29360..81be71fb569e1 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -4568,6 +4568,7 @@ static int btrfs_uuid_scan_kthread(void *data) - goto skip; - } - update_tree: -+ btrfs_release_path(path); - if (!btrfs_is_empty_uuid(root_item.uuid)) { - ret = btrfs_uuid_tree_add(trans, root_item.uuid, - BTRFS_UUID_KEY_SUBVOL, -@@ -4592,6 +4593,7 @@ update_tree: - } - - skip: -+ btrfs_release_path(path); - if (trans) { - ret = btrfs_end_transaction(trans); - trans = NULL; -@@ -4599,7 +4601,6 @@ skip: - break; - } - -- btrfs_release_path(path); - if (key.offset < (u64)-1) { - key.offset++; - } else if (key.type < BTRFS_ROOT_ITEM_KEY) { -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index 4a6b14a2bd7f9..a10711a6337af 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -2198,6 +2198,7 @@ const struct file_operations ceph_file_fops = { - .mmap = ceph_mmap, - .fsync = ceph_fsync, - .lock = ceph_lock, -+ .setlease = simple_nosetlease, - .flock = ceph_flock, - .splice_read = generic_file_splice_read, - .splice_write = iter_file_splice_write, -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 0d9b1e2b9da72..ae1d32344f7ac 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -1992,9 +1992,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) - * during ep_insert(). - */ - if (list_empty(&epi->ffd.file->f_tfile_llink)) { -- get_file(epi->ffd.file); -- list_add(&epi->ffd.file->f_tfile_llink, -- &tfile_check_list); -+ if (get_file_rcu(epi->ffd.file)) -+ list_add(&epi->ffd.file->f_tfile_llink, -+ &tfile_check_list); - } - } - } -diff --git a/fs/ext2/file.c b/fs/ext2/file.c -index 39c4772e96c9d..d73103cdda210 100644 ---- a/fs/ext2/file.c -+++ b/fs/ext2/file.c -@@ -93,8 +93,10 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf) - struct inode *inode = file_inode(vmf->vma->vm_file); - struct ext2_inode_info *ei = EXT2_I(inode); - vm_fault_t ret; -+ bool write = (vmf->flags & FAULT_FLAG_WRITE) && -+ (vmf->vma->vm_flags & VM_SHARED); - -- if (vmf->flags & FAULT_FLAG_WRITE) { -+ if (write) { - sb_start_pagefault(inode->i_sb); - file_update_time(vmf->vma->vm_file); - } -@@ -103,7 +105,7 @@ static vm_fault_t ext2_dax_fault(struct vm_fault *vmf) - ret = dax_iomap_fault(vmf, PE_SIZE_PTE, NULL, NULL, &ext2_iomap_ops); - - up_read(&ei->dax_sem); -- if (vmf->flags & FAULT_FLAG_WRITE) -+ if (write) - sb_end_pagefault(inode->i_sb); - return ret; - } -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index f0089e862216c..fe277ee5ec7c4 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -946,8 +946,10 @@ xfs_attr_shortform_verify( - * struct xfs_attr_sf_entry has a variable length. - * Check the fixed-offset parts of the structure are - * within the data buffer. -+ * xfs_attr_sf_entry is defined with a 1-byte variable -+ * array at the end, so we must subtract that off. - */ -- if (((char *)sfep + sizeof(*sfep)) >= endp) -+ if (((char *)sfep + sizeof(*sfep) - 1) >= endp) - return __this_address; - - /* Don't allow names with known bad length. */ -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index 3f76da11197c4..19a600443b9ee 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -6179,7 +6179,7 @@ xfs_bmap_validate_extent( - - isrt = XFS_IS_REALTIME_INODE(ip); - endfsb = irec->br_startblock + irec->br_blockcount - 1; -- if (isrt) { -+ if (isrt && whichfork == XFS_DATA_FORK) { - if (!xfs_verify_rtbno(mp, irec->br_startblock)) - return __this_address; - if (!xfs_verify_rtbno(mp, endfsb)) -diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c -index 1ffb179f35d23..1e2176190c86f 100644 ---- a/fs/xfs/xfs_file.c -+++ b/fs/xfs/xfs_file.c -@@ -1172,6 +1172,14 @@ __xfs_filemap_fault( - return ret; - } - -+static inline bool -+xfs_is_write_fault( -+ struct vm_fault *vmf) -+{ -+ return (vmf->flags & FAULT_FLAG_WRITE) && -+ (vmf->vma->vm_flags & VM_SHARED); -+} -+ - static vm_fault_t - xfs_filemap_fault( - struct vm_fault *vmf) -@@ -1179,7 +1187,7 @@ xfs_filemap_fault( - /* DAX can shortcut the normal fault path on write faults! */ - return __xfs_filemap_fault(vmf, PE_SIZE_PTE, - IS_DAX(file_inode(vmf->vma->vm_file)) && -- (vmf->flags & FAULT_FLAG_WRITE)); -+ xfs_is_write_fault(vmf)); - } - - static vm_fault_t -@@ -1192,7 +1200,7 @@ xfs_filemap_huge_fault( - - /* DAX can shortcut the normal fault path on write faults! */ - return __xfs_filemap_fault(vmf, pe_size, -- (vmf->flags & FAULT_FLAG_WRITE)); -+ xfs_is_write_fault(vmf)); - } - - static vm_fault_t -diff --git a/include/linux/bvec.h b/include/linux/bvec.h -index a032f01e928c5..d7a628e066ee8 100644 ---- a/include/linux/bvec.h -+++ b/include/linux/bvec.h -@@ -110,11 +110,18 @@ static inline bool bvec_iter_advance(const struct bio_vec *bv, - return true; - } - -+static inline void bvec_iter_skip_zero_bvec(struct bvec_iter *iter) -+{ -+ iter->bi_bvec_done = 0; -+ iter->bi_idx++; -+} -+ - #define for_each_bvec(bvl, bio_vec, iter, start) \ - for (iter = (start); \ - (iter).bi_size && \ - ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \ -- bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len)) -+ (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \ -+ (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter))) - - /* for iterating one bio from start to end */ - #define BVEC_ITER_ALL_INIT (struct bvec_iter) \ -diff --git a/include/linux/libata.h b/include/linux/libata.h -index b9970f5bab67c..e752368ea3516 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -422,6 +422,7 @@ enum { - ATA_HORKAGE_NO_DMA_LOG = (1 << 23), /* don't use DMA for log read */ - ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ - ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ -+ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */ - - /* DMA mask for user DMA control: User visible values; DO NOT - renumber */ -diff --git a/include/linux/log2.h b/include/linux/log2.h -index 83a4a3ca3e8a7..c619ec6eff4ae 100644 ---- a/include/linux/log2.h -+++ b/include/linux/log2.h -@@ -173,7 +173,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) - #define roundup_pow_of_two(n) \ - ( \ - __builtin_constant_p(n) ? ( \ -- (n == 1) ? 1 : \ -+ ((n) == 1) ? 1 : \ - (1UL << (ilog2((n) - 1) + 1)) \ - ) : \ - __roundup_pow_of_two(n) \ -diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h -index 851425c3178f1..89016d08f6a27 100644 ---- a/include/linux/netfilter/nfnetlink.h -+++ b/include/linux/netfilter/nfnetlink.h -@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group); - int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid, - unsigned int group, int echo, gfp_t flags); - int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error); --int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, -- int flags); -+int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid); - - static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type) - { -diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h -index ab988940bf045..55b980b21f4b4 100644 ---- a/include/net/af_rxrpc.h -+++ b/include/net/af_rxrpc.h -@@ -59,7 +59,7 @@ bool rxrpc_kernel_abort_call(struct socket *, struct rxrpc_call *, - void rxrpc_kernel_end_call(struct socket *, struct rxrpc_call *); - void rxrpc_kernel_get_peer(struct socket *, struct rxrpc_call *, - struct sockaddr_rxrpc *); --u32 rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *); -+bool rxrpc_kernel_get_srtt(struct socket *, struct rxrpc_call *, u32 *); - int rxrpc_kernel_charge_accept(struct socket *, rxrpc_notify_rx_t, - rxrpc_user_attach_call_t, unsigned long, gfp_t, - unsigned int); -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 2d0275f13bbfd..bc2c73f549622 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -143,6 +143,8 @@ static inline u64 nft_reg_load64(u32 *sreg) - static inline void nft_data_copy(u32 *dst, const struct nft_data *src, - unsigned int len) - { -+ if (len % NFT_REG32_SIZE) -+ dst[len / NFT_REG32_SIZE] = 0; - memcpy(dst, src, len); - } - -diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h -index ed8881ad18edd..0a995403172cc 100644 ---- a/include/uapi/linux/netfilter/nf_tables.h -+++ b/include/uapi/linux/netfilter/nf_tables.h -@@ -132,7 +132,7 @@ enum nf_tables_msg_types { - * @NFTA_LIST_ELEM: list element (NLA_NESTED) - */ - enum nft_list_attributes { -- NFTA_LIST_UNPEC, -+ NFTA_LIST_UNSPEC, - NFTA_LIST_ELEM, - __NFTA_LIST_MAX - }; -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index 2a83b03c54a69..62ec514dae658 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -3082,6 +3082,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array) - } - - #ifdef CONFIG_SYSCTL -+static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write, -+ void *buffer, size_t *length, -+ loff_t *ppos, unsigned long *out) -+{ -+ struct ctl_table dup_table; -+ -+ /* -+ * In order to avoid races with __do_proc_doulongvec_minmax(), we -+ * can duplicate the @table and alter the duplicate of it. -+ */ -+ dup_table = *table; -+ dup_table.data = out; -+ -+ return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos); -+} -+ - static int hugetlb_sysctl_handler_common(bool obey_mempolicy, - struct ctl_table *table, int write, - void __user *buffer, size_t *length, loff_t *ppos) -@@ -3093,9 +3109,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, - if (!hugepages_supported()) - return -EOPNOTSUPP; - -- table->data = &tmp; -- table->maxlen = sizeof(unsigned long); -- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); -+ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, -+ &tmp); - if (ret) - goto out; - -@@ -3139,9 +3154,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, - if (write && hstate_is_gigantic(h)) - return -EINVAL; - -- table->data = &tmp; -- table->maxlen = sizeof(unsigned long); -- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); -+ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, -+ &tmp); - if (ret) - goto out; - -diff --git a/mm/khugepaged.c b/mm/khugepaged.c -index 3623d1c5343f2..9ec618d5ea557 100644 ---- a/mm/khugepaged.c -+++ b/mm/khugepaged.c -@@ -1592,7 +1592,7 @@ static void collapse_file(struct mm_struct *mm, - xas_unlock_irq(&xas); - page_cache_sync_readahead(mapping, &file->f_ra, - file, index, -- PAGE_SIZE); -+ end - index); - /* drain pagevecs to help isolate_lru_page() */ - lru_add_drain(); - page = find_lock_page(mapping, index); -diff --git a/mm/madvise.c b/mm/madvise.c -index d8cfc3a0c1534..26f7954865ed9 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -288,9 +288,9 @@ static long madvise_willneed(struct vm_area_struct *vma, - */ - *prev = NULL; /* tell sys_madvise we drop mmap_sem */ - get_file(file); -- up_read(¤t->mm->mmap_sem); - offset = (loff_t)(start - vma->vm_start) - + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); -+ up_read(¤t->mm->mmap_sem); - vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED); - fput(file); - down_read(¤t->mm->mmap_sem); -diff --git a/mm/slub.c b/mm/slub.c -index 709e31002504c..822ba07245291 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -645,12 +645,12 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...) - } - - static bool freelist_corrupted(struct kmem_cache *s, struct page *page, -- void *freelist, void *nextfree) -+ void **freelist, void *nextfree) - { - if ((s->flags & SLAB_CONSISTENCY_CHECKS) && -- !check_valid_pointer(s, page, nextfree)) { -- object_err(s, page, freelist, "Freechain corrupt"); -- freelist = NULL; -+ !check_valid_pointer(s, page, nextfree) && freelist) { -+ object_err(s, page, *freelist, "Freechain corrupt"); -+ *freelist = NULL; - slab_fix(s, "Isolate corrupted freechain"); - return true; - } -@@ -1394,7 +1394,7 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node, - int objects) {} - - static bool freelist_corrupted(struct kmem_cache *s, struct page *page, -- void *freelist, void *nextfree) -+ void **freelist, void *nextfree) - { - return false; - } -@@ -2086,7 +2086,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page, - * 'freelist' is already corrupted. So isolate all objects - * starting at 'freelist'. - */ -- if (freelist_corrupted(s, page, freelist, nextfree)) -+ if (freelist_corrupted(s, page, &freelist, nextfree)) - break; - - do { -diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c -index a9e7540c56918..3165f6ff8ee71 100644 ---- a/net/batman-adv/bat_v_ogm.c -+++ b/net/batman-adv/bat_v_ogm.c -@@ -878,6 +878,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset, - ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, - ogm_packet->version, ntohs(ogm_packet->tvlv_len)); - -+ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) { -+ batadv_dbg(BATADV_DBG_BATMAN, bat_priv, -+ "Drop packet: originator packet from ourself\n"); -+ return; -+ } -+ - /* If the throughput metric is 0, immediately drop the packet. No need - * to create orig_node / neigh_node for an unusable route. - */ -@@ -1005,11 +1011,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, - if (batadv_is_my_mac(bat_priv, ethhdr->h_source)) - goto free_skb; - -- ogm_packet = (struct batadv_ogm2_packet *)skb->data; -- -- if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) -- goto free_skb; -- - batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX); - batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES, - skb->len + ETH_HLEN); -diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c -index 663a53b6d36e6..5f6309ade1ea1 100644 ---- a/net/batman-adv/bridge_loop_avoidance.c -+++ b/net/batman-adv/bridge_loop_avoidance.c -@@ -437,7 +437,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac, - batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES, - skb->len + ETH_HLEN); - -- netif_rx(skb); -+ if (in_interrupt()) -+ netif_rx(skb); -+ else -+ netif_rx_ni(skb); - out: - if (primary_if) - batadv_hardif_put(primary_if); -diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c -index 47df4c6789886..89c9097007c3a 100644 ---- a/net/batman-adv/gateway_client.c -+++ b/net/batman-adv/gateway_client.c -@@ -703,8 +703,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, - - chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; - /* store the client address if the message is going to a client */ -- if (ret == BATADV_DHCP_TO_CLIENT && -- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { -+ if (ret == BATADV_DHCP_TO_CLIENT) { -+ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) -+ return BATADV_DHCP_NO; -+ - /* check if the DHCP packet carries an Ethernet DHCP */ - p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; - if (*p != BATADV_DHCP_HTYPE_ETHERNET) -diff --git a/net/core/dev.c b/net/core/dev.c -index 25858f1f67cf7..56cd7b83a3829 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -5602,12 +5602,13 @@ static void napi_skb_free_stolen_head(struct sk_buff *skb) - kmem_cache_free(skbuff_head_cache, skb); - } - --static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb) -+static gro_result_t napi_skb_finish(struct napi_struct *napi, -+ struct sk_buff *skb, -+ gro_result_t ret) - { - switch (ret) { - case GRO_NORMAL: -- if (netif_receive_skb_internal(skb)) -- ret = GRO_DROP; -+ gro_normal_one(napi, skb); - break; - - case GRO_DROP: -@@ -5639,7 +5640,7 @@ gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb) - - skb_gro_reset_offset(skb); - -- ret = napi_skb_finish(dev_gro_receive(napi, skb), skb); -+ ret = napi_skb_finish(napi, skb, dev_gro_receive(napi, skb)); - trace_napi_gro_receive_exit(ret); - - return ret; -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index f7129232c8250..2023650c27249 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -744,11 +744,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk, - nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, - family, table); - if (err < 0) -- goto err; -+ goto err_fill_table_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); - --err: -+err_fill_table_info: - kfree_skb(skb2); - return err; - } -@@ -1443,11 +1443,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk, - nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, - family, table, chain); - if (err < 0) -- goto err; -+ goto err_fill_chain_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); - --err: -+err_fill_chain_info: - kfree_skb(skb2); - return err; - } -@@ -2622,11 +2622,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, - nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, - family, table, chain, rule, NULL); - if (err < 0) -- goto err; -+ goto err_fill_rule_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); - --err: -+err_fill_rule_info: - kfree_skb(skb2); - return err; - } -@@ -3353,7 +3353,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, - goto nla_put_failure; - } - -- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) -+ if (set->udata && -+ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) - goto nla_put_failure; - - desc = nla_nest_start_noflag(skb, NFTA_SET_DESC); -@@ -3525,11 +3526,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk, - - err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); - if (err < 0) -- goto err; -+ goto err_fill_set_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); - --err: -+err_fill_set_info: - kfree_skb(skb2); - return err; - } -@@ -4304,24 +4305,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, - err = -ENOMEM; - skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); - if (skb == NULL) -- goto err1; -+ return err; - - err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, - NFT_MSG_NEWSETELEM, 0, set, &elem); - if (err < 0) -- goto err2; -+ goto err_fill_setelem; - -- err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT); -- /* This avoids a loop in nfnetlink. */ -- if (err < 0) -- goto err1; -+ return nfnetlink_unicast(skb, ctx->net, ctx->portid); - -- return 0; --err2: -+err_fill_setelem: - kfree_skb(skb); --err1: -- /* this avoids a loop in nfnetlink. */ -- return err == -EAGAIN ? -ENOBUFS : err; -+ return err; - } - - /* called with rcu_read_lock held */ -@@ -5498,10 +5493,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk, - nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, - family, table, obj, reset); - if (err < 0) -- goto err; -+ goto err_fill_obj_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); --err: -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); -+ -+err_fill_obj_info: - kfree_skb(skb2); - return err; - } -@@ -6173,10 +6169,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk, - NFT_MSG_NEWFLOWTABLE, 0, family, - flowtable); - if (err < 0) -- goto err; -+ goto err_fill_flowtable_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); --err: -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); -+ -+err_fill_flowtable_info: - kfree_skb(skb2); - return err; - } -@@ -6337,10 +6334,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk, - err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, - nlh->nlmsg_seq); - if (err < 0) -- goto err; -+ goto err_fill_gen_info; - -- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); --err: -+ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); -+ -+err_fill_gen_info: - kfree_skb(skb2); - return err; - } -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index 99127e2d95a84..6d03b09096210 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -148,10 +148,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error) - } - EXPORT_SYMBOL_GPL(nfnetlink_set_err); - --int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, -- int flags) -+int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid) - { -- return netlink_unicast(net->nfnl, skb, portid, flags); -+ int err; -+ -+ err = nlmsg_unicast(net->nfnl, skb, portid); -+ if (err == -EAGAIN) -+ err = -ENOBUFS; -+ -+ return err; - } - EXPORT_SYMBOL_GPL(nfnetlink_unicast); - -diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c -index 0ba020ca38e68..7ca2ca4bba055 100644 ---- a/net/netfilter/nfnetlink_log.c -+++ b/net/netfilter/nfnetlink_log.c -@@ -356,8 +356,7 @@ __nfulnl_send(struct nfulnl_instance *inst) - goto out; - } - } -- nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, -- MSG_DONTWAIT); -+ nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid); - out: - inst->qlen = 0; - inst->skb = NULL; -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index feabdfb22920b..6f0a2bad8ad5e 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -681,7 +681,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, - *packet_id_ptr = htonl(entry->id); - - /* nfnetlink_unicast will either free the nskb or add it to a socket */ -- err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT); -+ err = nfnetlink_unicast(nskb, net, queue->peer_portid); - if (err < 0) { - if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { - failopen = 1; -diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c -index 0e3bfbc26e790..62dc728bf93c9 100644 ---- a/net/netfilter/nft_payload.c -+++ b/net/netfilter/nft_payload.c -@@ -79,7 +79,9 @@ void nft_payload_eval(const struct nft_expr *expr, - u32 *dest = ®s->data[priv->dreg]; - int offset; - -- dest[priv->len / NFT_REG32_SIZE] = 0; -+ if (priv->len % NFT_REG32_SIZE) -+ dest[priv->len / NFT_REG32_SIZE] = 0; -+ - switch (priv->base) { - case NFT_PAYLOAD_LL_HEADER: - if (!skb_mac_header_was_set(skb)) -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 7735340c892eb..fbc2d4dfddf0e 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2169,7 +2169,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - int skb_len = skb->len; - unsigned int snaplen, res; - unsigned long status = TP_STATUS_USER; -- unsigned short macoff, netoff, hdrlen; -+ unsigned short macoff, hdrlen; -+ unsigned int netoff; - struct sk_buff *copy_skb = NULL; - struct timespec ts; - __u32 ts_status; -@@ -2238,6 +2239,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, - } - macoff = netoff - maclen; - } -+ if (netoff > USHRT_MAX) { -+ atomic_inc(&po->tp_drops); -+ goto drop_n_restore; -+ } - if (po->tp_version <= TPACKET_V2) { - if (macoff + snaplen > po->rx_ring.frame_size) { - if (po->copy_thresh && -diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c -index 22dec6049e1bb..6cace43b217ee 100644 ---- a/net/rxrpc/input.c -+++ b/net/rxrpc/input.c -@@ -844,7 +844,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - struct rxrpc_ackinfo info; - u8 acks[RXRPC_MAXACKS]; - } buf; -- rxrpc_serial_t acked_serial; -+ rxrpc_serial_t ack_serial, acked_serial; - rxrpc_seq_t first_soft_ack, hard_ack, prev_pkt; - int nr_acks, offset, ioffset; - -@@ -857,6 +857,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - } - offset += sizeof(buf.ack); - -+ ack_serial = sp->hdr.serial; - acked_serial = ntohl(buf.ack.serial); - first_soft_ack = ntohl(buf.ack.firstPacket); - prev_pkt = ntohl(buf.ack.previousPacket); -@@ -865,31 +866,31 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - summary.ack_reason = (buf.ack.reason < RXRPC_ACK__INVALID ? - buf.ack.reason : RXRPC_ACK__INVALID); - -- trace_rxrpc_rx_ack(call, sp->hdr.serial, acked_serial, -+ trace_rxrpc_rx_ack(call, ack_serial, acked_serial, - first_soft_ack, prev_pkt, - summary.ack_reason, nr_acks); - - if (buf.ack.reason == RXRPC_ACK_PING_RESPONSE) - rxrpc_input_ping_response(call, skb->tstamp, acked_serial, -- sp->hdr.serial); -+ ack_serial); - if (buf.ack.reason == RXRPC_ACK_REQUESTED) - rxrpc_input_requested_ack(call, skb->tstamp, acked_serial, -- sp->hdr.serial); -+ ack_serial); - - if (buf.ack.reason == RXRPC_ACK_PING) { -- _proto("Rx ACK %%%u PING Request", sp->hdr.serial); -+ _proto("Rx ACK %%%u PING Request", ack_serial); - rxrpc_propose_ACK(call, RXRPC_ACK_PING_RESPONSE, -- sp->hdr.serial, true, true, -+ ack_serial, true, true, - rxrpc_propose_ack_respond_to_ping); - } else if (sp->hdr.flags & RXRPC_REQUEST_ACK) { - rxrpc_propose_ACK(call, RXRPC_ACK_REQUESTED, -- sp->hdr.serial, true, true, -+ ack_serial, true, true, - rxrpc_propose_ack_respond_to_ack); - } - - /* Discard any out-of-order or duplicate ACKs (outside lock). */ - if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { -- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial, -+ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); - return; -@@ -905,7 +906,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - - /* Discard any out-of-order or duplicate ACKs (inside lock). */ - if (!rxrpc_is_ack_valid(call, first_soft_ack, prev_pkt)) { -- trace_rxrpc_rx_discard_ack(call->debug_id, sp->hdr.serial, -+ trace_rxrpc_rx_discard_ack(call->debug_id, ack_serial, - first_soft_ack, call->ackr_first_seq, - prev_pkt, call->ackr_prev_seq); - goto out; -@@ -965,7 +966,7 @@ static void rxrpc_input_ack(struct rxrpc_call *call, struct sk_buff *skb) - RXRPC_TX_ANNO_LAST && - summary.nr_acks == call->tx_top - hard_ack && - rxrpc_is_client_call(call)) -- rxrpc_propose_ACK(call, RXRPC_ACK_PING, sp->hdr.serial, -+ rxrpc_propose_ACK(call, RXRPC_ACK_PING, ack_serial, - false, true, - rxrpc_propose_ack_ping_for_lost_reply); - -diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c -index efce27802a74f..e011594adcd13 100644 ---- a/net/rxrpc/peer_object.c -+++ b/net/rxrpc/peer_object.c -@@ -500,11 +500,21 @@ EXPORT_SYMBOL(rxrpc_kernel_get_peer); - * rxrpc_kernel_get_srtt - Get a call's peer smoothed RTT - * @sock: The socket on which the call is in progress. - * @call: The call to query -+ * @_srtt: Where to store the SRTT value. - * -- * Get the call's peer smoothed RTT. -+ * Get the call's peer smoothed RTT in uS. - */ --u32 rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call) -+bool rxrpc_kernel_get_srtt(struct socket *sock, struct rxrpc_call *call, -+ u32 *_srtt) - { -- return call->peer->srtt_us >> 3; -+ struct rxrpc_peer *peer = call->peer; -+ -+ if (peer->rtt_count == 0) { -+ *_srtt = 1000000; /* 1S */ -+ return false; -+ } -+ -+ *_srtt = call->peer->srtt_us >> 3; -+ return true; - } - EXPORT_SYMBOL(rxrpc_kernel_get_srtt); -diff --git a/net/wireless/reg.c b/net/wireless/reg.c -index 1a8218f1bbe07..20a8e6af88c45 100644 ---- a/net/wireless/reg.c -+++ b/net/wireless/reg.c -@@ -2941,6 +2941,9 @@ int regulatory_hint_user(const char *alpha2, - if (WARN_ON(!alpha2)) - return -EINVAL; - -+ if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2)) -+ return -EINVAL; -+ - request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL); - if (!request) - return -ENOMEM; -diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl -index 6fcc66afb0880..0c9b114202796 100755 ---- a/scripts/checkpatch.pl -+++ b/scripts/checkpatch.pl -@@ -2576,8 +2576,8 @@ sub process { - - # Check if the commit log has what seems like a diff which can confuse patch - if ($in_commit_log && !$commit_log_has_diff && -- (($line =~ m@^\s+diff\b.*a/[\w/]+@ && -- $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) || -+ (($line =~ m@^\s+diff\b.*a/([\w/]+)@ && -+ $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) || - $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ || - $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) { - ERROR("DIFF_IN_COMMIT_MSG", -diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c -index 3788906421a73..fe27034f28460 100644 ---- a/sound/core/oss/mulaw.c -+++ b/sound/core/oss/mulaw.c -@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug, - snd_BUG(); - return -EINVAL; - } -- if (snd_BUG_ON(!snd_pcm_format_linear(format->format))) -- return -ENXIO; -+ if (!snd_pcm_format_linear(format->format)) -+ return -EINVAL; - - err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", - src_format, dst_format, -diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c -index 1f5fc0e7c0243..0e4b0eac30159 100644 ---- a/sound/firewire/digi00x/digi00x.c -+++ b/sound/firewire/digi00x/digi00x.c -@@ -14,6 +14,7 @@ MODULE_LICENSE("GPL v2"); - #define VENDOR_DIGIDESIGN 0x00a07e - #define MODEL_CONSOLE 0x000001 - #define MODEL_RACK 0x000002 -+#define SPEC_VERSION 0x000001 - - static int name_card(struct snd_dg00x *dg00x) - { -@@ -175,14 +176,18 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = { - /* Both of 002/003 use the same ID. */ - { - .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_VERSION | - IEEE1394_MATCH_MODEL_ID, - .vendor_id = VENDOR_DIGIDESIGN, -+ .version = SPEC_VERSION, - .model_id = MODEL_CONSOLE, - }, - { - .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_VERSION | - IEEE1394_MATCH_MODEL_ID, - .vendor_id = VENDOR_DIGIDESIGN, -+ .version = SPEC_VERSION, - .model_id = MODEL_RACK, - }, - {} -diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c -index addc464503bcf..0175e3e835ead 100644 ---- a/sound/firewire/tascam/tascam.c -+++ b/sound/firewire/tascam/tascam.c -@@ -39,9 +39,6 @@ static const struct snd_tscm_spec model_specs[] = { - .midi_capture_ports = 2, - .midi_playback_ports = 4, - }, -- // This kernel module doesn't support FE-8 because the most of features -- // can be implemented in userspace without any specific support of this -- // module. - }; - - static int identify_model(struct snd_tscm *tscm) -@@ -211,11 +208,39 @@ static void snd_tscm_remove(struct fw_unit *unit) - } - - static const struct ieee1394_device_id snd_tscm_id_table[] = { -+ // Tascam, FW-1884. -+ { -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, -+ .vendor_id = 0x00022e, -+ .specifier_id = 0x00022e, -+ .version = 0x800000, -+ }, -+ // Tascam, FE-8 (.version = 0x800001) -+ // This kernel module doesn't support FE-8 because the most of features -+ // can be implemented in userspace without any specific support of this -+ // module. -+ // -+ // .version = 0x800002 is unknown. -+ // -+ // Tascam, FW-1082. -+ { -+ .match_flags = IEEE1394_MATCH_VENDOR_ID | -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, -+ .vendor_id = 0x00022e, -+ .specifier_id = 0x00022e, -+ .version = 0x800003, -+ }, -+ // Tascam, FW-1804. - { - .match_flags = IEEE1394_MATCH_VENDOR_ID | -- IEEE1394_MATCH_SPECIFIER_ID, -+ IEEE1394_MATCH_SPECIFIER_ID | -+ IEEE1394_MATCH_VERSION, - .vendor_id = 0x00022e, - .specifier_id = 0x00022e, -+ .version = 0x800004, - }, - {} - }; -diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c -index 478412e0aa3c7..7aedaeb7a1968 100644 ---- a/sound/pci/ca0106/ca0106_main.c -+++ b/sound/pci/ca0106/ca0106_main.c -@@ -537,7 +537,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id, - else - /* Power down */ - chip->spi_dac_reg[reg] |= bit; -- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]); -+ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0) -+ return -ENXIO; - } - return 0; - } -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 3a456410937b5..7353d2ec359ae 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2671,8 +2671,6 @@ static const struct pci_device_id azx_ids[] = { - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_HDMI }, - /* Zhaoxin */ - { PCI_DEVICE(0x1d17, 0x3288), .driver_data = AZX_DRIVER_ZHAOXIN }, -- /* Loongson */ -- { PCI_DEVICE(0x0014, 0x7a07), .driver_data = AZX_DRIVER_GENERIC }, - { 0, } - }; - MODULE_DEVICE_TABLE(pci, azx_ids); -diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c -index ec9460f3a288e..a13bad262598d 100644 ---- a/sound/pci/hda/patch_hdmi.c -+++ b/sound/pci/hda/patch_hdmi.c -@@ -2798,6 +2798,7 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec, - hda_nid_t cvt_nid) - { - if (per_pin) { -+ haswell_verify_D0(codec, per_pin->cvt_nid, per_pin->pin_nid); - snd_hda_set_dev_select(codec, per_pin->pin_nid, - per_pin->dev_id); - intel_verify_pin_cvt_connect(codec, per_pin); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index d1b74c7cacd76..d614090dae49d 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2466,6 +2466,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD), -+ SND_PCI_QUIRK(0x1462, 0x9c37, "MSI X570-A PRO", ALC1220_FIXUP_CLEVO_P950), - SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), - SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3), - SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX), -@@ -5849,6 +5850,39 @@ static void alc275_fixup_gpio4_off(struct hda_codec *codec, - } - } - -+/* Quirk for Thinkpad X1 7th and 8th Gen -+ * The following fixed routing needed -+ * DAC1 (NID 0x02) -> Speaker (NID 0x14); some eq applied secretly -+ * DAC2 (NID 0x03) -> Bass (NID 0x17) & Headphone (NID 0x21); sharing a DAC -+ * DAC3 (NID 0x06) -> Unused, due to the lack of volume amp -+ */ -+static void alc285_fixup_thinkpad_x1_gen7(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ static const hda_nid_t conn[] = { 0x02, 0x03 }; /* exclude 0x06 */ -+ static const hda_nid_t preferred_pairs[] = { -+ 0x14, 0x02, 0x17, 0x03, 0x21, 0x03, 0 -+ }; -+ struct alc_spec *spec = codec->spec; -+ -+ switch (action) { -+ case HDA_FIXUP_ACT_PRE_PROBE: -+ snd_hda_override_conn_list(codec, 0x17, ARRAY_SIZE(conn), conn); -+ spec->gen.preferred_dacs = preferred_pairs; -+ break; -+ case HDA_FIXUP_ACT_BUILD: -+ /* The generic parser creates somewhat unintuitive volume ctls -+ * with the fixed routing above, and the shared DAC2 may be -+ * confusing for PA. -+ * Rename those to unique names so that PA doesn't touch them -+ * and use only Master volume. -+ */ -+ rename_ctl(codec, "Front Playback Volume", "DAC1 Playback Volume"); -+ rename_ctl(codec, "Bass Speaker Playback Volume", "DAC2 Playback Volume"); -+ break; -+ } -+} -+ - static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec, - const struct hda_fixup *fix, - int action) -@@ -6117,6 +6151,7 @@ enum { - ALC289_FIXUP_DUAL_SPK, - ALC294_FIXUP_SPK2_TO_DAC1, - ALC294_FIXUP_ASUS_DUAL_SPK, -+ ALC285_FIXUP_THINKPAD_X1_GEN7, - ALC285_FIXUP_THINKPAD_HEADSET_JACK, - ALC294_FIXUP_ASUS_HPE, - ALC294_FIXUP_ASUS_COEF_1B, -@@ -7262,11 +7297,17 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC294_FIXUP_SPK2_TO_DAC1 - }, -+ [ALC285_FIXUP_THINKPAD_X1_GEN7] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc285_fixup_thinkpad_x1_gen7, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_THINKPAD_ACPI -+ }, - [ALC285_FIXUP_THINKPAD_HEADSET_JACK] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc_fixup_headset_jack, - .chained = true, -- .chain_id = ALC285_FIXUP_SPEAKER2_TO_DAC1 -+ .chain_id = ALC285_FIXUP_THINKPAD_X1_GEN7 - }, - [ALC294_FIXUP_ASUS_HPE] = { - .type = HDA_FIXUP_VERBS, -@@ -7677,7 +7718,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc176, "Samsung Notebook 9 Pro (NP930MBE-K04US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc189, "Samsung Galaxy Flex Book (NT950QCG-X716)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -- SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -+ SND_PCI_QUIRK(0x144d, 0xc18a, "Samsung Galaxy Book Ion (NP930XCJ-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), -+ SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), - SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), - SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index 7b41f97489788..878f1201aad6e 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -356,6 +356,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, - case USB_ID(0x07fd, 0x0008): /* MOTU M Series */ - case USB_ID(0x31e9, 0x0001): /* Solid State Logic SSL2 */ - case USB_ID(0x31e9, 0x0002): /* Solid State Logic SSL2+ */ -+ case USB_ID(0x0499, 0x172f): /* Steinberg UR22C */ - case USB_ID(0x0d9a, 0x00df): /* RTX6001 */ - ep = 0x81; - ifnum = 2; -diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h -index bb7b271397a66..fabe5aeaa351a 100644 ---- a/tools/include/uapi/linux/perf_event.h -+++ b/tools/include/uapi/linux/perf_event.h -@@ -1131,7 +1131,7 @@ union perf_mem_data_src { - - #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */ - /* 1 free */ --#define PERF_MEM_SNOOPX_SHIFT 37 -+#define PERF_MEM_SNOOPX_SHIFT 38 - - /* locked instruction */ - #define PERF_MEM_LOCK_NA 0x01 /* not available */ -diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c -index 23332861de6e4..454e275cd5dff 100644 ---- a/tools/perf/builtin-record.c -+++ b/tools/perf/builtin-record.c -@@ -2137,7 +2137,7 @@ static struct option __record_options[] = { - OPT_BOOLEAN(0, "tail-synthesize", &record.opts.tail_synthesize, - "synthesize non-sample events at the end of output"), - OPT_BOOLEAN(0, "overwrite", &record.opts.overwrite, "use overwrite mode"), -- OPT_BOOLEAN(0, "no-bpf-event", &record.opts.no_bpf_event, "record bpf events"), -+ OPT_BOOLEAN(0, "no-bpf-event", &record.opts.no_bpf_event, "do not record bpf events"), - OPT_BOOLEAN(0, "strict-freq", &record.opts.strict_freq, - "Fail if the specified frequency can't be used"), - OPT_CALLBACK('F', "freq", &record.opts, "freq or 'max'", -diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c -index 99e3fd04a5cb3..d36ae65ae3330 100644 ---- a/tools/perf/pmu-events/jevents.c -+++ b/tools/perf/pmu-events/jevents.c -@@ -137,7 +137,7 @@ static char *fixregex(char *s) - return s; - - /* allocate space for a new string */ -- fixed = (char *) malloc(len + 1); -+ fixed = (char *) malloc(len + esc_count + 1); - if (!fixed) - return NULL; - -diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c -index c812f0178b643..1c4219ceced2f 100644 ---- a/tools/testing/selftests/bpf/test_maps.c -+++ b/tools/testing/selftests/bpf/test_maps.c -@@ -1282,6 +1282,8 @@ static void __run_parallel(unsigned int tasks, - pid_t pid[tasks]; - int i; - -+ fflush(stdout); -+ - for (i = 0; i < tasks; i++) { - pid[i] = fork(); - if (pid[i] == 0) { diff --git a/patch/kernel/odroidxu4-current/patch-5.4.64-65.patch b/patch/kernel/odroidxu4-current/patch-5.4.64-65.patch deleted file mode 100644 index 720873a939..0000000000 --- a/patch/kernel/odroidxu4-current/patch-5.4.64-65.patch +++ /dev/null @@ -1,356 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7bdfb21bb9269..4cb68164b79ee 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 64 -+SUBLEVEL = 65 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c -index b91f92e4e5f22..915ac75b55fc7 100644 ---- a/drivers/net/usb/dm9601.c -+++ b/drivers/net/usb/dm9601.c -@@ -625,6 +625,10 @@ static const struct usb_device_id products[] = { - USB_DEVICE(0x0a46, 0x1269), /* DM9621A USB to Fast Ethernet Adapter */ - .driver_info = (unsigned long)&dm9601_info, - }, -+ { -+ USB_DEVICE(0x0586, 0x3427), /* ZyXEL Keenetic Plus DSL xDSL modem */ -+ .driver_info = (unsigned long)&dm9601_info, -+ }, - {}, // END - }; - -diff --git a/net/core/dev.c b/net/core/dev.c -index 56cd7b83a3829..cdc1c3a144e1f 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -6231,12 +6231,13 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi, - netdev_err_once(dev, "%s() called with weight %d\n", __func__, - weight); - napi->weight = weight; -- list_add(&napi->dev_list, &dev->napi_list); - napi->dev = dev; - #ifdef CONFIG_NETPOLL - napi->poll_owner = -1; - #endif - set_bit(NAPI_STATE_SCHED, &napi->state); -+ set_bit(NAPI_STATE_NPSVC, &napi->state); -+ list_add_rcu(&napi->dev_list, &dev->napi_list); - napi_hash_add(napi); - } - EXPORT_SYMBOL(netif_napi_add); -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 849380a622ef9..cb67d36f3adb0 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -161,7 +161,7 @@ static void poll_napi(struct net_device *dev) - struct napi_struct *napi; - int cpu = smp_processor_id(); - -- list_for_each_entry(napi, &dev->napi_list, dev_list) { -+ list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) { - if (cmpxchg(&napi->poll_owner, -1, cpu) == -1) { - poll_one_napi(napi); - smp_store_release(&napi->poll_owner, -1); -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 47b6d73d30e55..51673d00bbeac 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -2010,7 +2010,8 @@ void fib_info_notify_update(struct net *net, struct nl_info *info) - struct hlist_head *head = &net->ipv4.fib_table_hash[h]; - struct fib_table *tb; - -- hlist_for_each_entry_rcu(tb, head, tb_hlist) -+ hlist_for_each_entry_rcu(tb, head, tb_hlist, -+ lockdep_rtnl_is_held()) - __fib_info_notify_update(net, tb, info); - } - } -diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c -index ec8fcfc60a27b..73842054bfe68 100644 ---- a/net/ipv6/sysctl_net_ipv6.c -+++ b/net/ipv6/sysctl_net_ipv6.c -@@ -21,6 +21,7 @@ - #include - #endif - -+static int two = 2; - static int flowlabel_reflect_max = 0x7; - static int auto_flowlabels_min; - static int auto_flowlabels_max = IP6_AUTO_FLOW_LABEL_MAX; -@@ -151,7 +152,7 @@ static struct ctl_table ipv6_table_template[] = { - .mode = 0644, - .proc_handler = proc_rt6_multipath_hash_policy, - .extra1 = SYSCTL_ZERO, -- .extra2 = SYSCTL_ONE, -+ .extra2 = &two, - }, - { - .procname = "seg6_flowlabel", -diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c -index f5d34da0646ed..12aa803b2f689 100644 ---- a/net/netlabel/netlabel_domainhash.c -+++ b/net/netlabel/netlabel_domainhash.c -@@ -85,6 +85,7 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry) - kfree(netlbl_domhsh_addr6_entry(iter6)); - } - #endif /* IPv6 */ -+ kfree(ptr->def.addrsel); - } - kfree(ptr->domain); - kfree(ptr); -@@ -536,6 +537,8 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry, - goto add_return; - } - #endif /* IPv6 */ -+ /* cleanup the new entry since we've moved everything over */ -+ netlbl_domhsh_free_entry(&entry->rcu); - } else - ret_val = -EINVAL; - -@@ -579,6 +582,12 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, - { - int ret_val = 0; - struct audit_buffer *audit_buf; -+ struct netlbl_af4list *iter4; -+ struct netlbl_domaddr4_map *map4; -+#if IS_ENABLED(CONFIG_IPV6) -+ struct netlbl_af6list *iter6; -+ struct netlbl_domaddr6_map *map6; -+#endif /* IPv6 */ - - if (entry == NULL) - return -ENOENT; -@@ -596,6 +605,9 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, - ret_val = -ENOENT; - spin_unlock(&netlbl_domhsh_lock); - -+ if (ret_val) -+ return ret_val; -+ - audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info); - if (audit_buf != NULL) { - audit_log_format(audit_buf, -@@ -605,40 +617,29 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, - audit_log_end(audit_buf); - } - -- if (ret_val == 0) { -- struct netlbl_af4list *iter4; -- struct netlbl_domaddr4_map *map4; --#if IS_ENABLED(CONFIG_IPV6) -- struct netlbl_af6list *iter6; -- struct netlbl_domaddr6_map *map6; --#endif /* IPv6 */ -- -- switch (entry->def.type) { -- case NETLBL_NLTYPE_ADDRSELECT: -- netlbl_af4list_foreach_rcu(iter4, -- &entry->def.addrsel->list4) { -- map4 = netlbl_domhsh_addr4_entry(iter4); -- cipso_v4_doi_putdef(map4->def.cipso); -- } -+ switch (entry->def.type) { -+ case NETLBL_NLTYPE_ADDRSELECT: -+ netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) { -+ map4 = netlbl_domhsh_addr4_entry(iter4); -+ cipso_v4_doi_putdef(map4->def.cipso); -+ } - #if IS_ENABLED(CONFIG_IPV6) -- netlbl_af6list_foreach_rcu(iter6, -- &entry->def.addrsel->list6) { -- map6 = netlbl_domhsh_addr6_entry(iter6); -- calipso_doi_putdef(map6->def.calipso); -- } -+ netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) { -+ map6 = netlbl_domhsh_addr6_entry(iter6); -+ calipso_doi_putdef(map6->def.calipso); -+ } - #endif /* IPv6 */ -- break; -- case NETLBL_NLTYPE_CIPSOV4: -- cipso_v4_doi_putdef(entry->def.cipso); -- break; -+ break; -+ case NETLBL_NLTYPE_CIPSOV4: -+ cipso_v4_doi_putdef(entry->def.cipso); -+ break; - #if IS_ENABLED(CONFIG_IPV6) -- case NETLBL_NLTYPE_CALIPSO: -- calipso_doi_putdef(entry->def.calipso); -- break; -+ case NETLBL_NLTYPE_CALIPSO: -+ calipso_doi_putdef(entry->def.calipso); -+ break; - #endif /* IPv6 */ -- } -- call_rcu(&entry->rcu, netlbl_domhsh_free_entry); - } -+ call_rcu(&entry->rcu, netlbl_domhsh_free_entry); - - return ret_val; - } -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index b1eb12d33b9a6..6a5086e586efb 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -1177,9 +1177,27 @@ static void taprio_offload_config_changed(struct taprio_sched *q) - spin_unlock(&q->current_entry_lock); - } - --static void taprio_sched_to_offload(struct taprio_sched *q, -+static u32 tc_map_to_queue_mask(struct net_device *dev, u32 tc_mask) -+{ -+ u32 i, queue_mask = 0; -+ -+ for (i = 0; i < dev->num_tc; i++) { -+ u32 offset, count; -+ -+ if (!(tc_mask & BIT(i))) -+ continue; -+ -+ offset = dev->tc_to_txq[i].offset; -+ count = dev->tc_to_txq[i].count; -+ -+ queue_mask |= GENMASK(offset + count - 1, offset); -+ } -+ -+ return queue_mask; -+} -+ -+static void taprio_sched_to_offload(struct net_device *dev, - struct sched_gate_list *sched, -- const struct tc_mqprio_qopt *mqprio, - struct tc_taprio_qopt_offload *offload) - { - struct sched_entry *entry; -@@ -1194,7 +1212,8 @@ static void taprio_sched_to_offload(struct taprio_sched *q, - - e->command = entry->command; - e->interval = entry->interval; -- e->gate_mask = entry->gate_mask; -+ e->gate_mask = tc_map_to_queue_mask(dev, entry->gate_mask); -+ - i++; - } - -@@ -1202,7 +1221,6 @@ static void taprio_sched_to_offload(struct taprio_sched *q, - } - - static int taprio_enable_offload(struct net_device *dev, -- struct tc_mqprio_qopt *mqprio, - struct taprio_sched *q, - struct sched_gate_list *sched, - struct netlink_ext_ack *extack) -@@ -1224,7 +1242,7 @@ static int taprio_enable_offload(struct net_device *dev, - return -ENOMEM; - } - offload->enable = 1; -- taprio_sched_to_offload(q, sched, mqprio, offload); -+ taprio_sched_to_offload(dev, sched, offload); - - err = ops->ndo_setup_tc(dev, TC_SETUP_QDISC_TAPRIO, offload); - if (err < 0) { -@@ -1486,7 +1504,7 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, - } - - if (FULL_OFFLOAD_IS_ENABLED(q->flags)) -- err = taprio_enable_offload(dev, mqprio, q, new_admin, extack); -+ err = taprio_enable_offload(dev, q, new_admin, extack); - else - err = taprio_disable_offload(dev, q, extack); - if (err) -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 58fe6556cdf5b..3a11212bb4c0e 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -8176,8 +8176,6 @@ static int sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - - pr_debug("%s: begins, snum:%d\n", __func__, snum); - -- local_bh_disable(); -- - if (snum == 0) { - /* Search for an available port. */ - int low, high, remaining, index; -@@ -8196,20 +8194,21 @@ static int sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - continue; - index = sctp_phashfn(sock_net(sk), rover); - head = &sctp_port_hashtable[index]; -- spin_lock(&head->lock); -+ spin_lock_bh(&head->lock); - sctp_for_each_hentry(pp, &head->chain) - if ((pp->port == rover) && - net_eq(sock_net(sk), pp->net)) - goto next; - break; - next: -- spin_unlock(&head->lock); -+ spin_unlock_bh(&head->lock); -+ cond_resched(); - } while (--remaining > 0); - - /* Exhausted local port range during search? */ - ret = 1; - if (remaining <= 0) -- goto fail; -+ return ret; - - /* OK, here is the one we will use. HEAD (the port - * hash table list entry) is non-NULL and we hold it's -@@ -8224,7 +8223,7 @@ static int sctp_get_port_local(struct sock *sk, union sctp_addr *addr) - * port iterator, pp being NULL. - */ - head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)]; -- spin_lock(&head->lock); -+ spin_lock_bh(&head->lock); - sctp_for_each_hentry(pp, &head->chain) { - if ((pp->port == snum) && net_eq(pp->net, sock_net(sk))) - goto pp_found; -@@ -8324,10 +8323,7 @@ success: - ret = 0; - - fail_unlock: -- spin_unlock(&head->lock); -- --fail: -- local_bh_enable(); -+ spin_unlock_bh(&head->lock); - return ret; - } - -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index aea951a1f805b..5318bb6611abc 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -2616,18 +2616,21 @@ static int tipc_shutdown(struct socket *sock, int how) - - trace_tipc_sk_shutdown(sk, NULL, TIPC_DUMP_ALL, " "); - __tipc_shutdown(sock, TIPC_CONN_SHUTDOWN); -- sk->sk_shutdown = SEND_SHUTDOWN; -+ if (tipc_sk_type_connectionless(sk)) -+ sk->sk_shutdown = SHUTDOWN_MASK; -+ else -+ sk->sk_shutdown = SEND_SHUTDOWN; - - if (sk->sk_state == TIPC_DISCONNECTING) { - /* Discard any unreceived messages */ - __skb_queue_purge(&sk->sk_receive_queue); - -- /* Wake up anyone sleeping in poll */ -- sk->sk_state_change(sk); - res = 0; - } else { - res = -ENOTCONN; - } -+ /* Wake up anyone sleeping in poll. */ -+ sk->sk_state_change(sk); - - release_sock(sk); - return res; diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.195-196.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.195-196.patch new file mode 100644 index 0000000000..508cd1afe2 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.195-196.patch @@ -0,0 +1,3387 @@ +diff --git a/Makefile b/Makefile +index a5946969f4fcb..5c8b785f72919 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 195 ++SUBLEVEL = 196 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +index 69ba1d79bcd5d..b24493ad44b0f 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916-pins.dtsi +@@ -555,7 +555,7 @@ + pins = "gpio63", "gpio64", "gpio65", "gpio66", + "gpio67", "gpio68"; + drive-strength = <2>; +- bias-disable; ++ bias-pull-down; + }; + }; + }; +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index 4a8fdbb292863..0ad952e074457 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -444,7 +444,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par, + * making sure it is a kernel address and not a PC-relative + * reference. + */ +- asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va)); ++ asm volatile("ldr %0, =%1" : "=r" (str_va) : "S" (__hyp_panic_string)); + + __hyp_do_panic(str_va, + spsr, elr, +diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c +index 530a36f465ced..afcc86726448e 100644 +--- a/arch/mips/vdso/genvdso.c ++++ b/arch/mips/vdso/genvdso.c +@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size) + if (fstat(fd, &stat) != 0) { + fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name, + path, strerror(errno)); ++ close(fd); + return NULL; + } + +@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size) + if (addr == MAP_FAILED) { + fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name, + path, strerror(errno)); ++ close(fd); + return NULL; + } + +@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size) + if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) { + fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name, + path); ++ close(fd); + return NULL; + } + +@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size) + default: + fprintf(stderr, "%s: '%s' has invalid ELF class\n", + program_name, path); ++ close(fd); + return NULL; + } + +@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size) + default: + fprintf(stderr, "%s: '%s' has invalid ELF data order\n", + program_name, path); ++ close(fd); + return NULL; + } + +@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size) + fprintf(stderr, + "%s: '%s' has invalid ELF machine (expected EM_MIPS)\n", + program_name, path); ++ close(fd); + return NULL; + } else if (swap_uint16(ehdr->e_type) != ET_DYN) { + fprintf(stderr, + "%s: '%s' has invalid ELF type (expected ET_DYN)\n", + program_name, path); ++ close(fd); + return NULL; + } + + *_size = stat.st_size; ++ close(fd); + return addr; + } + +@@ -284,10 +292,12 @@ int main(int argc, char **argv) + /* Calculate and write symbol offsets to */ + if (!get_symbols(dbg_vdso_path, dbg_vdso)) { + unlink(out_path); ++ fclose(out_file); + return EXIT_FAILURE; + } + + fprintf(out_file, "};\n"); ++ fclose(out_file); + + return EXIT_SUCCESS; + } +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 9daede99c1316..f52e2c55a12b2 100644 +--- a/arch/powerpc/kernel/cpu_setup_power.S ++++ b/arch/powerpc/kernel/cpu_setup_power.S +@@ -189,7 +189,7 @@ __init_LPCR_ISA300: + + __init_FSCR: + mfspr r3,SPRN_FSCR +- ori r3,r3,FSCR_TAR|FSCR_DSCR|FSCR_EBB ++ ori r3,r3,FSCR_TAR|FSCR_EBB + mtspr SPRN_FSCR,r3 + blr + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 3188040022c4f..78f75e48dfe7f 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2096,6 +2096,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + + if (perf_event_overflow(event, &data, regs)) + power_pmu_stop(event, 0); ++ } else if (period) { ++ /* Account for interrupt in case of invalid SIAR */ ++ if (perf_event_account_interrupt(event)) ++ power_pmu_stop(event, 0); + } + } + +diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig +index 9f5958f169234..741a8fa8a3e6b 100644 +--- a/arch/powerpc/platforms/cell/Kconfig ++++ b/arch/powerpc/platforms/cell/Kconfig +@@ -46,6 +46,7 @@ config SPU_FS + tristate "SPU file system" + default m + depends on PPC_CELL ++ depends on COREDUMP + select SPU_BASE + help + The SPU file system is used to access Synergistic Processing +diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c +index 30cdcbfa1c04e..b0e96f4b728c1 100644 +--- a/arch/powerpc/sysdev/xive/native.c ++++ b/arch/powerpc/sysdev/xive/native.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -630,6 +631,7 @@ static bool xive_native_provision_pages(void) + pr_err("Failed to allocate provisioning page\n"); + return false; + } ++ kmemleak_ignore(p); + opal_xive_donate_page(chip, __pa(p)); + } + return true; +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 93c2fc58013ed..3c14f0c4ef87f 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -3074,9 +3074,9 @@ static inline bool fwnode_is_primary(struct fwnode_handle *fwnode) + */ + void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + { +- if (fwnode) { +- struct fwnode_handle *fn = dev->fwnode; ++ struct fwnode_handle *fn = dev->fwnode; + ++ if (fwnode) { + if (fwnode_is_primary(fn)) + fn = fn->secondary; + +@@ -3086,8 +3086,12 @@ void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode) + } + dev->fwnode = fwnode; + } else { +- dev->fwnode = fwnode_is_primary(dev->fwnode) ? +- dev->fwnode->secondary : NULL; ++ if (fwnode_is_primary(fn)) { ++ dev->fwnode = fn->secondary; ++ fn->secondary = NULL; ++ } else { ++ dev->fwnode = NULL; ++ } + } + } + EXPORT_SYMBOL_GPL(set_primary_fwnode); +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 0e7fa1f27ad46..4fd49d55bc3e2 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1500,13 +1500,17 @@ static int __device_suspend(struct device *dev, pm_message_t state, bool async) + } + + /* +- * If a device configured to wake up the system from sleep states +- * has been suspended at run time and there's a resume request pending +- * for it, this is equivalent to the device signaling wakeup, so the +- * system suspend operation should be aborted. ++ * Wait for possible runtime PM transitions of the device in progress ++ * to complete and if there's a runtime resume request pending for it, ++ * resume it before proceeding with invoking the system-wide suspend ++ * callbacks for it. ++ * ++ * If the system-wide suspend callbacks below change the configuration ++ * of the device, they must disable runtime PM for it or otherwise ++ * ensure that its runtime-resume callbacks will not be confused by that ++ * change in case they are invoked going forward. + */ +- if (pm_runtime_barrier(dev) && device_may_wakeup(dev)) +- pm_wakeup_event(dev, 0); ++ pm_runtime_barrier(dev); + + if (pm_wakeup_pending()) { + dev->power.direct_complete = false; +diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c +index b12e373aa956a..ec670a1b7e02f 100644 +--- a/drivers/block/null_blk.c ++++ b/drivers/block/null_blk.c +@@ -1135,7 +1135,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) + len = bvec.bv_len; + err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset, + op_is_write(req_op(rq)), sector, +- req_op(rq) & REQ_FUA); ++ rq->cmd_flags & REQ_FUA); + if (err) { + spin_unlock_irq(&nullb->lock); + return err; +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index dcf5bb1534955..11ec5c2715a9e 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -247,13 +247,8 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->cdev.owner = THIS_MODULE; + chip->cdevs.owner = THIS_MODULE; + +- chip->work_space.context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); +- if (!chip->work_space.context_buf) { +- rc = -ENOMEM; +- goto out; +- } +- chip->work_space.session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); +- if (!chip->work_space.session_buf) { ++ rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); ++ if (rc) { + rc = -ENOMEM; + goto out; + } +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index d53d12f3df6d6..019fe80fedd83 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -174,6 +174,7 @@ struct tpm_space { + u8 *context_buf; + u32 session_tbl[3]; + u8 *session_buf; ++ u32 buf_size; + }; + + enum tpm_chip_flags { +@@ -261,6 +262,9 @@ struct tpm_output_header { + + #define TPM_TAG_RQU_COMMAND 193 + ++/* TPM2 specific constants. */ ++#define TPM2_SPACE_BUFFER_SIZE 16384 /* 16 kB */ ++ + struct stclear_flags_t { + __be16 tag; + u8 deactivated; +@@ -583,7 +587,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type); + unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal); + int tpm2_probe(struct tpm_chip *chip); + int tpm2_find_cc(struct tpm_chip *chip, u32 cc); +-int tpm2_init_space(struct tpm_space *space); ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size); + void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space); + int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc, + u8 *cmd); +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index dabb2ae4e779a..115f0fb32179f 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -44,18 +44,21 @@ static void tpm2_flush_sessions(struct tpm_chip *chip, struct tpm_space *space) + } + } + +-int tpm2_init_space(struct tpm_space *space) ++int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) + { +- space->context_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); ++ space->context_buf = kzalloc(buf_size, GFP_KERNEL); + if (!space->context_buf) + return -ENOMEM; + +- space->session_buf = kzalloc(PAGE_SIZE, GFP_KERNEL); ++ space->session_buf = kzalloc(buf_size, GFP_KERNEL); + if (space->session_buf == NULL) { + kfree(space->context_buf); ++ /* Prevent caller getting a dangling pointer. */ ++ space->context_buf = NULL; + return -ENOMEM; + } + ++ space->buf_size = buf_size; + return 0; + } + +@@ -278,8 +281,10 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc, + sizeof(space->context_tbl)); + memcpy(&chip->work_space.session_tbl, &space->session_tbl, + sizeof(space->session_tbl)); +- memcpy(chip->work_space.context_buf, space->context_buf, PAGE_SIZE); +- memcpy(chip->work_space.session_buf, space->session_buf, PAGE_SIZE); ++ memcpy(chip->work_space.context_buf, space->context_buf, ++ space->buf_size); ++ memcpy(chip->work_space.session_buf, space->session_buf, ++ space->buf_size); + + rc = tpm2_load_space(chip); + if (rc) { +@@ -459,7 +464,7 @@ static int tpm2_save_space(struct tpm_chip *chip) + continue; + + rc = tpm2_save_context(chip, space->context_tbl[i], +- space->context_buf, PAGE_SIZE, ++ space->context_buf, space->buf_size, + &offset); + if (rc == -ENOENT) { + space->context_tbl[i] = 0; +@@ -478,9 +483,8 @@ static int tpm2_save_space(struct tpm_chip *chip) + continue; + + rc = tpm2_save_context(chip, space->session_tbl[i], +- space->session_buf, PAGE_SIZE, ++ space->session_buf, space->buf_size, + &offset); +- + if (rc == -ENOENT) { + /* handle error saving session, just forget it */ + space->session_tbl[i] = 0; +@@ -526,8 +530,10 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, + sizeof(space->context_tbl)); + memcpy(&space->session_tbl, &chip->work_space.session_tbl, + sizeof(space->session_tbl)); +- memcpy(space->context_buf, chip->work_space.context_buf, PAGE_SIZE); +- memcpy(space->session_buf, chip->work_space.session_buf, PAGE_SIZE); ++ memcpy(space->context_buf, chip->work_space.context_buf, ++ space->buf_size); ++ memcpy(space->session_buf, chip->work_space.session_buf, ++ space->buf_size); + + return 0; + } +diff --git a/drivers/char/tpm/tpmrm-dev.c b/drivers/char/tpm/tpmrm-dev.c +index 1a0e97a5da5a4..162fb16243d03 100644 +--- a/drivers/char/tpm/tpmrm-dev.c ++++ b/drivers/char/tpm/tpmrm-dev.c +@@ -22,7 +22,7 @@ static int tpmrm_open(struct inode *inode, struct file *file) + if (priv == NULL) + return -ENOMEM; + +- rc = tpm2_init_space(&priv->space); ++ rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { + kfree(priv); + return -ENOMEM; +diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c +index aac9b9b360b80..9e4781a807cfa 100644 +--- a/drivers/edac/ie31200_edac.c ++++ b/drivers/edac/ie31200_edac.c +@@ -147,6 +147,8 @@ + (n << (28 + (2 * skl) - PAGE_SHIFT)) + + static int nr_channels; ++static struct pci_dev *mci_pdev; ++static int ie31200_registered = 1; + + struct ie31200_priv { + void __iomem *window; +@@ -518,12 +520,16 @@ fail_free: + static int ie31200_init_one(struct pci_dev *pdev, + const struct pci_device_id *ent) + { +- edac_dbg(0, "MC:\n"); ++ int rc; + ++ edac_dbg(0, "MC:\n"); + if (pci_enable_device(pdev) < 0) + return -EIO; ++ rc = ie31200_probe1(pdev, ent->driver_data); ++ if (rc == 0 && !mci_pdev) ++ mci_pdev = pci_dev_get(pdev); + +- return ie31200_probe1(pdev, ent->driver_data); ++ return rc; + } + + static void ie31200_remove_one(struct pci_dev *pdev) +@@ -532,6 +538,8 @@ static void ie31200_remove_one(struct pci_dev *pdev) + struct ie31200_priv *priv; + + edac_dbg(0, "\n"); ++ pci_dev_put(mci_pdev); ++ mci_pdev = NULL; + mci = edac_mc_del_mc(&pdev->dev); + if (!mci) + return; +@@ -583,17 +591,53 @@ static struct pci_driver ie31200_driver = { + + static int __init ie31200_init(void) + { ++ int pci_rc, i; ++ + edac_dbg(3, "MC:\n"); + /* Ensure that the OPSTATE is set correctly for POLL or NMI */ + opstate_init(); + +- return pci_register_driver(&ie31200_driver); ++ pci_rc = pci_register_driver(&ie31200_driver); ++ if (pci_rc < 0) ++ goto fail0; ++ ++ if (!mci_pdev) { ++ ie31200_registered = 0; ++ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) { ++ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor, ++ ie31200_pci_tbl[i].device, ++ NULL); ++ if (mci_pdev) ++ break; ++ } ++ if (!mci_pdev) { ++ edac_dbg(0, "ie31200 pci_get_device fail\n"); ++ pci_rc = -ENODEV; ++ goto fail1; ++ } ++ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]); ++ if (pci_rc < 0) { ++ edac_dbg(0, "ie31200 init fail\n"); ++ pci_rc = -ENODEV; ++ goto fail1; ++ } ++ } ++ return 0; ++ ++fail1: ++ pci_unregister_driver(&ie31200_driver); ++fail0: ++ pci_dev_put(mci_pdev); ++ ++ return pci_rc; + } + + static void __exit ie31200_exit(void) + { + edac_dbg(3, "MC:\n"); + pci_unregister_driver(&ie31200_driver); ++ if (!ie31200_registered) ++ ie31200_remove_one(mci_pdev); + } + + module_init(ie31200_init); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 1eff36a875958..3992e1cbb61ca 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (encoder) { +@@ -872,8 +874,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + encoder = amdgpu_connector_best_single_encoder(connector); +@@ -996,8 +1000,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { +@@ -1371,8 +1377,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +index 6ad243293a78b..df24494299791 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +@@ -269,7 +269,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set, + + ret = pm_runtime_get_sync(dev->dev); + if (ret < 0) +- return ret; ++ goto out; + + ret = drm_crtc_helper_set_config(set, ctx); + +@@ -284,7 +284,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set, + take the current one */ + if (active && !adev->have_disp_power_ref) { + adev->have_disp_power_ref = true; +- return ret; ++ goto out; + } + /* if we have no active crtcs, then drop the power ref + we got before */ +@@ -293,6 +293,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set, + adev->have_disp_power_ref = false; + } + ++out: + /* drop the power reference we got coming in here */ + pm_runtime_put_autosuspend(dev->dev); + return ret; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index ae23f7e0290c3..465ece90e63ab 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -801,11 +801,12 @@ long amdgpu_drm_ioctl(struct file *filp, + dev = file_priv->minor->dev; + ret = pm_runtime_get_sync(dev->dev); + if (ret < 0) +- return ret; ++ goto out; + + ret = drm_ioctl(filp, cmd, arg); + + pm_runtime_mark_last_busy(dev->dev); ++out: + pm_runtime_put_autosuspend(dev->dev); + return ret; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 22d9ec80a2ffd..df5ed16f7fb7c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -502,8 +502,12 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + * in the bitfields */ + if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK) + se_num = 0xffffffff; ++ else if (se_num >= AMDGPU_GFX_MAX_SE) ++ return -EINVAL; + if (sh_num == AMDGPU_INFO_MMR_SH_INDEX_MASK) + sh_num = 0xffffffff; ++ else if (sh_num >= AMDGPU_GFX_MAX_SH_PER_SE) ++ return -EINVAL; + + if (info->read_mmr_reg.count > 128) + return -EINVAL; +@@ -785,7 +789,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + + r = pm_runtime_get_sync(dev->dev); + if (r < 0) +- return r; ++ goto pm_put; + + fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); + if (unlikely(!fpriv)) { +@@ -824,6 +828,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + + out_suspend: + pm_runtime_mark_last_busy(dev->dev); ++pm_put: + pm_runtime_put_autosuspend(dev->dev); + + return r; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index e0b78fd9804de..ab79c1030f005 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -821,8 +821,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, + + ret = kobject_init_and_add(dev->kobj_node, &node_type, + sys_props.kobj_nodes, "%d", id); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(dev->kobj_node); + return ret; ++ } + + dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node); + if (!dev->kobj_mem) +@@ -865,8 +867,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, + return -ENOMEM; + ret = kobject_init_and_add(mem->kobj, &mem_type, + dev->kobj_mem, "%d", i); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(mem->kobj); + return ret; ++ } + + mem->attr.name = "properties"; + mem->attr.mode = KFD_SYSFS_FILE_MODE; +@@ -884,8 +888,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, + return -ENOMEM; + ret = kobject_init_and_add(cache->kobj, &cache_type, + dev->kobj_cache, "%d", i); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(cache->kobj); + return ret; ++ } + + cache->attr.name = "properties"; + cache->attr.mode = KFD_SYSFS_FILE_MODE; +@@ -903,8 +909,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev, + return -ENOMEM; + ret = kobject_init_and_add(iolink->kobj, &iolink_type, + dev->kobj_iolink, "%d", i); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(iolink->kobj); + return ret; ++ } + + iolink->attr.name = "properties"; + iolink->attr.mode = KFD_SYSFS_FILE_MODE; +@@ -956,8 +964,10 @@ static int kfd_topology_update_sysfs(void) + ret = kobject_init_and_add(sys_props.kobj_topology, + &sysprops_type, &kfd_device->kobj, + "topology"); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(sys_props.kobj_topology); + return ret; ++ } + + sys_props.kobj_nodes = kobject_create_and_add("nodes", + sys_props.kobj_topology); +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 4a7d50a96d36f..b5c8219c54557 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -580,8 +580,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + pm_runtime_get_noresume(dev->dev); + } else { + ret = pm_runtime_get_sync(dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put_autosuspend(dev->dev); + return conn_status; ++ } + } + + nv_encoder = nouveau_connector_ddc_detect(connector); +diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +index 9ffb09679cc4a..cae1beabcd05d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -184,8 +184,10 @@ nouveau_fbcon_open(struct fb_info *info, int user) + struct nouveau_fbdev *fbcon = info->par; + struct nouveau_drm *drm = nouveau_drm(fbcon->helper.dev); + int ret = pm_runtime_get_sync(drm->dev->dev); +- if (ret < 0 && ret != -EACCES) ++ if (ret < 0 && ret != -EACCES) { ++ pm_runtime_put(drm->dev->dev); + return ret; ++ } + return 0; + } + +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 48f752cf7a920..fc021b8e4077d 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -895,8 +895,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (encoder) { +@@ -1041,8 +1043,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + encoder = radeon_best_single_encoder(connector); +@@ -1179,8 +1183,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + encoder = radeon_best_single_encoder(connector); +@@ -1263,8 +1269,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (radeon_connector->detected_hpd_without_ddc) { +@@ -1704,8 +1712,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + + if (!drm_kms_helper_is_poll_worker()) { + r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) ++ if (r < 0) { ++ pm_runtime_put_autosuspend(connector->dev->dev); + return connector_status_disconnected; ++ } + } + + if (!force && radeon_check_hpd_status_unchanged(connector)) { +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 7842d76aa813b..0294cac4c856d 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -406,6 +406,19 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) + dev_err(&client->dev, "failed to change power setting.