From c092c0123bc04ca73d139add3389ef6040483119 Mon Sep 17 00:00:00 2001 From: Julian Sikorski Date: Sun, 24 Apr 2022 22:32:46 +0200 Subject: [PATCH] Update odroidxu4-current to 5.4.190 (#3707) * Update odroidxu4-current to 5.4.188 * Update odroidxu4-current to 5.4.190 --- .../odroidxu4-5.4/patch-5.4.185-186.patch | 2261 +++ .../odroidxu4-5.4/patch-5.4.186-187.patch | 511 + .../odroidxu4-5.4/patch-5.4.187-188.patch | 1264 ++ .../odroidxu4-5.4/patch-5.4.188-189.patch | 14679 ++++++++++++++++ .../odroidxu4-5.4/patch-5.4.189-190.patch | 1735 ++ 5 files changed, 20450 insertions(+) create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch create mode 100644 patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch new file mode 100644 index 0000000000..ead390ff6a --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.185-186.patch @@ -0,0 +1,2261 @@ +diff --git a/Makefile b/Makefile +index bd3bdf86b992e..f9054b4e8a123 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 185 ++SUBLEVEL = 186 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi +index 140e22d74dcfb..d393bb481e747 100644 +--- a/arch/arm/boot/dts/rk322x.dtsi ++++ b/arch/arm/boot/dts/rk322x.dtsi +@@ -635,8 +635,8 @@ + interrupts = ; + assigned-clocks = <&cru SCLK_HDMI_PHY>; + assigned-clock-parents = <&hdmi_phy>; +- clocks = <&cru SCLK_HDMI_HDCP>, <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_CEC>; +- clock-names = "isfr", "iahb", "cec"; ++ clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>, <&cru SCLK_HDMI_CEC>; ++ clock-names = "iahb", "isfr", "cec"; + pinctrl-names = "default"; + pinctrl-0 = <&hdmii2c_xfer &hdmi_hpd &hdmi_cec>; + resets = <&cru SRST_HDMI_P>; +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 658ceb96d8bd1..7dcafd0833ba8 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -975,7 +975,7 @@ + status = "disabled"; + }; + +- crypto: cypto-controller@ff8a0000 { ++ crypto: crypto@ff8a0000 { + compatible = "rockchip,rk3288-crypto"; + reg = <0x0 0xff8a0000 0x0 0x4000>; + interrupts = ; +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index 32564b017ba06..d8ac89879327d 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + + #define __KVM_HAVE_ARCH_INTC_INITIALIZED +@@ -424,4 +425,10 @@ static inline bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu) + + #define kvm_arm_vcpu_loaded(vcpu) (false) + ++static inline int kvm_arm_get_spectre_bhb_state(void) ++{ ++ /* 32bit guests don't need firmware for this */ ++ return SPECTRE_VULNERABLE; /* aka SMCCC_RET_NOT_SUPPORTED */ ++} ++ + #endif /* __ARM_KVM_HOST_H__ */ +diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h +index 2769360f195ca..89b8e70068a13 100644 +--- a/arch/arm/include/uapi/asm/kvm.h ++++ b/arch/arm/include/uapi/asm/kvm.h +@@ -227,6 +227,12 @@ struct kvm_vcpu_events { + #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED 3 + #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) + ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3 KVM_REG_ARM_FW_REG(3) ++ /* Higher values mean better protection. */ ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL 0 ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL 1 ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED 2 ++ + /* Device Control API: ARM VGIC */ + #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 + #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 9c8ea59398658..a1a828ca188cf 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1139,6 +1139,15 @@ config ARM64_SSBD + + If unsure, say Y. + ++config MITIGATE_SPECTRE_BRANCH_HISTORY ++ bool "Mitigate Spectre style attacks against branch history" if EXPERT ++ default y ++ help ++ Speculation attacks against some high-performance processors can ++ make use of branch history to influence future speculation. ++ When taking an exception from user-space, a sequence of branches ++ or a firmware call overwrites the branch history. ++ + config RODATA_FULL_DEFAULT_ENABLED + bool "Apply r/o permissions of VM areas also to their linear aliases" + default y +diff --git a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi +index d911d38877e52..19f17bb29e4bd 100644 +--- a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi ++++ b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi +@@ -369,7 +369,7 @@ + }; + + usb0: usb@ffb00000 { +- compatible = "snps,dwc2"; ++ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; + reg = <0xffb00000 0x40000>; + interrupts = <0 93 4>; + phys = <&usbphy0>; +@@ -381,7 +381,7 @@ + }; + + usb1: usb@ffb40000 { +- compatible = "snps,dwc2"; ++ compatible = "intel,socfpga-agilex-hsotg", "snps,dwc2"; + reg = <0xffb40000 0x40000>; + interrupts = <0 94 4>; + phys = <&usbphy0>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 45b86933c6ea0..390b86ec65389 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -467,6 +467,12 @@ + }; + + &sdhci { ++ /* ++ * Signal integrity isn't great at 200MHz but 100MHz has proven stable ++ * enough. ++ */ ++ max-frequency = <100000000>; ++ + bus-width = <8>; + mmc-hs400-1_8v; + mmc-hs400-enhanced-strobe; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399.dtsi b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +index 750dad0d17400..95942d917de53 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi +@@ -1746,10 +1746,10 @@ + interrupts = ; + clocks = <&cru PCLK_HDMI_CTRL>, + <&cru SCLK_HDMI_SFR>, +- <&cru PLL_VPLL>, ++ <&cru SCLK_HDMI_CEC>, + <&cru PCLK_VIO_GRF>, +- <&cru SCLK_HDMI_CEC>; +- clock-names = "iahb", "isfr", "vpll", "grf", "cec"; ++ <&cru PLL_VPLL>; ++ clock-names = "iahb", "isfr", "cec", "grf", "vpll"; + power-domains = <&power RK3399_PD_HDCP>; + reg-io-width = <4>; + rockchip,grf = <&grf>; +diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h +index 4a4258f17c868..01112f9767bc3 100644 +--- a/arch/arm64/include/asm/assembler.h ++++ b/arch/arm64/include/asm/assembler.h +@@ -110,6 +110,13 @@ + hint #20 + .endm + ++/* ++ * Clear Branch History instruction ++ */ ++ .macro clearbhb ++ hint #22 ++ .endm ++ + /* + * Speculation barrier + */ +@@ -757,4 +764,30 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU + .Lyield_out_\@ : + .endm + ++ .macro __mitigate_spectre_bhb_loop tmp ++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++alternative_cb spectre_bhb_patch_loop_iter ++ mov \tmp, #32 // Patched to correct the immediate ++alternative_cb_end ++.Lspectre_bhb_loop\@: ++ b . + 4 ++ subs \tmp, \tmp, #1 ++ b.ne .Lspectre_bhb_loop\@ ++ sb ++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++ .endm ++ ++ /* Save/restores x0-x3 to the stack */ ++ .macro __mitigate_spectre_bhb_fw ++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++ stp x0, x1, [sp, #-16]! ++ stp x2, x3, [sp, #-16]! ++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3 ++alternative_cb arm64_update_smccc_conduit ++ nop // Patched to SMC/HVC #0 ++alternative_cb_end ++ ldp x2, x3, [sp], #16 ++ ldp x0, x1, [sp], #16 ++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++ .endm + #endif /* __ASM_ASSEMBLER_H */ +diff --git a/arch/arm64/include/asm/cpu.h b/arch/arm64/include/asm/cpu.h +index d72d995b7e258..85cc06380e93e 100644 +--- a/arch/arm64/include/asm/cpu.h ++++ b/arch/arm64/include/asm/cpu.h +@@ -25,6 +25,7 @@ struct cpuinfo_arm64 { + u64 reg_id_aa64dfr1; + u64 reg_id_aa64isar0; + u64 reg_id_aa64isar1; ++ u64 reg_id_aa64isar2; + u64 reg_id_aa64mmfr0; + u64 reg_id_aa64mmfr1; + u64 reg_id_aa64mmfr2; +diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h +index 1dc3c762fdcb9..4ffa86149d28d 100644 +--- a/arch/arm64/include/asm/cpucaps.h ++++ b/arch/arm64/include/asm/cpucaps.h +@@ -55,7 +55,8 @@ + #define ARM64_WORKAROUND_CAVIUM_TX2_219_TVM 45 + #define ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM 46 + #define ARM64_WORKAROUND_1542419 47 ++#define ARM64_SPECTRE_BHB 48 + +-#define ARM64_NCAPS 48 ++#define ARM64_NCAPS 49 + + #endif /* __ASM_CPUCAPS_H */ +diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h +index ccae05da98a7f..f63438474dd54 100644 +--- a/arch/arm64/include/asm/cpufeature.h ++++ b/arch/arm64/include/asm/cpufeature.h +@@ -508,6 +508,34 @@ static inline bool cpu_supports_mixed_endian_el0(void) + return id_aa64mmfr0_mixed_endian_el0(read_cpuid(ID_AA64MMFR0_EL1)); + } + ++static inline bool supports_csv2p3(int scope) ++{ ++ u64 pfr0; ++ u8 csv2_val; ++ ++ if (scope == SCOPE_LOCAL_CPU) ++ pfr0 = read_sysreg_s(SYS_ID_AA64PFR0_EL1); ++ else ++ pfr0 = read_sanitised_ftr_reg(SYS_ID_AA64PFR0_EL1); ++ ++ csv2_val = cpuid_feature_extract_unsigned_field(pfr0, ++ ID_AA64PFR0_CSV2_SHIFT); ++ return csv2_val == 3; ++} ++ ++static inline bool supports_clearbhb(int scope) ++{ ++ u64 isar2; ++ ++ if (scope == SCOPE_LOCAL_CPU) ++ isar2 = read_sysreg_s(SYS_ID_AA64ISAR2_EL1); ++ else ++ isar2 = read_sanitised_ftr_reg(SYS_ID_AA64ISAR2_EL1); ++ ++ return cpuid_feature_extract_unsigned_field(isar2, ++ ID_AA64ISAR2_CLEARBHB_SHIFT); ++} ++ + static inline bool system_supports_32bit_el0(void) + { + return cpus_have_const_cap(ARM64_HAS_32BIT_EL0); +@@ -639,6 +667,18 @@ static inline int arm64_get_ssbd_state(void) + + void arm64_set_ssbd_mitigation(bool state); + ++/* Watch out, ordering is important here. */ ++enum mitigation_state { ++ SPECTRE_UNAFFECTED, ++ SPECTRE_MITIGATED, ++ SPECTRE_VULNERABLE, ++}; ++ ++enum mitigation_state arm64_get_spectre_bhb_state(void); ++bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope); ++u8 spectre_bhb_loop_affected(int scope); ++void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused); ++ + extern int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt); + + static inline u32 id_aa64mmfr0_parange_to_phys_shift(int parange) +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index aca07c2f6e6e3..f0165df489a38 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -71,6 +71,14 @@ + #define ARM_CPU_PART_CORTEX_A55 0xD05 + #define ARM_CPU_PART_CORTEX_A76 0xD0B + #define ARM_CPU_PART_NEOVERSE_N1 0xD0C ++#define ARM_CPU_PART_CORTEX_A77 0xD0D ++#define ARM_CPU_PART_NEOVERSE_V1 0xD40 ++#define ARM_CPU_PART_CORTEX_A78 0xD41 ++#define ARM_CPU_PART_CORTEX_X1 0xD44 ++#define ARM_CPU_PART_CORTEX_A710 0xD47 ++#define ARM_CPU_PART_CORTEX_X2 0xD48 ++#define ARM_CPU_PART_NEOVERSE_N2 0xD49 ++#define ARM_CPU_PART_CORTEX_A78C 0xD4B + + #define APM_CPU_PART_POTENZA 0x000 + +@@ -102,6 +110,14 @@ + #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55) + #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76) + #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1) ++#define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) ++#define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) ++#define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) ++#define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) ++#define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) ++#define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) ++#define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) ++#define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +diff --git a/arch/arm64/include/asm/fixmap.h b/arch/arm64/include/asm/fixmap.h +index f987b8a8f325e..928a96b9b1617 100644 +--- a/arch/arm64/include/asm/fixmap.h ++++ b/arch/arm64/include/asm/fixmap.h +@@ -63,9 +63,11 @@ enum fixed_addresses { + #endif /* CONFIG_ACPI_APEI_GHES */ + + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 ++ FIX_ENTRY_TRAMP_TEXT3, ++ FIX_ENTRY_TRAMP_TEXT2, ++ FIX_ENTRY_TRAMP_TEXT1, + FIX_ENTRY_TRAMP_DATA, +- FIX_ENTRY_TRAMP_TEXT, +-#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT)) ++#define TRAMP_VALIAS (__fix_to_virt(FIX_ENTRY_TRAMP_TEXT1)) + #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ + __end_of_permanent_fixed_addresses, + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 697702a1a1ff1..e6efdbe88c0a9 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -684,4 +684,9 @@ bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu); + + #define kvm_arm_vcpu_loaded(vcpu) ((vcpu)->arch.sysregs_loaded_on_cpu) + ++static inline enum mitigation_state kvm_arm_get_spectre_bhb_state(void) ++{ ++ return arm64_get_spectre_bhb_state(); ++} ++ + #endif /* __ARM64_KVM_HOST_H__ */ +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index befe37d4bc0e5..78d110667c0c7 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -478,7 +478,8 @@ static inline void *kvm_get_hyp_vector(void) + void *vect = kern_hyp_va(kvm_ksym_ref(__kvm_hyp_vector)); + int slot = -1; + +- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) && data->fn) { ++ if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || ++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { + vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); + slot = data->hyp_vectors_slot; + } +@@ -507,7 +508,8 @@ static inline int kvm_map_vectors(void) + * !HBP + HEL2 -> allocate one vector slot and use exec mapping + * HBP + HEL2 -> use hardened vertors and use exec mapping + */ +- if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR)) { ++ if (cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || ++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) { + __kvm_bp_vect_base = kvm_ksym_ref(__bp_harden_hyp_vecs_start); + __kvm_bp_vect_base = kern_hyp_va(__kvm_bp_vect_base); + } +diff --git a/arch/arm64/include/asm/mmu.h b/arch/arm64/include/asm/mmu.h +index f217e32929193..1b9e49fb0e1b7 100644 +--- a/arch/arm64/include/asm/mmu.h ++++ b/arch/arm64/include/asm/mmu.h +@@ -29,7 +29,7 @@ typedef struct { + */ + #define ASID(mm) ((mm)->context.id.counter & 0xffff) + +-static inline bool arm64_kernel_unmapped_at_el0(void) ++static __always_inline bool arm64_kernel_unmapped_at_el0(void) + { + return IS_ENABLED(CONFIG_UNMAP_KERNEL_AT_EL0) && + cpus_have_const_cap(ARM64_UNMAP_KERNEL_AT_EL0); +@@ -82,6 +82,12 @@ typedef void (*bp_hardening_cb_t)(void); + struct bp_hardening_data { + int hyp_vectors_slot; + bp_hardening_cb_t fn; ++ ++ /* ++ * template_start is only used by the BHB mitigation to identify the ++ * hyp_vectors_slot sequence. ++ */ ++ const char *template_start; + }; + + #if (defined(CONFIG_HARDEN_BRANCH_PREDICTOR) || \ +diff --git a/arch/arm64/include/asm/sections.h b/arch/arm64/include/asm/sections.h +index 25a73aab438f9..a75f2882cc7cb 100644 +--- a/arch/arm64/include/asm/sections.h ++++ b/arch/arm64/include/asm/sections.h +@@ -20,4 +20,9 @@ extern char __irqentry_text_start[], __irqentry_text_end[]; + extern char __mmuoff_data_start[], __mmuoff_data_end[]; + extern char __entry_tramp_text_start[], __entry_tramp_text_end[]; + ++static inline size_t entry_tramp_text_size(void) ++{ ++ return __entry_tramp_text_end - __entry_tramp_text_start; ++} ++ + #endif /* __ASM_SECTIONS_H */ +diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h +index 9b68f1b3915ec..5b3bdad66b27e 100644 +--- a/arch/arm64/include/asm/sysreg.h ++++ b/arch/arm64/include/asm/sysreg.h +@@ -165,6 +165,7 @@ + + #define SYS_ID_AA64ISAR0_EL1 sys_reg(3, 0, 0, 6, 0) + #define SYS_ID_AA64ISAR1_EL1 sys_reg(3, 0, 0, 6, 1) ++#define SYS_ID_AA64ISAR2_EL1 sys_reg(3, 0, 0, 6, 2) + + #define SYS_ID_AA64MMFR0_EL1 sys_reg(3, 0, 0, 7, 0) + #define SYS_ID_AA64MMFR1_EL1 sys_reg(3, 0, 0, 7, 1) +@@ -575,6 +576,21 @@ + #define ID_AA64ISAR1_GPI_NI 0x0 + #define ID_AA64ISAR1_GPI_IMP_DEF 0x1 + ++/* id_aa64isar2 */ ++#define ID_AA64ISAR2_CLEARBHB_SHIFT 28 ++#define ID_AA64ISAR2_RPRES_SHIFT 4 ++#define ID_AA64ISAR2_WFXT_SHIFT 0 ++ ++#define ID_AA64ISAR2_RPRES_8BIT 0x0 ++#define ID_AA64ISAR2_RPRES_12BIT 0x1 ++/* ++ * Value 0x1 has been removed from the architecture, and is ++ * reserved, but has not yet been removed from the ARM ARM ++ * as of ARM DDI 0487G.b. ++ */ ++#define ID_AA64ISAR2_WFXT_NI 0x0 ++#define ID_AA64ISAR2_WFXT_SUPPORTED 0x2 ++ + /* id_aa64pfr0 */ + #define ID_AA64PFR0_CSV3_SHIFT 60 + #define ID_AA64PFR0_CSV2_SHIFT 56 +@@ -646,6 +662,7 @@ + #endif + + /* id_aa64mmfr1 */ ++#define ID_AA64MMFR1_ECBHB_SHIFT 60 + #define ID_AA64MMFR1_PAN_SHIFT 20 + #define ID_AA64MMFR1_LOR_SHIFT 16 + #define ID_AA64MMFR1_HPD_SHIFT 12 +diff --git a/arch/arm64/include/asm/vectors.h b/arch/arm64/include/asm/vectors.h +new file mode 100644 +index 0000000000000..f64613a96d530 +--- /dev/null ++++ b/arch/arm64/include/asm/vectors.h +@@ -0,0 +1,73 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++/* ++ * Copyright (C) 2022 ARM Ltd. ++ */ ++#ifndef __ASM_VECTORS_H ++#define __ASM_VECTORS_H ++ ++#include ++#include ++ ++#include ++ ++extern char vectors[]; ++extern char tramp_vectors[]; ++extern char __bp_harden_el1_vectors[]; ++ ++/* ++ * Note: the order of this enum corresponds to two arrays in entry.S: ++ * tramp_vecs and __bp_harden_el1_vectors. By default the canonical ++ * 'full fat' vectors are used directly. ++ */ ++enum arm64_bp_harden_el1_vectors { ++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++ /* ++ * Perform the BHB loop mitigation, before branching to the canonical ++ * vectors. ++ */ ++ EL1_VECTOR_BHB_LOOP, ++ ++ /* ++ * Make the SMC call for firmware mitigation, before branching to the ++ * canonical vectors. ++ */ ++ EL1_VECTOR_BHB_FW, ++ ++ /* ++ * Use the ClearBHB instruction, before branching to the canonical ++ * vectors. ++ */ ++ EL1_VECTOR_BHB_CLEAR_INSN, ++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++ ++ /* ++ * Remap the kernel before branching to the canonical vectors. ++ */ ++ EL1_VECTOR_KPTI, ++}; ++ ++#ifndef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++#define EL1_VECTOR_BHB_LOOP -1 ++#define EL1_VECTOR_BHB_FW -1 ++#define EL1_VECTOR_BHB_CLEAR_INSN -1 ++#endif /* !CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++ ++/* The vectors to use on return from EL0. e.g. to remap the kernel */ ++DECLARE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector); ++ ++#ifndef CONFIG_UNMAP_KERNEL_AT_EL0 ++#define TRAMP_VALIAS 0 ++#endif ++ ++static inline const char * ++arm64_get_bp_hardening_vector(enum arm64_bp_harden_el1_vectors slot) ++{ ++ if (arm64_kernel_unmapped_at_el0()) ++ return (char *)TRAMP_VALIAS + SZ_2K * slot; ++ ++ WARN_ON_ONCE(slot == EL1_VECTOR_KPTI); ++ ++ return __bp_harden_el1_vectors + SZ_2K * slot; ++} ++ ++#endif /* __ASM_VECTORS_H */ +diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h +index 67c21f9bdbad2..08440ce57a1c2 100644 +--- a/arch/arm64/include/uapi/asm/kvm.h ++++ b/arch/arm64/include/uapi/asm/kvm.h +@@ -240,6 +240,11 @@ struct kvm_vcpu_events { + #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED 3 + #define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_ENABLED (1U << 4) + ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3 KVM_REG_ARM_FW_REG(3) ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL 0 ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL 1 ++#define KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED 2 ++ + /* SVE registers */ + #define KVM_REG_ARM64_SVE (0x15 << KVM_REG_ARM_COPROC_SHIFT) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 1e16c4e00e771..33b33416fea42 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + static bool __maybe_unused + is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope) +@@ -116,6 +117,16 @@ DEFINE_PER_CPU_READ_MOSTLY(struct bp_hardening_data, bp_hardening_data); + #ifdef CONFIG_KVM_INDIRECT_VECTORS + extern char __smccc_workaround_1_smc_start[]; + extern char __smccc_workaround_1_smc_end[]; ++extern char __smccc_workaround_3_smc_start[]; ++extern char __smccc_workaround_3_smc_end[]; ++extern char __spectre_bhb_loop_k8_start[]; ++extern char __spectre_bhb_loop_k8_end[]; ++extern char __spectre_bhb_loop_k24_start[]; ++extern char __spectre_bhb_loop_k24_end[]; ++extern char __spectre_bhb_loop_k32_start[]; ++extern char __spectre_bhb_loop_k32_end[]; ++extern char __spectre_bhb_clearbhb_start[]; ++extern char __spectre_bhb_clearbhb_end[]; + + static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start, + const char *hyp_vecs_end) +@@ -129,11 +140,11 @@ static void __copy_hyp_vect_bpi(int slot, const char *hyp_vecs_start, + __flush_icache_range((uintptr_t)dst, (uintptr_t)dst + SZ_2K); + } + ++static DEFINE_RAW_SPINLOCK(bp_lock); + static void install_bp_hardening_cb(bp_hardening_cb_t fn, + const char *hyp_vecs_start, + const char *hyp_vecs_end) + { +- static DEFINE_RAW_SPINLOCK(bp_lock); + int cpu, slot = -1; + + /* +@@ -161,6 +172,7 @@ static void install_bp_hardening_cb(bp_hardening_cb_t fn, + + __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot); + __this_cpu_write(bp_hardening_data.fn, fn); ++ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start); + raw_spin_unlock(&bp_lock); + } + #else +@@ -927,6 +939,13 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + .cpu_enable = cpu_enable_ssbd_mitigation, + .midr_range_list = arm64_ssb_cpus, + }, ++ { ++ .desc = "Spectre-BHB", ++ .capability = ARM64_SPECTRE_BHB, ++ .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, ++ .matches = is_spectre_bhb_affected, ++ .cpu_enable = spectre_bhb_enable_mitigation, ++ }, + #ifdef CONFIG_ARM64_ERRATUM_1418040 + { + .desc = "ARM erratum 1418040", +@@ -989,15 +1008,41 @@ ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, + return sprintf(buf, "Mitigation: __user pointer sanitization\n"); + } + ++static const char *get_bhb_affected_string(enum mitigation_state bhb_state) ++{ ++ switch (bhb_state) { ++ case SPECTRE_UNAFFECTED: ++ return ""; ++ default: ++ case SPECTRE_VULNERABLE: ++ return ", but not BHB"; ++ case SPECTRE_MITIGATED: ++ return ", BHB"; ++ } ++} ++ + ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, + char *buf) + { ++ enum mitigation_state bhb_state = arm64_get_spectre_bhb_state(); ++ const char *bhb_str = get_bhb_affected_string(bhb_state); ++ const char *v2_str = "Branch predictor hardening"; ++ + switch (get_spectre_v2_workaround_state()) { + case ARM64_BP_HARDEN_NOT_REQUIRED: +- return sprintf(buf, "Not affected\n"); +- case ARM64_BP_HARDEN_WA_NEEDED: +- return sprintf(buf, "Mitigation: Branch predictor hardening\n"); +- case ARM64_BP_HARDEN_UNKNOWN: ++ if (bhb_state == SPECTRE_UNAFFECTED) ++ return sprintf(buf, "Not affected\n"); ++ ++ /* ++ * Platforms affected by Spectre-BHB can't report ++ * "Not affected" for Spectre-v2. ++ */ ++ v2_str = "CSV2"; ++ fallthrough; ++ case ARM64_BP_HARDEN_WA_NEEDED: ++ return sprintf(buf, "Mitigation: %s%s\n", v2_str, bhb_str); ++ case ARM64_BP_HARDEN_UNKNOWN: ++ fallthrough; + default: + return sprintf(buf, "Vulnerable\n"); + } +@@ -1019,3 +1064,333 @@ ssize_t cpu_show_spec_store_bypass(struct device *dev, + + return sprintf(buf, "Vulnerable\n"); + } ++ ++/* ++ * We try to ensure that the mitigation state can never change as the result of ++ * onlining a late CPU. ++ */ ++static void update_mitigation_state(enum mitigation_state *oldp, ++ enum mitigation_state new) ++{ ++ enum mitigation_state state; ++ ++ do { ++ state = READ_ONCE(*oldp); ++ if (new <= state) ++ break; ++ } while (cmpxchg_relaxed(oldp, state, new) != state); ++} ++ ++/* ++ * Spectre BHB. ++ * ++ * A CPU is either: ++ * - Mitigated by a branchy loop a CPU specific number of times, and listed ++ * in our "loop mitigated list". ++ * - Mitigated in software by the firmware Spectre v2 call. ++ * - Has the ClearBHB instruction to perform the mitigation. ++ * - Has the 'Exception Clears Branch History Buffer' (ECBHB) feature, so no ++ * software mitigation in the vectors is needed. ++ * - Has CSV2.3, so is unaffected. ++ */ ++static enum mitigation_state spectre_bhb_state; ++ ++enum mitigation_state arm64_get_spectre_bhb_state(void) ++{ ++ return spectre_bhb_state; ++} ++ ++/* ++ * This must be called with SCOPE_LOCAL_CPU for each type of CPU, before any ++ * SCOPE_SYSTEM call will give the right answer. ++ */ ++u8 spectre_bhb_loop_affected(int scope) ++{ ++ u8 k = 0; ++ static u8 max_bhb_k; ++ ++ if (scope == SCOPE_LOCAL_CPU) { ++ static const struct midr_range spectre_bhb_k32_list[] = { ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), ++ {}, ++ }; ++ static const struct midr_range spectre_bhb_k24_list[] = { ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), ++ {}, ++ }; ++ static const struct midr_range spectre_bhb_k8_list[] = { ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A57), ++ {}, ++ }; ++ ++ if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k32_list)) ++ k = 32; ++ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k24_list)) ++ k = 24; ++ else if (is_midr_in_range_list(read_cpuid_id(), spectre_bhb_k8_list)) ++ k = 8; ++ ++ max_bhb_k = max(max_bhb_k, k); ++ } else { ++ k = max_bhb_k; ++ } ++ ++ return k; ++} ++ ++static enum mitigation_state spectre_bhb_get_cpu_fw_mitigation_state(void) ++{ ++ int ret; ++ struct arm_smccc_res res; ++ ++ if (psci_ops.smccc_version == SMCCC_VERSION_1_0) ++ return SPECTRE_VULNERABLE; ++ ++ switch (psci_ops.conduit) { ++ case PSCI_CONDUIT_HVC: ++ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, ++ ARM_SMCCC_ARCH_WORKAROUND_3, &res); ++ break; ++ ++ case PSCI_CONDUIT_SMC: ++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, ++ ARM_SMCCC_ARCH_WORKAROUND_3, &res); ++ break; ++ ++ default: ++ return SPECTRE_VULNERABLE; ++ } ++ ++ ret = res.a0; ++ switch (ret) { ++ case SMCCC_RET_SUCCESS: ++ return SPECTRE_MITIGATED; ++ case SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED: ++ return SPECTRE_UNAFFECTED; ++ default: ++ fallthrough; ++ case SMCCC_RET_NOT_SUPPORTED: ++ return SPECTRE_VULNERABLE; ++ } ++} ++ ++static bool is_spectre_bhb_fw_affected(int scope) ++{ ++ static bool system_affected; ++ enum mitigation_state fw_state; ++ bool has_smccc = (psci_ops.smccc_version >= SMCCC_VERSION_1_1); ++ static const struct midr_range spectre_bhb_firmware_mitigated_list[] = { ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A75), ++ {}, ++ }; ++ bool cpu_in_list = is_midr_in_range_list(read_cpuid_id(), ++ spectre_bhb_firmware_mitigated_list); ++ ++ if (scope != SCOPE_LOCAL_CPU) ++ return system_affected; ++ ++ fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); ++ if (cpu_in_list || (has_smccc && fw_state == SPECTRE_MITIGATED)) { ++ system_affected = true; ++ return true; ++ } ++ ++ return false; ++} ++ ++static bool supports_ecbhb(int scope) ++{ ++ u64 mmfr1; ++ ++ if (scope == SCOPE_LOCAL_CPU) ++ mmfr1 = read_sysreg_s(SYS_ID_AA64MMFR1_EL1); ++ else ++ mmfr1 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR1_EL1); ++ ++ return cpuid_feature_extract_unsigned_field(mmfr1, ++ ID_AA64MMFR1_ECBHB_SHIFT); ++} ++ ++bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, ++ int scope) ++{ ++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible()); ++ ++ if (supports_csv2p3(scope)) ++ return false; ++ ++ if (supports_clearbhb(scope)) ++ return true; ++ ++ if (spectre_bhb_loop_affected(scope)) ++ return true; ++ ++ if (is_spectre_bhb_fw_affected(scope)) ++ return true; ++ ++ return false; ++} ++ ++static void this_cpu_set_vectors(enum arm64_bp_harden_el1_vectors slot) ++{ ++ const char *v = arm64_get_bp_hardening_vector(slot); ++ ++ if (slot < 0) ++ return; ++ ++ __this_cpu_write(this_cpu_vector, v); ++ ++ /* ++ * When KPTI is in use, the vectors are switched when exiting to ++ * user-space. ++ */ ++ if (arm64_kernel_unmapped_at_el0()) ++ return; ++ ++ write_sysreg(v, vbar_el1); ++ isb(); ++} ++ ++#ifdef CONFIG_KVM_INDIRECT_VECTORS ++static const char *kvm_bhb_get_vecs_end(const char *start) ++{ ++ if (start == __smccc_workaround_3_smc_start) ++ return __smccc_workaround_3_smc_end; ++ else if (start == __spectre_bhb_loop_k8_start) ++ return __spectre_bhb_loop_k8_end; ++ else if (start == __spectre_bhb_loop_k24_start) ++ return __spectre_bhb_loop_k24_end; ++ else if (start == __spectre_bhb_loop_k32_start) ++ return __spectre_bhb_loop_k32_end; ++ else if (start == __spectre_bhb_clearbhb_start) ++ return __spectre_bhb_clearbhb_end; ++ ++ return NULL; ++} ++ ++static void kvm_setup_bhb_slot(const char *hyp_vecs_start) ++{ ++ int cpu, slot = -1; ++ const char *hyp_vecs_end; ++ ++ if (!IS_ENABLED(CONFIG_KVM) || !is_hyp_mode_available()) ++ return; ++ ++ hyp_vecs_end = kvm_bhb_get_vecs_end(hyp_vecs_start); ++ if (WARN_ON_ONCE(!hyp_vecs_start || !hyp_vecs_end)) ++ return; ++ ++ raw_spin_lock(&bp_lock); ++ for_each_possible_cpu(cpu) { ++ if (per_cpu(bp_hardening_data.template_start, cpu) == hyp_vecs_start) { ++ slot = per_cpu(bp_hardening_data.hyp_vectors_slot, cpu); ++ break; ++ } ++ } ++ ++ if (slot == -1) { ++ slot = atomic_inc_return(&arm64_el2_vector_last_slot); ++ BUG_ON(slot >= BP_HARDEN_EL2_SLOTS); ++ __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end); ++ } ++ ++ __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot); ++ __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start); ++ raw_spin_unlock(&bp_lock); ++} ++#else ++#define __smccc_workaround_3_smc_start NULL ++#define __spectre_bhb_loop_k8_start NULL ++#define __spectre_bhb_loop_k24_start NULL ++#define __spectre_bhb_loop_k32_start NULL ++#define __spectre_bhb_clearbhb_start NULL ++ ++static void kvm_setup_bhb_slot(const char *hyp_vecs_start) { } ++#endif ++ ++void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *entry) ++{ ++ enum mitigation_state fw_state, state = SPECTRE_VULNERABLE; ++ ++ if (!is_spectre_bhb_affected(entry, SCOPE_LOCAL_CPU)) ++ return; ++ ++ if (get_spectre_v2_workaround_state() == ARM64_BP_HARDEN_UNKNOWN) { ++ /* No point mitigating Spectre-BHB alone. */ ++ } else if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) { ++ pr_info_once("spectre-bhb mitigation disabled by compile time option\n"); ++ } else if (cpu_mitigations_off()) { ++ pr_info_once("spectre-bhb mitigation disabled by command line option\n"); ++ } else if (supports_ecbhb(SCOPE_LOCAL_CPU)) { ++ state = SPECTRE_MITIGATED; ++ } else if (supports_clearbhb(SCOPE_LOCAL_CPU)) { ++ kvm_setup_bhb_slot(__spectre_bhb_clearbhb_start); ++ this_cpu_set_vectors(EL1_VECTOR_BHB_CLEAR_INSN); ++ ++ state = SPECTRE_MITIGATED; ++ } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) { ++ switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) { ++ case 8: ++ kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start); ++ break; ++ case 24: ++ kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start); ++ break; ++ case 32: ++ kvm_setup_bhb_slot(__spectre_bhb_loop_k32_start); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } ++ this_cpu_set_vectors(EL1_VECTOR_BHB_LOOP); ++ ++ state = SPECTRE_MITIGATED; ++ } else if (is_spectre_bhb_fw_affected(SCOPE_LOCAL_CPU)) { ++ fw_state = spectre_bhb_get_cpu_fw_mitigation_state(); ++ if (fw_state == SPECTRE_MITIGATED) { ++ kvm_setup_bhb_slot(__smccc_workaround_3_smc_start); ++ this_cpu_set_vectors(EL1_VECTOR_BHB_FW); ++ ++ /* ++ * With WA3 in the vectors, the WA1 calls can be ++ * removed. ++ */ ++ __this_cpu_write(bp_hardening_data.fn, NULL); ++ ++ state = SPECTRE_MITIGATED; ++ } ++ } ++ ++ update_mitigation_state(&spectre_bhb_state, state); ++} ++ ++/* Patched to correct the immediate */ ++void noinstr spectre_bhb_patch_loop_iter(struct alt_instr *alt, ++ __le32 *origptr, __le32 *updptr, int nr_inst) ++{ ++ u8 rd; ++ u32 insn; ++ u16 loop_count = spectre_bhb_loop_affected(SCOPE_SYSTEM); ++ ++ BUG_ON(nr_inst != 1); /* MOV -> MOV */ ++ ++ if (!IS_ENABLED(CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY)) ++ return; ++ ++ insn = le32_to_cpu(*origptr); ++ rd = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RD, insn); ++ insn = aarch64_insn_gen_movewide(rd, loop_count, 0, ++ AARCH64_INSN_VARIANT_64BIT, ++ AARCH64_INSN_MOVEWIDE_ZERO); ++ *updptr++ = cpu_to_le32(insn); ++} +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index acdef8d76c64d..d07dadd6b8ff7 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -10,11 +10,13 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + #include ++ + #include + #include + #include +@@ -23,6 +25,7 @@ + #include + #include + #include ++#include + #include + + /* Kernel representation of AT_HWCAP and AT_HWCAP2 */ +@@ -45,6 +48,8 @@ static struct arm64_cpu_capabilities const __ro_after_init *cpu_hwcaps_ptrs[ARM6 + /* Need also bit for ARM64_CB_PATCH */ + DECLARE_BITMAP(boot_capabilities, ARM64_NPATCHABLE); + ++DEFINE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector) = vectors; ++ + /* + * Flag to indicate if we have computed the system wide + * capabilities based on the boot time active CPUs. This +@@ -150,6 +155,11 @@ static const struct arm64_ftr_bits ftr_id_aa64isar1[] = { + ARM64_FTR_END, + }; + ++static const struct arm64_ftr_bits ftr_id_aa64isar2[] = { ++ ARM64_FTR_BITS(FTR_HIDDEN, FTR_STRICT, FTR_HIGHER_SAFE, ID_AA64ISAR2_CLEARBHB_SHIFT, 4, 0), ++ ARM64_FTR_END, ++}; ++ + static const struct arm64_ftr_bits ftr_id_aa64pfr0[] = { + ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV3_SHIFT, 4, 0), + ARM64_FTR_BITS(FTR_HIDDEN, FTR_NONSTRICT, FTR_LOWER_SAFE, ID_AA64PFR0_CSV2_SHIFT, 4, 0), +@@ -410,6 +420,7 @@ static const struct __ftr_reg_entry { + /* Op1 = 0, CRn = 0, CRm = 6 */ + ARM64_FTR_REG(SYS_ID_AA64ISAR0_EL1, ftr_id_aa64isar0), + ARM64_FTR_REG(SYS_ID_AA64ISAR1_EL1, ftr_id_aa64isar1), ++ ARM64_FTR_REG(SYS_ID_AA64ISAR2_EL1, ftr_id_aa64isar2), + + /* Op1 = 0, CRn = 0, CRm = 7 */ + ARM64_FTR_REG(SYS_ID_AA64MMFR0_EL1, ftr_id_aa64mmfr0), +@@ -581,6 +592,7 @@ void __init init_cpu_features(struct cpuinfo_arm64 *info) + init_cpu_ftr_reg(SYS_ID_AA64DFR1_EL1, info->reg_id_aa64dfr1); + init_cpu_ftr_reg(SYS_ID_AA64ISAR0_EL1, info->reg_id_aa64isar0); + init_cpu_ftr_reg(SYS_ID_AA64ISAR1_EL1, info->reg_id_aa64isar1); ++ init_cpu_ftr_reg(SYS_ID_AA64ISAR2_EL1, info->reg_id_aa64isar2); + init_cpu_ftr_reg(SYS_ID_AA64MMFR0_EL1, info->reg_id_aa64mmfr0); + init_cpu_ftr_reg(SYS_ID_AA64MMFR1_EL1, info->reg_id_aa64mmfr1); + init_cpu_ftr_reg(SYS_ID_AA64MMFR2_EL1, info->reg_id_aa64mmfr2); +@@ -704,6 +716,8 @@ void update_cpu_features(int cpu, + info->reg_id_aa64isar0, boot->reg_id_aa64isar0); + taint |= check_update_ftr_reg(SYS_ID_AA64ISAR1_EL1, cpu, + info->reg_id_aa64isar1, boot->reg_id_aa64isar1); ++ taint |= check_update_ftr_reg(SYS_ID_AA64ISAR2_EL1, cpu, ++ info->reg_id_aa64isar2, boot->reg_id_aa64isar2); + + /* + * Differing PARange support is fine as long as all peripherals and +@@ -838,6 +852,7 @@ static u64 __read_sysreg_by_encoding(u32 sys_id) + read_sysreg_case(SYS_ID_AA64MMFR2_EL1); + read_sysreg_case(SYS_ID_AA64ISAR0_EL1); + read_sysreg_case(SYS_ID_AA64ISAR1_EL1); ++ read_sysreg_case(SYS_ID_AA64ISAR2_EL1); + + read_sysreg_case(SYS_CNTFRQ_EL0); + read_sysreg_case(SYS_CTR_EL0); +@@ -1038,6 +1053,12 @@ kpti_install_ng_mappings(const struct arm64_cpu_capabilities *__unused) + static bool kpti_applied = false; + int cpu = smp_processor_id(); + ++ if (__this_cpu_read(this_cpu_vector) == vectors) { ++ const char *v = arm64_get_bp_hardening_vector(EL1_VECTOR_KPTI); ++ ++ __this_cpu_write(this_cpu_vector, v); ++ } ++ + /* + * We don't need to rewrite the page-tables if either we've done + * it already or we have KASLR enabled and therefore have not +diff --git a/arch/arm64/kernel/cpuinfo.c b/arch/arm64/kernel/cpuinfo.c +index 05933c065732b..90b35011a22f8 100644 +--- a/arch/arm64/kernel/cpuinfo.c ++++ b/arch/arm64/kernel/cpuinfo.c +@@ -344,6 +344,7 @@ static void __cpuinfo_store_cpu(struct cpuinfo_arm64 *info) + info->reg_id_aa64dfr1 = read_cpuid(ID_AA64DFR1_EL1); + info->reg_id_aa64isar0 = read_cpuid(ID_AA64ISAR0_EL1); + info->reg_id_aa64isar1 = read_cpuid(ID_AA64ISAR1_EL1); ++ info->reg_id_aa64isar2 = read_cpuid(ID_AA64ISAR2_EL1); + info->reg_id_aa64mmfr0 = read_cpuid(ID_AA64MMFR0_EL1); + info->reg_id_aa64mmfr1 = read_cpuid(ID_AA64MMFR1_EL1); + info->reg_id_aa64mmfr2 = read_cpuid(ID_AA64MMFR2_EL1); +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index db137746c6fa3..8a4c108a0c0b6 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -59,18 +59,21 @@ + + .macro kernel_ventry, el, label, regsize = 64 + .align 7 +-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 +-alternative_if ARM64_UNMAP_KERNEL_AT_EL0 ++.Lventry_start\@: + .if \el == 0 ++ /* ++ * This must be the first instruction of the EL0 vector entries. It is ++ * skipped by the trampoline vectors, to trigger the cleanup. ++ */ ++ b .Lskip_tramp_vectors_cleanup\@ + .if \regsize == 64 + mrs x30, tpidrro_el0 + msr tpidrro_el0, xzr + .else + mov x30, xzr + .endif ++.Lskip_tramp_vectors_cleanup\@: + .endif +-alternative_else_nop_endif +-#endif + + sub sp, sp, #S_FRAME_SIZE + #ifdef CONFIG_VMAP_STACK +@@ -116,11 +119,15 @@ alternative_else_nop_endif + mrs x0, tpidrro_el0 + #endif + b el\()\el\()_\label ++.org .Lventry_start\@ + 128 // Did we overflow the ventry slot? + .endm + +- .macro tramp_alias, dst, sym ++ .macro tramp_alias, dst, sym, tmp + mov_q \dst, TRAMP_VALIAS +- add \dst, \dst, #(\sym - .entry.tramp.text) ++ adr_l \tmp, \sym ++ add \dst, \dst, \tmp ++ adr_l \tmp, .entry.tramp.text ++ sub \dst, \dst, \tmp + .endm + + // This macro corrupts x0-x3. It is the caller's duty +@@ -361,21 +368,25 @@ alternative_else_nop_endif + ldp x24, x25, [sp, #16 * 12] + ldp x26, x27, [sp, #16 * 13] + ldp x28, x29, [sp, #16 * 14] +- ldr lr, [sp, #S_LR] +- add sp, sp, #S_FRAME_SIZE // restore sp + + .if \el == 0 +-alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0 ++alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 ++ ldr lr, [sp, #S_LR] ++ add sp, sp, #S_FRAME_SIZE // restore sp ++ eret ++alternative_else_nop_endif + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 + bne 5f +- msr far_el1, x30 +- tramp_alias x30, tramp_exit_native ++ msr far_el1, x29 ++ tramp_alias x30, tramp_exit_native, x29 + br x30 + 5: +- tramp_alias x30, tramp_exit_compat ++ tramp_alias x30, tramp_exit_compat, x29 + br x30 + #endif + .else ++ ldr lr, [sp, #S_LR] ++ add sp, sp, #S_FRAME_SIZE // restore sp + eret + .endif + sb +@@ -1012,12 +1023,6 @@ ENDPROC(el0_svc) + + .popsection // .entry.text + +-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 +-/* +- * Exception vectors trampoline. +- */ +- .pushsection ".entry.tramp.text", "ax" +- + // Move from tramp_pg_dir to swapper_pg_dir + .macro tramp_map_kernel, tmp + mrs \tmp, ttbr1_el1 +@@ -1051,12 +1056,47 @@ alternative_else_nop_endif + */ + .endm + +- .macro tramp_ventry, regsize = 64 ++ .macro tramp_data_page dst ++ adr_l \dst, .entry.tramp.text ++ sub \dst, \dst, PAGE_SIZE ++ .endm ++ ++ .macro tramp_data_read_var dst, var ++#ifdef CONFIG_RANDOMIZE_BASE ++ tramp_data_page \dst ++ add \dst, \dst, #:lo12:__entry_tramp_data_\var ++ ldr \dst, [\dst] ++#else ++ ldr \dst, =\var ++#endif ++ .endm ++ ++#define BHB_MITIGATION_NONE 0 ++#define BHB_MITIGATION_LOOP 1 ++#define BHB_MITIGATION_FW 2 ++#define BHB_MITIGATION_INSN 3 ++ ++ .macro tramp_ventry, vector_start, regsize, kpti, bhb + .align 7 + 1: + .if \regsize == 64 + msr tpidrro_el0, x30 // Restored in kernel_ventry + .endif ++ ++ .if \bhb == BHB_MITIGATION_LOOP ++ /* ++ * This sequence must appear before the first indirect branch. i.e. the ++ * ret out of tramp_ventry. It appears here because x30 is free. ++ */ ++ __mitigate_spectre_bhb_loop x30 ++ .endif // \bhb == BHB_MITIGATION_LOOP ++ ++ .if \bhb == BHB_MITIGATION_INSN ++ clearbhb ++ isb ++ .endif // \bhb == BHB_MITIGATION_INSN ++ ++ .if \kpti == 1 + /* + * Defend against branch aliasing attacks by pushing a dummy + * entry onto the return stack and using a RET instruction to +@@ -1066,46 +1106,79 @@ alternative_else_nop_endif + b . + 2: + tramp_map_kernel x30 +-#ifdef CONFIG_RANDOMIZE_BASE +- adr x30, tramp_vectors + PAGE_SIZE + alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003 +- ldr x30, [x30] +-#else +- ldr x30, =vectors +-#endif ++ tramp_data_read_var x30, vectors + alternative_if_not ARM64_WORKAROUND_CAVIUM_TX2_219_PRFM +- prfm plil1strm, [x30, #(1b - tramp_vectors)] ++ prfm plil1strm, [x30, #(1b - \vector_start)] + alternative_else_nop_endif ++ + msr vbar_el1, x30 +- add x30, x30, #(1b - tramp_vectors) + isb ++ .else ++ ldr x30, =vectors ++ .endif // \kpti == 1 ++ ++ .if \bhb == BHB_MITIGATION_FW ++ /* ++ * The firmware sequence must appear before the first indirect branch. ++ * i.e. the ret out of tramp_ventry. But it also needs the stack to be ++ * mapped to save/restore the registers the SMC clobbers. ++ */ ++ __mitigate_spectre_bhb_fw ++ .endif // \bhb == BHB_MITIGATION_FW ++ ++ add x30, x30, #(1b - \vector_start + 4) + ret ++.org 1b + 128 // Did we overflow the ventry slot? + .endm + + .macro tramp_exit, regsize = 64 +- adr x30, tramp_vectors ++ tramp_data_read_var x30, this_cpu_vector ++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN ++ mrs x29, tpidr_el1 ++alternative_else ++ mrs x29, tpidr_el2 ++alternative_endif ++ ldr x30, [x30, x29] ++ + msr vbar_el1, x30 +- tramp_unmap_kernel x30 ++ ldr lr, [sp, #S_LR] ++ tramp_unmap_kernel x29 + .if \regsize == 64 +- mrs x30, far_el1 ++ mrs x29, far_el1 + .endif ++ add sp, sp, #S_FRAME_SIZE // restore sp + eret + sb + .endm + +- .align 11 +-ENTRY(tramp_vectors) ++ .macro generate_tramp_vector, kpti, bhb ++.Lvector_start\@: + .space 0x400 + +- tramp_ventry +- tramp_ventry +- tramp_ventry +- tramp_ventry ++ .rept 4 ++ tramp_ventry .Lvector_start\@, 64, \kpti, \bhb ++ .endr ++ .rept 4 ++ tramp_ventry .Lvector_start\@, 32, \kpti, \bhb ++ .endr ++ .endm + +- tramp_ventry 32 +- tramp_ventry 32 +- tramp_ventry 32 +- tramp_ventry 32 ++#ifdef CONFIG_UNMAP_KERNEL_AT_EL0 ++/* ++ * Exception vectors trampoline. ++ * The order must match __bp_harden_el1_vectors and the ++ * arm64_bp_harden_el1_vectors enum. ++ */ ++ .pushsection ".entry.tramp.text", "ax" ++ .align 11 ++ENTRY(tramp_vectors) ++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_LOOP ++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_FW ++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_INSN ++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++ generate_tramp_vector kpti=1, bhb=BHB_MITIGATION_NONE + END(tramp_vectors) + + ENTRY(tramp_exit_native) +@@ -1123,11 +1196,55 @@ END(tramp_exit_compat) + .align PAGE_SHIFT + .globl __entry_tramp_data_start + __entry_tramp_data_start: ++__entry_tramp_data_vectors: + .quad vectors ++#ifdef CONFIG_ARM_SDE_INTERFACE ++__entry_tramp_data___sdei_asm_handler: ++ .quad __sdei_asm_handler ++#endif /* CONFIG_ARM_SDE_INTERFACE */ ++__entry_tramp_data_this_cpu_vector: ++ .quad this_cpu_vector + .popsection // .rodata + #endif /* CONFIG_RANDOMIZE_BASE */ + #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ + ++/* ++ * Exception vectors for spectre mitigations on entry from EL1 when ++ * kpti is not in use. ++ */ ++ .macro generate_el1_vector, bhb ++.Lvector_start\@: ++ kernel_ventry 1, sync_invalid // Synchronous EL1t ++ kernel_ventry 1, irq_invalid // IRQ EL1t ++ kernel_ventry 1, fiq_invalid // FIQ EL1t ++ kernel_ventry 1, error_invalid // Error EL1t ++ ++ kernel_ventry 1, sync // Synchronous EL1h ++ kernel_ventry 1, irq // IRQ EL1h ++ kernel_ventry 1, fiq_invalid // FIQ EL1h ++ kernel_ventry 1, error // Error EL1h ++ ++ .rept 4 ++ tramp_ventry .Lvector_start\@, 64, 0, \bhb ++ .endr ++ .rept 4 ++ tramp_ventry .Lvector_start\@, 32, 0, \bhb ++ .endr ++ .endm ++ ++/* The order must match tramp_vecs and the arm64_bp_harden_el1_vectors enum. */ ++ .pushsection ".entry.text", "ax" ++ .align 11 ++SYM_CODE_START(__bp_harden_el1_vectors) ++#ifdef CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY ++ generate_el1_vector bhb=BHB_MITIGATION_LOOP ++ generate_el1_vector bhb=BHB_MITIGATION_FW ++ generate_el1_vector bhb=BHB_MITIGATION_INSN ++#endif /* CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY */ ++SYM_CODE_END(__bp_harden_el1_vectors) ++ .popsection ++ ++ + /* + * Register switch for AArch64. The callee-saved registers need to be saved + * and restored. On entry: +@@ -1214,13 +1331,7 @@ ENTRY(__sdei_asm_entry_trampoline) + */ + 1: str x4, [x1, #(SDEI_EVENT_INTREGS + S_ORIG_ADDR_LIMIT)] + +-#ifdef CONFIG_RANDOMIZE_BASE +- adr x4, tramp_vectors + PAGE_SIZE +- add x4, x4, #:lo12:__sdei_asm_trampoline_next_handler +- ldr x4, [x4] +-#else +- ldr x4, =__sdei_asm_handler +-#endif ++ tramp_data_read_var x4, __sdei_asm_handler + br x4 + ENDPROC(__sdei_asm_entry_trampoline) + NOKPROBE(__sdei_asm_entry_trampoline) +@@ -1243,12 +1354,6 @@ ENDPROC(__sdei_asm_exit_trampoline) + NOKPROBE(__sdei_asm_exit_trampoline) + .ltorg + .popsection // .entry.tramp.text +-#ifdef CONFIG_RANDOMIZE_BASE +-.pushsection ".rodata", "a" +-__sdei_asm_trampoline_next_handler: +- .quad __sdei_asm_handler +-.popsection // .rodata +-#endif /* CONFIG_RANDOMIZE_BASE */ + #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ + + /* +@@ -1344,7 +1449,7 @@ alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0 + alternative_else_nop_endif + + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 +- tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline ++ tramp_alias dst=x5, sym=__sdei_asm_exit_trampoline, tmp=x3 + br x5 + #endif + ENDPROC(__sdei_asm_handler) +diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S +index 1f82cf631c3c4..fbab044b3a39a 100644 +--- a/arch/arm64/kernel/vmlinux.lds.S ++++ b/arch/arm64/kernel/vmlinux.lds.S +@@ -276,7 +276,7 @@ ASSERT(__hibernate_exit_text_end - (__hibernate_exit_text_start & ~(SZ_4K - 1)) + <= SZ_4K, "Hibernate exit text too big or misaligned") + #endif + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 +-ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) == PAGE_SIZE, ++ASSERT((__entry_tramp_text_end - __entry_tramp_text_start) <= 3*PAGE_SIZE, + "Entry trampoline text too big") + #endif + /* +diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S +index f36aad0f207bb..99b8ecaae8109 100644 +--- a/arch/arm64/kvm/hyp/hyp-entry.S ++++ b/arch/arm64/kvm/hyp/hyp-entry.S +@@ -113,6 +113,10 @@ el1_hvc_guest: + /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */ + eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_1 ^ \ + ARM_SMCCC_ARCH_WORKAROUND_2) ++ cbz w1, wa_epilogue ++ ++ eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_2 ^ \ ++ ARM_SMCCC_ARCH_WORKAROUND_3) + cbnz w1, el1_trap + + #ifdef CONFIG_ARM64_SSBD +@@ -347,4 +351,64 @@ ENTRY(__smccc_workaround_1_smc_start) + ldp x0, x1, [sp, #(8 * 2)] + add sp, sp, #(8 * 4) + ENTRY(__smccc_workaround_1_smc_end) ++ ++ENTRY(__smccc_workaround_3_smc_start) ++ esb ++ sub sp, sp, #(8 * 4) ++ stp x2, x3, [sp, #(8 * 0)] ++ stp x0, x1, [sp, #(8 * 2)] ++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_3 ++ smc #0 ++ ldp x2, x3, [sp, #(8 * 0)] ++ ldp x0, x1, [sp, #(8 * 2)] ++ add sp, sp, #(8 * 4) ++ENTRY(__smccc_workaround_3_smc_end) ++ ++ENTRY(__spectre_bhb_loop_k8_start) ++ esb ++ sub sp, sp, #(8 * 2) ++ stp x0, x1, [sp, #(8 * 0)] ++ mov x0, #8 ++2: b . + 4 ++ subs x0, x0, #1 ++ b.ne 2b ++ dsb nsh ++ isb ++ ldp x0, x1, [sp, #(8 * 0)] ++ add sp, sp, #(8 * 2) ++ENTRY(__spectre_bhb_loop_k8_end) ++ ++ENTRY(__spectre_bhb_loop_k24_start) ++ esb ++ sub sp, sp, #(8 * 2) ++ stp x0, x1, [sp, #(8 * 0)] ++ mov x0, #24 ++2: b . + 4 ++ subs x0, x0, #1 ++ b.ne 2b ++ dsb nsh ++ isb ++ ldp x0, x1, [sp, #(8 * 0)] ++ add sp, sp, #(8 * 2) ++ENTRY(__spectre_bhb_loop_k24_end) ++ ++ENTRY(__spectre_bhb_loop_k32_start) ++ esb ++ sub sp, sp, #(8 * 2) ++ stp x0, x1, [sp, #(8 * 0)] ++ mov x0, #32 ++2: b . + 4 ++ subs x0, x0, #1 ++ b.ne 2b ++ dsb nsh ++ isb ++ ldp x0, x1, [sp, #(8 * 0)] ++ add sp, sp, #(8 * 2) ++ENTRY(__spectre_bhb_loop_k32_end) ++ ++ENTRY(__spectre_bhb_clearbhb_start) ++ esb ++ clearbhb ++ isb ++ENTRY(__spectre_bhb_clearbhb_end) + #endif +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index 14607fac7ca38..768983bd23261 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + extern struct exception_table_entry __start___kvm_ex_table; + extern struct exception_table_entry __stop___kvm_ex_table; +@@ -152,7 +153,7 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu) + + static void deactivate_traps_vhe(void) + { +- extern char vectors[]; /* kernel exception vectors */ ++ const char *host_vectors = vectors; + write_sysreg(HCR_HOST_VHE_FLAGS, hcr_el2); + + /* +@@ -163,7 +164,10 @@ static void deactivate_traps_vhe(void) + asm(ALTERNATIVE("nop", "isb", ARM64_WORKAROUND_1165522)); + + write_sysreg(CPACR_EL1_DEFAULT, cpacr_el1); +- write_sysreg(vectors, vbar_el1); ++ ++ if (!arm64_kernel_unmapped_at_el0()) ++ host_vectors = __this_cpu_read(this_cpu_vector); ++ write_sysreg(host_vectors, vbar_el1); + } + NOKPROBE_SYMBOL(deactivate_traps_vhe); + +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index da649e90240c8..a25f737dfa0bb 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -1454,7 +1454,7 @@ static const struct sys_reg_desc sys_reg_descs[] = { + /* CRm=6 */ + ID_SANITISED(ID_AA64ISAR0_EL1), + ID_SANITISED(ID_AA64ISAR1_EL1), +- ID_UNALLOCATED(6,2), ++ ID_SANITISED(ID_AA64ISAR2_EL1), + ID_UNALLOCATED(6,3), + ID_UNALLOCATED(6,4), + ID_UNALLOCATED(6,5), +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 99bc0289ab2b6..5cf575f23af28 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -583,6 +583,8 @@ early_param("rodata", parse_rodata); + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 + static int __init map_entry_trampoline(void) + { ++ int i; ++ + pgprot_t prot = rodata_enabled ? PAGE_KERNEL_ROX : PAGE_KERNEL_EXEC; + phys_addr_t pa_start = __pa_symbol(__entry_tramp_text_start); + +@@ -591,11 +593,15 @@ static int __init map_entry_trampoline(void) + + /* Map only the text into the trampoline page table */ + memset(tramp_pg_dir, 0, PGD_SIZE); +- __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, PAGE_SIZE, +- prot, __pgd_pgtable_alloc, 0); ++ __create_pgd_mapping(tramp_pg_dir, pa_start, TRAMP_VALIAS, ++ entry_tramp_text_size(), prot, ++ __pgd_pgtable_alloc, NO_BLOCK_MAPPINGS); + + /* Map both the text and data into the kernel page table */ +- __set_fixmap(FIX_ENTRY_TRAMP_TEXT, pa_start, prot); ++ for (i = 0; i < DIV_ROUND_UP(entry_tramp_text_size(), PAGE_SIZE); i++) ++ __set_fixmap(FIX_ENTRY_TRAMP_TEXT1 - i, ++ pa_start + i * PAGE_SIZE, prot); ++ + if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) { + extern char __entry_tramp_data_start[]; + +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index f510c00bda882..c563b03bdccc1 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -361,6 +361,9 @@ asmlinkage void start_secondary(void) + cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + ++ set_cpu_sibling_map(cpu); ++ set_cpu_core_map(cpu); ++ + cpumask_set_cpu(cpu, &cpu_coherent_mask); + notify_cpu_starting(cpu); + +@@ -372,9 +375,6 @@ asmlinkage void start_secondary(void) + /* The CPU is running and counters synchronised, now mark it online */ + set_cpu_online(cpu, true); + +- set_cpu_sibling_map(cpu); +- set_cpu_core_map(cpu); +- + calculate_cpu_foreign_map(); + + /* +diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c +index 5acb459856752..8995c39330fac 100644 +--- a/drivers/atm/firestream.c ++++ b/drivers/atm/firestream.c +@@ -1677,6 +1677,8 @@ static int fs_init(struct fs_dev *dev) + dev->hw_base = pci_resource_start(pci_dev, 0); + + dev->base = ioremap(dev->hw_base, 0x1000); ++ if (!dev->base) ++ return 1; + + reset_chip (dev); + +diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c +index 2337b3827e6a4..11a81e8ba9639 100644 +--- a/drivers/gpu/drm/drm_connector.c ++++ b/drivers/gpu/drm/drm_connector.c +@@ -1984,6 +1984,9 @@ EXPORT_SYMBOL(drm_connector_attach_max_bpc_property); + void drm_connector_set_vrr_capable_property( + struct drm_connector *connector, bool capable) + { ++ if (!connector->vrr_capable_property) ++ return; ++ + drm_object_property_set_value(&connector->base, + connector->vrr_capable_property, + capable); +diff --git a/drivers/net/can/rcar/rcar_canfd.c b/drivers/net/can/rcar/rcar_canfd.c +index edaa1ca972c15..d4e9815ca26ff 100644 +--- a/drivers/net/can/rcar/rcar_canfd.c ++++ b/drivers/net/can/rcar/rcar_canfd.c +@@ -1598,15 +1598,15 @@ static int rcar_canfd_channel_probe(struct rcar_canfd_global *gpriv, u32 ch, + + netif_napi_add(ndev, &priv->napi, rcar_canfd_rx_poll, + RCANFD_NAPI_WEIGHT); ++ spin_lock_init(&priv->tx_lock); ++ devm_can_led_init(ndev); ++ gpriv->ch[priv->channel] = priv; + err = register_candev(ndev); + if (err) { + dev_err(&pdev->dev, + "register_candev() failed, error %d\n", err); + goto fail_candev; + } +- spin_lock_init(&priv->tx_lock); +- devm_can_led_init(ndev); +- gpriv->ch[priv->channel] = priv; + dev_info(&pdev->dev, "device registered (channel %u)\n", priv->channel); + return 0; + +diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c +index 2713300343c7f..ec551def58359 100644 +--- a/drivers/net/ethernet/sfc/mcdi.c ++++ b/drivers/net/ethernet/sfc/mcdi.c +@@ -163,9 +163,9 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd, + /* Serialise with efx_mcdi_ev_cpl() and efx_mcdi_ev_death() */ + spin_lock_bh(&mcdi->iface_lock); + ++mcdi->seqno; ++ seqno = mcdi->seqno & SEQ_MASK; + spin_unlock_bh(&mcdi->iface_lock); + +- seqno = mcdi->seqno & SEQ_MASK; + xflags = 0; + if (mcdi->mode == MCDI_MODE_EVENTS) + xflags |= MCDI_HEADER_XFLAGS_EVREQ; +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +index 022f2faccab41..4a433e34ee7a1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +@@ -519,8 +519,7 @@ static struct ieee80211_sband_iftype_data iwl_he_capa[] = { + .has_he = true, + .he_cap_elem = { + .mac_cap_info[0] = +- IEEE80211_HE_MAC_CAP0_HTC_HE | +- IEEE80211_HE_MAC_CAP0_TWT_REQ, ++ IEEE80211_HE_MAC_CAP0_HTC_HE, + .mac_cap_info[1] = + IEEE80211_HE_MAC_CAP1_TF_MAC_PAD_DUR_16US | + IEEE80211_HE_MAC_CAP1_MULTI_TID_AGG_RX_QOS_8, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 29ad7804d77aa..3c523774ef0e6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -343,7 +343,6 @@ const static u8 he_if_types_ext_capa_sta[] = { + [0] = WLAN_EXT_CAPA1_EXT_CHANNEL_SWITCHING, + [2] = WLAN_EXT_CAPA3_MULTI_BSSID_SUPPORT, + [7] = WLAN_EXT_CAPA8_OPMODE_NOTIF, +- [9] = WLAN_EXT_CAPA10_TWT_REQUESTER_SUPPORT, + }; + + const static struct wiphy_iftype_ext_capab he_iftypes_ext_capa[] = { +diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h +index 4e97ba64dbb42..3e6ef64e74d3d 100644 +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -76,6 +76,11 @@ + ARM_SMCCC_SMC_32, \ + 0, 0x7fff) + ++#define ARM_SMCCC_ARCH_WORKAROUND_3 \ ++ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ ++ ARM_SMCCC_SMC_32, \ ++ 0, 0x3fff) ++ + #define SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED 1 + + #ifndef __ASSEMBLY__ +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index 614f19bbad74f..96faf09186945 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1663,14 +1663,15 @@ int km_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + const struct xfrm_migrate *m, int num_bundles, + const struct xfrm_kmaddress *k, + const struct xfrm_encap_tmpl *encap); +-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net); ++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, ++ u32 if_id); + struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, + struct xfrm_migrate *m, + struct xfrm_encap_tmpl *encap); + int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + struct xfrm_migrate *m, int num_bundles, + struct xfrm_kmaddress *k, struct net *net, +- struct xfrm_encap_tmpl *encap); ++ struct xfrm_encap_tmpl *encap, u32 if_id); + #endif + + int km_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, __be16 sport); +diff --git a/lib/Kconfig b/lib/Kconfig +index 3321d04dfa5a5..fa129b5c4320d 100644 +--- a/lib/Kconfig ++++ b/lib/Kconfig +@@ -42,7 +42,6 @@ config BITREVERSE + config HAVE_ARCH_BITREVERSE + bool + default n +- depends on BITREVERSE + help + This option enables the use of hardware bit-reversal instructions on + architectures which support such operations. +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 9f53d25e047e3..4815cf72569e0 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1652,11 +1652,13 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, + if (!copied) + copied = used; + break; +- } else if (used <= len) { +- seq += used; +- copied += used; +- offset += used; + } ++ if (WARN_ON_ONCE(used > len)) ++ used = len; ++ seq += used; ++ copied += used; ++ offset += used; ++ + /* If recv_actor drops the lock (e.g. TCP splice + * receive) the skb pointer might be invalid when + * getting here: tcp_collapse might have deleted it +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 907d04a474597..406e13478b01b 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -2627,7 +2627,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb, + } + + return xfrm_migrate(&sel, dir, XFRM_POLICY_TYPE_MAIN, m, i, +- kma ? &k : NULL, net, NULL); ++ kma ? &k : NULL, net, NULL, 0); + + out: + return err; +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index f140c2b94b2c6..f30cdd7f3a73a 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -9,7 +9,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH +- * Copyright (C) 2018 - 2021 Intel Corporation ++ * Copyright (C) 2018 - 2022 Intel Corporation + */ + + #include +@@ -615,6 +615,14 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid, + return -EINVAL; + } + ++ if (test_sta_flag(sta, WLAN_STA_MFP) && ++ !test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { ++ ht_dbg(sdata, ++ "MFP STA not authorized - deny BA session request %pM tid %d\n", ++ sta->sta.addr, tid); ++ return -EINVAL; ++ } ++ + /* + * 802.11n-2009 11.5.1.1: If the initiating STA is an HT STA, is a + * member of an IBSS, and has no other existing Block Ack agreement +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 7c6dcbc8e98ba..1d2f633c6c7c3 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -149,6 +149,12 @@ static enum sctp_disposition __sctp_sf_do_9_1_abort( + void *arg, + struct sctp_cmd_seq *commands); + ++static enum sctp_disposition ++__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, ++ const struct sctp_association *asoc, ++ const union sctp_subtype type, void *arg, ++ struct sctp_cmd_seq *commands); ++ + /* Small helper function that checks if the chunk length + * is of the appropriate length. The 'required_length' argument + * is set to be the size of a specific chunk we are testing. +@@ -330,6 +336,14 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net, + if (!chunk->singleton) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + ++ /* Make sure that the INIT chunk has a valid length. ++ * Normally, this would cause an ABORT with a Protocol Violation ++ * error, but since we don't have an association, we'll ++ * just discard the packet. ++ */ ++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + /* If the packet is an OOTB packet which is temporarily on the + * control endpoint, respond with an ABORT. + */ +@@ -344,14 +358,6 @@ enum sctp_disposition sctp_sf_do_5_1B_init(struct net *net, + if (chunk->sctp_hdr->vtag != 0) + return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); + +- /* Make sure that the INIT chunk has a valid length. +- * Normally, this would cause an ABORT with a Protocol Violation +- * error, but since we don't have an association, we'll +- * just discard the packet. +- */ +- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- + /* If the INIT is coming toward a closing socket, we'll send back + * and ABORT. Essentially, this catches the race of INIT being + * backloged to the socket at the same time as the user isses close(). +@@ -1484,19 +1490,16 @@ static enum sctp_disposition sctp_sf_do_unexpected_init( + if (!chunk->singleton) + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + ++ /* Make sure that the INIT chunk has a valid length. */ ++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ + /* 3.1 A packet containing an INIT chunk MUST have a zero Verification + * Tag. + */ + if (chunk->sctp_hdr->vtag != 0) + return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); + +- /* Make sure that the INIT chunk has a valid length. +- * In this case, we generate a protocol violation since we have +- * an association established. +- */ +- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) +- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, +- commands); + /* Grab the INIT header. */ + chunk->subh.init_hdr = (struct sctp_inithdr *)chunk->skb->data; + +@@ -1814,9 +1817,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_a( + * its peer. + */ + if (sctp_state(asoc, SHUTDOWN_ACK_SENT)) { +- disposition = sctp_sf_do_9_2_reshutack(net, ep, asoc, +- SCTP_ST_CHUNK(chunk->chunk_hdr->type), +- chunk, commands); ++ disposition = __sctp_sf_do_9_2_reshutack(net, ep, asoc, ++ SCTP_ST_CHUNK(chunk->chunk_hdr->type), ++ chunk, commands); + if (SCTP_DISPOSITION_NOMEM == disposition) + goto nomem; + +@@ -2915,13 +2918,11 @@ enum sctp_disposition sctp_sf_do_9_2_shut_ctsn( + * that belong to this association, it should discard the INIT chunk and + * retransmit the SHUTDOWN ACK chunk. + */ +-enum