\n"); + + set_pwr_exit: ++ ++ /* ++ * The HID over I2C specification states that if a DEVICE needs time ++ * after the PWR_ON request, it should utilise CLOCK stretching. ++ * However, it has been observered that the Windows driver provides a ++ * 1ms sleep between the PWR_ON and RESET requests. ++ * According to Goodix Windows even waits 60 ms after (other?) ++ * PWR_ON requests. Testing has confirmed that several devices ++ * will not work properly without a delay after a PWR_ON request. ++ */ ++ if (!ret && power_state == I2C_HID_PWR_ON) ++ msleep(60); ++ + return ret; + } + +@@ -427,15 +440,6 @@ static int i2c_hid_hwreset(struct i2c_client *client) + if (ret) + goto out_unlock; + +- /* +- * The HID over I2C specification states that if a DEVICE needs time +- * after the PWR_ON request, it should utilise CLOCK stretching. +- * However, it has been observered that the Windows driver provides a +- * 1ms sleep between the PWR_ON and RESET requests and that some devices +- * rely on this. +- */ +- usleep_range(1000, 5000); +- + i2c_hid_dbg(ihid, "resetting...\n"); + + ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index d9602f3a359e1..5f56feb468c15 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -532,12 +532,16 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, + + switch (cmd) { + case HIDIOCGUSAGE: ++ if (uref->usage_index >= field->report_count) ++ goto inval; + uref->value = field->value[uref->usage_index]; + if (copy_to_user(user_arg, uref, sizeof(*uref))) + goto fault; + goto goodreturn; + + case HIDIOCSUSAGE: ++ if (uref->usage_index >= field->report_count) ++ goto inval; + field->value[uref->usage_index] = uref->value; + goto goodreturn; + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index ed0f068109785..d5d0809a6283c 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -545,6 +545,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 4edf65dbbcab5..2c97d2552c5bd 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -845,7 +845,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad) + for (i = 0 ; i < mag->size; ++i) { + struct iova *iova = private_find_iova(iovad, mag->pfns[i]); + +- BUG_ON(!iova); ++ if (WARN_ON(!iova)) ++ continue; ++ + private_free_iova(iovad, iova); + } + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 8f070debe4982..777343cff5f1e 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -547,14 +547,14 @@ static int adjoin(struct dm_table *table, struct dm_target *ti) + * On the other hand, dm-switch needs to process bulk data using messages and + * excessive use of GFP_NOIO could cause trouble. + */ +-static char **realloc_argv(unsigned *array_size, char **old_argv) ++static char **realloc_argv(unsigned *size, char **old_argv) + { + char **argv; + unsigned new_size; + gfp_t gfp; + +- if (*array_size) { +- new_size = *array_size * 2; ++ if (*size) { ++ new_size = *size * 2; + gfp = GFP_KERNEL; + } else { + new_size = 8; +@@ -562,8 +562,8 @@ static char **realloc_argv(unsigned *array_size, char **old_argv) + } + argv = kmalloc(new_size * sizeof(*argv), gfp); + if (argv) { +- memcpy(argv, old_argv, *array_size * sizeof(*argv)); +- *array_size = new_size; ++ memcpy(argv, old_argv, *size * sizeof(*argv)); ++ *size = new_size; + } + + kfree(old_argv); +diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c +index 21a5f45e0259e..66ef06f4670c8 100644 +--- a/drivers/media/cec/cec-api.c ++++ b/drivers/media/cec/cec-api.c +@@ -159,7 +159,13 @@ static long cec_adap_g_log_addrs(struct cec_adapter *adap, + struct cec_log_addrs log_addrs; + + mutex_lock(&adap->lock); +- log_addrs = adap->log_addrs; ++ /* ++ * We use memcpy here instead of assignment since there is a ++ * hole at the end of struct cec_log_addrs that an assignment ++ * might ignore. So when we do copy_to_user() we could leak ++ * one byte of memory. ++ */ ++ memcpy(&log_addrs, &adap->log_addrs, sizeof(log_addrs)); + if (!adap->is_configured) + memset(log_addrs.log_addr, CEC_LOG_ADDR_INVALID, + sizeof(log_addrs.log_addr)); +diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c +index f46947d8adf8f..fcc053d95ae49 100644 +--- a/drivers/media/pci/ttpci/av7110.c ++++ b/drivers/media/pci/ttpci/av7110.c +@@ -423,14 +423,15 @@ static void debiirq(unsigned long cookie) + case DATA_CI_GET: + { + u8 *data = av7110->debi_virt; ++ u8 data_0 = data[0]; + +- if ((data[0] < 2) && data[2] == 0xff) { ++ if (data_0 < 2 && data[2] == 0xff) { + int flags = 0; + if (data[5] > 0) + flags |= CA_CI_MODULE_PRESENT; + if (data[5] > 5) + flags |= CA_CI_MODULE_READY; +- av7110->ci_slot[data[0]].flags = flags; ++ av7110->ci_slot[data_0].flags = flags; + } else + ci_get_data(&av7110->ci_rbuffer, + av7110->debi_virt, +diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c +index dc8fc2120b63f..acc52d28c5c45 100644 +--- a/drivers/media/platform/davinci/vpif_capture.c ++++ b/drivers/media/platform/davinci/vpif_capture.c +@@ -1489,8 +1489,6 @@ probe_out: + /* Unregister video device */ + video_unregister_device(&ch->video_dev); + } +- kfree(vpif_obj.sd); +- v4l2_device_unregister(&vpif_obj.v4l2_dev); + + return err; + } +diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c +index cd476cab97820..4e70b67ccd181 100644 +--- a/drivers/media/rc/gpio-ir-tx.c ++++ b/drivers/media/rc/gpio-ir-tx.c +@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf, + // space + edge = ktime_add_us(edge, txbuf[i]); + delta = ktime_us_delta(edge, ktime_get()); +- if (delta > 10) { +- spin_unlock_irqrestore(&gpio_ir->lock, flags); +- usleep_range(delta, delta + 10); +- spin_lock_irqsave(&gpio_ir->lock, flags); +- } else if (delta > 0) { ++ if (delta > 0) + udelay(delta); +- } + } else { + // pulse + ktime_t last = ktime_add_us(edge, txbuf[i]); +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c +index 0504761516f7b..a12bb8ed20405 100644 +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -176,6 +176,9 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x1ac4), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info }, ++ /* EBG */ ++ { PCI_VDEVICE(INTEL, 0x1bad), (kernel_ulong_t)&bxt_uart_info }, ++ { PCI_VDEVICE(INTEL, 0x1bae), (kernel_ulong_t)&bxt_uart_info }, + /* GLK */ + { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info }, + { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info }, +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index e4a2c74a9b47e..6b95334e172d1 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) + continue; + + err = gfar_parse_group(child, priv, model); +- if (err) ++ if (err) { ++ of_node_put(child); + goto err_grp_init; ++ } + } + } else { /* SQ_SG_MODE */ + err = gfar_parse_group(np, priv, model); +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index cd32d6623f6a3..11b7006142cec 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -187,12 +187,21 @@ static void ipvlan_port_destroy(struct net_device *dev) + kfree(port); + } + ++#define IPVLAN_ALWAYS_ON_OFLOADS \ ++ (NETIF_F_SG | NETIF_F_HW_CSUM | \ ++ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL) ++ ++#define IPVLAN_ALWAYS_ON \ ++ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED) ++ + #define IPVLAN_FEATURES \ +- (NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ ++ (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \ + NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \ + NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \ + NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER) + ++ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */ ++ + #define IPVLAN_STATE_MASK \ + ((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT)) + +@@ -205,7 +214,9 @@ static int ipvlan_init(struct net_device *dev) + dev->state = (dev->state & ~IPVLAN_STATE_MASK) | + (phy_dev->state & IPVLAN_STATE_MASK); + dev->features = phy_dev->features & IPVLAN_FEATURES; +- dev->features |= NETIF_F_LLTX; ++ dev->features |= IPVLAN_ALWAYS_ON; ++ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES; ++ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS; + dev->gso_max_size = phy_dev->gso_max_size; + dev->gso_max_segs = phy_dev->gso_max_segs; + dev->hard_header_len = phy_dev->hard_header_len; +@@ -293,7 +304,14 @@ static netdev_features_t ipvlan_fix_features(struct net_device *dev, + { + struct ipvl_dev *ipvlan = netdev_priv(dev); + +- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES); ++ features |= NETIF_F_ALL_FOR_ALL; ++ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES); ++ features = netdev_increment_features(ipvlan->phy_dev->features, ++ features, features); ++ features |= IPVLAN_ALWAYS_ON; ++ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON); ++ ++ return features; + } + + static void ipvlan_change_rx_flags(struct net_device *dev, int change) +@@ -743,10 +761,9 @@ static int ipvlan_device_event(struct notifier_block *unused, + + case NETDEV_FEAT_CHANGE: + list_for_each_entry(ipvlan, &port->ipvlans, pnode) { +- ipvlan->dev->features = dev->features & IPVLAN_FEATURES; + ipvlan->dev->gso_max_size = dev->gso_max_size; + ipvlan->dev->gso_max_segs = dev->gso_max_segs; +- netdev_features_change(ipvlan->dev); ++ netdev_update_features(ipvlan->dev); + } + break; + +diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h +index 0c089f6dd3d92..6a8c5f71787ad 100644 +--- a/drivers/net/wireless/ath/ath10k/hw.h ++++ b/drivers/net/wireless/ath/ath10k/hw.h +@@ -702,7 +702,7 @@ ath10k_rx_desc_get_l3_pad_bytes(struct ath10k_hw_params *hw, + + #define TARGET_10_4_TX_DBG_LOG_SIZE 1024 + #define TARGET_10_4_NUM_WDS_ENTRIES 32 +-#define TARGET_10_4_DMA_BURST_SIZE 0 ++#define TARGET_10_4_DMA_BURST_SIZE 1 + #define TARGET_10_4_MAC_AGGR_DELIM 0 + #define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1 + #define TARGET_10_4_VOW_CONFIG 0 +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 7a050a75bdcbb..4fa4d877f913b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -739,8 +739,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw) + + usb_anchor_urb(urb, &rtlusb->rx_submitted); + err = usb_submit_urb(urb, GFP_KERNEL); +- if (err) ++ if (err) { ++ usb_unanchor_urb(urb); ++ usb_free_urb(urb); + goto err_out; ++ } + usb_free_urb(urb); + } + return 0; +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 058d542647dd5..13c89cc9d10cf 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1492,7 +1492,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) { + dev_err(ctrl->dev, + "FCP Op failed - cmdiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + goto out_on_error; + } + +@@ -1502,7 +1502,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) { + dev_err(ctrl->dev, + "FCP Op failed - rspiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + } + + atomic_set(&op->state, FCPOP_STATE_IDLE); +diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c +index e42909524deed..379925fc49d4e 100644 +--- a/drivers/pci/slot.c ++++ b/drivers/pci/slot.c +@@ -303,13 +303,16 @@ placeholder: + slot_name = make_slot_name(name); + if (!slot_name) { + err = -ENOMEM; ++ kfree(slot); + goto err; + } + + err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL, + "%s", slot_name); +- if (err) ++ if (err) { ++ kobject_put(&slot->kobj); + goto err; ++ } + + INIT_LIST_HEAD(&slot->list); + list_add(&slot->list, &parent->slots); +@@ -328,7 +331,6 @@ out: + mutex_unlock(&pci_slot_mutex); + return slot; + err: +- kfree(slot); + slot = ERR_PTR(err); + goto out; + } +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index dadff1838fec1..e2026d54dd375 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -581,6 +581,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) + rc = css_evaluate_known_subchannel(sch, 1); + if (rc == -EAGAIN) + css_schedule_eval(sch->schid); ++ /* ++ * The loop might take long time for platforms with lots of ++ * known devices. Allow scheduling here. ++ */ ++ cond_resched(); + } + return 0; + } +diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c +index d95ba1a07ba3b..eaab59afd90c7 100644 +--- a/drivers/scsi/fcoe/fcoe_ctlr.c ++++ b/drivers/scsi/fcoe/fcoe_ctlr.c +@@ -267,9 +267,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new) + WARN_ON(!fcf_dev); + new->fcf_dev = NULL; + fcoe_fcf_device_delete(fcf_dev); +- kfree(new); + mutex_unlock(&cdev->lock); + } ++ kfree(new); + } + + /** +diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c +index c714482bf4c55..9c738e201f462 100644 +--- a/drivers/scsi/lpfc/lpfc_vport.c ++++ b/drivers/scsi/lpfc/lpfc_vport.c +@@ -644,27 +644,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport) + vport->port_state < LPFC_VPORT_READY) + return -EAGAIN; + } ++ + /* +- * This is a bit of a mess. We want to ensure the shost doesn't get +- * torn down until we're done with the embedded lpfc_vport structure. +- * +- * Beyond holding a reference for this function, we also need a +- * reference for outstanding I/O requests we schedule during delete +- * processing. But once we scsi_remove_host() we can no longer obtain +- * a reference through scsi_host_get(). +- * +- * So we take two references here. We release one reference at the +- * bottom of the function -- after delinking the vport. And we +- * release the other at the completion of the unreg_vpi that get's +- * initiated after we've disposed of all other resources associated +- * with the port. ++ * Take early refcount for outstanding I/O requests we schedule during ++ * delete processing for unreg_vpi. Always keep this before ++ * scsi_remove_host() as we can no longer obtain a reference through ++ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. + */ + if (!scsi_host_get(shost)) + return VPORT_INVAL; +- if (!scsi_host_get(shost)) { +- scsi_host_put(shost); +- return VPORT_INVAL; +- } ++ + lpfc_free_sysfs_attr(vport); + + lpfc_debugfs_terminate(vport); +@@ -811,8 +800,9 @@ skip_logo: + if (!(vport->vpi_state & LPFC_VPI_REGISTERED) || + lpfc_mbx_unreg_vpi(vport)) + scsi_host_put(shost); +- } else ++ } else { + scsi_host_put(shost); ++ } + + lpfc_free_vpi(phba, vport->vpi); + vport->work_port_events = 0; +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 9589015234693..c3170500a1a1d 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -3172,7 +3172,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport, + pr_err("%s could not find host no %u\n", + __func__, ev->u.set_flashnode.host_no); + err = -ENODEV; +- goto put_host; ++ goto exit_set_fnode; + } + + idx = ev->u.set_flashnode.flashnode_idx; +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 11e917b44a0f1..c1792f271ac5d 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1425,6 +1425,7 @@ unblock_reqs: + int ufshcd_hold(struct ufs_hba *hba, bool async) + { + int rc = 0; ++ bool flush_result; + unsigned long flags; + + if (!ufshcd_is_clkgating_allowed(hba)) +@@ -1456,7 +1457,9 @@ start: + break; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +- flush_work(&hba->clk_gating.ungate_work); ++ flush_result = flush_work(&hba->clk_gating.ungate_work); ++ if (hba->clk_gating.is_suspended && !flush_result) ++ goto out; + spin_lock_irqsave(hba->host->host_lock, flags); + goto start; + } +@@ -5370,7 +5373,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) + */ + static irqreturn_t ufshcd_intr(int irq, void *__hba) + { +- u32 intr_status, enabled_intr_status; ++ u32 intr_status, enabled_intr_status = 0; + irqreturn_t retval = IRQ_NONE; + struct ufs_hba *hba = __hba; + int retries = hba->nutrs; +@@ -5384,7 +5387,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + * read, make sure we handle them by checking the interrupt status + * again in a loop until we process all of the reqs before returning. + */ +- do { ++ while (intr_status && retries--) { + enabled_intr_status = + intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + if (intr_status) +@@ -5395,7 +5398,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + } + + intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); +- } while (intr_status && --retries); ++ } + + spin_unlock(hba->host->host_lock); + return retval; +@@ -5691,7 +5694,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + /* command completed already */ + dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n", + __func__, tag); +- goto out; ++ goto cleanup; + } else { + dev_err(hba->dev, + "%s: no response from device. tag = %d, err %d\n", +@@ -5725,6 +5728,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + goto out; + } + ++cleanup: + scsi_dma_unmap(cmd); + + spin_lock_irqsave(host->host_lock, flags); +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index ba9743fa2326d..179749f354c33 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -254,7 +254,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz) + { + u32 div, mbrdiv; + +- div = DIV_ROUND_UP(spi->clk_rate, speed_hz); ++ /* Ensure spi->clk_rate is even */ ++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); + + /* + * SPI framework set xfer->speed_hz to master->max_speed_hz if +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index c4a5fb6f038fc..96601fda47b18 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -997,7 +997,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev) + struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned; + struct tcmu_cmd *cmd; + +- tcmu_flush_dcache_range(entry, sizeof(*entry)); ++ /* ++ * Flush max. up to end of cmd ring since current entry might ++ * be a padding that is shorter than sizeof(*entry) ++ */ ++ size_t ring_left = head_to_end(udev->cmdr_last_cleaned, ++ udev->cmdr_size); ++ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ? ++ ring_left : sizeof(*entry)); + + if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) { + UPDATE_HEAD(udev->cmdr_last_cleaned, +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index ed81128bb42e0..fd7d9aa1de9a7 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -629,6 +629,24 @@ static const struct exar8250_board pbn_exar_XR17V35x = { + .exit = pci_xr17v35x_exit, + }; + ++static const struct exar8250_board pbn_fastcom35x_2 = { ++ .num_ports = 2, ++ .setup = pci_xr17v35x_setup, ++ .exit = pci_xr17v35x_exit, ++}; ++ ++static const struct exar8250_board pbn_fastcom35x_4 = { ++ .num_ports = 4, ++ .setup = pci_xr17v35x_setup, ++ .exit = pci_xr17v35x_exit, ++}; ++ ++static const struct exar8250_board pbn_fastcom35x_8 = { ++ .num_ports = 8, ++ .setup = pci_xr17v35x_setup, ++ .exit = pci_xr17v35x_exit, ++}; ++ + static const struct exar8250_board pbn_exar_XR17V4358 = { + .num_ports = 12, + .has_slave = true, +@@ -701,9 +719,9 @@ static const struct pci_device_id exar_pci_tbl[] = { + EXAR_DEVICE(EXAR, EXAR_XR17V358, pbn_exar_XR17V35x), + EXAR_DEVICE(EXAR, EXAR_XR17V4358, pbn_exar_XR17V4358), + EXAR_DEVICE(EXAR, EXAR_XR17V8358, pbn_exar_XR17V8358), +- EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_exar_XR17V35x), +- EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_exar_XR17V35x), +- EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_exar_XR17V35x), ++ EXAR_DEVICE(COMMTECH, COMMTECH_4222PCIE, pbn_fastcom35x_2), ++ EXAR_DEVICE(COMMTECH, COMMTECH_4224PCIE, pbn_fastcom35x_4), ++ EXAR_DEVICE(COMMTECH, COMMTECH_4228PCIE, pbn_fastcom35x_8), + + EXAR_DEVICE(COMMTECH, COMMTECH_4222PCI335, pbn_fastcom335_2), + EXAR_DEVICE(COMMTECH, COMMTECH_4224PCI335, pbn_fastcom335_4), +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 90a93c001e169..07d5925791e1c 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -2264,6 +2264,10 @@ int serial8250_do_startup(struct uart_port *port) + + if (port->irq && !(up->port.flags & UPF_NO_THRE_TEST)) { + unsigned char iir1; ++ ++ if (port->irqflags & IRQF_SHARED) ++ disable_irq_nosync(port->irq); ++ + /* + * Test for UARTs that do not reassert THRE when the + * transmitter is idle and the interrupt has already +@@ -2273,8 +2277,6 @@ int serial8250_do_startup(struct uart_port *port) + * allow register changes to become visible. + */ + spin_lock_irqsave(&port->lock, flags); +- if (up->port.irqflags & IRQF_SHARED) +- disable_irq_nosync(port->irq); + + wait_for_xmitr(up, UART_LSR_THRE); + serial_port_out_sync(port, UART_IER, UART_IER_THRI); +@@ -2286,9 +2288,10 @@ int serial8250_do_startup(struct uart_port *port) + iir = serial_port_in(port, UART_IIR); + serial_port_out(port, UART_IER, 0); + ++ spin_unlock_irqrestore(&port->lock, flags); ++ + if (port->irqflags & IRQF_SHARED) + enable_irq(port->irq); +- spin_unlock_irqrestore(&port->lock, flags); + + /* + * If the interrupt is not reasserted, or we otherwise +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index e55b556337214..49bdd0f8d06a0 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -2272,9 +2272,8 @@ pl011_console_write(struct console *co, const char *s, unsigned int count) + clk_disable(uap->clk); + } + +-static void __init +-pl011_console_get_options(struct uart_amba_port *uap, int *baud, +- int *parity, int *bits) ++static void pl011_console_get_options(struct uart_amba_port *uap, int *baud, ++ int *parity, int *bits) + { + if (pl011_read(uap, REG_CR) & UART01x_CR_UARTEN) { + unsigned int lcr_h, ibrd, fbrd; +@@ -2307,7 +2306,7 @@ pl011_console_get_options(struct uart_amba_port *uap, int *baud, + } + } + +-static int __init pl011_console_setup(struct console *co, char *options) ++static int pl011_console_setup(struct console *co, char *options) + { + struct uart_amba_port *uap; + int baud = 38400; +@@ -2375,8 +2374,8 @@ static int __init pl011_console_setup(struct console *co, char *options) + * + * Returns 0 if console matches; otherwise non-zero to use default matching + */ +-static int __init pl011_console_match(struct console *co, char *name, int idx, +- char *options) ++static int pl011_console_match(struct console *co, char *name, int idx, ++ char *options) + { + unsigned char iotype; + resource_size_t addr; +@@ -2614,7 +2613,7 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap, + + static int pl011_register_port(struct uart_amba_port *uap) + { +- int ret; ++ int ret, i; + + /* Ensure interrupts from this UART are masked and cleared */ + pl011_write(0, uap, REG_IMSC); +@@ -2625,6 +2624,9 @@ static int pl011_register_port(struct uart_amba_port *uap) + if (ret < 0) { + dev_err(uap->port.dev, + "Failed to register AMBA-PL011 driver\n"); ++ for (i = 0; i < ARRAY_SIZE(amba_ports); i++) ++ if (amba_ports[i] == uap) ++ amba_ports[i] = NULL; + return ret; + } + } +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index 808373d4e37a6..c67d39fea74ca 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1733,9 +1733,11 @@ static int s3c24xx_serial_init_port(struct s3c24xx_uart_port *ourport, + ourport->tx_irq = ret + 1; + } + +- ret = platform_get_irq(platdev, 1); +- if (ret > 0) +- ourport->tx_irq = ret; ++ if (!s3c24xx_serial_has_interrupt_mask(port)) { ++ ret = platform_get_irq(platdev, 1); ++ if (ret > 0) ++ ourport->tx_irq = ret; ++ } + /* + * DMA is currently supported only on DT platforms, if DMA properties + * are specified. +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 92267396ff407..781d95113742f 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -865,7 +865,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + unsigned int old_rows, old_row_size; + unsigned int new_cols, new_rows, new_row_size, new_screen_size; + unsigned int user; +- unsigned short *newscreen; ++ unsigned short *oldscreen, *newscreen; + + WARN_CONSOLE_UNLOCKED(); + +@@ -947,10 +947,11 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + if (new_scr_end > new_origin) + scr_memsetw((void *)new_origin, vc->vc_video_erase_char, + new_scr_end - new_origin); +- kfree(vc->vc_screenbuf); ++ oldscreen = vc->vc_screenbuf; + vc->vc_screenbuf = newscreen; + vc->vc_screenbuf_size = new_screen_size; + set_origin(vc); ++ kfree(oldscreen); + + /* do part of a reset_terminal() */ + vc->vc_top = 0; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 699ad55e3ec60..1184105b2a17b 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -893,12 +893,22 @@ int vt_ioctl(struct tty_struct *tty, + console_lock(); + vcp = vc_cons[i].d; + if (vcp) { ++ int ret; ++ int save_scan_lines = vcp->vc_scan_lines; ++ int save_font_height = vcp->vc_font.height; ++ + if (v.v_vlin) + vcp->vc_scan_lines = v.v_vlin; + if (v.v_clin) + vcp->vc_font.height = v.v_clin; + vcp->vc_resize_user = 1; +- vc_resize(vcp, v.v_cols, v.v_rows); ++ ret = vc_resize(vcp, v.v_cols, v.v_rows); ++ if (ret) { ++ vcp->vc_scan_lines = save_scan_lines; ++ vcp->vc_font.height = save_font_height; ++ console_unlock(); ++ return ret; ++ } + } + console_unlock(); + } +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 0de467c8593db..b3e4b014a1cc0 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -390,21 +390,19 @@ static void acm_ctrl_irq(struct urb *urb) + if (current_size < expected_size) { + /* notification is transmitted fragmented, reassemble */ + if (acm->nb_size < expected_size) { +- if (acm->nb_size) { +- kfree(acm->notification_buffer); +- acm->nb_size = 0; +- } ++ u8 *new_buffer; + alloc_size = roundup_pow_of_two(expected_size); +- /* +- * kmalloc ensures a valid notification_buffer after a +- * use of kfree in case the previous allocation was too +- * small. Final freeing is done on disconnect. +- */ +- acm->notification_buffer = +- kmalloc(alloc_size, GFP_ATOMIC); +- if (!acm->notification_buffer) ++ /* Final freeing is done on disconnect. */ ++ new_buffer = krealloc(acm->notification_buffer, ++ alloc_size, GFP_ATOMIC); ++ if (!new_buffer) { ++ acm->nb_index = 0; + goto exit; ++ } ++ ++ acm->notification_buffer = new_buffer; + acm->nb_size = alloc_size; ++ dr = (struct usb_cdc_notification *)acm->notification_buffer; + } + + copy_size = min(current_size, +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index e6e0f786547bf..eed7c8d8e3d4f 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -299,6 +299,8 @@ static const struct usb_device_id usb_quirk_list[] = { + + { USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM }, + ++ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* DJI CineSSD */ + { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c +index 5c2d39232bb0e..03fb995d359ee 100644 +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -1202,12 +1202,15 @@ static int ncm_unwrap_ntb(struct gether *port, + int ndp_index; + unsigned dg_len, dg_len2; + unsigned ndp_len; ++ unsigned block_len; + struct sk_buff *skb2; + int ret = -EINVAL; +- unsigned max_size = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); ++ unsigned ntb_max = le32_to_cpu(ntb_parameters.dwNtbOutMaxSize); ++ unsigned frame_max = le16_to_cpu(ecm_desc.wMaxSegmentSize); + const struct ndp_parser_opts *opts = ncm->parser_opts; + unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; + int dgram_counter; ++ bool ndp_after_header; + + /* dwSignature */ + if (get_unaligned_le32(tmp) != opts->nth_sign) { +@@ -1226,25 +1229,37 @@ static int ncm_unwrap_ntb(struct gether *port, + } + tmp++; /* skip wSequence */ + ++ block_len = get_ncm(&tmp, opts->block_length); + /* (d)wBlockLength */ +- if (get_ncm(&tmp, opts->block_length) > max_size) { ++ if (block_len > ntb_max) { + INFO(port->func.config->cdev, "OUT size exceeded\n"); + goto err; + } + + ndp_index = get_ncm(&tmp, opts->ndp_index); ++ ndp_after_header = false; + + /* Run through all the NDP's in the NTB */ + do { +- /* NCM 3.2 */ +- if (((ndp_index % 4) != 0) && +- (ndp_index < opts->nth_size)) { ++ /* ++ * NCM 3.2 ++ * dwNdpIndex ++ */ ++ if (((ndp_index % 4) != 0) || ++ (ndp_index < opts->nth_size) || ++ (ndp_index > (block_len - ++ opts->ndp_size))) { + INFO(port->func.config->cdev, "Bad index: %#X\n", + ndp_index); + goto err; + } ++ if (ndp_index == opts->nth_size) ++ ndp_after_header = true; + +- /* walk through NDP */ ++ /* ++ * walk through NDP ++ * dwSignature ++ */ + tmp = (void *)(skb->data + ndp_index); + if (get_unaligned_le32(tmp) != ncm->ndp_sign) { + INFO(port->func.config->cdev, "Wrong NDP SIGN\n"); +@@ -1255,14 +1270,15 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_len = get_unaligned_le16(tmp++); + /* + * NCM 3.3.1 ++ * wLength + * entry is 2 items + * item size is 16/32 bits, opts->dgram_item_len * 2 bytes + * minimal: struct usb_cdc_ncm_ndpX + normal entry + zero entry + * Each entry is a dgram index and a dgram length. + */ + if ((ndp_len < opts->ndp_size +- + 2 * 2 * (opts->dgram_item_len * 2)) +- || (ndp_len % opts->ndplen_align != 0)) { ++ + 2 * 2 * (opts->dgram_item_len * 2)) || ++ (ndp_len % opts->ndplen_align != 0)) { + INFO(port->func.config->cdev, "Bad NDP length: %#X\n", + ndp_len); + goto err; +@@ -1279,8 +1295,21 @@ static int ncm_unwrap_ntb(struct gether *port, + + do { + index = index2; ++ /* wDatagramIndex[0] */ ++ if ((index < opts->nth_size) || ++ (index > block_len - opts->dpe_size)) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index); ++ goto err; ++ } ++ + dg_len = dg_len2; +- if (dg_len < 14 + crc_len) { /* ethernet hdr + crc */ ++ /* ++ * wDatagramLength[0] ++ * ethernet hdr + crc or larger than max frame size ++ */ ++ if ((dg_len < 14 + crc_len) || ++ (dg_len > frame_max)) { + INFO(port->func.config->cdev, + "Bad dgram length: %#X\n", dg_len); + goto err; +@@ -1304,6 +1333,37 @@ static int ncm_unwrap_ntb(struct gether *port, + index2 = get_ncm(&tmp, opts->dgram_item_len); + dg_len2 = get_ncm(&tmp, opts->dgram_item_len); + ++ if (index2 == 0 || dg_len2 == 0) ++ break; ++ ++ /* wDatagramIndex[1] */ ++ if (ndp_after_header) { ++ if (index2 < opts->nth_size + opts->ndp_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ } else { ++ if (index2 < opts->nth_size + opts->dpe_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ } ++ if (index2 > block_len - opts->dpe_size) { ++ INFO(port->func.config->cdev, ++ "Bad index: %#X\n", index2); ++ goto err; ++ } ++ ++ /* wDatagramLength[1] */ ++ if ((dg_len2 < 14 + crc_len) || ++ (dg_len2 > frame_max)) { ++ INFO(port->func.config->cdev, ++ "Bad dgram length: %#X\n", dg_len); ++ goto err; ++ } ++ + /* + * Copy the data into a new skb. + * This ensures the truesize is correct +@@ -1320,9 +1380,6 @@ static int ncm_unwrap_ntb(struct gether *port, + ndp_len -= 2 * (opts->dgram_item_len * 2); + + dgram_counter++; +- +- if (index2 == 0 || dg_len2 == 0) +- break; + } while (ndp_len > 2 * (opts->dgram_item_len * 2)); + } while (ndp_index); + +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c +index a82e2bd5ea34d..c41d09166a1d6 100644 +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) + goto err_sts; + + return 0; ++ + err_sts: +- usb_ep_free_request(fu->ep_status, stream->req_status); +- stream->req_status = NULL; +-err_out: + usb_ep_free_request(fu->ep_out, stream->req_out); + stream->req_out = NULL; ++err_out: ++ usb_ep_free_request(fu->ep_in, stream->req_in); ++ stream->req_in = NULL; + out: + return -ENOMEM; + } +diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h +index 2f03334c68741..d150a6795f481 100644 +--- a/drivers/usb/gadget/u_f.h ++++ b/drivers/usb/gadget/u_f.h +@@ -17,6 +17,7 @@ + #define __U_F_H__ + + #include ++#include + + /* Variable Length Array Macros **********************************************/ + #define vla_group(groupname) size_t groupname##__next = 0 +@@ -24,21 +25,36 @@ + + #define vla_item(groupname, type, name, n) \ + size_t groupname##_##name##__offset = ({ \ +- size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ +- size_t size = (n) * sizeof(type); \ +- groupname##__next = offset + size; \ ++ size_t offset = 0; \ ++ if (groupname##__next != SIZE_MAX) { \ ++ size_t align_mask = __alignof__(type) - 1; \ ++ size_t size = array_size(n, sizeof(type)); \ ++ offset = (groupname##__next + align_mask) & \ ++ ~align_mask; \ ++ if (check_add_overflow(offset, size, \ ++ &groupname##__next)) { \ ++ groupname##__next = SIZE_MAX; \ ++ offset = 0; \ ++ } \ ++ } \ + offset; \ + }) + + #define vla_item_with_sz(groupname, type, name, n) \ +- size_t groupname##_##name##__sz = (n) * sizeof(type); \ +- size_t groupname##_##name##__offset = ({ \ +- size_t align_mask = __alignof__(type) - 1; \ +- size_t offset = (groupname##__next + align_mask) & ~align_mask;\ +- size_t size = groupname##_##name##__sz; \ +- groupname##__next = offset + size; \ +- offset; \ ++ size_t groupname##_##name##__sz = array_size(n, sizeof(type)); \ ++ size_t groupname##_##name##__offset = ({ \ ++ size_t offset = 0; \ ++ if (groupname##__next != SIZE_MAX) { \ ++ size_t align_mask = __alignof__(type) - 1; \ ++ offset = (groupname##__next + align_mask) & \ ++ ~align_mask; \ ++ if (check_add_overflow(offset, groupname##_##name##__sz,\ ++ &groupname##__next)) { \ ++ groupname##__next = SIZE_MAX; \ ++ offset = 0; \ ++ } \ ++ } \ ++ offset; \ + }) + + #define vla_ptr(ptr, groupname, name) \ +diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c +index 6865b919403f7..2ed062a2e93b4 100644 +--- a/drivers/usb/host/ohci-exynos.c ++++ b/drivers/usb/host/ohci-exynos.c +@@ -166,9 +166,8 @@ skip_phy: + hcd->rsrc_len = resource_size(res); + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "Failed to get IRQ\n"); +- err = -ENODEV; ++ if (irq < 0) { ++ err = irq; + goto fail_io; + } + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 3bb38d9dc45bf..592f8183af280 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -750,15 +750,6 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, + { + u32 pls = status_reg & PORT_PLS_MASK; + +- /* resume state is a xHCI internal state. +- * Do not report it to usb core, instead, pretend to be U3, +- * thus usb core knows it's not ready for transfer +- */ +- if (pls == XDEV_RESUME) { +- *status |= USB_SS_PORT_LS_U3; +- return; +- } +- + /* When the CAS bit is set then warm reset + * should be performed on port + */ +@@ -780,6 +771,16 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci, + */ + pls |= USB_PORT_STAT_CONNECTION; + } else { ++ /* ++ * Resume state is an xHCI internal state. Do not report it to ++ * usb core, instead, pretend to be U3, thus usb core knows ++ * it's not ready for transfer. ++ */ ++ if (pls == XDEV_RESUME) { ++ *status |= USB_SS_PORT_LS_U3; ++ return; ++ } ++ + /* + * If CAS bit isn't set but the Port is already at + * Compliance Mode, fake a connection so the USB core +diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c +index ddddd6387f664..e4a7510f9b0e1 100644 +--- a/drivers/usb/misc/lvstest.c ++++ b/drivers/usb/misc/lvstest.c +@@ -432,7 +432,7 @@ static int lvs_rh_probe(struct usb_interface *intf, + USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT); + if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) { + dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret); +- return ret; ++ return ret < 0 ? ret : -EINVAL; + } + + /* submit urb to poll interrupt endpoint */ +diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c +index a6f88442a53a9..a020d5eafb4a5 100644 +--- a/drivers/usb/misc/sisusbvga/sisusb.c ++++ b/drivers/usb/misc/sisusbvga/sisusb.c +@@ -760,7 +760,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr, + u8 swap8, fromkern = kernbuffer ? 1 : 0; + u16 swap16; + u32 swap32, flag = (length >> 28) & 1; +- char buf[4]; ++ u8 buf[4]; + + /* if neither kernbuffer not userbuffer are given, assume + * data in obuf +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index ec42f6b75564e..cf4a7ef4e663d 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -496,7 +496,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE); + dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__, + dev->cntl_buffer[0]); +- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL); ++ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC); + if (retval >= 0) + timeout = schedule_timeout(YUREX_WRITE_TIMEOUT); + finish_wait(&dev->waitq, &wait); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 5c3f2eaf59e8c..e77140a5b6729 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2347,7 +2347,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x0114, + "JMicron", + "USB to ATA/ATAPI Bridge", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, +- US_FL_BROKEN_FUA ), ++ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ), + + /* Reported by Andrey Rahmatullin */ + UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100, +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 4df15faa66d71..018b0663d6109 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -41,6 +41,13 @@ + * and don't forget to CC: the USB development list + */ + ++/* Reported-by: Till Dörges */ ++UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999, ++ "Sony", ++ "PSZ-HA*", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_REPORT_OPCODES), ++ + /* Reported-by: Julian Groß */ + UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999, + "LaCie", +@@ -156,6 +163,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA), + ++/* Reported-by: Thinh Nguyen */ ++UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999, ++ "PNY", ++ "Pro Elite SSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* Reported-by: Hans de Goede */ + UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, + "VIA", +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 41360caff17f8..be31be84af67d 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2130,6 +2130,9 @@ static void updatescrollmode(struct display *p, + } + } + ++#define PITCH(w) (((w) + 7) >> 3) ++#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ ++ + static int fbcon_resize(struct vc_data *vc, unsigned int width, + unsigned int height, unsigned int user) + { +@@ -2139,6 +2142,24 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + struct fb_var_screeninfo var = info->var; + int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; + ++ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { ++ int size; ++ int pitch = PITCH(vc->vc_font.width); ++ ++ /* ++ * If user font, ensure that a possible change to user font ++ * height or width will not allow a font data out-of-bounds access. ++ * NOTE: must use original charcount in calculation as font ++ * charcount can change and cannot be used to determine the ++ * font data allocated size. ++ */ ++ if (pitch <= 0) ++ return -EINVAL; ++ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data)); ++ if (size > FNTSIZE(vc->vc_font.data)) ++ return -EINVAL; ++ } ++ + virt_w = FBCON_SWAP(ops->rotate, width, height); + virt_h = FBCON_SWAP(ops->rotate, height, width); + virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width, +@@ -2600,7 +2621,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne + int size; + int i, csum; + u8 *new_data, *data = font->data; +- int pitch = (font->width+7) >> 3; ++ int pitch = PITCH(font->width); + + /* Is there a reason why fbconsole couldn't handle any charcount >256? + * If not this check should be changed to charcount < 256 */ +@@ -2616,7 +2637,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, unsigne + if (fbcon_invalid_charcount(info, charcount)) + return -EINVAL; + +- size = h * pitch * charcount; ++ size = CALC_FONTSZ(h, pitch, charcount); + + new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER); + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c +index 7a75dfda98457..00f5a54aaf9b7 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c +@@ -531,8 +531,11 @@ int dispc_runtime_get(void) + DSSDBG("dispc_runtime_get\n"); + + r = pm_runtime_get_sync(&dispc.pdev->dev); +- WARN_ON(r < 0); +- return r < 0 ? r : 0; ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&dispc.pdev->dev); ++ return r; ++ } ++ return 0; + } + EXPORT_SYMBOL(dispc_runtime_get); + +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c +index 30d49f3800b33..2bfd9063cdfc3 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dsi.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dsi.c +@@ -1148,8 +1148,11 @@ static int dsi_runtime_get(struct platform_device *dsidev) + DSSDBG("dsi_runtime_get\n"); + + r = pm_runtime_get_sync(&dsi->pdev->dev); +- WARN_ON(r < 0); +- return r < 0 ? r : 0; ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&dsi->pdev->dev); ++ return r; ++ } ++ return 0; + } + + static void dsi_runtime_put(struct platform_device *dsidev) +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c +index 4429ad37b64cd..acecee5b1c102 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c +@@ -778,8 +778,11 @@ int dss_runtime_get(void) + DSSDBG("dss_runtime_get\n"); + + r = pm_runtime_get_sync(&dss.pdev->dev); +- WARN_ON(r < 0); +- return r < 0 ? r : 0; ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&dss.pdev->dev); ++ return r; ++ } ++ return 0; + } + + void dss_runtime_put(void) +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c +index ec78d61bc5512..e2d571ca8590a 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi4.c +@@ -50,9 +50,10 @@ static int hdmi_runtime_get(void) + DSSDBG("hdmi_runtime_get\n"); + + r = pm_runtime_get_sync(&hdmi.pdev->dev); +- WARN_ON(r < 0); +- if (r < 0) ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&hdmi.pdev->dev); + return r; ++ } + + return 0; + } +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c +index 2e2fcc3d6d4f7..13f3a5ce55294 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/hdmi5.c +@@ -54,9 +54,10 @@ static int hdmi_runtime_get(void) + DSSDBG("hdmi_runtime_get\n"); + + r = pm_runtime_get_sync(&hdmi.pdev->dev); +- WARN_ON(r < 0); +- if (r < 0) ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&hdmi.pdev->dev); + return r; ++ } + + return 0; + } +diff --git a/drivers/video/fbdev/omap2/omapfb/dss/venc.c b/drivers/video/fbdev/omap2/omapfb/dss/venc.c +index 392464da12e41..96714b4596d2d 100644 +--- a/drivers/video/fbdev/omap2/omapfb/dss/venc.c ++++ b/drivers/video/fbdev/omap2/omapfb/dss/venc.c +@@ -402,8 +402,11 @@ static int venc_runtime_get(void) + DSSDBG("venc_runtime_get\n"); + + r = pm_runtime_get_sync(&venc.pdev->dev); +- WARN_ON(r < 0); +- return r < 0 ? r : 0; ++ if (WARN_ON(r < 0)) { ++ pm_runtime_put_sync(&venc.pdev->dev); ++ return r; ++ } ++ return 0; + } + + static void venc_runtime_put(void) +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 8d49b91d92cd3..95e5a9300ff04 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -154,7 +154,7 @@ int get_evtchn_to_irq(unsigned evtchn) + /* Get info for IRQ */ + struct irq_info *info_for_irq(unsigned irq) + { +- return irq_get_handler_data(irq); ++ return irq_get_chip_data(irq); + } + + /* Constructors for packed IRQ information. */ +@@ -375,7 +375,7 @@ static void xen_irq_init(unsigned irq) + info->type = IRQT_UNBOUND; + info->refcnt = -1; + +- irq_set_handler_data(irq, info); ++ irq_set_chip_data(irq, info); + + list_add_tail(&info->list, &xen_irq_list_head); + } +@@ -424,14 +424,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) + + static void xen_free_irq(unsigned irq) + { +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (WARN_ON(!info)) + return; + + list_del(&info->list); + +- irq_set_handler_data(irq, NULL); ++ irq_set_chip_data(irq, NULL); + + WARN_ON(info->refcnt > 0); + +@@ -601,7 +601,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi); + static void __unbind_from_irq(unsigned int irq) + { + int evtchn = evtchn_from_irq(irq); +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (info->refcnt > 0) { + info->refcnt--; +@@ -1105,7 +1105,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi, + + void unbind_from_irqhandler(unsigned int irq, void *dev_id) + { +- struct irq_info *info = irq_get_handler_data(irq); ++ struct irq_info *info = irq_get_chip_data(irq); + + if (WARN_ON(!info)) + return; +@@ -1139,7 +1139,7 @@ int evtchn_make_refcounted(unsigned int evtchn) + if (irq == -1) + return -ENOENT; + +- info = irq_get_handler_data(irq); ++ info = irq_get_chip_data(irq); + + if (!info) + return -ENOENT; +@@ -1167,7 +1167,7 @@ int evtchn_get(unsigned int evtchn) + if (irq == -1) + goto done; + +- info = irq_get_handler_data(irq); ++ info = irq_get_chip_data(irq); + + if (!info) + goto done; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 893066970c689..495430e4f84be 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4344,6 +4344,7 @@ static void btrfs_cleanup_bg_io(struct btrfs_block_group_cache *cache) + cache->io_ctl.inode = NULL; + iput(inode); + } ++ ASSERT(cache->io_ctl.pages == NULL); + btrfs_put_block_group(cache); + } + +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 57f89708fab1c..9bf72a9088aca 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -1169,7 +1169,6 @@ static int __btrfs_wait_cache_io(struct btrfs_root *root, + ret = update_cache_item(trans, root, inode, path, offset, + io_ctl->entries, io_ctl->bitmaps); + out: +- io_ctl_free(io_ctl); + if (ret) { + invalidate_inode_pages2(inode->i_mapping); + BTRFS_I(inode)->generation = 0; +@@ -1334,6 +1333,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, + * them out later + */ + io_ctl_drop_pages(io_ctl); ++ io_ctl_free(io_ctl); + + unlock_extent_cached(&BTRFS_I(inode)->io_tree, 0, + i_size_read(inode) - 1, &cached_state, GFP_NOFS); +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 3d30bf90d59ec..ec8706a6e9c66 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3311,11 +3311,13 @@ fail: + btrfs_free_path(path); + out_unlock: + mutex_unlock(&dir->log_mutex); +- if (ret == -ENOSPC) { ++ if (err == -ENOSPC) { + btrfs_set_log_full_commit(root->fs_info, trans); +- ret = 0; +- } else if (ret < 0) +- btrfs_abort_transaction(trans, ret); ++ err = 0; ++ } else if (err < 0 && err != -ENOENT) { ++ /* ENOENT can be returned if the entry hasn't been fsynced yet */ ++ btrfs_abort_transaction(trans, err); ++ } + + btrfs_end_log_trans(root); + +diff --git a/fs/buffer.c b/fs/buffer.c +index cae7f24a0410e..9fbeddb6834a4 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3250,6 +3250,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) + WARN_ON(atomic_read(&bh->b_count) < 1); + lock_buffer(bh); + if (test_clear_buffer_dirty(bh)) { ++ /* ++ * The bh should be mapped, but it might not be if the ++ * device was hot-removed. Not much we can do but fail the I/O. ++ */ ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); ++ return -EIO; ++ } ++ + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; + ret = submit_bh(REQ_OP_WRITE, op_flags, bh); +diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c +index f36ddfea4997e..06109314d93c8 100644 +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -3518,6 +3518,9 @@ static void delayed_work(struct work_struct *work) + dout("mdsc delayed_work\n"); + ceph_check_delayed_caps(mdsc); + ++ if (mdsc->stopping) ++ return; ++ + mutex_lock(&mdsc->mutex); + renew_interval = mdsc->mdsmap->m_session_timeout >> 2; + renew_caps = time_after_eq(jiffies, HZ*renew_interval + +@@ -3851,7 +3854,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc) + static void ceph_mdsc_stop(struct ceph_mds_client *mdsc) + { + dout("stop\n"); +- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */ ++ /* ++ * Make sure the delayed work stopped before releasing ++ * the resources. ++ * ++ * Because the cancel_delayed_work_sync() will only ++ * guarantee that the work finishes executing. But the ++ * delayed work will re-arm itself again after that. ++ */ ++ flush_delayed_work(&mdsc->delayed_work); ++ + if (mdsc->mdsmap) + ceph_mdsmap_destroy(mdsc->mdsmap); + kfree(mdsc->sessions); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ffc985d781373..634c822d1dc98 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -63,10 +63,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, + unsigned long journal_devnum); + static int ext4_show_options(struct seq_file *seq, struct dentry *root); + static int ext4_commit_super(struct super_block *sb, int sync); +-static void ext4_mark_recovery_complete(struct super_block *sb, ++static int ext4_mark_recovery_complete(struct super_block *sb, + struct ext4_super_block *es); +-static void ext4_clear_journal_err(struct super_block *sb, +- struct ext4_super_block *es); ++static int ext4_clear_journal_err(struct super_block *sb, ++ struct ext4_super_block *es); + static int ext4_sync_fs(struct super_block *sb, int wait); + static int ext4_remount(struct super_block *sb, int *flags, char *data); + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf); +@@ -4458,7 +4458,9 @@ no_journal: + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; + if (needs_recovery) { + ext4_msg(sb, KERN_INFO, "recovery complete"); +- ext4_mark_recovery_complete(sb, es); ++ err = ext4_mark_recovery_complete(sb, es); ++ if (err) ++ goto failed_mount8; + } + if (EXT4_SB(sb)->s_journal) { + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +@@ -4501,10 +4503,8 @@ cantfind_ext4: + ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); + goto failed_mount; + +-#ifdef CONFIG_QUOTA + failed_mount8: + ext4_unregister_sysfs(sb); +-#endif + failed_mount7: + ext4_unregister_li_request(sb); + failed_mount6: +@@ -4640,7 +4640,8 @@ static journal_t *ext4_get_journal(struct super_block *sb, + struct inode *journal_inode; + journal_t *journal; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + journal_inode = ext4_get_journal_inode(sb, journal_inum); + if (!journal_inode) +@@ -4670,7 +4671,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, + struct ext4_super_block *es; + struct block_device *bdev; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + bdev = ext4_blkdev_get(j_dev, sb); + if (bdev == NULL) +@@ -4762,7 +4764,8 @@ static int ext4_load_journal(struct super_block *sb, + int err = 0; + int really_read_only; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return -EFSCORRUPTED; + + if (journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -4831,7 +4834,12 @@ static int ext4_load_journal(struct super_block *sb, + } + + EXT4_SB(sb)->s_journal = journal; +- ext4_clear_journal_err(sb, es); ++ err = ext4_clear_journal_err(sb, es); ++ if (err) { ++ EXT4_SB(sb)->s_journal = NULL; ++ jbd2_journal_destroy(journal); ++ return err; ++ } + + if (!really_read_only && journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -4853,13 +4861,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) + if (!sbh || block_device_ejected(sb)) + return error; + +- /* +- * The superblock bh should be mapped, but it might not be if the +- * device was hot-removed. Not much we can do but fail the I/O. +- */ +- if (!buffer_mapped(sbh)) +- return error; +- + /* + * If the file system is mounted read-only, don't update the + * superblock write time. This avoids updating the superblock +@@ -4930,26 +4931,32 @@ static int ext4_commit_super(struct super_block *sb, int sync) + * remounting) the filesystem readonly, then we will end up with a + * consistent fs on disk. Record that fact. + */ +-static void ext4_mark_recovery_complete(struct super_block *sb, +- struct ext4_super_block *es) ++static int ext4_mark_recovery_complete(struct super_block *sb, ++ struct ext4_super_block *es) + { ++ int err; + journal_t *journal = EXT4_SB(sb)->s_journal; + + if (!ext4_has_feature_journal(sb)) { +- BUG_ON(journal != NULL); +- return; ++ if (journal != NULL) { ++ ext4_error(sb, "Journal got removed while the fs was " ++ "mounted!"); ++ return -EFSCORRUPTED; ++ } ++ return 0; + } + jbd2_journal_lock_updates(journal); +- if (jbd2_journal_flush(journal) < 0) ++ err = jbd2_journal_flush(journal); ++ if (err < 0) + goto out; + + if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) { + ext4_clear_feature_journal_needs_recovery(sb); + ext4_commit_super(sb, 1); + } +- + out: + jbd2_journal_unlock_updates(journal); ++ return err; + } + + /* +@@ -4957,14 +4964,17 @@ out: + * has recorded an error from a previous lifetime, move that error to the + * main filesystem now. + */ +-static void ext4_clear_journal_err(struct super_block *sb, ++static int ext4_clear_journal_err(struct super_block *sb, + struct ext4_super_block *es) + { + journal_t *journal; + int j_errno; + const char *errstr; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (!ext4_has_feature_journal(sb)) { ++ ext4_error(sb, "Journal got removed while the fs was mounted!"); ++ return -EFSCORRUPTED; ++ } + + journal = EXT4_SB(sb)->s_journal; + +@@ -4989,6 +4999,7 @@ static void ext4_clear_journal_err(struct super_block *sb, + jbd2_journal_clear_err(journal); + jbd2_journal_update_sb_errno(journal); + } ++ return 0; + } + + /* +@@ -5268,8 +5279,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + (sbi->s_mount_state & EXT4_VALID_FS)) + es->s_state = cpu_to_le16(sbi->s_mount_state); + +- if (sbi->s_journal) ++ if (sbi->s_journal) { ++ /* ++ * We let remount-ro finish even if marking fs ++ * as clean failed... ++ */ + ext4_mark_recovery_complete(sb, es); ++ } + if (sbi->s_mmp_tsk) + kthread_stop(sbi->s_mmp_tsk); + } else { +@@ -5317,8 +5333,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + * been changed by e2fsck since we originally mounted + * the partition.) + */ +- if (sbi->s_journal) +- ext4_clear_journal_err(sb, es); ++ if (sbi->s_journal) { ++ err = ext4_clear_journal_err(sb, es); ++ if (err) ++ goto restore_opts; ++ } + sbi->s_mount_state = le16_to_cpu(es->s_state); + if (!ext4_setup_super(sb, es, 0)) + sb->s_flags &= ~MS_RDONLY; +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 89319c3524061..990339c538b0a 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -782,6 +782,9 @@ static void f2fs_put_super(struct super_block *sb) + struct f2fs_sb_info *sbi = F2FS_SB(sb); + int i; + ++ /* unregister procfs/sysfs entries in advance to avoid race case */ ++ f2fs_unregister_sysfs(sbi); ++ + f2fs_quota_off_umount(sb); + + /* prevent remaining shrinker jobs */ +@@ -834,8 +837,6 @@ static void f2fs_put_super(struct super_block *sb) + + kfree(sbi->ckpt); + +- f2fs_unregister_sysfs(sbi); +- + sb->s_fs_info = NULL; + if (sbi->s_chksum_driver) + crypto_free_shash(sbi->s_chksum_driver); +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index fe907ff91eeb5..3dbb875ed7903 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -45,7 +45,6 @@ struct wb_completion { + struct wb_writeback_work { + long nr_pages; + struct super_block *sb; +- unsigned long *older_than_this; + enum writeback_sync_modes sync_mode; + unsigned int tagged_writepages:1; + unsigned int for_kupdate:1; +@@ -160,7 +159,9 @@ static void inode_io_list_del_locked(struct inode *inode, + struct bdi_writeback *wb) + { + assert_spin_locked(&wb->list_lock); ++ assert_spin_locked(&inode->i_lock); + ++ inode->i_state &= ~I_SYNC_QUEUED; + list_del_init(&inode->i_io_list); + wb_io_lists_depopulated(wb); + } +@@ -1039,7 +1040,9 @@ void inode_io_list_del(struct inode *inode) + struct bdi_writeback *wb; + + wb = inode_to_wb_and_lock_list(inode); ++ spin_lock(&inode->i_lock); + inode_io_list_del_locked(inode, wb); ++ spin_unlock(&inode->i_lock); + spin_unlock(&wb->list_lock); + } + +@@ -1088,8 +1091,10 @@ void sb_clear_inode_writeback(struct inode *inode) + * the case then the inode must have been redirtied while it was being written + * out and we don't reset its dirtied_when. + */ +-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) ++static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb) + { ++ assert_spin_locked(&inode->i_lock); ++ + if (!list_empty(&wb->b_dirty)) { + struct inode *tail; + +@@ -1098,6 +1103,14 @@ static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) + inode->dirtied_when = jiffies; + } + inode_io_list_move_locked(inode, wb, &wb->b_dirty); ++ inode->i_state &= ~I_SYNC_QUEUED; ++} ++ ++static void redirty_tail(struct inode *inode, struct bdi_writeback *wb) ++{ ++ spin_lock(&inode->i_lock); ++ redirty_tail_locked(inode, wb); ++ spin_unlock(&inode->i_lock); + } + + /* +@@ -1136,16 +1149,13 @@ static bool inode_dirtied_after(struct inode *inode, unsigned long t) + #define EXPIRE_DIRTY_ATIME 0x0001 + + /* +- * Move expired (dirtied before work->older_than_this) dirty inodes from ++ * Move expired (dirtied before dirtied_before) dirty inodes from + * @delaying_queue to @dispatch_queue. + */ + static int move_expired_inodes(struct list_head *delaying_queue, + struct list_head *dispatch_queue, +- int flags, +- struct wb_writeback_work *work) ++ int flags, unsigned long dirtied_before) + { +- unsigned long *older_than_this = NULL; +- unsigned long expire_time; + LIST_HEAD(tmp); + struct list_head *pos, *node; + struct super_block *sb = NULL; +@@ -1153,21 +1163,17 @@ static int move_expired_inodes(struct list_head *delaying_queue, + int do_sb_sort = 0; + int moved = 0; + +- if ((flags & EXPIRE_DIRTY_ATIME) == 0) +- older_than_this = work->older_than_this; +- else if (!work->for_sync) { +- expire_time = jiffies - (dirtytime_expire_interval * HZ); +- older_than_this = &expire_time; +- } + while (!list_empty(delaying_queue)) { + inode = wb_inode(delaying_queue->prev); +- if (older_than_this && +- inode_dirtied_after(inode, *older_than_this)) ++ if (inode_dirtied_after(inode, dirtied_before)) + break; + list_move(&inode->i_io_list, &tmp); + moved++; ++ spin_lock(&inode->i_lock); + if (flags & EXPIRE_DIRTY_ATIME) +- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state); ++ inode->i_state |= I_DIRTY_TIME_EXPIRED; ++ inode->i_state |= I_SYNC_QUEUED; ++ spin_unlock(&inode->i_lock); + if (sb_is_blkdev_sb(inode->i_sb)) + continue; + if (sb && sb != inode->i_sb) +@@ -1205,18 +1211,22 @@ out: + * | + * +--> dequeue for IO + */ +-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work) ++static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work, ++ unsigned long dirtied_before) + { + int moved; ++ unsigned long time_expire_jif = dirtied_before; + + assert_spin_locked(&wb->list_lock); + list_splice_init(&wb->b_more_io, &wb->b_io); +- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work); ++ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before); ++ if (!work->for_sync) ++ time_expire_jif = jiffies - dirtytime_expire_interval * HZ; + moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io, +- EXPIRE_DIRTY_ATIME, work); ++ EXPIRE_DIRTY_ATIME, time_expire_jif); + if (moved) + wb_io_lists_populated(wb); +- trace_writeback_queue_io(wb, work, moved); ++ trace_writeback_queue_io(wb, work, dirtied_before, moved); + } + + static int write_inode(struct inode *inode, struct writeback_control *wbc) +@@ -1310,7 +1320,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, + * writeback is not making progress due to locked + * buffers. Skip this inode for now. + */ +- redirty_tail(inode, wb); ++ redirty_tail_locked(inode, wb); + return; + } + +@@ -1330,7 +1340,7 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, + * retrying writeback of the dirty page/inode + * that cannot be performed immediately. + */ +- redirty_tail(inode, wb); ++ redirty_tail_locked(inode, wb); + } + } else if (inode->i_state & I_DIRTY) { + /* +@@ -1338,10 +1348,11 @@ static void requeue_inode(struct inode *inode, struct bdi_writeback *wb, + * such as delayed allocation during submission or metadata + * updates after data IO completion. + */ +- redirty_tail(inode, wb); ++ redirty_tail_locked(inode, wb); + } else if (inode->i_state & I_DIRTY_TIME) { + inode->dirtied_when = jiffies; + inode_io_list_move_locked(inode, wb, &wb->b_dirty_time); ++ inode->i_state &= ~I_SYNC_QUEUED; + } else { + /* The inode is clean. Remove from writeback lists. */ + inode_io_list_del_locked(inode, wb); +@@ -1585,8 +1596,8 @@ static long writeback_sb_inodes(struct super_block *sb, + */ + spin_lock(&inode->i_lock); + if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) { ++ redirty_tail_locked(inode, wb); + spin_unlock(&inode->i_lock); +- redirty_tail(inode, wb); + continue; + } + if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) { +@@ -1727,7 +1738,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, + blk_start_plug(&plug); + spin_lock(&wb->list_lock); + if (list_empty(&wb->b_io)) +- queue_io(wb, &work); ++ queue_io(wb, &work, jiffies); + __writeback_inodes_wb(wb, &work); + spin_unlock(&wb->list_lock); + blk_finish_plug(&plug); +@@ -1747,7 +1758,7 @@ static long writeback_inodes_wb(struct bdi_writeback *wb, long nr_pages, + * takes longer than a dirty_writeback_interval interval, then leave a + * one-second gap. + * +- * older_than_this takes precedence over nr_to_write. So we'll only write back ++ * dirtied_before takes precedence over nr_to_write. So we'll only write back + * all dirty pages if they are all attached to "old" mappings. + */ + static long wb_writeback(struct bdi_writeback *wb, +@@ -1755,14 +1766,11 @@ static long wb_writeback(struct bdi_writeback *wb, + { + unsigned long wb_start = jiffies; + long nr_pages = work->nr_pages; +- unsigned long oldest_jif; ++ unsigned long dirtied_before = jiffies; + struct inode *inode; + long progress; + struct blk_plug plug; + +- oldest_jif = jiffies; +- work->older_than_this = &oldest_jif; +- + blk_start_plug(&plug); + spin_lock(&wb->list_lock); + for (;;) { +@@ -1796,14 +1804,14 @@ static long wb_writeback(struct bdi_writeback *wb, + * safe. + */ + if (work->for_kupdate) { +- oldest_jif = jiffies - ++ dirtied_before = jiffies - + msecs_to_jiffies(dirty_expire_interval * 10); + } else if (work->for_background) +- oldest_jif = jiffies; ++ dirtied_before = jiffies; + + trace_writeback_start(wb, work); + if (list_empty(&wb->b_io)) +- queue_io(wb, work); ++ queue_io(wb, work, dirtied_before); + if (work->sb) + progress = writeback_sb_inodes(work->sb, wb, work); + else +@@ -2176,11 +2184,12 @@ void __mark_inode_dirty(struct inode *inode, int flags) + inode->i_state |= flags; + + /* +- * If the inode is being synced, just update its dirty state. +- * The unlocker will place the inode on the appropriate +- * superblock list, based upon its state. ++ * If the inode is queued for writeback by flush worker, just ++ * update its dirty state. Once the flush worker is done with ++ * the inode it will place it on the appropriate superblock ++ * list, based upon its state. + */ +- if (inode->i_state & I_SYNC) ++ if (inode->i_state & I_SYNC_QUEUED) + goto out_unlock_inode; + + /* +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index a355ca418e788..3311b1e684def 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1914,6 +1914,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) + */ + static void __jbd2_journal_unfile_buffer(struct journal_head *jh) + { ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); ++ + __jbd2_journal_temp_unlink_buffer(jh); + jh->b_transaction = NULL; + jbd2_journal_put_journal_head(jh); +@@ -2005,6 +2008,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + { + struct buffer_head *head; + struct buffer_head *bh; ++ bool has_write_io_error = false; + int ret = 0; + + J_ASSERT(PageLocked(page)); +@@ -2029,11 +2033,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + jbd_unlock_bh_state(bh); + if (buffer_jbd(bh)) + goto busy; ++ ++ /* ++ * If we free a metadata buffer which has been failed to ++ * write out, the jbd2 checkpoint procedure will not detect ++ * this failure and may lead to filesystem inconsistency ++ * after cleanup journal tail. ++ */ ++ if (buffer_write_io_error(bh)) { ++ pr_err("JBD2: Error while async write back metadata bh %llu.", ++ (unsigned long long)bh->b_blocknr); ++ has_write_io_error = true; ++ } + } while ((bh = bh->b_this_page) != head); + + ret = try_to_free_buffers(page); + + busy: ++ if (has_write_io_error) ++ jbd2_journal_abort(journal, -EIO); ++ + return ret; + } + +@@ -2461,6 +2480,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) + + was_dirty = test_clear_buffer_jbddirty(bh); + __jbd2_journal_temp_unlink_buffer(jh); ++ ++ /* ++ * b_transaction must be set, otherwise the new b_transaction won't ++ * be holding jh reference ++ */ ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ + /* + * We set b_transaction here because b_next_transaction will inherit + * our jh reference and thus __jbd2_journal_file_buffer() must not +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 2dab158b74c45..598ee6ba5b18f 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -948,7 +948,11 @@ extern void *efi_get_pal_addr (void); + extern void efi_map_pal_code (void); + extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg); + extern void efi_gettimeofday (struct timespec64 *ts); ++#ifdef CONFIG_EFI + extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */ ++#else ++static inline void efi_enter_virtual_mode (void) {} ++#endif + #ifdef CONFIG_X86 + extern void efi_late_init(void); + extern void efi_free_boot_services(void); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 92b9cf88a95e6..30172ad84b25f 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1989,6 +1989,10 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp) + * I_OVL_INUSE Used by overlayfs to get exclusive ownership on upper + * and work dirs among overlayfs mounts. + * ++ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists. ++ * Used to detect that mark_inode_dirty() should not move ++ * inode between dirty lists. ++ * + * Q: What is the difference between I_WILL_FREE and I_FREEING? + */ + #define I_DIRTY_SYNC (1 << 0) +@@ -2006,10 +2010,10 @@ static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp) + #define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP) + #define I_LINKABLE (1 << 10) + #define I_DIRTY_TIME (1 << 11) +-#define __I_DIRTY_TIME_EXPIRED 12 +-#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED) ++#define I_DIRTY_TIME_EXPIRED (1 << 12) + #define I_WB_SWITCH (1 << 13) + #define I_OVL_INUSE (1 << 14) ++#define I_SYNC_QUEUED (1 << 17) + + #define I_DIRTY (I_DIRTY_SYNC | I_DIRTY_DATASYNC | I_DIRTY_PAGES) + #define I_DIRTY_ALL (I_DIRTY | I_DIRTY_TIME) +diff --git a/include/linux/overflow.h b/include/linux/overflow.h +index d309788f4cd24..40b48e2133cb8 100644 +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -233,4 +233,77 @@ + (*_d >> _to_shift) != _a); \ + }) + ++/** ++ * array_size() - Calculate size of 2-dimensional array. ++ * ++ * @a: dimension one ++ * @b: dimension two ++ * ++ * Calculates size of 2-dimensional array: @a * @b. ++ * ++ * Returns: number of bytes needed to represent the array or SIZE_MAX on ++ * overflow. ++ */ ++static inline __must_check size_t array_size(size_t a, size_t b) ++{ ++ size_t bytes; ++ ++ if (check_mul_overflow(a, b, &bytes)) ++ return SIZE_MAX; ++ ++ return bytes; ++} ++ ++/** ++ * array3_size() - Calculate size of 3-dimensional array. ++ * ++ * @a: dimension one ++ * @b: dimension two ++ * @c: dimension three ++ * ++ * Calculates size of 3-dimensional array: @a * @b * @c. ++ * ++ * Returns: number of bytes needed to represent the array or SIZE_MAX on ++ * overflow. ++ */ ++static inline __must_check size_t array3_size(size_t a, size_t b, size_t c) ++{ ++ size_t bytes; ++ ++ if (check_mul_overflow(a, b, &bytes)) ++ return SIZE_MAX; ++ if (check_mul_overflow(bytes, c, &bytes)) ++ return SIZE_MAX; ++ ++ return bytes; ++} ++ ++static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c) ++{ ++ size_t bytes; ++ ++ if (check_mul_overflow(n, size, &bytes)) ++ return SIZE_MAX; ++ if (check_add_overflow(bytes, c, &bytes)) ++ return SIZE_MAX; ++ ++ return bytes; ++} ++ ++/** ++ * struct_size() - Calculate size of structure with trailing array. ++ * @p: Pointer to the structure. ++ * @member: Name of the array member. ++ * @n: Number of elements in the array. ++ * ++ * Calculates size of memory needed for structure @p followed by an ++ * array of @n @member elements. ++ * ++ * Return: number of bytes needed or SIZE_MAX on overflow. ++ */ ++#define struct_size(p, member, n) \ ++ __ab_c_size(n, \ ++ sizeof(*(p)->member) + __must_be_array((p)->member),\ ++ sizeof(*(p))) ++ + #endif /* __LINUX_OVERFLOW_H */ +diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h +index 2e1fa7910306d..3a76ca2eecd06 100644 +--- a/include/trace/events/writeback.h ++++ b/include/trace/events/writeback.h +@@ -361,8 +361,9 @@ DEFINE_WBC_EVENT(wbc_writepage); + TRACE_EVENT(writeback_queue_io, + TP_PROTO(struct bdi_writeback *wb, + struct wb_writeback_work *work, ++ unsigned long dirtied_before, + int moved), +- TP_ARGS(wb, work, moved), ++ TP_ARGS(wb, work, dirtied_before, moved), + TP_STRUCT__entry( + __array(char, name, 32) + __field(unsigned long, older) +@@ -372,19 +373,17 @@ TRACE_EVENT(writeback_queue_io, + __field(unsigned int, cgroup_ino) + ), + TP_fast_assign( +- unsigned long *older_than_this = work->older_than_this; + strncpy(__entry->name, dev_name(wb->bdi->dev), 32); +- __entry->older = older_than_this ? *older_than_this : 0; +- __entry->age = older_than_this ? +- (jiffies - *older_than_this) * 1000 / HZ : -1; ++ __entry->older = dirtied_before; ++ __entry->age = (jiffies - dirtied_before) * 1000 / HZ; + __entry->moved = moved; + __entry->reason = work->reason; + __entry->cgroup_ino = __trace_wb_assign_cgroup(wb); + ), + TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup_ino=%u", + __entry->name, +- __entry->older, /* older_than_this in jiffies */ +- __entry->age, /* older_than_this in relative milliseconds */ ++ __entry->older, /* dirtied_before in jiffies */ ++ __entry->age, /* dirtied_before in relative milliseconds */ + __entry->moved, + __print_symbolic(__entry->reason, WB_WORK_REASON), + __entry->cgroup_ino +diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c +index 8b2ef15e35524..06c02cd0ff577 100644 +--- a/kernel/locking/lockdep_proc.c ++++ b/kernel/locking/lockdep_proc.c +@@ -430,7 +430,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt) + seq_time(m, lt->min); + seq_time(m, lt->max); + seq_time(m, lt->total); +- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0); ++ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0); + } + + static void seq_stats(struct seq_file *m, struct lock_stat_data *data) +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 9a55c5bc52434..987daf9cc6e54 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -541,6 +541,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev, + if (!dir) + goto err; + ++ /* ++ * As blktrace relies on debugfs for its interface the debugfs directory ++ * is required, contrary to the usual mantra of not checking for debugfs ++ * files or directories. ++ */ ++ if (IS_ERR_OR_NULL(dir)) { ++ pr_warn("debugfs_dir not present for %s so skipping\n", ++ buts->name); ++ ret = -ENOENT; ++ goto err; ++ } ++ + bt->dev = dev; + atomic_set(&bt->dropped, 0); + INIT_LIST_HEAD(&bt->running_list); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index b1933e1f3aef9..4c0f637bbf8b8 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -5053,8 +5053,8 @@ struct sk_buff *skb_vlan_untag(struct sk_buff *skb) + skb = skb_share_check(skb, GFP_ATOMIC); + if (unlikely(!skb)) + goto err_free; +- +- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) ++ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */ ++ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short)))) + goto err_free; + + vhdr = (struct vlan_hdr *)skb->data; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index c2644405bab19..2ffb4b8eca04c 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -872,7 +872,15 @@ int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb, + struct metadata_dst *tun_dst, + bool log_ecn_err) + { +- return __ip6_tnl_rcv(t, skb, tpi, NULL, ip6ip6_dscp_ecn_decapsulate, ++ int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t, ++ const struct ipv6hdr *ipv6h, ++ struct sk_buff *skb); ++ ++ dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate; ++ if (tpi->proto == htons(ETH_P_IP)) ++ dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate; ++ ++ return __ip6_tnl_rcv(t, skb, tpi, NULL, dscp_ecn_decapsulate, + log_ecn_err); + } + EXPORT_SYMBOL(ip6_tnl_rcv); +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index fa0522cd683ee..99c69489bb442 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -250,8 +250,9 @@ err_out: + static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, + struct tipc_nl_compat_msg *msg) + { +- int err; ++ struct nlmsghdr *nlh; + struct sk_buff *arg; ++ int err; + + if (msg->req_type && (!msg->req_size || + !TLV_CHECK_TYPE(msg->req, msg->req_type))) +@@ -280,6 +281,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, + return -ENOMEM; + } + ++ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI); ++ if (!nlh) { ++ kfree_skb(arg); ++ kfree_skb(msg->rep); ++ msg->rep = NULL; ++ return -EMSGSIZE; ++ } ++ nlmsg_end(arg, nlh); ++ + err = __tipc_nl_compat_dumpit(cmd, msg, arg); + if (err) { + kfree_skb(msg->rep); +diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c +index 0020fd0efc466..09c547f4cc186 100644 +--- a/sound/pci/cs46xx/cs46xx_lib.c ++++ b/sound/pci/cs46xx/cs46xx_lib.c +@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned + rate = 48000 / 9; + + /* +- * We can not capture at at rate greater than the Input Rate (48000). ++ * We can not capture at a rate greater than the Input Rate (48000). + * Return an error if an attempt is made to stray outside that limit. + */ + if (rate > 48000) +diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c +index 7488e1b7a7707..4e726d39b05d1 100644 +--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c ++++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c +@@ -1742,7 +1742,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip) + struct dsp_spos_instance * ins = chip->dsp_spos_instance; + + if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) { +- /* remove AsynchFGTxSCB and and PCMSerialInput_II */ ++ /* remove AsynchFGTxSCB and PCMSerialInput_II */ + cs46xx_dsp_disable_spdif_out (chip); + + /* save state */ +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 7d65fe31c8257..a56f018d586f5 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -3394,7 +3394,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save); + * @nid: NID to check / update + * + * Check whether the given NID is in the amp list. If it's in the list, +- * check the current AMP status, and update the the power-status according ++ * check the current AMP status, and update the power-status according + * to the mute status. + * + * This function is supposed to be set or called from the check_power_status +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index 28ef409a9e6ae..9dee657ce9e27 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -823,7 +823,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path, + } + } + +-/* sync power of each widget in the the given path */ ++/* sync power of each widget in the given path */ + static hda_nid_t path_power_update(struct hda_codec *codec, + struct nid_path *path, + bool allow_powerdown) +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 7cd147411b22d..f7896a9ae3d65 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -863,7 +863,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec, + static struct snd_kcontrol_new beep_vol_ctl = + HDA_CODEC_VOLUME(NULL, 0, 0, 0); + +- /* check for mute support for the the amp */ ++ /* check for mute support for the amp */ + if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) { + const struct snd_kcontrol_new *temp; + if (spec->anabeep_nid == nid) +diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c +index 3919aed39ca03..5e52086d7b986 100644 +--- a/sound/pci/ice1712/prodigy192.c ++++ b/sound/pci/ice1712/prodigy192.c +@@ -31,7 +31,7 @@ + * Experimentally I found out that only a combination of + * OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 - + * VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct +- * sampling rate. That means the the FPGA doubles the ++ * sampling rate. That means that the FPGA doubles the + * MCK01 rate. + * + * Copyright (c) 2003 Takashi Iwai +diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c +index 4cf3200e988b0..df44135e1b0c9 100644 +--- a/sound/pci/oxygen/xonar_dg.c ++++ b/sound/pci/oxygen/xonar_dg.c +@@ -39,7 +39,7 @@ + * GPIO 4 <- headphone detect + * GPIO 5 -> enable ADC analog circuit for the left channel + * GPIO 6 -> enable ADC analog circuit for the right channel +- * GPIO 7 -> switch green rear output jack between CS4245 and and the first ++ * GPIO 7 -> switch green rear output jack between CS4245 and the first + * channel of CS4361 (mechanical relay) + * GPIO 8 -> enable output to speakers + * +diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c +index 43679aeeb12be..88e838ac937dc 100644 +--- a/sound/soc/tegra/tegra30_ahub.c ++++ b/sound/soc/tegra/tegra30_ahub.c +@@ -655,8 +655,10 @@ static int tegra30_ahub_resume(struct device *dev) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put(dev); + return ret; ++ } + ret = regcache_sync(ahub->regmap_ahub); + ret |= regcache_sync(ahub->regmap_apbif); + pm_runtime_put(dev); +diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c +index 0b176ea24914b..bf155c5092f06 100644 +--- a/sound/soc/tegra/tegra30_i2s.c ++++ b/sound/soc/tegra/tegra30_i2s.c +@@ -551,8 +551,10 @@ static int tegra30_i2s_resume(struct device *dev) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put(dev); + return ret; ++ } + ret = regcache_sync(i2s->regmap); + pm_runtime_put(dev); + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 689fd3103e5b6..a917b7e02d312 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3331,8 +3331,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + * they pretend to be 96kHz mono as a workaround for stereo being broken + * by that... + * +- * They also have swapped L-R channels, but that's for userspace to deal +- * with. ++ * They also have an issue with initial stream alignment that causes the ++ * channels to be swapped and out of phase, which is dealt with in quirks.c. + */ + { + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c +index 94110b1dcd3d8..031baa43646fb 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c +@@ -91,8 +91,6 @@ int back_to_back_ebbs(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + event_close(&event); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c +index 7c57a8d79535d..361e0be9df9ae 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c +@@ -42,8 +42,6 @@ int cycles(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + event_close(&event); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c +index ecf5ee3283a3e..fe7d0dc2a1a26 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c +@@ -99,8 +99,6 @@ int cycles_with_freeze(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + printf("EBBs while frozen %d\n", ebbs_while_frozen); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c +index c0faba520b35c..b9b30f974b5ea 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c +@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + event_close(&event); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c +index 46681fec549b8..2694ae161a84a 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c +@@ -396,8 +396,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + event_close(&event); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c +index a991d2ea8d0a1..174e4f4dae6c0 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c +@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + FAIL_IF(ebb_state.stats.ebb_count == 0); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c +index eb8acb78bc6c1..531083accfcad 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c +@@ -75,7 +75,6 @@ static int test_body(void) + ebb_freeze_pmcs(); + ebb_global_disable(); + +- count_pmc(4, sample_period); + mtspr(SPRN_PMC4, 0xdead); + + dump_summary_ebb_state(); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c +index 6ff8c8ff27d66..035c02273cd49 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c +@@ -70,13 +70,6 @@ int multi_counter(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- count_pmc(2, sample_period); +- count_pmc(3, sample_period); +- count_pmc(4, sample_period); +- count_pmc(5, sample_period); +- count_pmc(6, sample_period); +- + dump_ebb_state(); + + for (i = 0; i < 6; i++) +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c +index 037cb6154f360..3e9d4ac965c85 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c +@@ -61,8 +61,6 @@ static int cycles_child(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_summary_ebb_state(); + + event_close(&event); +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c +index c5fa64790c22e..d90891fe96a32 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c +@@ -82,8 +82,6 @@ static int test_body(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(1, sample_period); +- + dump_ebb_state(); + + if (mmcr0_mismatch) +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c +index 30e1ac62e8cb4..8ca92b9ee5b01 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c +@@ -76,8 +76,6 @@ int pmc56_overflow(void) + ebb_global_disable(); + ebb_freeze_pmcs(); + +- count_pmc(2, sample_period); +- + dump_ebb_state(); + + printf("PMC5/6 overflow %d\n", pmc56_overflowed); diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.196-197.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.196-197.patch new file mode 100644 index 0000000000..c2a0343595 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.196-197.patch @@ -0,0 +1,2688 @@ +diff --git a/Documentation/filesystems/affs.txt b/Documentation/filesystems/affs.txt +index 71b63c2b98410..a8f1a58e36922 100644 +--- a/Documentation/filesystems/affs.txt ++++ b/Documentation/filesystems/affs.txt +@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPARWED are handled as follows: + + - R maps to r for user, group and others. On directories, R implies x. + +- - If both W and D are allowed, w will be set. ++ - W maps to w. + + - E maps to x. + +- - H and P are always retained and ignored under Linux. ++ - D is ignored. + +- - A is always reset when a file is written to. ++ - H, S and P are always retained and ignored under Linux. ++ ++ - A is cleared when a file is written to. + + User id and group id will be used unless set[gu]id are given as mount + options. Since most of the Amiga file systems are single user systems +@@ -111,11 +113,13 @@ Linux -> Amiga: + + The Linux rwxrwxrwx file mode is handled as follows: + +- - r permission will set R for user, group and others. ++ - r permission will allow R for user, group and others. ++ ++ - w permission will allow W for user, group and others. + +- - w permission will set W and D for user, group and others. ++ - x permission of the user will allow E for plain files. + +- - x permission of the user will set E for plain files. ++ - D will be allowed for user, group and others. + + - All other flags (suid, sgid, ...) are ignored and will + not be retained. +diff --git a/Makefile b/Makefile +index 5c8b785f72919..3712b4deafbed 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 196 ++SUBLEVEL = 197 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h +index 1d6d980f80ac0..f88611e241f0e 100644 +--- a/arch/arm64/include/asm/kvm_arm.h ++++ b/arch/arm64/include/asm/kvm_arm.h +@@ -78,10 +78,11 @@ + * IMO: Override CPSR.I and enable signaling with VI + * FMO: Override CPSR.F and enable signaling with VF + * SWIO: Turn set/way invalidates into set/way clean+invalidate ++ * PTW: Take a stage2 fault if a stage1 walk steps in device memory + */ + #define HCR_GUEST_FLAGS (HCR_TSC | HCR_TSW | HCR_TWE | HCR_TWI | HCR_VM | \ + HCR_TVM | HCR_BSU_IS | HCR_FB | HCR_TAC | \ +- HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW) ++ HCR_AMO | HCR_SWIO | HCR_TIDCP | HCR_RW | HCR_PTW) + #define HCR_VIRT_EXCP_MASK (HCR_VSE | HCR_VI | HCR_VF) + #define HCR_INT_OVERRIDE (HCR_FMO | HCR_IMO) + #define HCR_HOST_NVHE_FLAGS (HCR_RW | HCR_API | HCR_APK) +diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h +index c59e81b651328..b0f0fb81f5f5e 100644 +--- a/arch/arm64/include/asm/kvm_asm.h ++++ b/arch/arm64/include/asm/kvm_asm.h +@@ -83,6 +83,34 @@ extern u32 __init_stage2_translation(void); + *__hyp_this_cpu_ptr(sym); \ + }) + ++#define __KVM_EXTABLE(from, to) \ ++ " .pushsection __kvm_ex_table, \"a\"\n" \ ++ " .align 3\n" \ ++ " .long (" #from " - .), (" #to " - .)\n" \ ++ " .popsection\n" ++ ++ ++#define __kvm_at(at_op, addr) \ ++( { \ ++ int __kvm_at_err = 0; \ ++ u64 spsr, elr; \ ++ asm volatile( \ ++ " mrs %1, spsr_el2\n" \ ++ " mrs %2, elr_el2\n" \ ++ "1: at "at_op", %3\n" \ ++ " isb\n" \ ++ " b 9f\n" \ ++ "2: msr spsr_el2, %1\n" \ ++ " msr elr_el2, %2\n" \ ++ " mov %w0, %4\n" \ ++ "9:\n" \ ++ __KVM_EXTABLE(1b, 2b) \ ++ : "+r" (__kvm_at_err), "=&r" (spsr), "=&r" (elr) \ ++ : "r" (addr), "i" (-EFAULT)); \ ++ __kvm_at_err; \ ++} ) ++ ++ + #else /* __ASSEMBLY__ */ + + .macro hyp_adr_this_cpu reg, sym, tmp +@@ -107,6 +135,21 @@ extern u32 __init_stage2_translation(void); + kern_hyp_va \vcpu + .endm + ++/* ++ * KVM extable for unexpected exceptions. ++ * In the same format _asm_extable, but output to a different section so that ++ * it can be mapped to EL2. The KVM version is not sorted. The caller must ++ * ensure: ++ * x18 has the hypervisor value to allow any Shadow-Call-Stack instrumented ++ * code to write to it, and that SPSR_EL2 and ELR_EL2 are restored by the fixup. ++ */ ++.macro _kvm_extable, from, to ++ .pushsection __kvm_ex_table, "a" ++ .align 3 ++ .long (\from - .), (\to - .) ++ .popsection ++.endm ++ + #endif + + #endif /* __ARM_KVM_ASM_H__ */ +diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S +index c4e55176f4b6d..4c11d3e64aef4 100644 +--- a/arch/arm64/kernel/vmlinux.lds.S ++++ b/arch/arm64/kernel/vmlinux.lds.S +@@ -24,6 +24,13 @@ ENTRY(_text) + + jiffies = jiffies_64; + ++ ++#define HYPERVISOR_EXTABLE \ ++ . = ALIGN(SZ_8); \ ++ VMLINUX_SYMBOL(__start___kvm_ex_table) = .; \ ++ *(__kvm_ex_table) \ ++ VMLINUX_SYMBOL(__stop___kvm_ex_table) = .; ++ + #define HYPERVISOR_TEXT \ + /* \ + * Align to 4 KB so that \ +@@ -39,6 +46,7 @@ jiffies = jiffies_64; + VMLINUX_SYMBOL(__hyp_idmap_text_end) = .; \ + VMLINUX_SYMBOL(__hyp_text_start) = .; \ + *(.hyp.text) \ ++ HYPERVISOR_EXTABLE \ + VMLINUX_SYMBOL(__hyp_text_end) = .; + + #define IDMAP_TEXT \ +diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S +index a360ac6e89e9d..4e0eac361f87c 100644 +--- a/arch/arm64/kvm/hyp/entry.S ++++ b/arch/arm64/kvm/hyp/entry.S +@@ -17,6 +17,7 @@ + + #include + ++#include + #include + #include + #include +@@ -62,6 +63,15 @@ ENTRY(__guest_enter) + // Store the host regs + save_callee_saved_regs x1 + ++ // Now the host state is stored if we have a pending RAS SError it must ++ // affect the host. If any asynchronous exception is pending we defer ++ // the guest entry. ++ mrs x1, isr_el1 ++ cbz x1, 1f ++ mov x0, #ARM_EXCEPTION_IRQ ++ ret ++ ++1: + add x18, x0, #VCPU_CONTEXT + + // Restore guest regs x0-x17 +@@ -135,18 +145,22 @@ ENTRY(__guest_exit) + // This is our single instruction exception window. A pending + // SError is guaranteed to occur at the earliest when we unmask + // it, and at the latest just after the ISB. +- .global abort_guest_exit_start + abort_guest_exit_start: + + isb + +- .global abort_guest_exit_end + abort_guest_exit_end: ++ msr daifset, #4 // Mask aborts ++ ret ++ ++ _kvm_extable abort_guest_exit_start, 9997f ++ _kvm_extable abort_guest_exit_end, 9997f ++9997: ++ msr daifset, #4 // Mask aborts ++ mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT) + +- // If the exception took place, restore the EL1 exception +- // context so that we can report some information. +- // Merge the exception code with the SError pending bit. +- tbz x0, #ARM_EXIT_WITH_SERROR_BIT, 1f ++ // restore the EL1 exception context so that we can report some ++ // information. Merge the exception code with the SError pending bit. + msr elr_el2, x2 + msr esr_el2, x3 + msr spsr_el2, x4 +diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S +index 3c283fd8c8f5a..5e041eabdd03e 100644 +--- a/arch/arm64/kvm/hyp/hyp-entry.S ++++ b/arch/arm64/kvm/hyp/hyp-entry.S +@@ -25,6 +25,30 @@ + #include + #include + ++.macro save_caller_saved_regs_vect ++ stp x0, x1, [sp, #-16]! ++ stp x2, x3, [sp, #-16]! ++ stp x4, x5, [sp, #-16]! ++ stp x6, x7, [sp, #-16]! ++ stp x8, x9, [sp, #-16]! ++ stp x10, x11, [sp, #-16]! ++ stp x12, x13, [sp, #-16]! ++ stp x14, x15, [sp, #-16]! ++ stp x16, x17, [sp, #-16]! ++.endm ++ ++.macro restore_caller_saved_regs_vect ++ ldp x16, x17, [sp], #16 ++ ldp x14, x15, [sp], #16 ++ ldp x12, x13, [sp], #16 ++ ldp x10, x11, [sp], #16 ++ ldp x8, x9, [sp], #16 ++ ldp x6, x7, [sp], #16 ++ ldp x4, x5, [sp], #16 ++ ldp x2, x3, [sp], #16 ++ ldp x0, x1, [sp], #16 ++.endm ++ + .text + .pushsection .hyp.text, "ax" + +@@ -183,26 +207,24 @@ el1_error: + mov x0, #ARM_EXCEPTION_EL1_SERROR + b __guest_exit + ++el2_sync: ++ save_caller_saved_regs_vect ++ stp x29, x30, [sp, #-16]! ++ bl kvm_unexpected_el2_exception ++ ldp x29, x30, [sp], #16 ++ restore_caller_saved_regs_vect ++ ++ eret ++ + el2_error: +- /* +- * Only two possibilities: +- * 1) Either we come from the exit path, having just unmasked +- * PSTATE.A: change the return code to an EL2 fault, and +- * carry on, as we're already in a sane state to handle it. +- * 2) Or we come from anywhere else, and that's a bug: we panic. +- * +- * For (1), x0 contains the original return code and x1 doesn't +- * contain anything meaningful at that stage. We can reuse them +- * as temp registers. +- * For (2), who cares? +- */ +- mrs x0, elr_el2 +- adr x1, abort_guest_exit_start +- cmp x0, x1 +- adr x1, abort_guest_exit_end +- ccmp x0, x1, #4, ne +- b.ne __hyp_panic +- mov x0, #(1 << ARM_EXIT_WITH_SERROR_BIT) ++ save_caller_saved_regs_vect ++ stp x29, x30, [sp, #-16]! ++ ++ bl kvm_unexpected_el2_exception ++ ++ ldp x29, x30, [sp], #16 ++ restore_caller_saved_regs_vect ++ + eret + + ENTRY(__hyp_do_panic) +@@ -231,7 +253,6 @@ ENDPROC(\label) + invalid_vector el2t_irq_invalid + invalid_vector el2t_fiq_invalid + invalid_vector el2t_error_invalid +- invalid_vector el2h_sync_invalid + invalid_vector el2h_irq_invalid + invalid_vector el2h_fiq_invalid + invalid_vector el1_sync_invalid +@@ -248,7 +269,7 @@ ENTRY(__kvm_hyp_vector) + ventry el2t_fiq_invalid // FIQ EL2t + ventry el2t_error_invalid // Error EL2t + +- ventry el2h_sync_invalid // Synchronous EL2h ++ ventry el2_sync // Synchronous EL2h + ventry el2h_irq_invalid // IRQ EL2h + ventry el2h_fiq_invalid // FIQ EL2h + ventry el2_error // Error EL2h +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index 0ad952e074457..99ae75a43985c 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -22,11 +22,15 @@ + + #include + ++#include + #include + #include + #include + #include + ++extern struct exception_table_entry __start___kvm_ex_table; ++extern struct exception_table_entry __stop___kvm_ex_table; ++ + static bool __hyp_text __fpsimd_enabled_nvhe(void) + { + return !(read_sysreg(cptr_el2) & CPTR_EL2_TFP); +@@ -216,10 +220,10 @@ static bool __hyp_text __translate_far_to_hpfar(u64 far, u64 *hpfar) + * saved the guest context yet, and we may return early... + */ + par = read_sysreg(par_el1); +- asm volatile("at s1e1r, %0" : : "r" (far)); +- isb(); +- +- tmp = read_sysreg(par_el1); ++ if (!__kvm_at("s1e1r", far)) ++ tmp = read_sysreg(par_el1); ++ else ++ tmp = 1; /* back to the guest */ + write_sysreg(par, par_el1); + + if (unlikely(tmp & 1)) +@@ -486,3 +490,30 @@ void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt) + + unreachable(); + } ++ ++asmlinkage void __hyp_text kvm_unexpected_el2_exception(void) ++{ ++ unsigned long addr, fixup; ++ struct kvm_cpu_context *host_ctxt; ++ struct exception_table_entry *entry, *end; ++ unsigned long elr_el2 = read_sysreg(elr_el2); ++ ++ entry = hyp_symbol_addr(__start___kvm_ex_table); ++ end = hyp_symbol_addr(__stop___kvm_ex_table); ++ host_ctxt = __hyp_this_cpu_ptr(kvm_host_cpu_state); ++ ++ while (entry < end) { ++ addr = (unsigned long)&entry->insn + entry->insn; ++ fixup = (unsigned long)&entry->fixup + entry->fixup; ++ ++ if (addr != elr_el2) { ++ entry++; ++ continue; ++ } ++ ++ write_sysreg(fixup, elr_el2); ++ return; ++ } ++ ++ hyp_panic(host_ctxt); ++} +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 45fbcbbf2504e..3018582794efc 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -240,6 +240,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle) + */ + static void bmips_init_secondary(void) + { ++ bmips_cpu_setup(); ++ + switch (current_cpu_type()) { + case CPU_BMIPS4350: + case CPU_BMIPS4380: +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index bacd67f5d71df..e4de107bf7fd8 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -1781,7 +1781,11 @@ static void setup_scache(void) + printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n", + scache_size >> 10, + way_string[c->scache.ways], c->scache.linesz); ++ ++ if (current_cpu_type() == CPU_BMIPS5000) ++ c->options |= MIPS_CPU_INCLUSIVE_CACHES; + } ++ + #else + if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT)) + panic("Dunno how to handle MIPS32 / MIPS64 second level cache"); +diff --git a/arch/s390/include/asm/percpu.h b/arch/s390/include/asm/percpu.h +index 0095ddb58ff69..50f6661ba5664 100644 +--- a/arch/s390/include/asm/percpu.h ++++ b/arch/s390/include/asm/percpu.h +@@ -29,7 +29,7 @@ + typedef typeof(pcp) pcp_op_T__; \ + pcp_op_T__ old__, new__, prev__; \ + pcp_op_T__ *ptr__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + prev__ = *ptr__; \ + do { \ +@@ -37,7 +37,7 @@ + new__ = old__ op (val); \ + prev__ = cmpxchg(ptr__, old__, new__); \ + } while (prev__ != old__); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + new__; \ + }) + +@@ -68,7 +68,7 @@ + typedef typeof(pcp) pcp_op_T__; \ + pcp_op_T__ val__ = (val); \ + pcp_op_T__ old__, *ptr__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + if (__builtin_constant_p(val__) && \ + ((szcast)val__ > -129) && ((szcast)val__ < 128)) { \ +@@ -84,7 +84,7 @@ + : [val__] "d" (val__) \ + : "cc"); \ + } \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + } + + #define this_cpu_add_4(pcp, val) arch_this_cpu_add(pcp, val, "laa", "asi", int) +@@ -95,14 +95,14 @@ + typedef typeof(pcp) pcp_op_T__; \ + pcp_op_T__ val__ = (val); \ + pcp_op_T__ old__, *ptr__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + asm volatile( \ + op " %[old__],%[val__],%[ptr__]\n" \ + : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ + : [val__] "d" (val__) \ + : "cc"); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + old__ + val__; \ + }) + +@@ -114,14 +114,14 @@ + typedef typeof(pcp) pcp_op_T__; \ + pcp_op_T__ val__ = (val); \ + pcp_op_T__ old__, *ptr__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + asm volatile( \ + op " %[old__],%[val__],%[ptr__]\n" \ + : [old__] "=d" (old__), [ptr__] "+Q" (*ptr__) \ + : [val__] "d" (val__) \ + : "cc"); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + } + + #define this_cpu_and_4(pcp, val) arch_this_cpu_to_op(pcp, val, "lan") +@@ -136,10 +136,10 @@ + typedef typeof(pcp) pcp_op_T__; \ + pcp_op_T__ ret__; \ + pcp_op_T__ *ptr__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + ret__ = cmpxchg(ptr__, oval, nval); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + ret__; \ + }) + +@@ -152,10 +152,10 @@ + ({ \ + typeof(pcp) *ptr__; \ + typeof(pcp) ret__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + ptr__ = raw_cpu_ptr(&(pcp)); \ + ret__ = xchg(ptr__, nval); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + ret__; \ + }) + +@@ -171,11 +171,11 @@ + typeof(pcp1) *p1__; \ + typeof(pcp2) *p2__; \ + int ret__; \ +- preempt_disable(); \ ++ preempt_disable_notrace(); \ + p1__ = raw_cpu_ptr(&(pcp1)); \ + p2__ = raw_cpu_ptr(&(pcp2)); \ + ret__ = __cmpxchg_double(p1__, p2__, o1__, o2__, n1__, n2__); \ +- preempt_enable(); \ ++ preempt_enable_notrace(); \ + ret__; \ + }) + +diff --git a/arch/xtensa/platforms/iss/simdisk.c b/arch/xtensa/platforms/iss/simdisk.c +index c45b90bb93393..c75e75932807e 100644 +--- a/arch/xtensa/platforms/iss/simdisk.c ++++ b/arch/xtensa/platforms/iss/simdisk.c +@@ -21,7 +21,6 @@ + #include + + #define SIMDISK_MAJOR 240 +-#define SECTOR_SHIFT 9 + #define SIMDISK_MINORS 1 + #define MAX_SIMDISK_COUNT 10 + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index a3a65f5490c02..f90a20cad3fef 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4488,9 +4488,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ + { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, + +- /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on +- SD7SN6S256G and SD8SN8U256G */ +- { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, }, ++ /* Sandisk SD7/8/9s lock up hard on large trims */ ++ { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, }, + + /* devices which puke on READ_NATIVE_MAX */ + { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, }, +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index bc2c27f0493fc..4b299efbd8047 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2392,6 +2392,7 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf) + + static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) + { ++ struct ata_device *dev = args->dev; + u16 min_io_sectors; + + rbuf[1] = 0xb0; +@@ -2417,7 +2418,12 @@ static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) + * with the unmap bit set. + */ + if (ata_id_has_trim(args->id)) { +- put_unaligned_be64(65535 * ATA_MAX_TRIM_RNUM, &rbuf[36]); ++ u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM; ++ ++ if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M) ++ max_blocks = 128 << (20 - SECTOR_SHIFT); ++ ++ put_unaligned_be64(max_blocks, &rbuf[36]); + put_unaligned_be32(1, &rbuf[28]); + } + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index 0129b1921cb36..78287f029cf07 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -28,7 +28,6 @@ + + #include + +-#define SECTOR_SHIFT 9 + #define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT) + +diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c +index ec670a1b7e02f..b499e72b2847e 100644 +--- a/drivers/block/null_blk.c ++++ b/drivers/block/null_blk.c +@@ -16,10 +16,8 @@ + #include + #include + +-#define SECTOR_SHIFT 9 + #define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT) +-#define SECTOR_SIZE (1 << SECTOR_SHIFT) + #define SECTOR_MASK (PAGE_SECTORS - 1) + + #define FREE_BATCH 16 +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index 557cf52f674b5..b9b20e1fa8c88 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -50,15 +50,6 @@ + + #define RBD_DEBUG /* Activate rbd_assert() calls */ + +-/* +- * The basic unit of block I/O is a sector. It is interpreted in a +- * number of contexts in Linux (blk, bio, genhd), but the default is +- * universally 512 bytes. These symbols are just slightly more +- * meaningful than the bare numbers they represent. +- */ +-#define SECTOR_SHIFT 9 +-#define SECTOR_SIZE (1ULL << SECTOR_SHIFT) +- + /* + * Increment the given counter and return its updated value. + * If the counter is already 0 it will not be incremented. +diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h +index 31762db861e38..1e9bf65c0bfba 100644 +--- a/drivers/block/zram/zram_drv.h ++++ b/drivers/block/zram/zram_drv.h +@@ -37,7 +37,6 @@ static const size_t max_zpage_size = PAGE_SIZE / 4 * 3; + + /*-- End of configurable params */ + +-#define SECTOR_SHIFT 9 + #define SECTORS_PER_PAGE_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define SECTORS_PER_PAGE (1 << SECTORS_PER_PAGE_SHIFT) + #define ZRAM_LOGICAL_BLOCK_SHIFT 12 +diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c +index ed4df58a855e1..da9eb38d79d9c 100644 +--- a/drivers/cpuidle/cpuidle.c ++++ b/drivers/cpuidle/cpuidle.c +@@ -144,7 +144,8 @@ static void enter_s2idle_proper(struct cpuidle_driver *drv, + */ + stop_critical_timings(); + drv->states[index].enter_s2idle(dev, drv, index); +- WARN_ON(!irqs_disabled()); ++ if (WARN_ON_ONCE(!irqs_disabled())) ++ local_irq_disable(); + /* + * timekeeping_resume() that will be called by tick_unfreeze() for the + * first CPU executing it calls functions containing RCU read-side +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index 21ed0e20c5d91..cf3225a229890 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1677,6 +1677,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + return NULL; + + dmac_pdev = of_find_device_by_node(dma_spec->np); ++ if (!dmac_pdev) ++ return NULL; + + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); +diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c +index 91fd395c90c4c..8344a60c2131b 100644 +--- a/drivers/dma/of-dma.c ++++ b/drivers/dma/of-dma.c +@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + return NULL; + + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); +- if (chan) { +- chan->router = ofdma->dma_router; +- chan->route_data = route_data; +- } else { ++ if (IS_ERR_OR_NULL(chan)) { + ofdma->dma_router->route_free(ofdma->dma_router->dev, + route_data); ++ } else { ++ chan->router = ofdma->dma_router; ++ chan->route_data = route_data; + } + + /* +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index b4fa555a243f9..ff8b7042d28f4 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2661,6 +2661,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + while (burst != (1 << desc->rqcfg.brst_size)) + desc->rqcfg.brst_size++; + ++ desc->rqcfg.brst_len = get_burst_len(desc, len); + /* + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. +@@ -2668,7 +2669,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + +- desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; + + desc->txd.flags = flags; +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index d9c0687435a05..c59240b566d83 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -1134,6 +1134,13 @@ static int msm_pdev_remove(struct platform_device *pdev) + return 0; + } + ++static void msm_pdev_shutdown(struct platform_device *pdev) ++{ ++ struct drm_device *drm = platform_get_drvdata(pdev); ++ ++ drm_atomic_helper_shutdown(drm); ++} ++ + static const struct of_device_id dt_match[] = { + { .compatible = "qcom,mdp4", .data = (void *)4 }, /* MDP4 */ + { .compatible = "qcom,mdss", .data = (void *)5 }, /* MDP5 MDSS */ +@@ -1144,6 +1151,7 @@ MODULE_DEVICE_TABLE(of, dt_match); + static struct platform_driver msm_platform_driver = { + .probe = msm_pdev_probe, + .remove = msm_pdev_remove, ++ .shutdown = msm_pdev_shutdown, + .driver = { + .name = "msm", + .of_match_table = dt_match, +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 75b0a337114df..ff6e327cbd027 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1426,6 +1426,17 @@ static void hid_output_field(const struct hid_device *hid, + } + } + ++/* ++ * Compute the size of a report. ++ */ ++static size_t hid_compute_report_size(struct hid_report *report) ++{ ++ if (report->size) ++ return ((report->size - 1) >> 3) + 1; ++ ++ return 0; ++} ++ + /* + * Create a report. 'data' has to be allocated using + * hid_alloc_report_buf() so that it has proper size. +@@ -1438,7 +1449,7 @@ void hid_output_report(struct hid_report *report, __u8 *data) + if (report->id > 0) + *data++ = report->id; + +- memset(data, 0, ((report->size - 1) >> 3) + 1); ++ memset(data, 0, hid_compute_report_size(report)); + for (n = 0; n < report->maxfield; n++) + hid_output_field(report->device, report->field[n], data); + } +@@ -1565,7 +1576,7 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, + csize--; + } + +- rsize = ((report->size - 1) >> 3) + 1; ++ rsize = hid_compute_report_size(report); + + if (report_enum->numbered && rsize >= HID_MAX_BUFFER_SIZE) + rsize = HID_MAX_BUFFER_SIZE - 1; +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 204ccf6745333..3624d6e3384ff 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1116,6 +1116,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + } + + mapped: ++ /* Mapping failed, bail out */ ++ if (!bit) ++ return; ++ + if (device->driver->input_mapped && + device->driver->input_mapped(device, hidinput, field, usage, + &bit, &max) < 0) { +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index db29bf539a4b2..ac31998f93a88 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -616,6 +616,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + (usage->hid & HID_USAGE) > 1) + code--; + hid_map_usage(hi, usage, bit, max, EV_KEY, code); ++ if (!*bit) ++ return -1; + input_set_capability(hi->input, EV_KEY, code); + return 1; + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index 5c677ba440143..b201129a9beae 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -760,15 +760,18 @@ static ssize_t applesmc_light_show(struct device *dev, + } + + ret = applesmc_read_key(LIGHT_SENSOR_LEFT_KEY, buffer, data_length); ++ if (ret) ++ goto out; + /* newer macbooks report a single 10-bit bigendian value */ + if (data_length == 10) { + left = be16_to_cpu(*(__be16 *)(buffer + 6)) >> 2; + goto out; + } + left = buffer[2]; ++ ++ ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); + if (ret) + goto out; +- ret = applesmc_read_key(LIGHT_SENSOR_RIGHT_KEY, buffer, data_length); + right = buffer[2]; + + out: +@@ -817,12 +820,11 @@ static ssize_t applesmc_show_fan_speed(struct device *dev, + to_index(attr)); + + ret = applesmc_read_key(newkey, buffer, 2); +- speed = ((buffer[0] << 8 | buffer[1]) >> 2); +- + if (ret) + return ret; +- else +- return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); ++ ++ speed = ((buffer[0] << 8 | buffer[1]) >> 2); ++ return snprintf(sysfsbuf, PAGE_SIZE, "%u\n", speed); + } + + static ssize_t applesmc_store_fan_speed(struct device *dev, +@@ -858,12 +860,11 @@ static ssize_t applesmc_show_fan_manual(struct device *dev, + u8 buffer[2]; + + ret = applesmc_read_key(FANS_MANUAL, buffer, 2); +- manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; +- + if (ret) + return ret; +- else +- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); ++ ++ manual = ((buffer[0] << 8 | buffer[1]) >> to_index(attr)) & 0x01; ++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", manual); + } + + static ssize_t applesmc_store_fan_manual(struct device *dev, +@@ -879,10 +880,11 @@ static ssize_t applesmc_store_fan_manual(struct device *dev, + return -EINVAL; + + ret = applesmc_read_key(FANS_MANUAL, buffer, 2); +- val = (buffer[0] << 8 | buffer[1]); + if (ret) + goto out; + ++ val = (buffer[0] << 8 | buffer[1]); ++ + if (input) + val = val | (0x01 << to_index(attr)); + else +@@ -958,13 +960,12 @@ static ssize_t applesmc_key_count_show(struct device *dev, + u32 count; + + ret = applesmc_read_key(KEY_COUNT_KEY, buffer, 4); +- count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + +- ((u32)buffer[2]<<8) + buffer[3]; +- + if (ret) + return ret; +- else +- return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); ++ ++ count = ((u32)buffer[0]<<24) + ((u32)buffer[1]<<16) + ++ ((u32)buffer[2]<<8) + buffer[3]; ++ return snprintf(sysfsbuf, PAGE_SIZE, "%d\n", count); + } + + static ssize_t applesmc_key_at_index_read_show(struct device *dev, +diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c +index 4de45db76756c..5aed1de845d0d 100644 +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -712,7 +712,7 @@ static ide_startstop_t cdrom_start_rw(ide_drive_t *drive, struct request *rq) + struct request_queue *q = drive->queue; + int write = rq_data_dir(rq) == WRITE; + unsigned short sectors_per_frame = +- queue_logical_block_size(q) >> SECTOR_BITS; ++ queue_logical_block_size(q) >> SECTOR_SHIFT; + + ide_debug_log(IDE_DBG_RQ, "rq->cmd[0]: 0x%x, rq->cmd_flags: 0x%x, " + "secs_per_frame: %u", +@@ -919,7 +919,7 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity, + * end up being bogus. + */ + blocklen = be32_to_cpu(capbuf.blocklen); +- blocklen = (blocklen >> SECTOR_BITS) << SECTOR_BITS; ++ blocklen = (blocklen >> SECTOR_SHIFT) << SECTOR_SHIFT; + switch (blocklen) { + case 512: + case 1024: +@@ -935,7 +935,7 @@ static int cdrom_read_capacity(ide_drive_t *drive, unsigned long *capacity, + } + + *capacity = 1 + be32_to_cpu(capbuf.lba); +- *sectors_per_frame = blocklen >> SECTOR_BITS; ++ *sectors_per_frame = blocklen >> SECTOR_SHIFT; + + ide_debug_log(IDE_DBG_PROBE, "cap: %lu, sectors_per_frame: %lu", + *capacity, *sectors_per_frame); +@@ -1012,7 +1012,7 @@ int ide_cd_read_toc(ide_drive_t *drive, struct request_sense *sense) + drive->probed_capacity = toc->capacity * sectors_per_frame; + + blk_queue_logical_block_size(drive->queue, +- sectors_per_frame << SECTOR_BITS); ++ sectors_per_frame << SECTOR_SHIFT); + + /* first read just the header, so we know how long the TOC is */ + stat = cdrom_read_tocentry(drive, 0, 1, 0, (char *) &toc->hdr, +diff --git a/drivers/ide/ide-cd.h b/drivers/ide/ide-cd.h +index 264e822eba58a..04f0f310a8566 100644 +--- a/drivers/ide/ide-cd.h ++++ b/drivers/ide/ide-cd.h +@@ -21,11 +21,7 @@ + + /************************************************************************/ + +-#define SECTOR_BITS 9 +-#ifndef SECTOR_SIZE +-#define SECTOR_SIZE (1 << SECTOR_BITS) +-#endif +-#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_BITS) ++#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_SHIFT) + #define SECTOR_BUFFER_SIZE (CD_FRAMESIZE * 32) + + /* Capabilities Page size including 8 bytes of Mode Page Header */ +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 7cc5b04e30b7a..09c6b17aaf80e 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -479,12 +479,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu) + + /* Enable interrupt-remapping */ + iommu->gcmd |= DMA_GCMD_IRE; +- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */ + writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); +- + IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, + readl, (sts & DMA_GSTS_IRES), sts); + ++ /* Block compatibility-format MSIs */ ++ if (sts & DMA_GSTS_CFIS) { ++ iommu->gcmd &= ~DMA_GCMD_CFI; ++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); ++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, ++ readl, !(sts & DMA_GSTS_CFIS), sts); ++ } ++ + /* + * With CFI clear in the Global Command register, we should be + * protected from dangerous (i.e. compatibility) interrupts +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 394e53afc2593..0acd10d3b7bff 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -536,12 +536,16 @@ static int __create_persistent_data_objects(struct dm_cache_metadata *cmd, + CACHE_MAX_CONCURRENT_LOCKS); + if (IS_ERR(cmd->bm)) { + DMERR("could not create block manager"); +- return PTR_ERR(cmd->bm); ++ r = PTR_ERR(cmd->bm); ++ cmd->bm = NULL; ++ return r; + } + + r = __open_or_format_metadata(cmd, may_format_device); +- if (r) ++ if (r) { + dm_block_manager_destroy(cmd->bm); ++ cmd->bm = NULL; ++ } + + return r; + } +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index b85a66f42814e..29f8a632b42b2 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -698,12 +698,16 @@ static int __create_persistent_data_objects(struct dm_pool_metadata *pmd, bool f + THIN_MAX_CONCURRENT_LOCKS); + if (IS_ERR(pmd->bm)) { + DMERR("could not create block manager"); +- return PTR_ERR(pmd->bm); ++ r = PTR_ERR(pmd->bm); ++ pmd->bm = NULL; ++ return r; + } + + r = __open_or_format_metadata(pmd, format_device); +- if (r) ++ if (r) { + dm_block_manager_destroy(pmd->bm); ++ pmd->bm = NULL; ++ } + + return r; + } +diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c +index 0187dbf3b87df..54cdafdd067db 100644 +--- a/drivers/net/ethernet/arc/emac_mdio.c ++++ b/drivers/net/ethernet/arc/emac_mdio.c +@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + if (IS_ERR(data->reset_gpio)) { + error = PTR_ERR(data->reset_gpio); + dev_err(priv->dev, "Failed to request gpio: %d\n", error); ++ mdiobus_free(bus); + return error; + } + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 123ee5c11bc0c..11eb393497a2a 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2087,8 +2087,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) + priv->tx_rings = devm_kcalloc(&pdev->dev, txq, + sizeof(struct bcm_sysport_tx_ring), + GFP_KERNEL); +- if (!priv->tx_rings) +- return -ENOMEM; ++ if (!priv->tx_rings) { ++ ret = -ENOMEM; ++ goto err_free_netdev; ++ } + + priv->is_lite = params->is_lite; + priv->num_rx_desc_words = params->num_rx_desc_words; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index a189061d8f97e..7de38ae5c18f2 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8251,6 +8251,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + + bnxt_parse_log_pcie_link(bp); + ++ pci_save_state(pdev); + return 0; + + init_err_cleanup_tc: +@@ -8412,6 +8413,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + "Cannot re-enable PCI device after reset.\n"); + } else { + pci_set_master(pdev); ++ pci_restore_state(pdev); ++ pci_save_state(pdev); + + err = bnxt_hwrm_func_reset(bp); + if (!err && netif_running(netdev)) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 6edbbfc1709a2..a38433cb9015d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1761,6 +1761,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data) + if (rc != 0) + return rc; + ++ if (!dir_entries || !entry_length) ++ return -EIO; ++ + /* Insert 2 bytes of directory info (count and size of entries) */ + if (len < 2) + return -EINVAL; +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index e40d31b405253..480179ddc45b6 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -7204,8 +7204,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp) + + static inline void tg3_reset_task_cancel(struct tg3 *tp) + { +- cancel_work_sync(&tp->reset_task); +- tg3_flag_clear(tp, RESET_TASK_PENDING); ++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags)) ++ cancel_work_sync(&tp->reset_task); + tg3_flag_clear(tp, TX_RECOVERY_PENDING); + } + +@@ -11182,18 +11182,27 @@ static void tg3_reset_task(struct work_struct *work) + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 0); + err = tg3_init_hw(tp, true); +- if (err) ++ if (err) { ++ tg3_full_unlock(tp); ++ tp->irq_sync = 0; ++ tg3_napi_enable(tp); ++ /* Clear this flag so that tg3_reset_task_cancel() will not ++ * call cancel_work_sync() and wait forever. ++ */ ++ tg3_flag_clear(tp, RESET_TASK_PENDING); ++ dev_close(tp->dev); + goto out; ++ } + + tg3_netif_start(tp); + +-out: + tg3_full_unlock(tp); + + if (!err) + tg3_phy_start(tp); + + tg3_flag_clear(tp, RESET_TASK_PENDING); ++out: + rtnl_unlock(); + } + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 0733745f4be6c..af832929ae287 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -2433,8 +2433,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->enet_ver = AE_VERSION_1; + else if (acpi_dev_found(hns_enet_acpi_match[1].id)) + priv->enet_ver = AE_VERSION_2; +- else +- return -ENXIO; ++ else { ++ ret = -ENXIO; ++ goto out_read_prop_fail; ++ } + + /* try to find port-idx-in-ae first */ + ret = acpi_node_get_property_reference(dev->fwnode, +@@ -2446,7 +2448,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->fwnode = acpi_fwnode_handle(args.adev); + } else { + dev_err(dev, "cannot read cfg data from OF or acpi\n"); +- return -ENXIO; ++ ret = -ENXIO; ++ goto out_read_prop_fail; + } + + ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id); +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index 20043f82c1d82..7c212d6618640 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) + goto err_out; + + for (i = 0; i <= buddy->max_order; ++i) { +- s = BITS_TO_LONGS(1 << (buddy->max_order - i)); ++ s = BITS_TO_LONGS(1UL << (buddy->max_order - i)); + buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO); + if (!buddy->bits[i]) + goto err_out_free; +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 9f4d93a16b7e5..19fb3dbb80f58 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1374,6 +1374,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, + return error; + } + ++/* MDIO bus init function */ ++static int ravb_mdio_init(struct ravb_private *priv) ++{ ++ struct platform_device *pdev = priv->pdev; ++ struct device *dev = &pdev->dev; ++ int error; ++ ++ /* Bitbang init */ ++ priv->mdiobb.ops = &bb_ops; ++ ++ /* MII controller setting */ ++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); ++ if (!priv->mii_bus) ++ return -ENOMEM; ++ ++ /* Hook up MII support for ethtool */ ++ priv->mii_bus->name = "ravb_mii"; ++ priv->mii_bus->parent = dev; ++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", ++ pdev->name, pdev->id); ++ ++ /* Register MDIO bus */ ++ error = of_mdiobus_register(priv->mii_bus, dev->of_node); ++ if (error) ++ goto out_free_bus; ++ ++ return 0; ++ ++out_free_bus: ++ free_mdio_bitbang(priv->mii_bus); ++ return error; ++} ++ ++/* MDIO bus release function */ ++static int ravb_mdio_release(struct ravb_private *priv) ++{ ++ /* Unregister mdio bus */ ++ mdiobus_unregister(priv->mii_bus); ++ ++ /* Free bitbang info */ ++ free_mdio_bitbang(priv->mii_bus); ++ ++ return 0; ++} ++ + /* Network device open function for Ethernet AVB */ + static int ravb_open(struct net_device *ndev) + { +@@ -1382,6 +1427,13 @@ static int ravb_open(struct net_device *ndev) + struct device *dev = &pdev->dev; + int error; + ++ /* MDIO bus init */ ++ error = ravb_mdio_init(priv); ++ if (error) { ++ netdev_err(ndev, "failed to initialize MDIO\n"); ++ return error; ++ } ++ + napi_enable(&priv->napi[RAVB_BE]); + napi_enable(&priv->napi[RAVB_NC]); + +@@ -1459,6 +1511,7 @@ out_free_irq: + out_napi_off: + napi_disable(&priv->napi[RAVB_NC]); + napi_disable(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); + return error; + } + +@@ -1757,6 +1810,8 @@ static int ravb_close(struct net_device *ndev) + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + ++ ravb_mdio_release(priv); ++ + return 0; + } + +@@ -1858,51 +1913,6 @@ static const struct net_device_ops ravb_netdev_ops = { + .ndo_set_mac_address = eth_mac_addr, + }; + +-/* MDIO bus init function */ +-static int ravb_mdio_init(struct ravb_private *priv) +-{ +- struct platform_device *pdev = priv->pdev; +- struct device *dev = &pdev->dev; +- int error; +- +- /* Bitbang init */ +- priv->mdiobb.ops = &bb_ops; +- +- /* MII controller setting */ +- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); +- if (!priv->mii_bus) +- return -ENOMEM; +- +- /* Hook up MII support for ethtool */ +- priv->mii_bus->name = "ravb_mii"; +- priv->mii_bus->parent = dev; +- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", +- pdev->name, pdev->id); +- +- /* Register MDIO bus */ +- error = of_mdiobus_register(priv->mii_bus, dev->of_node); +- if (error) +- goto out_free_bus; +- +- return 0; +- +-out_free_bus: +- free_mdio_bitbang(priv->mii_bus); +- return error; +-} +- +-/* MDIO bus release function */ +-static int ravb_mdio_release(struct ravb_private *priv) +-{ +- /* Unregister mdio bus */ +- mdiobus_unregister(priv->mii_bus); +- +- /* Free bitbang info */ +- free_mdio_bitbang(priv->mii_bus); +- +- return 0; +-} +- + static const struct of_device_id ravb_match_table[] = { + { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, + { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, +@@ -2132,13 +2142,6 @@ static int ravb_probe(struct platform_device *pdev) + eth_hw_addr_random(ndev); + } + +- /* MDIO bus init */ +- error = ravb_mdio_init(priv); +- if (error) { +- dev_err(&pdev->dev, "failed to initialize MDIO\n"); +- goto out_dma_free; +- } +- + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); + netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); + +@@ -2161,8 +2164,6 @@ static int ravb_probe(struct platform_device *pdev) + out_napi_del: + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); +-out_dma_free: + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); + +@@ -2195,7 +2196,6 @@ static int ravb_remove(struct platform_device *pdev) + unregister_netdev(ndev); + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); + pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + platform_set_drvdata(pdev, NULL); +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 090607e725a24..d3ccd6929579a 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1187,6 +1187,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, + goto nlmsg_failure; + + if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || ++ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || + nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) || + nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr)) + goto nla_put_failure; +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index e9fcf6ef716a8..9bf18127e63a1 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -309,7 +309,7 @@ int asix_read_phy_addr(struct usbnet *dev, int internal) + + netdev_dbg(dev->net, "asix_get_phy_addr()\n"); + +- if (ret < 0) { ++ if (ret < 2) { + netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret); + goto out; + } +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 88b8ba0ad2cda..3e3dca59b7a69 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1216,6 +1216,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ + {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ ++ {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */ + {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ + {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ + {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ +@@ -1251,6 +1252,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ ++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ + {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ +diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h +index e3f060f0b83ea..dd3cb53846290 100644 +--- a/drivers/nvdimm/nd.h ++++ b/drivers/nvdimm/nd.h +@@ -29,7 +29,6 @@ enum { + * BTT instance + */ + ND_MAX_LANES = 256, +- SECTOR_SHIFT = 9, + INT_LBASIZE_ALIGNMENT = 64, + NVDIMM_IO_ATOMIC = 1, + }; +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 09a39f4aaf821..d0be85d0c289a 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -208,6 +208,9 @@ static void nvmet_keep_alive_timer(struct work_struct *work) + + static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl) + { ++ if (unlikely(ctrl->kato == 0)) ++ return; ++ + pr_debug("ctrl %d start keep-alive timer for %d secs\n", + ctrl->cntlid, ctrl->kato); + +@@ -217,6 +220,9 @@ static void nvmet_start_keep_alive_timer(struct nvmet_ctrl *ctrl) + + static void nvmet_stop_keep_alive_timer(struct nvmet_ctrl *ctrl) + { ++ if (unlikely(ctrl->kato == 0)) ++ return; ++ + pr_debug("ctrl %d stop keep-alive\n", ctrl->cntlid); + + cancel_delayed_work_sync(&ctrl->ka_work); +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index b7a5d1065378d..df1c6dee255bf 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1994,9 +1994,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod) + return; + if (fcpreq->fcp_error || + fcpreq->transferred_length != fcpreq->transfer_length) { +- spin_lock(&fod->flock); ++ spin_lock_irqsave(&fod->flock, flags); + fod->abort = true; +- spin_unlock(&fod->flock); ++ spin_unlock_irqrestore(&fod->flock, flags); + + nvmet_req_complete(&fod->req, NVME_SC_INTERNAL); + return; +diff --git a/drivers/scsi/gdth.h b/drivers/scsi/gdth.h +index 95fc720c1b304..e6e5ccb1e0f38 100644 +--- a/drivers/scsi/gdth.h ++++ b/drivers/scsi/gdth.h +@@ -178,9 +178,6 @@ + #define MSG_SIZE 34 /* size of message structure */ + #define MSG_REQUEST 0 /* async. event: message */ + +-/* cacheservice defines */ +-#define SECTOR_SIZE 0x200 /* always 512 bytes per sec. */ +- + /* DPMEM constants */ + #define DPMEM_MAGIC 0xC0FFEE11 + #define IC_HEADER_BYTES 48 +diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +index fd11133606038..0c3141746edfe 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c ++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +@@ -49,20 +49,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = { + + /* + * Temperature values in milli degree celsius +- * ADC code values from 530 to 923 ++ * ADC code values from 13 to 107, see TRM ++ * "18.4.10.2.3 ADC Codes Versus Temperature". + */ + static const int + omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = { +- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000, +- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000, +- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000, +- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000, +- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000, +- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000, +- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000, +- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000, +- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000, +- 117000, 118000, 120000, 122000, 123000, ++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, ++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000, ++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000, ++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500, ++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000, ++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000, ++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000, ++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000, ++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000, ++ 115000, 117000, 118500, 120000, 122000, 123500, 125000, + }; + + /* OMAP4430 data */ +diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +index 6f2de3a3356d4..86850082b24b9 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h ++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +@@ -67,9 +67,13 @@ + * and thresholds for OMAP4430. + */ + +-/* ADC conversion table limits */ +-#define OMAP4430_ADC_START_VALUE 0 +-#define OMAP4430_ADC_END_VALUE 127 ++/* ++ * ADC conversion table limits. Ignore values outside the TRM listed ++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter ++ * "18.4.10.2.3 ADC Codes Versus Temperature". ++ */ ++#define OMAP4430_ADC_START_VALUE 13 ++#define OMAP4430_ADC_END_VALUE 107 + /* bandgap clock limits (no control on 4430) */ + #define OMAP4430_MAX_FREQ 32768 + #define OMAP4430_MIN_FREQ 32768 +diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c +index e94a61eaeceb0..f7b553faadb10 100644 +--- a/drivers/xen/xenbus/xenbus_client.c ++++ b/drivers/xen/xenbus/xenbus_client.c +@@ -365,8 +365,14 @@ int xenbus_grant_ring(struct xenbus_device *dev, void *vaddr, + int i, j; + + for (i = 0; i < nr_pages; i++) { +- err = gnttab_grant_foreign_access(dev->otherend_id, +- virt_to_gfn(vaddr), 0); ++ unsigned long gfn; ++ ++ if (is_vmalloc_addr(vaddr)) ++ gfn = pfn_to_gfn(vmalloc_to_pfn(vaddr)); ++ else ++ gfn = virt_to_gfn(vaddr); ++ ++ err = gnttab_grant_foreign_access(dev->otherend_id, gfn, 0); + if (err < 0) { + xenbus_dev_fatal(dev, err, + "granting access to ring page"); +diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c +index 185d5ab7e986a..a80ce75b5bad1 100644 +--- a/fs/affs/amigaffs.c ++++ b/fs/affs/amigaffs.c +@@ -419,24 +419,51 @@ affs_mode_to_prot(struct inode *inode) + u32 prot = AFFS_I(inode)->i_protect; + umode_t mode = inode->i_mode; + ++ /* ++ * First, clear all RWED bits for owner, group, other. ++ * Then, recalculate them afresh. ++ * ++ * We'll always clear the delete-inhibit bit for the owner, as that is ++ * the classic single-user mode AmigaOS protection bit and we need to ++ * stay compatible with all scenarios. ++ * ++ * Since multi-user AmigaOS is an extension, we'll only set the ++ * delete-allow bit if any of the other bits in the same user class ++ * (group/other) are used. ++ */ ++ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD ++ | FIBF_NOWRITE | FIBF_NODELETE ++ | FIBF_GRP_EXECUTE | FIBF_GRP_READ ++ | FIBF_GRP_WRITE | FIBF_GRP_DELETE ++ | FIBF_OTR_EXECUTE | FIBF_OTR_READ ++ | FIBF_OTR_WRITE | FIBF_OTR_DELETE); ++ ++ /* Classic single-user AmigaOS flags. These are inverted. */ + if (!(mode & 0100)) + prot |= FIBF_NOEXECUTE; + if (!(mode & 0400)) + prot |= FIBF_NOREAD; + if (!(mode & 0200)) + prot |= FIBF_NOWRITE; ++ ++ /* Multi-user extended flags. Not inverted. */ + if (mode & 0010) + prot |= FIBF_GRP_EXECUTE; + if (mode & 0040) + prot |= FIBF_GRP_READ; + if (mode & 0020) + prot |= FIBF_GRP_WRITE; ++ if (mode & 0070) ++ prot |= FIBF_GRP_DELETE; ++ + if (mode & 0001) + prot |= FIBF_OTR_EXECUTE; + if (mode & 0004) + prot |= FIBF_OTR_READ; + if (mode & 0002) + prot |= FIBF_OTR_WRITE; ++ if (mode & 0007) ++ prot |= FIBF_OTR_DELETE; + + AFFS_I(inode)->i_protect = prot; + } +diff --git a/fs/affs/file.c b/fs/affs/file.c +index a85817f54483f..ba084b0b214b9 100644 +--- a/fs/affs/file.c ++++ b/fs/affs/file.c +@@ -428,6 +428,24 @@ static int affs_write_begin(struct file *file, struct address_space *mapping, + return ret; + } + ++static int affs_write_end(struct file *file, struct address_space *mapping, ++ loff_t pos, unsigned int len, unsigned int copied, ++ struct page *page, void *fsdata) ++{ ++ struct inode *inode = mapping->host; ++ int ret; ++ ++ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata); ++ ++ /* Clear Archived bit on file writes, as AmigaOS would do */ ++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { ++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; ++ mark_inode_dirty(inode); ++ } ++ ++ return ret; ++} ++ + static sector_t _affs_bmap(struct address_space *mapping, sector_t block) + { + return generic_block_bmap(mapping,block,affs_get_block); +@@ -437,7 +455,7 @@ const struct address_space_operations affs_aops = { + .readpage = affs_readpage, + .writepage = affs_writepage, + .write_begin = affs_write_begin, +- .write_end = generic_write_end, ++ .write_end = affs_write_end, + .direct_IO = affs_direct_IO, + .bmap = _affs_bmap + }; +@@ -794,6 +812,12 @@ done: + if (tmp > inode->i_size) + inode->i_size = AFFS_I(inode)->mmu_private = tmp; + ++ /* Clear Archived bit on file writes, as AmigaOS would do */ ++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { ++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; ++ mark_inode_dirty(inode); ++ } ++ + err_first_bh: + unlock_page(page); + put_page(page); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index f5a8c0d26cf36..cf1e8ba50f6bf 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1367,7 +1367,8 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path, + btrfs_tree_read_unlock_blocking(eb); + free_extent_buffer(eb); + +- extent_buffer_get(eb_rewin); ++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb_rewin), ++ eb_rewin, btrfs_header_level(eb_rewin)); + btrfs_tree_read_lock(eb_rewin); + __tree_mod_log_rewind(fs_info, eb_rewin, time_seq, tm); + WARN_ON(btrfs_header_nritems(eb_rewin) > +@@ -1438,8 +1439,6 @@ get_old_root(struct btrfs_root *root, u64 time_seq) + + if (!eb) + return NULL; +- extent_buffer_get(eb); +- btrfs_tree_read_lock(eb); + if (old_root) { + btrfs_set_header_bytenr(eb, eb->start); + btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV); +@@ -1447,6 +1446,9 @@ get_old_root(struct btrfs_root *root, u64 time_seq) + btrfs_set_header_level(eb, old_root->level); + btrfs_set_header_generation(eb, old_generation); + } ++ btrfs_set_buffer_lockdep_class(btrfs_header_owner(eb), eb, ++ btrfs_header_level(eb)); ++ btrfs_tree_read_lock(eb); + if (tm) + __tree_mod_log_rewind(fs_info, eb, time_seq, tm); + else +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index ef1fd6a09d8e5..0ba338cffa937 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -5448,9 +5448,9 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv, + } + } + +-int read_extent_buffer_to_user(const struct extent_buffer *eb, +- void __user *dstv, +- unsigned long start, unsigned long len) ++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, ++ void __user *dstv, ++ unsigned long start, unsigned long len) + { + size_t cur; + size_t offset; +@@ -5471,7 +5471,7 @@ int read_extent_buffer_to_user(const struct extent_buffer *eb, + + cur = min(len, (PAGE_SIZE - offset)); + kaddr = page_address(page); +- if (copy_to_user(dst, kaddr + offset, cur)) { ++ if (probe_user_write(dst, kaddr + offset, cur)) { + ret = -EFAULT; + break; + } +diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h +index e5535bbe69537..90c5095ae97ee 100644 +--- a/fs/btrfs/extent_io.h ++++ b/fs/btrfs/extent_io.h +@@ -455,9 +455,9 @@ int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv, + void read_extent_buffer(const struct extent_buffer *eb, void *dst, + unsigned long start, + unsigned long len); +-int read_extent_buffer_to_user(const struct extent_buffer *eb, +- void __user *dst, unsigned long start, +- unsigned long len); ++int read_extent_buffer_to_user_nofault(const struct extent_buffer *eb, ++ void __user *dst, unsigned long start, ++ unsigned long len); + void write_extent_buffer_fsid(struct extent_buffer *eb, const void *src); + void write_extent_buffer_chunk_tree_uuid(struct extent_buffer *eb, + const void *src); +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index e82b4f3f490c1..7b3e41987d072 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2021,9 +2021,14 @@ static noinline int copy_to_sk(struct btrfs_path *path, + sh.len = item_len; + sh.transid = found_transid; + +- /* copy search result header */ +- if (copy_to_user(ubuf + *sk_offset, &sh, sizeof(sh))) { +- ret = -EFAULT; ++ /* ++ * Copy search result header. If we fault then loop again so we ++ * can fault in the pages and -EFAULT there if there's a ++ * problem. Otherwise we'll fault and then copy the buffer in ++ * properly this next time through ++ */ ++ if (probe_user_write(ubuf + *sk_offset, &sh, sizeof(sh))) { ++ ret = 0; + goto out; + } + +@@ -2031,10 +2036,14 @@ static noinline int copy_to_sk(struct btrfs_path *path, + + if (item_len) { + char __user *up = ubuf + *sk_offset; +- /* copy the item */ +- if (read_extent_buffer_to_user(leaf, up, +- item_off, item_len)) { +- ret = -EFAULT; ++ /* ++ * Copy the item, same behavior as above, but reset the ++ * * sk_offset so we copy the full thing again. ++ */ ++ if (read_extent_buffer_to_user_nofault(leaf, up, ++ item_off, item_len)) { ++ ret = 0; ++ *sk_offset -= sizeof(sh); + goto out; + } + +@@ -2122,6 +2131,10 @@ static noinline int search_ioctl(struct inode *inode, + key.offset = sk->min_offset; + + while (1) { ++ ret = fault_in_pages_writeable(ubuf, *buf_size - sk_offset); ++ if (ret) ++ break; ++ + ret = btrfs_search_forward(root, &key, path, sk->min_transid); + if (ret != 0) { + if (ret > 0) +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 4ff96e0aa26a9..a57f847303fcd 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4174,6 +4174,7 @@ static int btrfs_uuid_scan_kthread(void *data) + goto skip; + } + update_tree: ++ btrfs_release_path(path); + if (!btrfs_is_empty_uuid(root_item.uuid)) { + ret = btrfs_uuid_tree_add(trans, fs_info, + root_item.uuid, +@@ -4199,6 +4200,7 @@ update_tree: + } + + skip: ++ btrfs_release_path(path); + if (trans) { + ret = btrfs_end_transaction(trans); + trans = NULL; +@@ -4206,7 +4208,6 @@ skip: + break; + } + +- btrfs_release_path(path); + if (key.offset < (u64)-1) { + key.offset++; + } else if (key.type < BTRFS_ROOT_ITEM_KEY) { +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 6d653235e323b..1f873034f4691 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -1728,6 +1728,7 @@ const struct file_operations ceph_file_fops = { + .mmap = ceph_mmap, + .fsync = ceph_fsync, + .lock = ceph_lock, ++ .setlease = simple_nosetlease, + .flock = ceph_flock, + .splice_read = generic_file_splice_read, + .splice_write = iter_file_splice_write, +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 00f0902e27e88..af9dfa494b1fa 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1901,9 +1901,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + * during ep_insert(). + */ + if (list_empty(&epi->ffd.file->f_tfile_llink)) { +- get_file(epi->ffd.file); +- list_add(&epi->ffd.file->f_tfile_llink, +- &tfile_check_list); ++ if (get_file_rcu(epi->ffd.file)) ++ list_add(&epi->ffd.file->f_tfile_llink, ++ &tfile_check_list); + } + } + } +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 5999d80316759..1c3d774d3c839 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1015,6 +1015,19 @@ static inline struct request_queue *bdev_get_queue(struct block_device *bdev) + return bdev->bd_disk->queue; /* this is never NULL */ + } + ++/* ++ * The basic unit of block I/O is a sector. It is used in a number of contexts ++ * in Linux (blk, bio, genhd). The size of one sector is 512 = 2**9 ++ * bytes. Variables of type sector_t represent an offset or size that is a ++ * multiple of 512 bytes. Hence these two constants. ++ */ ++#ifndef SECTOR_SHIFT ++#define SECTOR_SHIFT 9 ++#endif ++#ifndef SECTOR_SIZE ++#define SECTOR_SIZE (1 << SECTOR_SHIFT) ++#endif ++ + /* + * blk_rq_pos() : the current sector + * blk_rq_bytes() : bytes left in the entire request +@@ -1042,12 +1055,12 @@ extern unsigned int blk_rq_err_bytes(const struct request *rq); + + static inline unsigned int blk_rq_sectors(const struct request *rq) + { +- return blk_rq_bytes(rq) >> 9; ++ return blk_rq_bytes(rq) >> SECTOR_SHIFT; + } + + static inline unsigned int blk_rq_cur_sectors(const struct request *rq) + { +- return blk_rq_cur_bytes(rq) >> 9; ++ return blk_rq_cur_bytes(rq) >> SECTOR_SHIFT; + } + + /* +@@ -1067,7 +1080,8 @@ static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q, + int op) + { + if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)) +- return min(q->limits.max_discard_sectors, UINT_MAX >> 9); ++ return min(q->limits.max_discard_sectors, ++ UINT_MAX >> SECTOR_SHIFT); + + if (unlikely(op == REQ_OP_WRITE_SAME)) + return q->limits.max_write_same_sectors; +@@ -1376,16 +1390,21 @@ extern int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector, + static inline int sb_issue_discard(struct super_block *sb, sector_t block, + sector_t nr_blocks, gfp_t gfp_mask, unsigned long flags) + { +- return blkdev_issue_discard(sb->s_bdev, block << (sb->s_blocksize_bits - 9), +- nr_blocks << (sb->s_blocksize_bits - 9), ++ return blkdev_issue_discard(sb->s_bdev, ++ block << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), ++ nr_blocks << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), + gfp_mask, flags); + } + static inline int sb_issue_zeroout(struct super_block *sb, sector_t block, + sector_t nr_blocks, gfp_t gfp_mask) + { + return blkdev_issue_zeroout(sb->s_bdev, +- block << (sb->s_blocksize_bits - 9), +- nr_blocks << (sb->s_blocksize_bits - 9), ++ block << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), ++ nr_blocks << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), + gfp_mask, 0); + } + +@@ -1492,7 +1511,8 @@ static inline int queue_alignment_offset(struct request_queue *q) + static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) + { + unsigned int granularity = max(lim->physical_block_size, lim->io_min); +- unsigned int alignment = sector_div(sector, granularity >> 9) << 9; ++ unsigned int alignment = sector_div(sector, granularity >> SECTOR_SHIFT) ++ << SECTOR_SHIFT; + + return (granularity + lim->alignment_offset - alignment) % granularity; + } +@@ -1526,8 +1546,8 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector + return 0; + + /* Why are these in bytes, not sectors? */ +- alignment = lim->discard_alignment >> 9; +- granularity = lim->discard_granularity >> 9; ++ alignment = lim->discard_alignment >> SECTOR_SHIFT; ++ granularity = lim->discard_granularity >> SECTOR_SHIFT; + if (!granularity) + return 0; + +@@ -1538,7 +1558,7 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector + offset = (granularity + alignment - offset) % granularity; + + /* Turn it back into bytes, gaah */ +- return offset << 9; ++ return offset << SECTOR_SHIFT; + } + + static inline int bdev_discard_alignment(struct block_device *bdev) +diff --git a/include/linux/bvec.h b/include/linux/bvec.h +index ec8a4d7af6bda..f7dc68cd0a392 100644 +--- a/include/linux/bvec.h ++++ b/include/linux/bvec.h +@@ -119,10 +119,17 @@ static inline bool bvec_iter_rewind(const struct bio_vec *bv, + return true; + } + ++static inline void bvec_iter_skip_zero_bvec(struct bvec_iter *iter) ++{ ++ iter->bi_bvec_done = 0; ++ iter->bi_idx++; ++} ++ + #define for_each_bvec(bvl, bio_vec, iter, start) \ + for (iter = (start); \ + (iter).bi_size && \ + ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \ +- bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len)) ++ (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \ ++ (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter))) + + #endif /* __LINUX_BVEC_ITER_H */ +diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h +index 91a063a1f3b37..5d067136fc27d 100644 +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -577,8 +577,6 @@ do { \ + #define DMEMIT(x...) sz += ((sz >= maxlen) ? \ + 0 : scnprintf(result + sz, maxlen - sz, x)) + +-#define SECTOR_SHIFT 9 +- + /* + * Definitions of return values from target end_io function. + */ +diff --git a/include/linux/hid.h b/include/linux/hid.h +index ba1f675598314..40409453ef3e5 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -919,34 +919,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { + * @max: maximal valid usage->code to consider later (out parameter) + * @type: input event type (EV_KEY, EV_REL, ...) + * @c: code which corresponds to this usage and type ++ * ++ * The value pointed to by @bit will be set to NULL if either @type is ++ * an unhandled event type, or if @c is out of range for @type. This ++ * can be used as an error condition. + */ + static inline void hid_map_usage(struct hid_input *hidinput, + struct hid_usage *usage, unsigned long **bit, int *max, +- __u8 type, __u16 c) ++ __u8 type, unsigned int c) + { + struct input_dev *input = hidinput->input; +- +- usage->type = type; +- usage->code = c; ++ unsigned long *bmap = NULL; ++ unsigned int limit = 0; + + switch (type) { + case EV_ABS: +- *bit = input->absbit; +- *max = ABS_MAX; ++ bmap = input->absbit; ++ limit = ABS_MAX; + break; + case EV_REL: +- *bit = input->relbit; +- *max = REL_MAX; ++ bmap = input->relbit; ++ limit = REL_MAX; + break; + case EV_KEY: +- *bit = input->keybit; +- *max = KEY_MAX; ++ bmap = input->keybit; ++ limit = KEY_MAX; + break; + case EV_LED: +- *bit = input->ledbit; +- *max = LED_MAX; ++ bmap = input->ledbit; ++ limit = LED_MAX; + break; + } ++ ++ if (unlikely(c > limit || !bmap)) { ++ pr_warn_ratelimited("%s: Invalid code %d type %d\n", ++ input->name, c, type); ++ *bit = NULL; ++ return; ++ } ++ ++ usage->type = type; ++ usage->code = c; ++ *max = limit; ++ *bit = bmap; + } + + /** +@@ -960,7 +975,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, + __u8 type, __u16 c) + { + hid_map_usage(hidinput, usage, bit, max, type, c); +- clear_bit(c, *bit); ++ if (*bit) ++ clear_bit(usage->code, *bit); + } + + /** +diff --git a/include/linux/ide.h b/include/linux/ide.h +index 70db3af045417..9885080c21c5c 100644 +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -165,7 +165,6 @@ struct ide_io_ports { + */ + #define PARTN_BITS 6 /* number of minor dev bits for partitions */ + #define MAX_DRIVES 2 /* per interface; 2 assumed by lots of code */ +-#define SECTOR_SIZE 512 + + /* + * Timeouts for various operations: +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 5c9a44e3a0278..f772c55ed901d 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -440,6 +440,7 @@ enum { + ATA_HORKAGE_NO_DMA_LOG = (1 << 23), /* don't use DMA for log read */ + ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ + ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ ++ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ +diff --git a/include/linux/log2.h b/include/linux/log2.h +index c373295f359fa..cca606609e1bc 100644 +--- a/include/linux/log2.h ++++ b/include/linux/log2.h +@@ -159,7 +159,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + #define roundup_pow_of_two(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n == 1) ? 1 : \ ++ ((n) == 1) ? 1 : \ + (1UL << (ilog2((n) - 1) + 1)) \ + ) : \ + __roundup_pow_of_two(n) \ +diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h +index ec4f0053d6d8e..d49f193a44a29 100644 +--- a/include/linux/uaccess.h ++++ b/include/linux/uaccess.h +@@ -242,6 +242,17 @@ static inline unsigned long __copy_from_user_inatomic_nocache(void *to, + extern long probe_kernel_read(void *dst, const void *src, size_t size); + extern long __probe_kernel_read(void *dst, const void *src, size_t size); + ++/* ++ * probe_user_read(): safely attempt to read from a location in user space ++ * @dst: pointer to the buffer that shall take the data ++ * @src: address to read from ++ * @size: size of the data chunk ++ * ++ * Safely read from address @src to the buffer at @dst. If a kernel fault ++ * happens, handle that and return -EFAULT. ++ */ ++extern long probe_user_read(void *dst, const void __user *src, size_t size); ++ + /* + * probe_kernel_write(): safely attempt to write to a location + * @dst: address to write to +@@ -254,7 +265,22 @@ extern long __probe_kernel_read(void *dst, const void *src, size_t size); + extern long notrace probe_kernel_write(void *dst, const void *src, size_t size); + extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size); + ++/* ++ * probe_user_write(): safely attempt to write to a location in user space ++ * @dst: address to write to ++ * @src: pointer to the data that shall be written ++ * @size: size of the data chunk ++ * ++ * Safely write to address @dst from the buffer at @src. If a kernel fault ++ * happens, handle that and return -EFAULT. ++ */ ++extern long notrace probe_user_write(void __user *dst, const void *src, size_t size); ++extern long notrace __probe_user_write(void __user *dst, const void *src, size_t size); ++ + extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count); ++extern long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr, ++ long count); ++extern long strnlen_unsafe_user(const void __user *unsafe_addr, long count); + + /** + * probe_kernel_address(): safely attempt to read from a location +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index a9704c57430db..3107895115c25 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -136,6 +136,8 @@ static inline u8 nft_reg_load8(u32 *sreg) + static inline void nft_data_copy(u32 *dst, const struct nft_data *src, + unsigned int len) + { ++ if (len % NFT_REG32_SIZE) ++ dst[len / NFT_REG32_SIZE] = 0; + memcpy(dst, src, len); + } + +diff --git a/include/uapi/linux/msdos_fs.h b/include/uapi/linux/msdos_fs.h +index a45d0754102e0..fde753735abae 100644 +--- a/include/uapi/linux/msdos_fs.h ++++ b/include/uapi/linux/msdos_fs.h +@@ -10,7 +10,9 @@ + * The MS-DOS filesystem constants/structures + */ + ++#ifndef SECTOR_SIZE + #define SECTOR_SIZE 512 /* sector size (bytes) */ ++#endif + #define SECTOR_BITS 9 /* log2(SECTOR_SIZE) */ + #define MSDOS_DPB (MSDOS_DPS) /* dir entries per block */ + #define MSDOS_DPB_BITS 4 /* log2(MSDOS_DPB) */ +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index a3ee277b17a17..49b6997c32550 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -125,7 +125,7 @@ enum nf_tables_msg_types { + * @NFTA_LIST_ELEM: list element (NLA_NESTED) + */ + enum nft_list_attributes { +- NFTA_LIST_UNPEC, ++ NFTA_LIST_UNSPEC, + NFTA_LIST_ELEM, + __NFTA_LIST_MAX + }; +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 194125cf2d2b9..3d919635004e9 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2911,6 +2911,22 @@ static unsigned int cpuset_mems_nr(unsigned int *array) + } + + #ifdef CONFIG_SYSCTL ++static int proc_hugetlb_doulongvec_minmax(struct ctl_table *table, int write, ++ void *buffer, size_t *length, ++ loff_t *ppos, unsigned long *out) ++{ ++ struct ctl_table dup_table; ++ ++ /* ++ * In order to avoid races with __do_proc_doulongvec_minmax(), we ++ * can duplicate the @table and alter the duplicate of it. ++ */ ++ dup_table = *table; ++ dup_table.data = out; ++ ++ return proc_doulongvec_minmax(&dup_table, write, buffer, length, ppos); ++} ++ + static int hugetlb_sysctl_handler_common(bool obey_mempolicy, + struct ctl_table *table, int write, + void __user *buffer, size_t *length, loff_t *ppos) +@@ -2922,9 +2938,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy, + if (!hugepages_supported()) + return -EOPNOTSUPP; + +- table->data = &tmp; +- table->maxlen = sizeof(unsigned long); +- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); ++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, ++ &tmp); + if (ret) + goto out; + +@@ -2968,9 +2983,8 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write, + if (write && hstate_is_gigantic(h)) + return -EINVAL; + +- table->data = &tmp; +- table->maxlen = sizeof(unsigned long); +- ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); ++ ret = proc_hugetlb_doulongvec_minmax(table, write, buffer, length, ppos, ++ &tmp); + if (ret) + goto out; + +diff --git a/mm/maccess.c b/mm/maccess.c +index 78f9274dd49d0..03ea550f5a743 100644 +--- a/mm/maccess.c ++++ b/mm/maccess.c +@@ -5,8 +5,32 @@ + #include + #include + ++static __always_inline long ++probe_read_common(void *dst, const void __user *src, size_t size) ++{ ++ long ret; ++ ++ pagefault_disable(); ++ ret = __copy_from_user_inatomic(dst, src, size); ++ pagefault_enable(); ++ ++ return ret ? -EFAULT : 0; ++} ++ ++static __always_inline long ++probe_write_common(void __user *dst, const void *src, size_t size) ++{ ++ long ret; ++ ++ pagefault_disable(); ++ ret = __copy_to_user_inatomic(dst, src, size); ++ pagefault_enable(); ++ ++ return ret ? -EFAULT : 0; ++} ++ + /** +- * probe_kernel_read(): safely attempt to read from a location ++ * probe_kernel_read(): safely attempt to read from a kernel-space location + * @dst: pointer to the buffer that shall take the data + * @src: address to read from + * @size: size of the data chunk +@@ -29,16 +53,40 @@ long __probe_kernel_read(void *dst, const void *src, size_t size) + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- pagefault_disable(); +- ret = __copy_from_user_inatomic(dst, +- (__force const void __user *)src, size); +- pagefault_enable(); ++ ret = probe_read_common(dst, (__force const void __user *)src, size); + set_fs(old_fs); + +- return ret ? -EFAULT : 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(probe_kernel_read); + ++/** ++ * probe_user_read(): safely attempt to read from a user-space location ++ * @dst: pointer to the buffer that shall take the data ++ * @src: address to read from. This must be a user address. ++ * @size: size of the data chunk ++ * ++ * Safely read from user address @src to the buffer at @dst. If a kernel fault ++ * happens, handle that and return -EFAULT. ++ */ ++ ++long __weak probe_user_read(void *dst, const void __user *src, size_t size) ++ __attribute__((alias("__probe_user_read"))); ++ ++long __probe_user_read(void *dst, const void __user *src, size_t size) ++{ ++ long ret = -EFAULT; ++ mm_segment_t old_fs = get_fs(); ++ ++ set_fs(USER_DS); ++ if (access_ok(VERIFY_READ, src, size)) ++ ret = probe_read_common(dst, src, size); ++ set_fs(old_fs); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(probe_user_read); ++ + /** + * probe_kernel_write(): safely attempt to write to a location + * @dst: address to write to +@@ -48,6 +96,7 @@ EXPORT_SYMBOL_GPL(probe_kernel_read); + * Safely write to address @dst from the buffer at @src. If a kernel fault + * happens, handle that and return -EFAULT. + */ ++ + long __weak probe_kernel_write(void *dst, const void *src, size_t size) + __attribute__((alias("__probe_kernel_write"))); + +@@ -57,15 +106,40 @@ long __probe_kernel_write(void *dst, const void *src, size_t size) + mm_segment_t old_fs = get_fs(); + + set_fs(KERNEL_DS); +- pagefault_disable(); +- ret = __copy_to_user_inatomic((__force void __user *)dst, src, size); +- pagefault_enable(); ++ ret = probe_write_common((__force void __user *)dst, src, size); + set_fs(old_fs); + +- return ret ? -EFAULT : 0; ++ return ret; + } + EXPORT_SYMBOL_GPL(probe_kernel_write); + ++/** ++ * probe_user_write(): safely attempt to write to a user-space location ++ * @dst: address to write to ++ * @src: pointer to the data that shall be written ++ * @size: size of the data chunk ++ * ++ * Safely write to address @dst from the buffer at @src. If a kernel fault ++ * happens, handle that and return -EFAULT. ++ */ ++ ++long __weak probe_user_write(void __user *dst, const void *src, size_t size) ++ __attribute__((alias("__probe_user_write"))); ++ ++long __probe_user_write(void __user *dst, const void *src, size_t size) ++{ ++ long ret = -EFAULT; ++ mm_segment_t old_fs = get_fs(); ++ ++ set_fs(USER_DS); ++ if (access_ok(VERIFY_WRITE, dst, size)) ++ ret = probe_write_common(dst, src, size); ++ set_fs(old_fs); ++ ++ return ret; ++} ++EXPORT_SYMBOL_GPL(probe_user_write); ++ + /** + * strncpy_from_unsafe: - Copy a NUL terminated string from unsafe address. + * @dst: Destination address, in kernel space. This buffer must be at +@@ -105,3 +179,76 @@ long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count) + + return ret ? -EFAULT : src - unsafe_addr; + } ++ ++/** ++ * strncpy_from_unsafe_user: - Copy a NUL terminated string from unsafe user ++ * address. ++ * @dst: Destination address, in kernel space. This buffer must be at ++ * least @count bytes long. ++ * @unsafe_addr: Unsafe user address. ++ * @count: Maximum number of bytes to copy, including the trailing NUL. ++ * ++ * Copies a NUL-terminated string from unsafe user address to kernel buffer. ++ * ++ * On success, returns the length of the string INCLUDING the trailing NUL. ++ * ++ * If access fails, returns -EFAULT (some data may have been copied ++ * and the trailing NUL added). ++ * ++ * If @count is smaller than the length of the string, copies @count-1 bytes, ++ * sets the last byte of @dst buffer to NUL and returns @count. ++ */ ++long strncpy_from_unsafe_user(char *dst, const void __user *unsafe_addr, ++ long count) ++{ ++ mm_segment_t old_fs = get_fs(); ++ long ret; ++ ++ if (unlikely(count <= 0)) ++ return 0; ++ ++ set_fs(USER_DS); ++ pagefault_disable(); ++ ret = strncpy_from_user(dst, unsafe_addr, count); ++ pagefault_enable(); ++ set_fs(old_fs); ++ ++ if (ret >= count) { ++ ret = count; ++ dst[ret - 1] = '\0'; ++ } else if (ret > 0) { ++ ret++; ++ } ++ ++ return ret; ++} ++ ++/** ++ * strnlen_unsafe_user: - Get the size of a user string INCLUDING final NUL. ++ * @unsafe_addr: The string to measure. ++ * @count: Maximum count (including NUL) ++ * ++ * Get the size of a NUL-terminated string in user space without pagefault. ++ * ++ * Returns the size of the string INCLUDING the terminating NUL. ++ * ++ * If the string is too long, returns a number larger than @count. User ++ * has to check the return value against "> count". ++ * On exception (or invalid count), returns 0. ++ * ++ * Unlike strnlen_user, this can be used from IRQ handler etc. because ++ * it disables pagefaults. ++ */ ++long strnlen_unsafe_user(const void __user *unsafe_addr, long count) ++{ ++ mm_segment_t old_fs = get_fs(); ++ int ret; ++ ++ set_fs(USER_DS); ++ pagefault_disable(); ++ ret = strnlen_user(unsafe_addr, count); ++ pagefault_enable(); ++ set_fs(old_fs); ++ ++ return ret; ++} +diff --git a/mm/slub.c b/mm/slub.c +index 09d4cc4391bb2..db2639832037d 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -659,12 +659,12 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...) + } + + static bool freelist_corrupted(struct kmem_cache *s, struct page *page, +- void *freelist, void *nextfree) ++ void **freelist, void *nextfree) + { + if ((s->flags & SLAB_CONSISTENCY_CHECKS) && +- !check_valid_pointer(s, page, nextfree)) { +- object_err(s, page, freelist, "Freechain corrupt"); +- freelist = NULL; ++ !check_valid_pointer(s, page, nextfree) && freelist) { ++ object_err(s, page, *freelist, "Freechain corrupt"); ++ *freelist = NULL; + slab_fix(s, "Isolate corrupted freechain"); + return true; + } +@@ -1354,7 +1354,7 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node, + int objects) {} + + static bool freelist_corrupted(struct kmem_cache *s, struct page *page, +- void *freelist, void *nextfree) ++ void **freelist, void *nextfree) + { + return false; + } +@@ -2053,7 +2053,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page, + * 'freelist' is already corrupted. So isolate all objects + * starting at 'freelist'. + */ +- if (freelist_corrupted(s, page, freelist, nextfree)) ++ if (freelist_corrupted(s, page, &freelist, nextfree)) + break; + + do { +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index f0abbbdafe07f..c49c48866a3fc 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -715,6 +715,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset, + ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, + ogm_packet->version, ntohs(ogm_packet->tvlv_len)); + ++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) { ++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv, ++ "Drop packet: originator packet from ourself\n"); ++ return; ++ } ++ + /* If the throughput metric is 0, immediately drop the packet. No need + * to create orig_node / neigh_node for an unusable route. + */ +@@ -842,11 +848,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, + if (batadv_is_my_mac(bat_priv, ethhdr->h_source)) + goto free_skb; + +- ogm_packet = (struct batadv_ogm2_packet *)skb->data; +- +- if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) +- goto free_skb; +- + batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX); + batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES, + skb->len + ETH_HLEN); +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index c761c0c233e4b..ae647fa69ce85 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -450,7 +450,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac, + batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES, + skb->len + ETH_HLEN); + +- netif_rx(skb); ++ if (in_interrupt()) ++ netif_rx(skb); ++ else ++ netif_rx_ni(skb); + out: + if (primary_if) + batadv_hardif_put(primary_if); +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c +index c6a7341f05270..056af2eec4a2a 100644 +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -674,8 +674,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, + + chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; + /* store the client address if the message is going to a client */ +- if (ret == BATADV_DHCP_TO_CLIENT && +- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { ++ if (ret == BATADV_DHCP_TO_CLIENT) { ++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) ++ return BATADV_DHCP_NO; ++ + /* check if the DHCP packet carries an Ethernet DHCP */ + p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; + if (*p != BATADV_DHCP_HTYPE_ETHERNET) +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 5b8d5bfeb7ac5..7c95314f0b7de 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2882,7 +2882,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + goto nla_put_failure; + } + +- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) ++ if (set->udata && ++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) + goto nla_put_failure; + + desc = nla_nest_start(skb, NFTA_SET_DESC); +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index 19446a89a2a81..b1a9f330a51fe 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -79,7 +79,9 @@ static void nft_payload_eval(const struct nft_expr *expr, + u32 *dest = ®s->data[priv->dreg]; + int offset; + +- dest[priv->len / NFT_REG32_SIZE] = 0; ++ if (priv->len % NFT_REG32_SIZE) ++ dest[priv->len / NFT_REG32_SIZE] = 0; ++ + switch (priv->base) { + case NFT_PAYLOAD_LL_HEADER: + if (!skb_mac_header_was_set(skb)) +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index b95d1c2bdef7e..9eb9d34cef7b1 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2408,6 +2408,9 @@ int regulatory_hint_user(const char *alpha2, + if (WARN_ON(!alpha2)) + return -EINVAL; + ++ if (!is_world_regdom(alpha2) && !is_an_alpha2(alpha2)) ++ return -EINVAL; ++ + request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL); + if (!request) + return -ENOMEM; +diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl +index 8b80bac055e49..d702bdf19eb10 100755 +--- a/scripts/checkpatch.pl ++++ b/scripts/checkpatch.pl +@@ -2428,8 +2428,8 @@ sub process { + + # Check if the commit log has what seems like a diff which can confuse patch + if ($in_commit_log && !$commit_log_has_diff && +- (($line =~ m@^\s+diff\b.*a/[\w/]+@ && +- $line =~ m@^\s+diff\b.*a/([\w/]+)\s+b/$1\b@) || ++ (($line =~ m@^\s+diff\b.*a/([\w/]+)@ && ++ $line =~ m@^\s+diff\b.*a/[\w/]+\s+b/$1\b@) || + $line =~ m@^\s*(?:\-\-\-\s+a/|\+\+\+\s+b/)@ || + $line =~ m/^\s*\@\@ \-\d+,\d+ \+\d+,\d+ \@\@/)) { + ERROR("DIFF_IN_COMMIT_MSG", +diff --git a/sound/core/oss/mulaw.c b/sound/core/oss/mulaw.c +index 3788906421a73..fe27034f28460 100644 +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct snd_pcm_substream *plug, + snd_BUG(); + return -EINVAL; + } +- if (snd_BUG_ON(!snd_pcm_format_linear(format->format))) +- return -ENXIO; ++ if (!snd_pcm_format_linear(format->format)) ++ return -EINVAL; + + err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", + src_format, dst_format, +diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c +index ef689997d6a5b..bf53e342788e2 100644 +--- a/sound/firewire/digi00x/digi00x.c ++++ b/sound/firewire/digi00x/digi00x.c +@@ -15,6 +15,7 @@ MODULE_LICENSE("GPL v2"); + #define VENDOR_DIGIDESIGN 0x00a07e + #define MODEL_CONSOLE 0x000001 + #define MODEL_RACK 0x000002 ++#define SPEC_VERSION 0x000001 + + static int name_card(struct snd_dg00x *dg00x) + { +@@ -185,14 +186,18 @@ static const struct ieee1394_device_id snd_dg00x_id_table[] = { + /* Both of 002/003 use the same ID. */ + { + .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_VERSION | + IEEE1394_MATCH_MODEL_ID, + .vendor_id = VENDOR_DIGIDESIGN, ++ .version = SPEC_VERSION, + .model_id = MODEL_CONSOLE, + }, + { + .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_VERSION | + IEEE1394_MATCH_MODEL_ID, + .vendor_id = VENDOR_DIGIDESIGN, ++ .version = SPEC_VERSION, + .model_id = MODEL_RACK, + }, + {} +diff --git a/sound/pci/ca0106/ca0106_main.c b/sound/pci/ca0106/ca0106_main.c +index cd27b55366544..675b812e96d63 100644 +--- a/sound/pci/ca0106/ca0106_main.c ++++ b/sound/pci/ca0106/ca0106_main.c +@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(struct snd_ca0106 *chip, int channel_id, + else + /* Power down */ + chip->spi_dac_reg[reg] |= bit; +- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]); ++ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0) ++ return -ENXIO; + } + return 0; + } +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 9e8cfc409b4b3..cb7047bf844df 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2546,6 +2546,7 @@ static void i915_pin_cvt_fixup(struct hda_codec *codec, + hda_nid_t cvt_nid) + { + if (per_pin) { ++ haswell_verify_D0(codec, per_pin->cvt_nid, per_pin->pin_nid); + snd_hda_set_dev_select(codec, per_pin->pin_nid, + per_pin->dev_id); + intel_verify_pin_cvt_connect(codec, per_pin); +diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h +index 362493a2f950b..3b733511bb2b3 100644 +--- a/tools/include/uapi/linux/perf_event.h ++++ b/tools/include/uapi/linux/perf_event.h +@@ -1033,7 +1033,7 @@ union perf_mem_data_src { + + #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */ + /* 1 free */ +-#define PERF_MEM_SNOOPX_SHIFT 37 ++#define PERF_MEM_SNOOPX_SHIFT 38 + + /* locked instruction */ + #define PERF_MEM_LOCK_NA 0x01 /* not available */ +diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt +index 63526f4416ea4..7b36bc6e32bb0 100644 +--- a/tools/perf/Documentation/perf-record.txt ++++ b/tools/perf/Documentation/perf-record.txt +@@ -33,6 +33,10 @@ OPTIONS + - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a + hexadecimal event descriptor. + ++ - a symbolic or raw PMU event followed by an optional colon ++ and a list of event modifiers, e.g., cpu-cycles:p. See the ++ linkperf:perf-list[1] man page for details on event modifiers. ++ + - a symbolically formed PMU event like 'pmu/param1=0x3,param2/' where + 'param1', 'param2', etc are defined as formats for the PMU in + /sys/bus/event_source/devices//format/*. +diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt +index c37d61682dfb1..670aff81518b6 100644 +--- a/tools/perf/Documentation/perf-stat.txt ++++ b/tools/perf/Documentation/perf-stat.txt +@@ -39,6 +39,10 @@ report:: + - a raw PMU event (eventsel+umask) in the form of rNNN where NNN is a + hexadecimal event descriptor. + ++ - a symbolic or raw PMU event followed by an optional colon ++ and a list of event modifiers, e.g., cpu-cycles:p. See the ++ linkperf:perf-list[1] man page for details on event modifiers. ++ + - a symbolically formed event like 'pmu/param1=0x3,param2/' where + param1 and param2 are defined as formats for the PMU in + /sys/bus/event_source/devices//format/* diff --git a/patch/kernel/odroidxu4-legacy/patch-4.14.197-198.patch b/patch/kernel/odroidxu4-legacy/patch-4.14.197-198.patch new file mode 100644 index 0000000000..03ac8d4054 --- /dev/null +++ b/patch/kernel/odroidxu4-legacy/patch-4.14.197-198.patch @@ -0,0 +1,1173 @@ +diff --git a/Makefile b/Makefile +index 3712b4deafbed..d503d041b5267 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 197 ++SUBLEVEL = 198 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/block/blk-core.c b/block/blk-core.c +index 4e04c79aa2c27..2407c898ba7d8 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -852,6 +852,8 @@ struct request_queue *blk_alloc_queue_node(gfp_t gfp_mask, int node_id) + + q->backing_dev_info->ra_pages = + (VM_MAX_READAHEAD * 1024) / PAGE_SIZE; ++ q->backing_dev_info->io_pages = ++ (VM_MAX_READAHEAD * 1024) / PAGE_SIZE; + q->backing_dev_info->capabilities = BDI_CAP_CGROUP_WRITEBACK; + q->backing_dev_info->name = "block"; + q->node = node_id; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 7de38ae5c18f2..a03239ba1a323 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6378,14 +6378,14 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + } + } + +- bnxt_enable_napi(bp); +- + rc = bnxt_init_nic(bp, irq_re_init); + if (rc) { + netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + ++ bnxt_enable_napi(bp); ++ + if (link_re_init) { + mutex_lock(&bp->link_lock); + rc = bnxt_update_phy_setting(bp); +@@ -6410,9 +6410,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + bnxt_vf_reps_open(bp); + return 0; + +-open_err: +- bnxt_disable_napi(bp); +- + open_err_irq: + bnxt_del_napi(bp); + +diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c +index b91f92e4e5f22..915ac75b55fc7 100644 +--- a/drivers/net/usb/dm9601.c ++++ b/drivers/net/usb/dm9601.c +@@ -625,6 +625,10 @@ static const struct usb_device_id products[] = { + USB_DEVICE(0x0a46, 0x1269), /* DM9621A USB to Fast Ethernet Adapter */ + .driver_info = (unsigned long)&dm9601_info, + }, ++ { ++ USB_DEVICE(0x0586, 0x3427), /* ZyXEL Keenetic Plus DSL xDSL modem */ ++ .driver_info = (unsigned long)&dm9601_info, ++ }, + {}, // END + }; + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 550ab7707b57f..794dc90aa5c95 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include "vfio_pci_private.h" + +@@ -181,6 +182,7 @@ no_mmap: + + static void vfio_pci_try_bus_reset(struct vfio_pci_device *vdev); + static void vfio_pci_disable(struct vfio_pci_device *vdev); ++static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data); + + /* + * INTx masking requires the ability to disable INTx signaling via PCI_COMMAND +@@ -644,6 +646,12 @@ int vfio_pci_register_dev_region(struct vfio_pci_device *vdev, + return 0; + } + ++struct vfio_devices { ++ struct vfio_device **devices; ++ int cur_index; ++ int max_index; ++}; ++ + static long vfio_pci_ioctl(void *device_data, + unsigned int cmd, unsigned long arg) + { +@@ -717,7 +725,7 @@ static long vfio_pci_ioctl(void *device_data, + { + void __iomem *io; + size_t size; +- u16 orig_cmd; ++ u16 cmd; + + info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); + info.flags = 0; +@@ -737,10 +745,7 @@ static long vfio_pci_ioctl(void *device_data, + * Is it really there? Enable memory decode for + * implicit access in pci_map_rom(). + */ +- pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd); +- pci_write_config_word(pdev, PCI_COMMAND, +- orig_cmd | PCI_COMMAND_MEMORY); +- ++ cmd = vfio_pci_memory_lock_and_enable(vdev); + io = pci_map_rom(pdev, &size); + if (io) { + info.flags = VFIO_REGION_INFO_FLAG_READ; +@@ -748,8 +753,8 @@ static long vfio_pci_ioctl(void *device_data, + } else { + info.size = 0; + } ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); + +- pci_write_config_word(pdev, PCI_COMMAND, orig_cmd); + break; + } + case VFIO_PCI_VGA_REGION_INDEX: +@@ -885,8 +890,16 @@ static long vfio_pci_ioctl(void *device_data, + return ret; + + } else if (cmd == VFIO_DEVICE_RESET) { +- return vdev->reset_works ? +- pci_try_reset_function(vdev->pdev) : -EINVAL; ++ int ret; ++ ++ if (!vdev->reset_works) ++ return -EINVAL; ++ ++ vfio_pci_zap_and_down_write_memory_lock(vdev); ++ ret = pci_try_reset_function(vdev->pdev); ++ up_write(&vdev->memory_lock); ++ ++ return ret; + + } else if (cmd == VFIO_DEVICE_GET_PCI_HOT_RESET_INFO) { + struct vfio_pci_hot_reset_info hdr; +@@ -966,8 +979,9 @@ reset_info_exit: + int32_t *group_fds; + struct vfio_pci_group_entry *groups; + struct vfio_pci_group_info info; ++ struct vfio_devices devs = { .cur_index = 0 }; + bool slot = false; +- int i, count = 0, ret = 0; ++ int i, group_idx, mem_idx = 0, count = 0, ret = 0; + + minsz = offsetofend(struct vfio_pci_hot_reset, count); + +@@ -1019,9 +1033,9 @@ reset_info_exit: + * user interface and store the group and iommu ID. This + * ensures the group is held across the reset. + */ +- for (i = 0; i < hdr.count; i++) { ++ for (group_idx = 0; group_idx < hdr.count; group_idx++) { + struct vfio_group *group; +- struct fd f = fdget(group_fds[i]); ++ struct fd f = fdget(group_fds[group_idx]); + if (!f.file) { + ret = -EBADF; + break; +@@ -1034,8 +1048,9 @@ reset_info_exit: + break; + } + +- groups[i].group = group; +- groups[i].id = vfio_external_user_iommu_id(group); ++ groups[group_idx].group = group; ++ groups[group_idx].id = ++ vfio_external_user_iommu_id(group); + } + + kfree(group_fds); +@@ -1054,14 +1069,65 @@ reset_info_exit: + ret = vfio_pci_for_each_slot_or_bus(vdev->pdev, + vfio_pci_validate_devs, + &info, slot); +- if (!ret) +- /* User has access, do the reset */ +- ret = slot ? pci_try_reset_slot(vdev->pdev->slot) : +- pci_try_reset_bus(vdev->pdev->bus); ++ ++ if (ret) ++ goto hot_reset_release; ++ ++ devs.max_index = count; ++ devs.devices = kcalloc(count, sizeof(struct vfio_device *), ++ GFP_KERNEL); ++ if (!devs.devices) { ++ ret = -ENOMEM; ++ goto hot_reset_release; ++ } ++ ++ /* ++ * We need to get memory_lock for each device, but devices ++ * can share mmap_sem, therefore we need to zap and hold ++ * the vma_lock for each device, and only then get each ++ * memory_lock. ++ */ ++ ret = vfio_pci_for_each_slot_or_bus(vdev->pdev, ++ vfio_pci_try_zap_and_vma_lock_cb, ++ &devs, slot); ++ if (ret) ++ goto hot_reset_release; ++ ++ for (; mem_idx < devs.cur_index; mem_idx++) { ++ struct vfio_pci_device *tmp; ++ ++ tmp = vfio_device_data(devs.devices[mem_idx]); ++ ++ ret = down_write_trylock(&tmp->memory_lock); ++ if (!ret) { ++ ret = -EBUSY; ++ goto hot_reset_release; ++ } ++ mutex_unlock(&tmp->vma_lock); ++ } ++ ++ /* User has access, do the reset */ ++ ret = slot ? pci_try_reset_slot(vdev->pdev->slot) : ++ pci_try_reset_bus(vdev->pdev->bus); + + hot_reset_release: +- for (i--; i >= 0; i--) +- vfio_group_put_external_user(groups[i].group); ++ for (i = 0; i < devs.cur_index; i++) { ++ struct vfio_device *device; ++ struct vfio_pci_device *tmp; ++ ++ device = devs.devices[i]; ++ tmp = vfio_device_data(device); ++ ++ if (i < mem_idx) ++ up_write(&tmp->memory_lock); ++ else ++ mutex_unlock(&tmp->vma_lock); ++ vfio_device_put(device); ++ } ++ kfree(devs.devices); ++ ++ for (group_idx--; group_idx >= 0; group_idx--) ++ vfio_group_put_external_user(groups[group_idx].group); + + kfree(groups); + return ret; +@@ -1120,6 +1186,202 @@ static ssize_t vfio_pci_write(void *device_data, const char __user *buf, + return vfio_pci_rw(device_data, (char __user *)buf, count, ppos, true); + } + ++/* Return 1 on zap and vma_lock acquired, 0 on contention (only with @try) */ ++static int vfio_pci_zap_and_vma_lock(struct vfio_pci_device *vdev, bool try) ++{ ++ struct vfio_pci_mmap_vma *mmap_vma, *tmp; ++ ++ /* ++ * Lock ordering: ++ * vma_lock is nested under mmap_sem for vm_ops callback paths. ++ * The memory_lock semaphore is used by both code paths calling ++ * into this function to zap vmas and the vm_ops.fault callback ++ * to protect the memory enable state of the device. ++ * ++ * When zapping vmas we need to maintain the mmap_sem => vma_lock ++ * ordering, which requires using vma_lock to walk vma_list to ++ * acquire an mm, then dropping vma_lock to get the mmap_sem and ++ * reacquiring vma_lock. This logic is derived from similar ++ * requirements in uverbs_user_mmap_disassociate(). ++ * ++ * mmap_sem must always be the top-level lock when it is taken. ++ * Therefore we can only hold the memory_lock write lock when ++ * vma_list is empty, as we'd need to take mmap_sem to clear ++ * entries. vma_list can only be guaranteed empty when holding ++ * vma_lock, thus memory_lock is nested under vma_lock. ++ * ++ * This enables the vm_ops.fault callback to acquire vma_lock, ++ * followed by memory_lock read lock, while already holding ++ * mmap_sem without risk of deadlock. ++ */ ++ while (1) { ++ struct mm_struct *mm = NULL; ++ ++ if (try) { ++ if (!mutex_trylock(&vdev->vma_lock)) ++ return 0; ++ } else { ++ mutex_lock(&vdev->vma_lock); ++ } ++ while (!list_empty(&vdev->vma_list)) { ++ mmap_vma = list_first_entry(&vdev->vma_list, ++ struct vfio_pci_mmap_vma, ++ vma_next); ++ mm = mmap_vma->vma->vm_mm; ++ if (mmget_not_zero(mm)) ++ break; ++ ++ list_del(&mmap_vma->vma_next); ++ kfree(mmap_vma); ++ mm = NULL; ++ } ++ if (!mm) ++ return 1; ++ mutex_unlock(&vdev->vma_lock); ++ ++ if (try) { ++ if (!down_read_trylock(&mm->mmap_sem)) { ++ mmput(mm); ++ return 0; ++ } ++ } else { ++ down_read(&mm->mmap_sem); ++ } ++ if (mmget_still_valid(mm)) { ++ if (try) { ++ if (!mutex_trylock(&vdev->vma_lock)) { ++ up_read(&mm->mmap_sem); ++ mmput(mm); ++ return 0; ++ } ++ } else { ++ mutex_lock(&vdev->vma_lock); ++ } ++ list_for_each_entry_safe(mmap_vma, tmp, ++ &vdev->vma_list, vma_next) { ++ struct vm_area_struct *vma = mmap_vma->vma; ++ ++ if (vma->vm_mm != mm) ++ continue; ++ ++ list_del(&mmap_vma->vma_next); ++ kfree(mmap_vma); ++ ++ zap_vma_ptes(vma, vma->vm_start, ++ vma->vm_end - vma->vm_start); ++ } ++ mutex_unlock(&vdev->vma_lock); ++ } ++ up_read(&mm->mmap_sem); ++ mmput(mm); ++ } ++} ++ ++void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device *vdev) ++{ ++ vfio_pci_zap_and_vma_lock(vdev, false); ++ down_write(&vdev->memory_lock); ++ mutex_unlock(&vdev->vma_lock); ++} ++ ++u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev) ++{ ++ u16 cmd; ++ ++ down_write(&vdev->memory_lock); ++ pci_read_config_word(vdev->pdev, PCI_COMMAND, &cmd); ++ if (!(cmd & PCI_COMMAND_MEMORY)) ++ pci_write_config_word(vdev->pdev, PCI_COMMAND, ++ cmd | PCI_COMMAND_MEMORY); ++ ++ return cmd; ++} ++ ++void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev, u16 cmd) ++{ ++ pci_write_config_word(vdev->pdev, PCI_COMMAND, cmd); ++ up_write(&vdev->memory_lock); ++} ++ ++/* Caller holds vma_lock */ ++static int __vfio_pci_add_vma(struct vfio_pci_device *vdev, ++ struct vm_area_struct *vma) ++{ ++ struct vfio_pci_mmap_vma *mmap_vma; ++ ++ mmap_vma = kmalloc(sizeof(*mmap_vma), GFP_KERNEL); ++ if (!mmap_vma) ++ return -ENOMEM; ++ ++ mmap_vma->vma = vma; ++ list_add(&mmap_vma->vma_next, &vdev->vma_list); ++ ++ return 0; ++} ++ ++/* ++ * Zap mmaps on open so that we can fault them in on access and therefore ++ * our vma_list only tracks mappings accessed since last zap. ++ */ ++static void vfio_pci_mmap_open(struct vm_area_struct *vma) ++{ ++ zap_vma_ptes(vma, vma->vm_start, vma->vm_end - vma->vm_start); ++} ++ ++static void vfio_pci_mmap_close(struct vm_area_struct *vma) ++{ ++ struct vfio_pci_device *vdev = vma->vm_private_data; ++ struct vfio_pci_mmap_vma *mmap_vma; ++ ++ mutex_lock(&vdev->vma_lock); ++ list_for_each_entry(mmap_vma, &vdev->vma_list, vma_next) { ++ if (mmap_vma->vma == vma) { ++ list_del(&mmap_vma->vma_next); ++ kfree(mmap_vma); ++ break; ++ } ++ } ++ mutex_unlock(&vdev->vma_lock); ++} ++ ++static int vfio_pci_mmap_fault(struct vm_fault *vmf) ++{ ++ struct vm_area_struct *vma = vmf->vma; ++ struct vfio_pci_device *vdev = vma->vm_private_data; ++ int ret = VM_FAULT_NOPAGE; ++ ++ mutex_lock(&vdev->vma_lock); ++ down_read(&vdev->memory_lock); ++ ++ if (!__vfio_pci_memory_enabled(vdev)) { ++ ret = VM_FAULT_SIGBUS; ++ mutex_unlock(&vdev->vma_lock); ++ goto up_out; ++ } ++ ++ if (__vfio_pci_add_vma(vdev, vma)) { ++ ret = VM_FAULT_OOM; ++ mutex_unlock(&vdev->vma_lock); ++ goto up_out; ++ } ++ ++ mutex_unlock(&vdev->vma_lock); ++ ++ if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, ++ vma->vm_end - vma->vm_start, vma->vm_page_prot)) ++ ret = VM_FAULT_SIGBUS; ++ ++up_out: ++ up_read(&vdev->memory_lock); ++ return ret; ++} ++ ++static const struct vm_operations_struct vfio_pci_mmap_ops = { ++ .open = vfio_pci_mmap_open, ++ .close = vfio_pci_mmap_close, ++ .fault = vfio_pci_mmap_fault, ++}; ++ + static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) + { + struct vfio_pci_device *vdev = device_data; +@@ -1185,8 +1447,14 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) + vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); + vma->vm_pgoff = (pci_resource_start(pdev, index) >> PAGE_SHIFT) + pgoff; + +- return remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, +- req_len, vma->vm_page_prot); ++ /* ++ * See remap_pfn_range(), called from vfio_pci_fault() but we can't ++ * change vm_flags within the fault handler. Set them now. ++ */ ++ vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; ++ vma->vm_ops = &vfio_pci_mmap_ops; ++ ++ return 0; + } + + static void vfio_pci_request(void *device_data, unsigned int count) +@@ -1243,6 +1511,9 @@ static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + vdev->irq_type = VFIO_PCI_NUM_IRQS; + mutex_init(&vdev->igate); + spin_lock_init(&vdev->irqlock); ++ mutex_init(&vdev->vma_lock); ++ INIT_LIST_HEAD(&vdev->vma_list); ++ init_rwsem(&vdev->memory_lock); + + ret = vfio_add_group_dev(&pdev->dev, &vfio_pci_ops, vdev); + if (ret) { +@@ -1337,12 +1608,6 @@ static struct pci_driver vfio_pci_driver = { + .err_handler = &vfio_err_handlers, + }; + +-struct vfio_devices { +- struct vfio_device **devices; +- int cur_index; +- int max_index; +-}; +- + static int vfio_pci_get_devs(struct pci_dev *pdev, void *data) + { + struct vfio_devices *devs = data; +@@ -1364,6 +1629,39 @@ static int vfio_pci_get_devs(struct pci_dev *pdev, void *data) + return 0; + } + ++static int vfio_pci_try_zap_and_vma_lock_cb(struct pci_dev *pdev, void *data) ++{ ++ struct vfio_devices *devs = data; ++ struct vfio_device *device; ++ struct vfio_pci_device *vdev; ++ ++ if (devs->cur_index == devs->max_index) ++ return -ENOSPC; ++ ++ device = vfio_device_get_from_dev(&pdev->dev); ++ if (!device) ++ return -EINVAL; ++ ++ if (pci_dev_driver(pdev) != &vfio_pci_driver) { ++ vfio_device_put(device); ++ return -EBUSY; ++ } ++ ++ vdev = vfio_device_data(device); ++ ++ /* ++ * Locking multiple devices is prone to deadlock, runaway and ++ * unwind if we hit contention. ++ */ ++ if (!vfio_pci_zap_and_vma_lock(vdev, true)) { ++ vfio_device_put(device); ++ return -EBUSY; ++ } ++ ++ devs->devices[devs->cur_index++] = device; ++ return 0; ++} ++ + /* + * Attempt to do a bus/slot reset if there are devices affected by a reset for + * this device that are needs_reset and all of the affected devices are unused +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 36bc8f104e42e..a1a26465d224c 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -398,6 +398,20 @@ static inline void p_setd(struct perm_bits *p, int off, u32 virt, u32 write) + *(__le32 *)(&p->write[off]) = cpu_to_le32(write); + } + ++/* Caller should hold memory_lock semaphore */ ++bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev) ++{ ++ struct pci_dev *pdev = vdev->pdev; ++ u16 cmd = le16_to_cpu(*(__le16 *)&vdev->vconfig[PCI_COMMAND]); ++ ++ /* ++ * SR-IOV VF memory enable is handled by the MSE bit in the ++ * PF SR-IOV capability, there's therefore no need to trigger ++ * faults based on the virtual value. ++ */ ++ return pdev->is_virtfn || (cmd & PCI_COMMAND_MEMORY); ++} ++ + /* + * Restore the *real* BARs after we detect a FLR or backdoor reset. + * (backdoor = some device specific technique that we didn't catch) +@@ -558,13 +572,18 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, + + new_cmd = le32_to_cpu(val); + ++ phys_io = !!(phys_cmd & PCI_COMMAND_IO); ++ virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO); ++ new_io = !!(new_cmd & PCI_COMMAND_IO); ++ + phys_mem = !!(phys_cmd & PCI_COMMAND_MEMORY); + virt_mem = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_MEMORY); + new_mem = !!(new_cmd & PCI_COMMAND_MEMORY); + +- phys_io = !!(phys_cmd & PCI_COMMAND_IO); +- virt_io = !!(le16_to_cpu(*virt_cmd) & PCI_COMMAND_IO); +- new_io = !!(new_cmd & PCI_COMMAND_IO); ++ if (!new_mem) ++ vfio_pci_zap_and_down_write_memory_lock(vdev); ++ else ++ down_write(&vdev->memory_lock); + + /* + * If the user is writing mem/io enable (new_mem/io) and we +@@ -581,8 +600,11 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, + } + + count = vfio_default_config_write(vdev, pos, count, perm, offset, val); +- if (count < 0) ++ if (count < 0) { ++ if (offset == PCI_COMMAND) ++ up_write(&vdev->memory_lock); + return count; ++ } + + /* + * Save current memory/io enable bits in vconfig to allow for +@@ -593,6 +615,8 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, + + *virt_cmd &= cpu_to_le16(~mask); + *virt_cmd |= cpu_to_le16(new_cmd & mask); ++ ++ up_write(&vdev->memory_lock); + } + + /* Emulate INTx disable */ +@@ -830,8 +854,11 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos, + pos - offset + PCI_EXP_DEVCAP, + &cap); + +- if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) ++ if (!ret && (cap & PCI_EXP_DEVCAP_FLR)) { ++ vfio_pci_zap_and_down_write_memory_lock(vdev); + pci_try_reset_function(vdev->pdev); ++ up_write(&vdev->memory_lock); ++ } + } + + /* +@@ -909,8 +936,11 @@ static int vfio_af_config_write(struct vfio_pci_device *vdev, int pos, + pos - offset + PCI_AF_CAP, + &cap); + +- if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) ++ if (!ret && (cap & PCI_AF_CAP_FLR) && (cap & PCI_AF_CAP_TP)) { ++ vfio_pci_zap_and_down_write_memory_lock(vdev); + pci_try_reset_function(vdev->pdev); ++ up_write(&vdev->memory_lock); ++ } + } + + return count; +@@ -1708,6 +1738,15 @@ int vfio_config_init(struct vfio_pci_device *vdev) + vconfig[PCI_INTERRUPT_PIN]); + + vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */ ++ ++ /* ++ * VFs do no implement the memory enable bit of the COMMAND ++ * register therefore we'll not have it set in our initial ++ * copy of config space after pci_enable_device(). For ++ * consistency with PFs, set the virtual enable bit here. ++ */ ++ *(__le16 *)&vconfig[PCI_COMMAND] |= ++ cpu_to_le16(PCI_COMMAND_MEMORY); + } + + if (!IS_ENABLED(CONFIG_VFIO_PCI_INTX) || vdev->nointx) +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 94594dc63c417..bdfdd506bc588 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -252,6 +252,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) + struct pci_dev *pdev = vdev->pdev; + unsigned int flag = msix ? PCI_IRQ_MSIX : PCI_IRQ_MSI; + int ret; ++ u16 cmd; + + if (!is_irq_none(vdev)) + return -EINVAL; +@@ -261,13 +262,16 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) + return -ENOMEM; + + /* return the number of supported vectors if we can't get all: */ ++ cmd = vfio_pci_memory_lock_and_enable(vdev); + ret = pci_alloc_irq_vectors(pdev, 1, nvec, flag); + if (ret < nvec) { + if (ret > 0) + pci_free_irq_vectors(pdev); ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); + kfree(vdev->ctx); + return ret; + } ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); + + vdev->num_ctx = nvec; + vdev->irq_type = msix ? VFIO_PCI_MSIX_IRQ_INDEX : +@@ -290,6 +294,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + struct pci_dev *pdev = vdev->pdev; + struct eventfd_ctx *trigger; + int irq, ret; ++ u16 cmd; + + if (vector < 0 || vector >= vdev->num_ctx) + return -EINVAL; +@@ -298,7 +303,11 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + + if (vdev->ctx[vector].trigger) { + irq_bypass_unregister_producer(&vdev->ctx[vector].producer); ++ ++ cmd = vfio_pci_memory_lock_and_enable(vdev); + free_irq(irq, vdev->ctx[vector].trigger); ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); ++ + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(vdev->ctx[vector].trigger); + vdev->ctx[vector].trigger = NULL; +@@ -326,6 +335,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + * such a reset it would be unsuccessful. To avoid this, restore the + * cached value of the message prior to enabling. + */ ++ cmd = vfio_pci_memory_lock_and_enable(vdev); + if (msix) { + struct msi_msg msg; + +@@ -335,6 +345,7 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + + ret = request_irq(irq, vfio_msihandler, 0, + vdev->ctx[vector].name, trigger); ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); + if (ret) { + kfree(vdev->ctx[vector].name); + eventfd_ctx_put(trigger); +@@ -379,6 +390,7 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix) + { + struct pci_dev *pdev = vdev->pdev; + int i; ++ u16 cmd; + + for (i = 0; i < vdev->num_ctx; i++) { + vfio_virqfd_disable(&vdev->ctx[i].unmask); +@@ -387,7 +399,9 @@ static void vfio_msi_disable(struct vfio_pci_device *vdev, bool msix) + + vfio_msi_set_block(vdev, 0, vdev->num_ctx, NULL, msix); + ++ cmd = vfio_pci_memory_lock_and_enable(vdev); + pci_free_irq_vectors(pdev); ++ vfio_pci_memory_unlock_and_restore(vdev, cmd); + + /* + * Both disable paths above use pci_intx_for_msi() to clear DisINTx +diff --git a/drivers/vfio/pci/vfio_pci_private.h b/drivers/vfio/pci/vfio_pci_private.h +index f561ac1c78a0d..f896cebb5c2c2 100644 +--- a/drivers/vfio/pci/vfio_pci_private.h ++++ b/drivers/vfio/pci/vfio_pci_private.h +@@ -63,6 +63,11 @@ struct vfio_pci_dummy_resource { + struct list_head res_next; + }; + ++struct vfio_pci_mmap_vma { ++ struct vm_area_struct *vma; ++ struct list_head vma_next; ++}; ++ + struct vfio_pci_device { + struct pci_dev *pdev; + void __iomem *barmap[PCI_STD_RESOURCE_END + 1]; +@@ -95,6 +100,9 @@ struct vfio_pci_device { + struct eventfd_ctx *err_trigger; + struct eventfd_ctx *req_trigger; + struct list_head dummy_resources_list; ++ struct mutex vma_lock; ++ struct list_head vma_list; ++ struct rw_semaphore memory_lock; + }; + + #define is_intx(vdev) (vdev->irq_type == VFIO_PCI_INTX_IRQ_INDEX) +@@ -130,6 +138,14 @@ extern int vfio_pci_register_dev_region(struct vfio_pci_device *vdev, + unsigned int type, unsigned int subtype, + const struct vfio_pci_regops *ops, + size_t size, u32 flags, void *data); ++ ++extern bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev); ++extern void vfio_pci_zap_and_down_write_memory_lock(struct vfio_pci_device ++ *vdev); ++extern u16 vfio_pci_memory_lock_and_enable(struct vfio_pci_device *vdev); ++extern void vfio_pci_memory_unlock_and_restore(struct vfio_pci_device *vdev, ++ u16 cmd); ++ + #ifdef CONFIG_VFIO_PCI_IGD + extern int vfio_pci_igd_init(struct vfio_pci_device *vdev); + #else +diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c +index 357243d76f108..6445461a56013 100644 +--- a/drivers/vfio/pci/vfio_pci_rdwr.c ++++ b/drivers/vfio/pci/vfio_pci_rdwr.c +@@ -122,6 +122,7 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, + size_t x_start = 0, x_end = 0; + resource_size_t end; + void __iomem *io; ++ struct resource *res = &vdev->pdev->resource[bar]; + ssize_t done; + + if (pci_resource_start(pdev, bar)) +@@ -137,6 +138,14 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, + + count = min(count, (size_t)(end - pos)); + ++ if (res->flags & IORESOURCE_MEM) { ++ down_read(&vdev->memory_lock); ++ if (!__vfio_pci_memory_enabled(vdev)) { ++ up_read(&vdev->memory_lock); ++ return -EIO; ++ } ++ } ++ + if (bar == PCI_ROM_RESOURCE) { + /* + * The ROM can fill less space than the BAR, so we start the +@@ -144,20 +153,21 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, + * filling large ROM BARs much faster. + */ + io = pci_map_rom(pdev, &x_start); +- if (!io) +- return -ENOMEM; ++ if (!io) { ++ done = -ENOMEM; ++ goto out; ++ } + x_end = end; + } else if (!vdev->barmap[bar]) { +- int ret; +- +- ret = pci_request_selected_regions(pdev, 1 << bar, "vfio"); +- if (ret) +- return ret; ++ done = pci_request_selected_regions(pdev, 1 << bar, "vfio"); ++ if (done) ++ goto out; + + io = pci_iomap(pdev, bar, 0); + if (!io) { + pci_release_selected_regions(pdev, 1 << bar); +- return -ENOMEM; ++ done = -ENOMEM; ++ goto out; + } + + vdev->barmap[bar] = io; +@@ -176,6 +186,9 @@ ssize_t vfio_pci_bar_rw(struct vfio_pci_device *vdev, char __user *buf, + + if (bar == PCI_ROM_RESOURCE) + pci_unmap_rom(pdev, io); ++out: ++ if (res->flags & IORESOURCE_MEM) ++ up_read(&vdev->memory_lock); + + return done; + } +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index f22425501bc16..9c8ed9d7f9aa5 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -336,6 +336,32 @@ static int put_pfn(unsigned long pfn, int prot) + return 0; + } + ++static int follow_fault_pfn(struct vm_area_struct *vma, struct mm_struct *mm, ++ unsigned long vaddr, unsigned long *pfn, ++ bool write_fault) ++{ ++ int ret; ++ ++ ret = follow_pfn(vma, vaddr, pfn); ++ if (ret) { ++ bool unlocked = false; ++ ++ ret = fixup_user_fault(NULL, mm, vaddr, ++ FAULT_FLAG_REMOTE | ++ (write_fault ? FAULT_FLAG_WRITE : 0), ++ &unlocked); ++ if (unlocked) ++ return -EAGAIN; ++ ++ if (ret) ++ return ret; ++ ++ ret = follow_pfn(vma, vaddr, pfn); ++ } ++ ++ return ret; ++} ++ + static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + int prot, unsigned long *pfn) + { +@@ -375,12 +401,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + + down_read(&mm->mmap_sem); + ++retry: + vma = find_vma_intersection(mm, vaddr, vaddr + 1); + + if (vma && vma->vm_flags & VM_PFNMAP) { +- if (!follow_pfn(vma, vaddr, pfn) && +- is_invalid_reserved_pfn(*pfn)) +- ret = 0; ++ ret = follow_fault_pfn(vma, mm, vaddr, pfn, prot & IOMMU_WRITE); ++ if (ret == -EAGAIN) ++ goto retry; ++ ++ if (!ret && !is_invalid_reserved_pfn(*pfn)) ++ ret = -EFAULT; + } + + up_read(&mm->mmap_sem); +diff --git a/net/core/dev.c b/net/core/dev.c +index 7ec549e481e39..d101f95a47fbc 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5532,12 +5532,13 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi, + pr_err_once("netif_napi_add() called with weight %d on device %s\n", + weight, dev->name); + napi->weight = weight; +- list_add(&napi->dev_list, &dev->napi_list); + napi->dev = dev; + #ifdef CONFIG_NETPOLL + napi->poll_owner = -1; + #endif + set_bit(NAPI_STATE_SCHED, &napi->state); ++ set_bit(NAPI_STATE_NPSVC, &napi->state); ++ list_add_rcu(&napi->dev_list, &dev->napi_list); + napi_hash_add(napi); + } + EXPORT_SYMBOL(netif_napi_add); +diff --git a/net/core/netpoll.c b/net/core/netpoll.c +index abab3753a9e0e..0b247f7cd5833 100644 +--- a/net/core/netpoll.c ++++ b/net/core/netpoll.c +@@ -179,7 +179,7 @@ static void poll_napi(struct net_device *dev) + struct napi_struct *napi; + int cpu = smp_processor_id(); + +- list_for_each_entry(napi, &dev->napi_list, dev_list) { ++ list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) { + if (cmpxchg(&napi->poll_owner, -1, cpu) == -1) { + poll_one_napi(napi); + smp_store_release(&napi->poll_owner, -1); +diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c +index 41d0e95d171e1..b1a1718495f34 100644 +--- a/net/netlabel/netlabel_domainhash.c ++++ b/net/netlabel/netlabel_domainhash.c +@@ -99,6 +99,7 @@ static void netlbl_domhsh_free_entry(struct rcu_head *entry) + kfree(netlbl_domhsh_addr6_entry(iter6)); + } + #endif /* IPv6 */ ++ kfree(ptr->def.addrsel); + } + kfree(ptr->domain); + kfree(ptr); +@@ -550,6 +551,8 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry, + goto add_return; + } + #endif /* IPv6 */ ++ /* cleanup the new entry since we've moved everything over */ ++ netlbl_domhsh_free_entry(&entry->rcu); + } else + ret_val = -EINVAL; + +@@ -593,6 +596,12 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, + { + int ret_val = 0; + struct audit_buffer *audit_buf; ++ struct netlbl_af4list *iter4; ++ struct netlbl_domaddr4_map *map4; ++#if IS_ENABLED(CONFIG_IPV6) ++ struct netlbl_af6list *iter6; ++ struct netlbl_domaddr6_map *map6; ++#endif /* IPv6 */ + + if (entry == NULL) + return -ENOENT; +@@ -610,6 +619,9 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, + ret_val = -ENOENT; + spin_unlock(&netlbl_domhsh_lock); + ++ if (ret_val) ++ return ret_val; ++ + audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info); + if (audit_buf != NULL) { + audit_log_format(audit_buf, +@@ -619,40 +631,29 @@ int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, + audit_log_end(audit_buf); + } + +- if (ret_val == 0) { +- struct netlbl_af4list *iter4; +- struct netlbl_domaddr4_map *map4; +-#if IS_ENABLED(CONFIG_IPV6) +- struct netlbl_af6list *iter6; +- struct netlbl_domaddr6_map *map6; +-#endif /* IPv6 */ +- +- switch (entry->def.type) { +- case NETLBL_NLTYPE_ADDRSELECT: +- netlbl_af4list_foreach_rcu(iter4, +- &entry->def.addrsel->list4) { +- map4 = netlbl_domhsh_addr4_entry(iter4); +- cipso_v4_doi_putdef(map4->def.cipso); +- } ++ switch (entry->def.type) { ++ case NETLBL_NLTYPE_ADDRSELECT: ++ netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) { ++ map4 = netlbl_domhsh_addr4_entry(iter4); ++ cipso_v4_doi_putdef(map4->def.cipso); ++ } + #if IS_ENABLED(CONFIG_IPV6) +- netlbl_af6list_foreach_rcu(iter6, +- &entry->def.addrsel->list6) { +- map6 = netlbl_domhsh_addr6_entry(iter6); +- calipso_doi_putdef(map6->def.calipso); +- } ++ netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) { ++ map6 = netlbl_domhsh_addr6_entry(iter6); ++ calipso_doi_putdef(map6->def.calipso); ++ } + #endif /* IPv6 */ +- break; +- case NETLBL_NLTYPE_CIPSOV4: +- cipso_v4_doi_putdef(entry->def.cipso); +- break; ++ break; ++ case NETLBL_NLTYPE_CIPSOV4: ++ cipso_v4_doi_putdef(entry->def.cipso); ++ break; + #if IS_ENABLED(CONFIG_IPV6) +- case NETLBL_NLTYPE_CALIPSO: +- calipso_doi_putdef(entry->def.calipso); +- break; ++ case NETLBL_NLTYPE_CALIPSO: ++ calipso_doi_putdef(entry->def.calipso); ++ break; + #endif /* IPv6 */ +- } +- call_rcu(&entry->rcu, netlbl_domhsh_free_entry); + } ++ call_rcu(&entry->rcu, netlbl_domhsh_free_entry); + + return ret_val; + } +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 442780515760e..1f154276a681f 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -7086,8 +7086,6 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) + + pr_debug("%s: begins, snum:%d\n", __func__, snum); + +- local_bh_disable(); +- + if (snum == 0) { + /* Search for an available port. */ + int low, high, remaining, index; +@@ -7106,20 +7104,21 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) + continue; + index = sctp_phashfn(sock_net(sk), rover); + head = &sctp_port_hashtable[index]; +- spin_lock(&head->lock); ++ spin_lock_bh(&head->lock); + sctp_for_each_hentry(pp, &head->chain) + if ((pp->port == rover) && + net_eq(sock_net(sk), pp->net)) + goto next; + break; + next: +- spin_unlock(&head->lock); ++ spin_unlock_bh(&head->lock); ++ cond_resched(); + } while (--remaining > 0); + + /* Exhausted local port range during search? */ + ret = 1; + if (remaining <= 0) +- goto fail; ++ return ret; + + /* OK, here is the one we will use. HEAD (the port + * hash table list entry) is non-NULL and we hold it's +@@ -7134,7 +7133,7 @@ static long sctp_get_port_local(struct sock *sk, union sctp_addr *addr) + * port iterator, pp being NULL. + */ + head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)]; +- spin_lock(&head->lock); ++ spin_lock_bh(&head->lock); + sctp_for_each_hentry(pp, &head->chain) { + if ((pp->port == snum) && net_eq(pp->net, sock_net(sk))) + goto pp_found; +@@ -7218,10 +7217,7 @@ success: + ret = 0; + + fail_unlock: +- spin_unlock(&head->lock); +- +-fail: +- local_bh_enable(); ++ spin_unlock_bh(&head->lock); + return ret; + } + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index d9ec6335c7dcf..cbec2242f79ab 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2126,18 +2126,21 @@ static int tipc_shutdown(struct socket *sock, int how) + lock_sock(sk); + + __tipc_shutdown(sock, TIPC_CONN_SHUTDOWN); +- sk->sk_shutdown = SEND_SHUTDOWN; ++ if (tipc_sk_type_connectionless(sk)) ++ sk->sk_shutdown = SHUTDOWN_MASK; ++ else ++ sk->sk_shutdown = SEND_SHUTDOWN; + + if (sk->sk_state == TIPC_DISCONNECTING) { + /* Discard any unreceived messages */ + __skb_queue_purge(&sk->sk_receive_queue); + +- /* Wake up anyone sleeping in poll */ +- sk->sk_state_change(sk); + res = 0; + } else { + res = -ENOTCONN; + } ++ /* Wake up anyone sleeping in poll. */ ++ sk->sk_state_change(sk); + + release_sock(sk); + return res; +diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c +index d3fdc463a884e..1e61cdce28952 100644 +--- a/sound/firewire/tascam/tascam.c ++++ b/sound/firewire/tascam/tascam.c +@@ -225,11 +225,39 @@ static void snd_tscm_remove(struct fw_unit *unit) + } + + static const struct ieee1394_device_id snd_tscm_id_table[] = { ++ // Tascam, FW-1884. + { + .match_flags = IEEE1394_MATCH_VENDOR_ID | +- IEEE1394_MATCH_SPECIFIER_ID, ++ IEEE1394_MATCH_SPECIFIER_ID | ++ IEEE1394_MATCH_VERSION, + .vendor_id = 0x00022e, + .specifier_id = 0x00022e, ++ .version = 0x800000, ++ }, ++ // Tascam, FE-8 (.version = 0x800001) ++ // This kernel module doesn't support FE-8 because the most of features ++ // can be implemented in userspace without any specific support of this ++ // module. ++ // ++ // .version = 0x800002 is unknown. ++ // ++ // Tascam, FW-1082. ++ { ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_SPECIFIER_ID | ++ IEEE1394_MATCH_VERSION, ++ .vendor_id = 0x00022e, ++ .specifier_id = 0x00022e, ++ .version = 0x800003, ++ }, ++ // Tascam, FW-1804. ++ { ++ .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_SPECIFIER_ID | ++ IEEE1394_MATCH_VERSION, ++ .vendor_id = 0x00022e, ++ .specifier_id = 0x00022e, ++ .version = 0x800004, + }, + /* FE-08 requires reverse-engineering because it just has faders. */ + {}