sctp_disposition sctp_sf_do_9_2_reshutack( +- struct net *net, +- const struct sctp_endpoint *ep, +- const struct sctp_association *asoc, +- const union sctp_subtype type, +- void *arg, +- struct sctp_cmd_seq *commands) ++static enum sctp_disposition ++__sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, ++ const struct sctp_association *asoc, ++ const union sctp_subtype type, void *arg, ++ struct sctp_cmd_seq *commands) + { + struct sctp_chunk *chunk = arg; + struct sctp_chunk *reply; +@@ -2955,6 +2956,26 @@ nomem: + return SCTP_DISPOSITION_NOMEM; + } + ++enum sctp_disposition ++sctp_sf_do_9_2_reshutack(struct net *net, const struct sctp_endpoint *ep, ++ const struct sctp_association *asoc, ++ const union sctp_subtype type, void *arg, ++ struct sctp_cmd_seq *commands) ++{ ++ struct sctp_chunk *chunk = arg; ++ ++ if (!chunk->singleton) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ ++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_init_chunk))) ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); ++ ++ if (chunk->sctp_hdr->vtag != 0) ++ return sctp_sf_tabort_8_4_8(net, ep, asoc, type, arg, commands); ++ ++ return __sctp_sf_do_9_2_reshutack(net, ep, asoc, type, arg, commands); ++} ++ + /* + * sctp_sf_do_ecn_cwr + * +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index f2bc465de2845..d3e2b97d5d051 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -16314,7 +16314,8 @@ void cfg80211_ch_switch_notify(struct net_device *dev, + wdev->chandef = *chandef; + wdev->preset_chandef = *chandef; + +- if (wdev->iftype == NL80211_IFTYPE_STATION && ++ if ((wdev->iftype == NL80211_IFTYPE_STATION || ++ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) && + !WARN_ON(!wdev->current_bss)) + cfg80211_update_assoc_bss_entry(wdev, chandef->chan); + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 404823c5eb7d5..3ecb77c58c44e 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -4271,7 +4271,7 @@ static bool xfrm_migrate_selector_match(const struct xfrm_selector *sel_cmp, + } + + static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector *sel, +- u8 dir, u8 type, struct net *net) ++ u8 dir, u8 type, struct net *net, u32 if_id) + { + struct xfrm_policy *pol, *ret = NULL; + struct hlist_head *chain; +@@ -4280,7 +4280,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * + spin_lock_bh(&net->xfrm.xfrm_policy_lock); + chain = policy_hash_direct(net, &sel->daddr, &sel->saddr, sel->family, dir); + hlist_for_each_entry(pol, chain, bydst) { +- if (xfrm_migrate_selector_match(sel, &pol->selector) && ++ if ((if_id == 0 || pol->if_id == if_id) && ++ xfrm_migrate_selector_match(sel, &pol->selector) && + pol->type == type) { + ret = pol; + priority = ret->priority; +@@ -4292,7 +4293,8 @@ static struct xfrm_policy *xfrm_migrate_policy_find(const struct xfrm_selector * + if ((pol->priority >= priority) && ret) + break; + +- if (xfrm_migrate_selector_match(sel, &pol->selector) && ++ if ((if_id == 0 || pol->if_id == if_id) && ++ xfrm_migrate_selector_match(sel, &pol->selector) && + pol->type == type) { + ret = pol; + break; +@@ -4408,7 +4410,7 @@ static int xfrm_migrate_check(const struct xfrm_migrate *m, int num_migrate) + int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + struct xfrm_migrate *m, int num_migrate, + struct xfrm_kmaddress *k, struct net *net, +- struct xfrm_encap_tmpl *encap) ++ struct xfrm_encap_tmpl *encap, u32 if_id) + { + int i, err, nx_cur = 0, nx_new = 0; + struct xfrm_policy *pol = NULL; +@@ -4427,14 +4429,14 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + } + + /* Stage 1 - find policy */ +- if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) { ++ if ((pol = xfrm_migrate_policy_find(sel, dir, type, net, if_id)) == NULL) { + err = -ENOENT; + goto out; + } + + /* Stage 2 - find and update state(s) */ + for (i = 0, mp = m; i < num_migrate; i++, mp++) { +- if ((x = xfrm_migrate_state_find(mp, net))) { ++ if ((x = xfrm_migrate_state_find(mp, net, if_id))) { + x_cur[nx_cur] = x; + nx_cur++; + xc = xfrm_state_migrate(x, mp, encap); +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 1423e2b7cb42a..268bba29bb603 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1539,9 +1539,6 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + memcpy(&x->mark, &orig->mark, sizeof(x->mark)); + memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark)); + +- if (xfrm_init_state(x) < 0) +- goto error; +- + x->props.flags = orig->props.flags; + x->props.extra_flags = orig->props.extra_flags; + +@@ -1563,7 +1560,8 @@ out: + return NULL; + } + +-struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net) ++struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *net, ++ u32 if_id) + { + unsigned int h; + struct xfrm_state *x = NULL; +@@ -1579,6 +1577,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n + continue; + if (m->reqid && x->props.reqid != m->reqid) + continue; ++ if (if_id != 0 && x->if_id != if_id) ++ continue; + if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, + m->old_family) || + !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, +@@ -1594,6 +1594,8 @@ struct xfrm_state *xfrm_migrate_state_find(struct xfrm_migrate *m, struct net *n + if (x->props.mode != m->mode || + x->id.proto != m->proto) + continue; ++ if (if_id != 0 && x->if_id != if_id) ++ continue; + if (!xfrm_addr_equal(&x->id.daddr, &m->old_daddr, + m->old_family) || + !xfrm_addr_equal(&x->props.saddr, &m->old_saddr, +@@ -1620,6 +1622,11 @@ struct xfrm_state *xfrm_state_migrate(struct xfrm_state *x, + if (!xc) + return NULL; + ++ xc->props.family = m->new_family; ++ ++ if (xfrm_init_state(xc) < 0) ++ goto error; ++ + memcpy(&xc->id.daddr, &m->new_daddr, sizeof(xc->id.daddr)); + memcpy(&xc->props.saddr, &m->new_saddr, sizeof(xc->props.saddr)); + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 42ff32700d68b..bd44a800e7db7 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -621,13 +621,8 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, + + xfrm_smark_init(attrs, &x->props.smark); + +- if (attrs[XFRMA_IF_ID]) { ++ if (attrs[XFRMA_IF_ID]) + x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); +- if (!x->if_id) { +- err = -EINVAL; +- goto error; +- } +- } + + err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]); + if (err) +@@ -1333,13 +1328,8 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, + + mark = xfrm_mark_get(attrs, &m); + +- if (attrs[XFRMA_IF_ID]) { ++ if (attrs[XFRMA_IF_ID]) + if_id = nla_get_u32(attrs[XFRMA_IF_ID]); +- if (!if_id) { +- err = -EINVAL; +- goto out_noput; +- } +- } + + if (p->info.seq) { + x = xfrm_find_acq_byseq(net, mark, p->info.seq); +@@ -1641,13 +1631,8 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us + + xfrm_mark_get(attrs, &xp->mark); + +- if (attrs[XFRMA_IF_ID]) { ++ if (attrs[XFRMA_IF_ID]) + xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); +- if (!xp->if_id) { +- err = -EINVAL; +- goto error; +- } +- } + + return xp; + error: +@@ -2389,6 +2374,7 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, + int n = 0; + struct net *net = sock_net(skb->sk); + struct xfrm_encap_tmpl *encap = NULL; ++ u32 if_id = 0; + + if (attrs[XFRMA_MIGRATE] == NULL) + return -EINVAL; +@@ -2413,7 +2399,10 @@ static int xfrm_do_migrate(struct sk_buff *skb, struct nlmsghdr *nlh, + return 0; + } + +- err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap); ++ if (attrs[XFRMA_IF_ID]) ++ if_id = nla_get_u32(attrs[XFRMA_IF_ID]); ++ ++ err = xfrm_migrate(&pi->sel, pi->dir, type, m, n, kmp, net, encap, if_id); + + kfree(encap); + +diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c +index 9ba7feffe344b..9814a0a15ba78 100644 +--- a/tools/testing/selftests/vm/userfaultfd.c ++++ b/tools/testing/selftests/vm/userfaultfd.c +@@ -46,6 +46,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c +index 48fde38d64c37..2f5dc7fb437bd 100644 +--- a/virt/kvm/arm/psci.c ++++ b/virt/kvm/arm/psci.c +@@ -426,6 +426,18 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) + break; + } + break; ++ case ARM_SMCCC_ARCH_WORKAROUND_3: ++ switch (kvm_arm_get_spectre_bhb_state()) { ++ case SPECTRE_VULNERABLE: ++ break; ++ case SPECTRE_MITIGATED: ++ val = SMCCC_RET_SUCCESS; ++ break; ++ case SPECTRE_UNAFFECTED: ++ val = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; ++ break; ++ } ++ break; + } + break; + default: +@@ -438,7 +450,7 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) + + int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu) + { +- return 3; /* PSCI version and two workaround registers */ ++ return 4; /* PSCI version and three workaround registers */ + } + + int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) +@@ -452,6 +464,9 @@ int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) + if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2, uindices++)) + return -EFAULT; + ++ if (put_user(KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3, uindices++)) ++ return -EFAULT; ++ + return 0; + } + +@@ -486,9 +501,20 @@ static int get_kernel_wa_level(u64 regid) + return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_NOT_REQUIRED; + case KVM_SSBD_UNKNOWN: + default: +- return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; ++ break; + } +- } ++ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2_UNKNOWN; ++ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: ++ switch (kvm_arm_get_spectre_bhb_state()) { ++ case SPECTRE_VULNERABLE: ++ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL; ++ case SPECTRE_MITIGATED: ++ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_AVAIL; ++ case SPECTRE_UNAFFECTED: ++ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_REQUIRED; ++ } ++ return KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3_NOT_AVAIL; ++ } + + return -EINVAL; + } +@@ -503,6 +529,7 @@ int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + val = kvm_psci_version(vcpu, vcpu->kvm); + break; + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: ++ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: + val = get_kernel_wa_level(reg->id) & KVM_REG_FEATURE_LEVEL_MASK; + break; + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_2: +@@ -555,6 +582,7 @@ int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + } + + case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_1: ++ case KVM_REG_ARM_SMCCC_ARCH_WORKAROUND_3: + if (val & ~KVM_REG_FEATURE_LEVEL_MASK) + return -EINVAL; + diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch new file mode 100644 index 0000000000..fdb460d402 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.186-187.patch @@ -0,0 +1,511 @@ +diff --git a/Makefile b/Makefile +index f9054b4e8a123..d07421bc5c2fb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 186 ++SUBLEVEL = 187 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm64/include/asm/vectors.h b/arch/arm64/include/asm/vectors.h +index f64613a96d530..bc9a2145f4194 100644 +--- a/arch/arm64/include/asm/vectors.h ++++ b/arch/arm64/include/asm/vectors.h +@@ -56,14 +56,14 @@ enum arm64_bp_harden_el1_vectors { + DECLARE_PER_CPU_READ_MOSTLY(const char *, this_cpu_vector); + + #ifndef CONFIG_UNMAP_KERNEL_AT_EL0 +-#define TRAMP_VALIAS 0 ++#define TRAMP_VALIAS 0ul + #endif + + static inline const char * + arm64_get_bp_hardening_vector(enum arm64_bp_harden_el1_vectors slot) + { + if (arm64_kernel_unmapped_at_el0()) +- return (char *)TRAMP_VALIAS + SZ_2K * slot; ++ return (char *)(TRAMP_VALIAS + SZ_2K * slot); + + WARN_ON_ONCE(slot == EL1_VECTOR_KPTI); + +diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c +index de52428b8833d..4816db0553ef8 100644 +--- a/drivers/atm/eni.c ++++ b/drivers/atm/eni.c +@@ -1116,6 +1116,8 @@ DPRINTK("iovcnt = %d\n",skb_shinfo(skb)->nr_frags); + } + paddr = dma_map_single(&eni_dev->pci_dev->dev,skb->data,skb->len, + DMA_TO_DEVICE); ++ if (dma_mapping_error(&eni_dev->pci_dev->dev, paddr)) ++ return enq_next; + ENI_PRV_PADDR(skb) = paddr; + /* prepare DMA queue entries */ + j = 0; +diff --git a/drivers/crypto/qcom-rng.c b/drivers/crypto/qcom-rng.c +index 4730f84b646de..3a633a0c40fdf 100644 +--- a/drivers/crypto/qcom-rng.c ++++ b/drivers/crypto/qcom-rng.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -42,16 +43,19 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max) + { + unsigned int currsize = 0; + u32 val; ++ int ret; + + /* read random data from hardware */ + do { +- val = readl_relaxed(rng->base + PRNG_STATUS); +- if (!(val & PRNG_STATUS_DATA_AVAIL)) +- break; ++ ret = readl_poll_timeout(rng->base + PRNG_STATUS, val, ++ val & PRNG_STATUS_DATA_AVAIL, ++ 200, 10000); ++ if (ret) ++ return ret; + + val = readl_relaxed(rng->base + PRNG_DATA_OUT); + if (!val) +- break; ++ return -EINVAL; + + if ((max - currsize) >= WORD_SZ) { + memcpy(data, &val, WORD_SZ); +@@ -60,11 +64,10 @@ static int qcom_rng_read(struct qcom_rng *rng, u8 *data, unsigned int max) + } else { + /* copy only remaining bytes */ + memcpy(data, &val, max - currsize); +- break; + } + } while (currsize < max); + +- return currsize; ++ return 0; + } + + static int qcom_rng_generate(struct crypto_rng *tfm, +@@ -86,7 +89,7 @@ static int qcom_rng_generate(struct crypto_rng *tfm, + mutex_unlock(&rng->lock); + clk_disable_unprepare(rng->clk); + +- return 0; ++ return ret; + } + + static int qcom_rng_seed(struct crypto_rng *tfm, const u8 *seed, +diff --git a/drivers/firmware/efi/apple-properties.c b/drivers/firmware/efi/apple-properties.c +index 0e206c9e0d7ae..7ad2d85d7270b 100644 +--- a/drivers/firmware/efi/apple-properties.c ++++ b/drivers/firmware/efi/apple-properties.c +@@ -23,7 +23,7 @@ static bool dump_properties __initdata; + static int __init dump_properties_enable(char *arg) + { + dump_properties = true; +- return 0; ++ return 1; + } + + __setup("dump_apple_properties", dump_properties_enable); +diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c +index 415d7b3a59f82..8fd74a7501d40 100644 +--- a/drivers/firmware/efi/efi.c ++++ b/drivers/firmware/efi/efi.c +@@ -231,7 +231,7 @@ static int __init efivar_ssdt_setup(char *str) + memcpy(efivar_ssdt, str, strlen(str)); + else + pr_warn("efivar_ssdt: name too long: %s\n", str); +- return 0; ++ return 1; + } + __setup("efivar_ssdt=", efivar_ssdt_setup); + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index f0ea782df836d..312a3c4e23318 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1619,7 +1619,7 @@ static const struct display_timing innolux_g070y2_l01_timing = { + static const struct panel_desc innolux_g070y2_l01 = { + .timings = &innolux_g070y2_l01_timing, + .num_timings = 1, +- .bpc = 6, ++ .bpc = 8, + .size = { + .width = 152, + .height = 91, +diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c +index 06d0ffef4a171..acaf8c045f19a 100644 +--- a/drivers/input/tablet/aiptek.c ++++ b/drivers/input/tablet/aiptek.c +@@ -1801,15 +1801,13 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) + input_set_abs_params(inputdev, ABS_TILT_Y, AIPTEK_TILT_MIN, AIPTEK_TILT_MAX, 0, 0); + input_set_abs_params(inputdev, ABS_WHEEL, AIPTEK_WHEEL_MIN, AIPTEK_WHEEL_MAX - 1, 0, 0); + +- /* Verify that a device really has an endpoint */ +- if (intf->cur_altsetting->desc.bNumEndpoints < 1) { ++ err = usb_find_common_endpoints(intf->cur_altsetting, ++ NULL, NULL, &endpoint, NULL); ++ if (err) { + dev_err(&intf->dev, +- "interface has %d endpoints, but must have minimum 1\n", +- intf->cur_altsetting->desc.bNumEndpoints); +- err = -EINVAL; ++ "interface has no int in endpoints, but must have minimum 1\n"); + goto fail3; + } +- endpoint = &intf->cur_altsetting->endpoint[0].desc; + + /* Go set up our URB, which is called when the tablet receives + * input. +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 362b7ca6f3b2a..57e92c5bfcc92 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1445,6 +1445,9 @@ static void netvsc_get_ethtool_stats(struct net_device *dev, + pcpu_sum = kvmalloc_array(num_possible_cpus(), + sizeof(struct netvsc_ethtool_pcpu_stats), + GFP_KERNEL); ++ if (!pcpu_sum) ++ return; ++ + netvsc_get_pcpu_stats(dev, pcpu_sum); + for_each_present_cpu(cpu) { + struct netvsc_ethtool_pcpu_stats *this_sum = &pcpu_sum[cpu]; +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 53420c5312667..49801c2eb6271 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1408,8 +1408,8 @@ static int marvell_suspend(struct phy_device *phydev) + int err; + + /* Suspend the fiber mode first */ +- if (!linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, +- phydev->supported)) { ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, ++ phydev->supported)) { + err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE); + if (err < 0) + goto error; +@@ -1443,8 +1443,8 @@ static int marvell_resume(struct phy_device *phydev) + int err; + + /* Resume the fiber mode first */ +- if (!linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, +- phydev->supported)) { ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, ++ phydev->supported)) { + err = marvell_set_page(phydev, MII_MARVELL_FIBER_PAGE); + if (err < 0) + goto error; +diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c +index 3922a6f8c50a6..77b1802f829b3 100644 +--- a/drivers/usb/class/usbtmc.c ++++ b/drivers/usb/class/usbtmc.c +@@ -1889,6 +1889,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + struct usbtmc_ctrlrequest request; + u8 *buffer = NULL; + int rv; ++ unsigned int is_in, pipe; + unsigned long res; + + res = copy_from_user(&request, arg, sizeof(struct usbtmc_ctrlrequest)); +@@ -1898,12 +1899,14 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + if (request.req.wLength > USBTMC_BUFSIZE) + return -EMSGSIZE; + ++ is_in = request.req.bRequestType & USB_DIR_IN; ++ + if (request.req.wLength) { + buffer = kmalloc(request.req.wLength, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +- if ((request.req.bRequestType & USB_DIR_IN) == 0) { ++ if (!is_in) { + /* Send control data to device */ + res = copy_from_user(buffer, request.data, + request.req.wLength); +@@ -1914,8 +1917,12 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + } + } + ++ if (is_in) ++ pipe = usb_rcvctrlpipe(data->usb_dev, 0); ++ else ++ pipe = usb_sndctrlpipe(data->usb_dev, 0); + rv = usb_control_msg(data->usb_dev, +- usb_rcvctrlpipe(data->usb_dev, 0), ++ pipe, + request.req.bRequest, + request.req.bRequestType, + request.req.wValue, +@@ -1927,7 +1934,7 @@ static int usbtmc_ioctl_request(struct usbtmc_device_data *data, + goto exit; + } + +- if (rv && (request.req.bRequestType & USB_DIR_IN)) { ++ if (rv && is_in) { + /* Read control data from device */ + res = copy_to_user(request.data, buffer, rv); + if (res) +diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c +index 970ed1514f0bc..fa0c173a0d26f 100644 +--- a/drivers/usb/gadget/function/rndis.c ++++ b/drivers/usb/gadget/function/rndis.c +@@ -640,6 +640,7 @@ static int rndis_set_response(struct rndis_params *params, + BufLength = le32_to_cpu(buf->InformationBufferLength); + BufOffset = le32_to_cpu(buf->InformationBufferOffset); + if ((BufLength > RNDIS_MAX_TOTAL_SIZE) || ++ (BufOffset > RNDIS_MAX_TOTAL_SIZE) || + (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE)) + return -EINVAL; + +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index e41f67cd3d469..f9d2737aabe82 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -1303,7 +1303,6 @@ static void usb_gadget_remove_driver(struct usb_udc *udc) + usb_gadget_udc_stop(udc); + + udc->driver = NULL; +- udc->dev.driver = NULL; + udc->gadget->dev.driver = NULL; + } + +@@ -1352,7 +1351,6 @@ static int udc_bind_to_driver(struct usb_udc *udc, struct usb_gadget_driver *dri + driver->function); + + udc->driver = driver; +- udc->dev.driver = &driver->driver; + udc->gadget->dev.driver = &driver->driver; + + usb_gadget_udc_set_speed(udc, driver->max_speed); +@@ -1374,7 +1372,6 @@ err1: + dev_err(&udc->dev, "failed to start %s: %d\n", + udc->driver->function, ret); + udc->driver = NULL; +- udc->dev.driver = NULL; + udc->gadget->dev.driver = NULL; + return ret; + } +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c +index eaec97892dce8..c1cf67b24c19b 100644 +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -1100,17 +1100,6 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent) + goto read_super_error; + } + +- root = d_make_root(inode); +- if (!root) { +- status = -ENOMEM; +- mlog_errno(status); +- goto read_super_error; +- } +- +- sb->s_root = root; +- +- ocfs2_complete_mount_recovery(osb); +- + osb->osb_dev_kset = kset_create_and_add(sb->s_id, NULL, + &ocfs2_kset->kobj); + if (!osb->osb_dev_kset) { +@@ -1128,6 +1117,17 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent) + goto read_super_error; + } + ++ root = d_make_root(inode); ++ if (!root) { ++ status = -ENOMEM; ++ mlog_errno(status); ++ goto read_super_error; ++ } ++ ++ sb->s_root = root; ++ ++ ocfs2_complete_mount_recovery(osb); ++ + if (ocfs2_mount_local(osb)) + snprintf(nodestr, sizeof(nodestr), "local"); + else +diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h +index bf5c5f32c65e4..e147ea6794670 100644 +--- a/include/linux/if_arp.h ++++ b/include/linux/if_arp.h +@@ -51,6 +51,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) + case ARPHRD_VOID: + case ARPHRD_NONE: + case ARPHRD_RAWIP: ++ case ARPHRD_PIMREG: + return false; + default: + return true; +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index 70e6fc2edd304..1f27641f9cc07 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -669,6 +669,7 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) + struct net_device *master; + + master = of_find_net_device_by_node(ethernet); ++ of_node_put(ethernet); + if (!master) + return -EPROBE_DEFER; + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index ed11013d4b953..70c102359bfef 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2257,8 +2257,11 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + copy_skb = skb_get(skb); + skb_head = skb->data; + } +- if (copy_skb) ++ if (copy_skb) { ++ memset(&PACKET_SKB_CB(copy_skb)->sa.ll, 0, ++ sizeof(PACKET_SKB_CB(copy_skb)->sa.ll)); + skb_set_owner_r(copy_skb, sk); ++ } + } + snaplen = po->rx_ring.frame_size - macoff; + if ((int)snaplen < 0) { +@@ -3405,6 +3408,8 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + sock_recv_ts_and_drops(msg, sk, skb); + + if (msg->msg_name) { ++ const size_t max_len = min(sizeof(skb->cb), ++ sizeof(struct sockaddr_storage)); + int copy_len; + + /* If the address length field is there to be filled +@@ -3427,6 +3432,10 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + msg->msg_namelen = sizeof(struct sockaddr_ll); + } + } ++ if (WARN_ON_ONCE(copy_len > max_len)) { ++ copy_len = max_len; ++ msg->msg_namelen = copy_len; ++ } + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 901ad7f6f4dcc..ea2c7beff4868 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -231,7 +231,7 @@ void symbols__fixup_end(struct rb_root_cached *symbols) + prev = curr; + curr = rb_entry(nd, struct symbol, rb_node); + +- if (prev->end == prev->start && prev->end != curr->start) ++ if (prev->end == prev->start || prev->end != curr->start) + arch__symbols__fixup_end(prev, curr); + } + +diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c +deleted file mode 100644 +index f74b82305da8c..0000000000000 +--- a/tools/testing/selftests/bpf/prog_tests/timer_crash.c ++++ /dev/null +@@ -1,32 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +-#include +-#include "timer_crash.skel.h" +- +-enum { +- MODE_ARRAY, +- MODE_HASH, +-}; +- +-static void test_timer_crash_mode(int mode) +-{ +- struct timer_crash *skel; +- +- skel = timer_crash__open_and_load(); +- if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load")) +- return; +- skel->bss->pid = getpid(); +- skel->bss->crash_map = mode; +- if (!ASSERT_OK(timer_crash__attach(skel), "timer_crash__attach")) +- goto end; +- usleep(1); +-end: +- timer_crash__destroy(skel); +-} +- +-void test_timer_crash(void) +-{ +- if (test__start_subtest("array")) +- test_timer_crash_mode(MODE_ARRAY); +- if (test__start_subtest("hash")) +- test_timer_crash_mode(MODE_HASH); +-} +diff --git a/tools/testing/selftests/bpf/progs/timer_crash.c b/tools/testing/selftests/bpf/progs/timer_crash.c +deleted file mode 100644 +index f8f7944e70dae..0000000000000 +--- a/tools/testing/selftests/bpf/progs/timer_crash.c ++++ /dev/null +@@ -1,54 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0 +- +-#include +-#include +-#include +- +-struct map_elem { +- struct bpf_timer timer; +- struct bpf_spin_lock lock; +-}; +- +-struct { +- __uint(type, BPF_MAP_TYPE_ARRAY); +- __uint(max_entries, 1); +- __type(key, int); +- __type(value, struct map_elem); +-} amap SEC(".maps"); +- +-struct { +- __uint(type, BPF_MAP_TYPE_HASH); +- __uint(max_entries, 1); +- __type(key, int); +- __type(value, struct map_elem); +-} hmap SEC(".maps"); +- +-int pid = 0; +-int crash_map = 0; /* 0 for amap, 1 for hmap */ +- +-SEC("fentry/do_nanosleep") +-int sys_enter(void *ctx) +-{ +- struct map_elem *e, value = {}; +- void *map = crash_map ? (void *)&hmap : (void *)&amap; +- +- if (bpf_get_current_task_btf()->tgid != pid) +- return 0; +- +- *(void **)&value = (void *)0xdeadcaf3; +- +- bpf_map_update_elem(map, &(int){0}, &value, 0); +- /* For array map, doing bpf_map_update_elem will do a +- * check_and_free_timer_in_array, which will trigger the crash if timer +- * pointer was overwritten, for hmap we need to use bpf_timer_cancel. +- */ +- if (crash_map == 1) { +- e = bpf_map_lookup_elem(map, &(int){0}); +- if (!e) +- return 0; +- bpf_timer_cancel(&e->timer); +- } +- return 0; +-} +- +-char _license[] SEC("license") = "GPL"; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch new file mode 100644 index 0000000000..43de307110 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.187-188.patch @@ -0,0 +1,1264 @@ +diff --git a/Makefile b/Makefile +index d07421bc5c2fb..8684857148066 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 187 ++SUBLEVEL = 188 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/nds32/include/asm/uaccess.h b/arch/nds32/include/asm/uaccess.h +index 8916ad9f9f139..e205b1db8c807 100644 +--- a/arch/nds32/include/asm/uaccess.h ++++ b/arch/nds32/include/asm/uaccess.h +@@ -71,9 +71,7 @@ static inline void set_fs(mm_segment_t fs) + * versions are void (ie, don't return a value as such). + */ + +-#define get_user __get_user \ +- +-#define __get_user(x, ptr) \ ++#define get_user(x, ptr) \ + ({ \ + long __gu_err = 0; \ + __get_user_check((x), (ptr), __gu_err); \ +@@ -86,6 +84,14 @@ static inline void set_fs(mm_segment_t fs) + (void)0; \ + }) + ++#define __get_user(x, ptr) \ ++({ \ ++ long __gu_err = 0; \ ++ const __typeof__(*(ptr)) __user *__p = (ptr); \ ++ __get_user_err((x), __p, (__gu_err)); \ ++ __gu_err; \ ++}) ++ + #define __get_user_check(x, ptr, err) \ + ({ \ + const __typeof__(*(ptr)) __user *__p = (ptr); \ +@@ -166,12 +172,18 @@ do { \ + : "r"(addr), "i"(-EFAULT) \ + : "cc") + +-#define put_user __put_user \ ++#define put_user(x, ptr) \ ++({ \ ++ long __pu_err = 0; \ ++ __put_user_check((x), (ptr), __pu_err); \ ++ __pu_err; \ ++}) + + #define __put_user(x, ptr) \ + ({ \ + long __pu_err = 0; \ +- __put_user_err((x), (ptr), __pu_err); \ ++ __typeof__(*(ptr)) __user *__p = (ptr); \ ++ __put_user_err((x), __p, __pu_err); \ + __pu_err; \ + }) + +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 4137a7342d687..7b75658b7e9ac 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -1339,6 +1339,17 @@ static int __init disable_acpi_pci(const struct dmi_system_id *d) + return 0; + } + ++static int __init disable_acpi_xsdt(const struct dmi_system_id *d) ++{ ++ if (!acpi_force) { ++ pr_notice("%s detected: force use of acpi=rsdt\n", d->ident); ++ acpi_gbl_do_not_use_xsdt = TRUE; ++ } else { ++ pr_notice("Warning: DMI blacklist says broken, but acpi XSDT forced\n"); ++ } ++ return 0; ++} ++ + static int __init dmi_disable_acpi(const struct dmi_system_id *d) + { + if (!acpi_force) { +@@ -1463,6 +1474,19 @@ static const struct dmi_system_id acpi_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"), + }, + }, ++ /* ++ * Boxes that need ACPI XSDT use disabled due to corrupted tables ++ */ ++ { ++ .callback = disable_acpi_xsdt, ++ .ident = "Advantech DAC-BJ01", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "NEC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Bearlake CRB Board"), ++ DMI_MATCH(DMI_BIOS_VERSION, "V1.12"), ++ DMI_MATCH(DMI_BIOS_DATE, "02/01/2011"), ++ }, ++ }, + {} + }; + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 4e0aea5f008e3..974c2df13da1d 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -77,6 +77,10 @@ extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir); + + static const struct acpi_device_id battery_device_ids[] = { + {"PNP0C0A", 0}, ++ ++ /* Microsoft Surface Go 3 */ ++ {"MSHW0146", 0}, ++ + {"", 0}, + }; + +@@ -1403,6 +1407,14 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), + }, + }, ++ { ++ /* Microsoft Surface Go 3 */ ++ .callback = battery_notification_delay_quirk, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Microsoft Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Surface Go 3"), ++ }, ++ }, + {}, + }; + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index e7978d983b263..de4142723ff48 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -372,6 +372,81 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "BA51_MV"), + }, + }, ++ /* ++ * Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2 have both a ++ * working native and video interface. However the default detection ++ * mechanism first registers the video interface before unregistering ++ * it again and switching to the native interface during boot. This ++ * results in a dangling SBIOS request for backlight change for some ++ * reason, causing the backlight to switch to ~2% once per boot on the ++ * first power cord connect or disconnect event. Setting the native ++ * interface explicitly circumvents this buggy behaviour, by avoiding ++ * the unregistering process. ++ */ ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xRU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SchenkerTechnologiesGmbH"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "Clevo NL5xNU", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), ++ }, ++ }, + + /* + * Desktops which falsely report a backlight and which our heuristics +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index 1784530b8387b..b99e1941c52c9 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -70,7 +70,13 @@ static void tpm_dev_async_work(struct work_struct *work) + ret = tpm_dev_transmit(priv->chip, priv->space, priv->data_buffer, + sizeof(priv->data_buffer)); + tpm_put_ops(priv->chip); +- if (ret > 0) { ++ ++ /* ++ * If ret is > 0 then tpm_dev_transmit returned the size of the ++ * response. If ret is < 0 then tpm_dev_transmit failed and ++ * returned an error code. ++ */ ++ if (ret != 0) { + priv->response_length = ret; + mod_timer(&priv->user_read_timer, jiffies + (120 * HZ)); + } +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 97e916856cf3e..d2225020e4d2c 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -58,12 +58,12 @@ int tpm2_init_space(struct tpm_space *space, unsigned int buf_size) + + void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space) + { +- mutex_lock(&chip->tpm_mutex); +- if (!tpm_chip_start(chip)) { ++ ++ if (tpm_try_get_ops(chip) == 0) { + tpm2_flush_sessions(chip, space); +- tpm_chip_stop(chip); ++ tpm_put_ops(chip); + } +- mutex_unlock(&chip->tpm_mutex); ++ + kfree(space->context_buf); + kfree(space->session_buf); + } +diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c +index 3852d31ce0a4b..37a9f969c59cd 100644 +--- a/drivers/crypto/qat/qat_common/qat_crypto.c ++++ b/drivers/crypto/qat/qat_common/qat_crypto.c +@@ -170,6 +170,14 @@ int qat_crypto_dev_config(struct adf_accel_dev *accel_dev) + goto err; + if (adf_cfg_section_add(accel_dev, "Accelerator0")) + goto err; ++ ++ /* Temporarily set the number of crypto instances to zero to avoid ++ * registering the crypto algorithms. ++ * This will be removed when the algorithms will support the ++ * CRYPTO_TFM_REQ_MAY_BACKLOG flag ++ */ ++ instances = 0; ++ + for (i = 0; i < instances; i++) { + val = i; + snprintf(key, sizeof(key), ADF_CY "%d" ADF_RING_BANK_NUM, i); +diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +index cc8031ae9aa3f..ce4e617a6ec49 100644 +--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c ++++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c +@@ -696,6 +696,12 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + buf_pool->rx_skb[skb_index] = NULL; + + datalen = xgene_enet_get_data_len(le64_to_cpu(raw_desc->m1)); ++ ++ /* strip off CRC as HW isn't doing this */ ++ nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); ++ if (!nv) ++ datalen -= 4; ++ + skb_put(skb, datalen); + prefetch(skb->data - NET_IP_ALIGN); + skb->protocol = eth_type_trans(skb, ndev); +@@ -717,12 +723,8 @@ static int xgene_enet_rx_frame(struct xgene_enet_desc_ring *rx_ring, + } + } + +- nv = GET_VAL(NV, le64_to_cpu(raw_desc->m0)); +- if (!nv) { +- /* strip off CRC as HW isn't doing this */ +- datalen -= 4; ++ if (!nv) + goto skip_jumbo; +- } + + slots = page_pool->slots - 1; + head = page_pool->head; +diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c +index 6586378cacb05..a7ab6dab0f32d 100644 +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -321,6 +321,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, + return -ENOMEM; + + transaction->aid_len = skb->data[1]; ++ ++ /* Checking if the length of the AID is valid */ ++ if (transaction->aid_len > sizeof(transaction->aid)) ++ return -EINVAL; ++ + memcpy(transaction->aid, &skb->data[2], + transaction->aid_len); + +@@ -330,6 +335,11 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, + return -EPROTO; + + transaction->params_len = skb->data[transaction->aid_len + 3]; ++ ++ /* Total size is allocated (skb->len - 2) minus fixed array members */ ++ if (transaction->params_len > ((skb->len - 2) - sizeof(struct nfc_evt_transaction))) ++ return -EINVAL; ++ + memcpy(transaction->params, skb->data + + transaction->aid_len + 4, transaction->params_len); + +diff --git a/drivers/staging/fbtft/fb_st7789v.c b/drivers/staging/fbtft/fb_st7789v.c +index 3c3f387936e80..30086ae03605f 100644 +--- a/drivers/staging/fbtft/fb_st7789v.c ++++ b/drivers/staging/fbtft/fb_st7789v.c +@@ -76,6 +76,8 @@ enum st7789v_command { + */ + static int init_display(struct fbtft_par *par) + { ++ par->fbtftops.reset(par); ++ + /* turn off sleep mode */ + write_reg(par, MIPI_DCS_EXIT_SLEEP_MODE); + mdelay(120); +diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +index 3517883b5cdb9..a31163547fbaa 100644 +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -216,6 +216,10 @@ static void int3400_notify(acpi_handle handle, + thermal_prop[4] = NULL; + kobject_uevent_env(&priv->thermal->device.kobj, KOBJ_CHANGE, + thermal_prop); ++ kfree(thermal_prop[0]); ++ kfree(thermal_prop[1]); ++ kfree(thermal_prop[2]); ++ kfree(thermal_prop[3]); + break; + default: + /* Ignore unknown notification codes sent to INT3400 device */ +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index 662937472e9bd..79ad6b2c96082 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -44,6 +44,17 @@ struct nfsd_fcache_bucket { + + static DEFINE_PER_CPU(unsigned long, nfsd_file_cache_hits); + ++struct nfsd_fcache_disposal { ++ struct list_head list; ++ struct work_struct work; ++ struct net *net; ++ spinlock_t lock; ++ struct list_head freeme; ++ struct rcu_head rcu; ++}; ++ ++struct workqueue_struct *nfsd_filecache_wq __read_mostly; ++ + static struct kmem_cache *nfsd_file_slab; + static struct kmem_cache *nfsd_file_mark_slab; + static struct nfsd_fcache_bucket *nfsd_file_hashtbl; +@@ -52,32 +63,21 @@ static long nfsd_file_lru_flags; + static struct fsnotify_group *nfsd_file_fsnotify_group; + static atomic_long_t nfsd_filecache_count; + static struct delayed_work nfsd_filecache_laundrette; ++static DEFINE_SPINLOCK(laundrette_lock); ++static LIST_HEAD(laundrettes); + +-enum nfsd_file_laundrette_ctl { +- NFSD_FILE_LAUNDRETTE_NOFLUSH = 0, +- NFSD_FILE_LAUNDRETTE_MAY_FLUSH +-}; ++static void nfsd_file_gc(void); + + static void +-nfsd_file_schedule_laundrette(enum nfsd_file_laundrette_ctl ctl) ++nfsd_file_schedule_laundrette(void) + { + long count = atomic_long_read(&nfsd_filecache_count); + + if (count == 0 || test_bit(NFSD_FILE_SHUTDOWN, &nfsd_file_lru_flags)) + return; + +- /* Be more aggressive about scanning if over the threshold */ +- if (count > NFSD_FILE_LRU_THRESHOLD) +- mod_delayed_work(system_wq, &nfsd_filecache_laundrette, 0); +- else +- schedule_delayed_work(&nfsd_filecache_laundrette, NFSD_LAUNDRETTE_DELAY); +- +- if (ctl == NFSD_FILE_LAUNDRETTE_NOFLUSH) +- return; +- +- /* ...and don't delay flushing if we're out of control */ +- if (count >= NFSD_FILE_LRU_LIMIT) +- flush_delayed_work(&nfsd_filecache_laundrette); ++ queue_delayed_work(system_wq, &nfsd_filecache_laundrette, ++ NFSD_LAUNDRETTE_DELAY); + } + + static void +@@ -260,8 +260,6 @@ nfsd_file_do_unhash(struct nfsd_file *nf) + nfsd_reset_boot_verifier(net_generic(nf->nf_net, nfsd_net_id)); + --nfsd_file_hashtbl[nf->nf_hashval].nfb_count; + hlist_del_rcu(&nf->nf_node); +- if (!list_empty(&nf->nf_lru)) +- list_lru_del(&nfsd_file_lru, &nf->nf_lru); + atomic_long_dec(&nfsd_filecache_count); + } + +@@ -270,6 +268,8 @@ nfsd_file_unhash(struct nfsd_file *nf) + { + if (test_and_clear_bit(NFSD_FILE_HASHED, &nf->nf_flags)) { + nfsd_file_do_unhash(nf); ++ if (!list_empty(&nf->nf_lru)) ++ list_lru_del(&nfsd_file_lru, &nf->nf_lru); + return true; + } + return false; +@@ -316,7 +316,9 @@ nfsd_file_put(struct nfsd_file *nf) + + set_bit(NFSD_FILE_REFERENCED, &nf->nf_flags); + if (nfsd_file_put_noref(nf) == 1 && is_hashed && unused) +- nfsd_file_schedule_laundrette(NFSD_FILE_LAUNDRETTE_MAY_FLUSH); ++ nfsd_file_schedule_laundrette(); ++ if (atomic_long_read(&nfsd_filecache_count) >= NFSD_FILE_LRU_LIMIT) ++ nfsd_file_gc(); + } + + struct nfsd_file * +@@ -357,6 +359,58 @@ nfsd_file_dispose_list_sync(struct list_head *dispose) + flush_delayed_fput(); + } + ++static void ++nfsd_file_list_remove_disposal(struct list_head *dst, ++ struct nfsd_fcache_disposal *l) ++{ ++ spin_lock(&l->lock); ++ list_splice_init(&l->freeme, dst); ++ spin_unlock(&l->lock); ++} ++ ++static void ++nfsd_file_list_add_disposal(struct list_head *files, struct net *net) ++{ ++ struct nfsd_fcache_disposal *l; ++ ++ rcu_read_lock(); ++ list_for_each_entry_rcu(l, &laundrettes, list) { ++ if (l->net == net) { ++ spin_lock(&l->lock); ++ list_splice_tail_init(files, &l->freeme); ++ spin_unlock(&l->lock); ++ queue_work(nfsd_filecache_wq, &l->work); ++ break; ++ } ++ } ++ rcu_read_unlock(); ++} ++ ++static void ++nfsd_file_list_add_pernet(struct list_head *dst, struct list_head *src, ++ struct net *net) ++{ ++ struct nfsd_file *nf, *tmp; ++ ++ list_for_each_entry_safe(nf, tmp, src, nf_lru) { ++ if (nf->nf_net == net) ++ list_move_tail(&nf->nf_lru, dst); ++ } ++} ++ ++static void ++nfsd_file_dispose_list_delayed(struct list_head *dispose) ++{ ++ LIST_HEAD(list); ++ struct nfsd_file *nf; ++ ++ while(!list_empty(dispose)) { ++ nf = list_first_entry(dispose, struct nfsd_file, nf_lru); ++ nfsd_file_list_add_pernet(&list, dispose, nf->nf_net); ++ nfsd_file_list_add_disposal(&list, nf->nf_net); ++ } ++} ++ + /* + * Note this can deadlock with nfsd_file_cache_purge. + */ +@@ -403,18 +457,40 @@ out_skip: + return LRU_SKIP; + } + +-static void +-nfsd_file_lru_dispose(struct list_head *head) ++static unsigned long ++nfsd_file_lru_walk_list(struct shrink_control *sc) + { +- while(!list_empty(head)) { +- struct nfsd_file *nf = list_first_entry(head, +- struct nfsd_file, nf_lru); +- list_del_init(&nf->nf_lru); ++ LIST_HEAD(head); ++ struct nfsd_file *nf; ++ unsigned long ret; ++ ++ if (sc) ++ ret = list_lru_shrink_walk(&nfsd_file_lru, sc, ++ nfsd_file_lru_cb, &head); ++ else ++ ret = list_lru_walk(&nfsd_file_lru, ++ nfsd_file_lru_cb, ++ &head, LONG_MAX); ++ list_for_each_entry(nf, &head, nf_lru) { + spin_lock(&nfsd_file_hashtbl[nf->nf_hashval].nfb_lock); + nfsd_file_do_unhash(nf); + spin_unlock(&nfsd_file_hashtbl[nf->nf_hashval].nfb_lock); +- nfsd_file_put_noref(nf); + } ++ nfsd_file_dispose_list_delayed(&head); ++ return ret; ++} ++ ++static void ++nfsd_file_gc(void) ++{ ++ nfsd_file_lru_walk_list(NULL); ++} ++ ++static void ++nfsd_file_gc_worker(struct work_struct *work) ++{ ++ nfsd_file_gc(); ++ nfsd_file_schedule_laundrette(); + } + + static unsigned long +@@ -426,12 +502,7 @@ nfsd_file_lru_count(struct shrinker *s, struct shrink_control *sc) + static unsigned long + nfsd_file_lru_scan(struct shrinker *s, struct shrink_control *sc) + { +- LIST_HEAD(head); +- unsigned long ret; +- +- ret = list_lru_shrink_walk(&nfsd_file_lru, sc, nfsd_file_lru_cb, &head); +- nfsd_file_lru_dispose(&head); +- return ret; ++ return nfsd_file_lru_walk_list(sc); + } + + static struct shrinker nfsd_file_shrinker = { +@@ -493,7 +564,7 @@ nfsd_file_close_inode(struct inode *inode) + + __nfsd_file_close_inode(inode, hashval, &dispose); + trace_nfsd_file_close_inode(inode, hashval, !list_empty(&dispose)); +- nfsd_file_dispose_list(&dispose); ++ nfsd_file_dispose_list_delayed(&dispose); + } + + /** +@@ -509,16 +580,11 @@ static void + nfsd_file_delayed_close(struct work_struct *work) + { + LIST_HEAD(head); ++ struct nfsd_fcache_disposal *l = container_of(work, ++ struct nfsd_fcache_disposal, work); + +- list_lru_walk(&nfsd_file_lru, nfsd_file_lru_cb, &head, LONG_MAX); +- +- if (test_and_clear_bit(NFSD_FILE_LRU_RESCAN, &nfsd_file_lru_flags)) +- nfsd_file_schedule_laundrette(NFSD_FILE_LAUNDRETTE_NOFLUSH); +- +- if (!list_empty(&head)) { +- nfsd_file_lru_dispose(&head); +- flush_delayed_fput(); +- } ++ nfsd_file_list_remove_disposal(&head, l); ++ nfsd_file_dispose_list(&head); + } + + static int +@@ -579,6 +645,10 @@ nfsd_file_cache_init(void) + if (nfsd_file_hashtbl) + return 0; + ++ nfsd_filecache_wq = alloc_workqueue("nfsd_filecache", 0, 0); ++ if (!nfsd_filecache_wq) ++ goto out; ++ + nfsd_file_hashtbl = kcalloc(NFSD_FILE_HASH_SIZE, + sizeof(*nfsd_file_hashtbl), GFP_KERNEL); + if (!nfsd_file_hashtbl) { +@@ -632,7 +702,7 @@ nfsd_file_cache_init(void) + spin_lock_init(&nfsd_file_hashtbl[i].nfb_lock); + } + +- INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_delayed_close); ++ INIT_DELAYED_WORK(&nfsd_filecache_laundrette, nfsd_file_gc_worker); + out: + return ret; + out_notifier: +@@ -648,6 +718,8 @@ out_err: + nfsd_file_mark_slab = NULL; + kfree(nfsd_file_hashtbl); + nfsd_file_hashtbl = NULL; ++ destroy_workqueue(nfsd_filecache_wq); ++ nfsd_filecache_wq = NULL; + goto out; + } + +@@ -686,6 +758,88 @@ nfsd_file_cache_purge(struct net *net) + } + } + ++static struct nfsd_fcache_disposal * ++nfsd_alloc_fcache_disposal(struct net *net) ++{ ++ struct nfsd_fcache_disposal *l; ++ ++ l = kmalloc(sizeof(*l), GFP_KERNEL); ++ if (!l) ++ return NULL; ++ INIT_WORK(&l->work, nfsd_file_delayed_close); ++ l->net = net; ++ spin_lock_init(&l->lock); ++ INIT_LIST_HEAD(&l->freeme); ++ return l; ++} ++ ++static void ++nfsd_free_fcache_disposal(struct nfsd_fcache_disposal *l) ++{ ++ rcu_assign_pointer(l->net, NULL); ++ cancel_work_sync(&l->work); ++ nfsd_file_dispose_list(&l->freeme); ++ kfree_rcu(l, rcu); ++} ++ ++static void ++nfsd_add_fcache_disposal(struct nfsd_fcache_disposal *l) ++{ ++ spin_lock(&laundrette_lock); ++ list_add_tail_rcu(&l->list, &laundrettes); ++ spin_unlock(&laundrette_lock); ++} ++ ++static void ++nfsd_del_fcache_disposal(struct nfsd_fcache_disposal *l) ++{ ++ spin_lock(&laundrette_lock); ++ list_del_rcu(&l->list); ++ spin_unlock(&laundrette_lock); ++} ++ ++static int ++nfsd_alloc_fcache_disposal_net(struct net *net) ++{ ++ struct nfsd_fcache_disposal *l; ++ ++ l = nfsd_alloc_fcache_disposal(net); ++ if (!l) ++ return -ENOMEM; ++ nfsd_add_fcache_disposal(l); ++ return 0; ++} ++ ++static void ++nfsd_free_fcache_disposal_net(struct net *net) ++{ ++ struct nfsd_fcache_disposal *l; ++ ++ rcu_read_lock(); ++ list_for_each_entry_rcu(l, &laundrettes, list) { ++ if (l->net != net) ++ continue; ++ nfsd_del_fcache_disposal(l); ++ rcu_read_unlock(); ++ nfsd_free_fcache_disposal(l); ++ return; ++ } ++ rcu_read_unlock(); ++} ++ ++int ++nfsd_file_cache_start_net(struct net *net) ++{ ++ return nfsd_alloc_fcache_disposal_net(net); ++} ++ ++void ++nfsd_file_cache_shutdown_net(struct net *net) ++{ ++ nfsd_file_cache_purge(net); ++ nfsd_free_fcache_disposal_net(net); ++} ++ + void + nfsd_file_cache_shutdown(void) + { +@@ -712,6 +866,8 @@ nfsd_file_cache_shutdown(void) + nfsd_file_mark_slab = NULL; + kfree(nfsd_file_hashtbl); + nfsd_file_hashtbl = NULL; ++ destroy_workqueue(nfsd_filecache_wq); ++ nfsd_filecache_wq = NULL; + } + + static bool +@@ -881,7 +1037,8 @@ open_file: + nfsd_file_hashtbl[hashval].nfb_maxcount = max(nfsd_file_hashtbl[hashval].nfb_maxcount, + nfsd_file_hashtbl[hashval].nfb_count); + spin_unlock(&nfsd_file_hashtbl[hashval].nfb_lock); +- atomic_long_inc(&nfsd_filecache_count); ++ if (atomic_long_inc_return(&nfsd_filecache_count) >= NFSD_FILE_LRU_THRESHOLD) ++ nfsd_file_gc(); + + nf->nf_mark = nfsd_file_mark_find_or_create(nf); + if (nf->nf_mark) +diff --git a/fs/nfsd/filecache.h b/fs/nfsd/filecache.h +index 851d9abf54c25..79a7d6808d979 100644 +--- a/fs/nfsd/filecache.h ++++ b/fs/nfsd/filecache.h +@@ -51,6 +51,8 @@ struct nfsd_file { + int nfsd_file_cache_init(void); + void nfsd_file_cache_purge(struct net *); + void nfsd_file_cache_shutdown(void); ++int nfsd_file_cache_start_net(struct net *net); ++void nfsd_file_cache_shutdown_net(struct net *net); + void nfsd_file_put(struct nfsd_file *nf); + struct nfsd_file *nfsd_file_get(struct nfsd_file *nf); + void nfsd_file_close_inode_sync(struct inode *inode); +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index 155a4e43b24ee..d63cdda1782d4 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -394,13 +394,18 @@ static int nfsd_startup_net(int nrservs, struct net *net, const struct cred *cre + nn->lockd_up = 1; + } + +- ret = nfs4_state_start_net(net); ++ ret = nfsd_file_cache_start_net(net); + if (ret) + goto out_lockd; ++ ret = nfs4_state_start_net(net); ++ if (ret) ++ goto out_filecache; + + nn->nfsd_net_up = true; + return 0; + ++out_filecache: ++ nfsd_file_cache_shutdown_net(net); + out_lockd: + if (nn->lockd_up) { + lockd_down(net); +@@ -415,7 +420,7 @@ static void nfsd_shutdown_net(struct net *net) + { + struct nfsd_net *nn = net_generic(net, nfsd_net_id); + +- nfsd_file_cache_purge(net); ++ nfsd_file_cache_shutdown_net(net); + nfs4_state_shutdown_net(net); + if (nn->lockd_up) { + lockd_down(net); +diff --git a/include/net/esp.h b/include/net/esp.h +index 117652eb6ea32..465e38890ee98 100644 +--- a/include/net/esp.h ++++ b/include/net/esp.h +@@ -4,6 +4,8 @@ + + #include + ++#define ESP_SKB_FRAG_MAXSIZE (PAGE_SIZE << SKB_FRAG_PAGE_ORDER) ++ + struct ip_esp_hdr; + + static inline struct ip_esp_hdr *ip_esp_hdr(const struct sk_buff *skb) +diff --git a/include/net/sock.h b/include/net/sock.h +index 079b5f6f13d81..7f213cfcb3cc6 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2583,6 +2583,9 @@ extern int sysctl_optmem_max; + extern __u32 sysctl_wmem_default; + extern __u32 sysctl_rmem_default; + ++ ++/* On 32bit arches, an skb frag is limited to 2^15 */ ++#define SKB_FRAG_PAGE_ORDER get_order(32768) + DECLARE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key); + + static inline int sk_get_wmem0(const struct sock *sk, const struct proto *proto) +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index a71a4a272515d..2c127d438fe0a 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -523,16 +523,17 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags) + raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + } + +- /* Unboost if we were boosted. */ +- if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) +- rt_mutex_futex_unlock(&rnp->boost_mtx); +- + /* + * If this was the last task on the expedited lists, + * then we need to report up the rcu_node hierarchy. + */ + if (!empty_exp && empty_exp_now) + rcu_report_exp_rnp(rnp, true); ++ ++ /* Unboost if we were boosted. */ ++ if (IS_ENABLED(CONFIG_RCU_BOOST) && drop_boost_mutex) ++ rt_mutex_futex_unlock(&rnp->boost_mtx); ++ + } else { + local_irq_restore(flags); + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 57b7a10703c36..c84f68bff7f58 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2355,8 +2355,6 @@ static void sk_leave_memory_pressure(struct sock *sk) + } + } + +-/* On 32bit arches, an skb frag is limited to 2^15 */ +-#define SKB_FRAG_PAGE_ORDER get_order(32768) + DEFINE_STATIC_KEY_FALSE(net_high_order_alloc_disable_key); + + /** +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 00210e55b4cd1..ef20f550d2f81 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -277,6 +277,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * + struct page *page; + struct sk_buff *trailer; + int tailen = esp->tailen; ++ unsigned int allocsz; + + /* this is non-NULL only with UDP Encapsulation */ + if (x->encap) { +@@ -286,6 +287,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * + return err; + } + ++ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); ++ if (allocsz > ESP_SKB_FRAG_MAXSIZE) ++ goto cow; ++ + if (!skb_cloned(skb)) { + if (tailen <= skb_tailroom(skb)) { + nfrags = 1; +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 7a739f16d82b2..79f117e33b80e 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -230,6 +230,11 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info + struct page *page; + struct sk_buff *trailer; + int tailen = esp->tailen; ++ unsigned int allocsz; ++ ++ allocsz = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES); ++ if (allocsz > ESP_SKB_FRAG_MAXSIZE) ++ goto cow; + + if (!skb_cloned(skb)) { + if (tailen <= skb_tailroom(skb)) { +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 918a9520d1f17..3606796009572 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1429,8 +1429,8 @@ static int __ip6_append_data(struct sock *sk, + sizeof(struct frag_hdr) : 0) + + rt->rt6i_nfheader_len; + +- if (mtu < fragheaderlen || +- ((mtu - fragheaderlen) & ~7) + fragheaderlen < sizeof(struct frag_hdr)) ++ if (mtu <= fragheaderlen || ++ ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr)) + goto emsgsize; + + maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 0b3adf7594ffe..3b1ea89a340e3 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -276,6 +276,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + { + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); ++ struct net_device *dev = NULL; + struct llc_sap *sap; + int rc = -EINVAL; + +@@ -287,14 +288,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + goto out; + rc = -ENODEV; + if (sk->sk_bound_dev_if) { +- llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); +- if (llc->dev && addr->sllc_arphrd != llc->dev->type) { +- dev_put(llc->dev); +- llc->dev = NULL; ++ dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); ++ if (dev && addr->sllc_arphrd != dev->type) { ++ dev_put(dev); ++ dev = NULL; + } + } else +- llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); +- if (!llc->dev) ++ dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd); ++ if (!dev) + goto out; + rc = -EUSERS; + llc->laddr.lsap = llc_ui_autoport(); +@@ -304,6 +305,11 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + sap = llc_sap_open(llc->laddr.lsap, NULL); + if (!sap) + goto out; ++ ++ /* Note: We do not expect errors from this point. */ ++ llc->dev = dev; ++ dev = NULL; ++ + memcpy(llc->laddr.mac, llc->dev->dev_addr, IFHWADDRLEN); + memcpy(&llc->addr, addr, sizeof(llc->addr)); + /* assign new connection to its SAP */ +@@ -311,6 +317,7 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr) + sock_reset_flag(sk, SOCK_ZAPPED); + rc = 0; + out: ++ dev_put(dev); + return rc; + } + +@@ -333,6 +340,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + struct sockaddr_llc *addr = (struct sockaddr_llc *)uaddr; + struct sock *sk = sock->sk; + struct llc_sock *llc = llc_sk(sk); ++ struct net_device *dev = NULL; + struct llc_sap *sap; + int rc = -EINVAL; + +@@ -348,25 +356,26 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + rc = -ENODEV; + rcu_read_lock(); + if (sk->sk_bound_dev_if) { +- llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); +- if (llc->dev) { ++ dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if); ++ if (dev) { + if (is_zero_ether_addr(addr->sllc_mac)) +- memcpy(addr->sllc_mac, llc->dev->dev_addr, ++ memcpy(addr->sllc_mac, dev->dev_addr, + IFHWADDRLEN); +- if (addr->sllc_arphrd != llc->dev->type || ++ if (addr->sllc_arphrd != dev->type || + !ether_addr_equal(addr->sllc_mac, +- llc->dev->dev_addr)) { ++ dev->dev_addr)) { + rc = -EINVAL; +- llc->dev = NULL; ++ dev = NULL; + } + } +- } else +- llc->dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, ++ } else { ++ dev = dev_getbyhwaddr_rcu(&init_net, addr->sllc_arphrd, + addr->sllc_mac); +- if (llc->dev) +- dev_hold(llc->dev); ++ } ++ if (dev) ++ dev_hold(dev); + rcu_read_unlock(); +- if (!llc->dev) ++ if (!dev) + goto out; + if (!addr->sllc_sap) { + rc = -EUSERS; +@@ -399,6 +408,11 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + goto out_put; + } + } ++ ++ /* Note: We do not expect errors from this point. */ ++ llc->dev = dev; ++ dev = NULL; ++ + llc->laddr.lsap = addr->sllc_sap; + memcpy(llc->laddr.mac, addr->sllc_mac, IFHWADDRLEN); + memcpy(&llc->addr, addr, sizeof(llc->addr)); +@@ -409,6 +423,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen) + out_put: + llc_sap_put(sap); + out: ++ dev_put(dev); + release_sock(sk); + return rc; + } +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 1b50bbf030ed8..16f37fd0ac0e5 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1949,13 +1949,11 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, + const struct mesh_setup *setup) + { + u8 *new_ie; +- const u8 *old_ie; + struct ieee80211_sub_if_data *sdata = container_of(ifmsh, + struct ieee80211_sub_if_data, u.mesh); + + /* allocate information elements */ + new_ie = NULL; +- old_ie = ifmsh->ie; + + if (setup->ie_len) { + new_ie = kmemdup(setup->ie, setup->ie_len, +@@ -1965,7 +1963,6 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh, + } + ifmsh->ie_len = setup->ie_len; + ifmsh->ie = new_ie; +- kfree(old_ie); + + /* now copy the rest of the setup parameters */ + ifmsh->mesh_id_len = setup->mesh_id_len; +diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c +index 96c74c4c71762..ceb0ef437e23e 100644 +--- a/net/netfilter/nf_tables_core.c ++++ b/net/netfilter/nf_tables_core.c +@@ -153,7 +153,7 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) + struct nft_rule *const *rules; + const struct nft_rule *rule; + const struct nft_expr *expr, *last; +- struct nft_regs regs; ++ struct nft_regs regs = {}; + unsigned int stackptr = 0; + struct nft_jumpstack jumpstack[NFT_JUMP_STACK_SIZE]; + bool genbit = READ_ONCE(net->nft.gencursor); +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 841c0a12cc929..ad4e0af2d0d03 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -774,6 +774,11 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream, + + if (oss_period_size < 16) + return -EINVAL; ++ ++ /* don't allocate too large period; 1MB period must be enough */ ++ if (oss_period_size > 1024 * 1024) ++ return -ENOMEM; ++ + runtime->oss.period_bytes = oss_period_size; + runtime->oss.period_frames = 1; + runtime->oss.periods = oss_periods; +@@ -1045,10 +1050,9 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + goto failure; + } + #endif +- oss_period_size *= oss_frame_size; +- +- oss_buffer_size = oss_period_size * runtime->oss.periods; +- if (oss_buffer_size < 0) { ++ oss_period_size = array_size(oss_period_size, oss_frame_size); ++ oss_buffer_size = array_size(oss_period_size, runtime->oss.periods); ++ if (oss_buffer_size <= 0) { + err = -EINVAL; + goto failure; + } +diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c +index da400da1fafe6..8b7bbabeea24b 100644 +--- a/sound/core/oss/pcm_plugin.c ++++ b/sound/core/oss/pcm_plugin.c +@@ -61,7 +61,10 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t + } + if ((width = snd_pcm_format_physical_width(format->format)) < 0) + return width; +- size = frames * format->channels * width; ++ size = array3_size(frames, format->channels, width); ++ /* check for too large period size once again */ ++ if (size > 1024 * 1024) ++ return -ENOMEM; + if (snd_BUG_ON(size % 8)) + return -ENXIO; + size /= 8; +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 0c5b7a54ca81c..dbe9a65cc1d45 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -1656,21 +1656,25 @@ static int snd_pcm_do_reset(struct snd_pcm_substream *substream, int state) + int err = substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_RESET, NULL); + if (err < 0) + return err; ++ snd_pcm_stream_lock_irq(substream); + runtime->hw_ptr_base = 0; + runtime->hw_ptr_interrupt = runtime->status->hw_ptr - + runtime->status->hw_ptr % runtime->period_size; + runtime->silence_start = runtime->status->hw_ptr; + runtime->silence_filled = 0; ++ snd_pcm_stream_unlock_irq(substream); + return 0; + } + + static void snd_pcm_post_reset(struct snd_pcm_substream *substream, int state) + { + struct snd_pcm_runtime *runtime = substream->runtime; ++ snd_pcm_stream_lock_irq(substream); + runtime->control->appl_ptr = runtime->status->hw_ptr; + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && + runtime->silence_size > 0) + snd_pcm_playback_silence(substream, ULONG_MAX); ++ snd_pcm_stream_unlock_irq(substream); + } + + static const struct action_ops snd_pcm_action_reset = { +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index 66f6c3bf08e31..6fb192a94762f 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -938,8 +938,8 @@ static int snd_ac97_ad18xx_pcm_get_volume(struct snd_kcontrol *kcontrol, struct + int codec = kcontrol->private_value & 3; + + mutex_lock(&ac97->page_mutex); +- ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); +- ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); ++ ucontrol->value.integer.value[0] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 8) & 31); ++ ucontrol->value.integer.value[1] = 31 - ((ac97->spec.ad18xx.pcmreg[codec] >> 0) & 31); + mutex_unlock(&ac97->page_mutex); + return 0; + } +diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c +index df720881eb991..db9d89ba36587 100644 +--- a/sound/pci/cmipci.c ++++ b/sound/pci/cmipci.c +@@ -302,7 +302,6 @@ MODULE_PARM_DESC(joystick_port, "Joystick port address."); + #define CM_MICGAINZ 0x01 /* mic boost */ + #define CM_MICGAINZ_SHIFT 0 + +-#define CM_REG_MIXER3 0x24 + #define CM_REG_AUX_VOL 0x26 + #define CM_VAUXL_MASK 0xf0 + #define CM_VAUXR_MASK 0x0f +@@ -3310,7 +3309,7 @@ static void snd_cmipci_remove(struct pci_dev *pci) + */ + static unsigned char saved_regs[] = { + CM_REG_FUNCTRL1, CM_REG_CHFORMAT, CM_REG_LEGACY_CTRL, CM_REG_MISC_CTRL, +- CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_MIXER3, CM_REG_PLL, ++ CM_REG_MIXER0, CM_REG_MIXER1, CM_REG_MIXER2, CM_REG_AUX_VOL, CM_REG_PLL, + CM_REG_CH0_FRAME1, CM_REG_CH0_FRAME2, + CM_REG_CH1_FRAME1, CM_REG_CH1_FRAME2, CM_REG_EXT_MISC, + CM_REG_INT_STATUS, CM_REG_INT_HLDCLR, CM_REG_FUNCTRL0, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index c03448ea8a203..d201043d661c1 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8183,6 +8183,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS), + SND_PCI_QUIRK(0x1043, 0x1e8e, "ASUS Zephyrus G15", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x1f11, "ASUS Zephyrus G14", ALC289_FIXUP_ASUS_GA401), ++ SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401), + SND_PCI_QUIRK(0x1043, 0x3030, "ASUS ZN270IE", ALC256_FIXUP_ASUS_AIO_GPIO2), + SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC), +@@ -10201,6 +10202,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800), + SND_PCI_QUIRK(0x103c, 0x873e, "HP", ALC671_FIXUP_HP_HEADSET_MIC2), ++ SND_PCI_QUIRK(0x103c, 0x885f, "HP 288 Pro G8", ALC671_FIXUP_HP_HEADSET_MIC2), + SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50), + SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50), +diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c +index 2ed92c990b97c..dd9013c476649 100644 +--- a/sound/soc/sti/uniperif_player.c ++++ b/sound/soc/sti/uniperif_player.c +@@ -91,7 +91,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + SET_UNIPERIF_ITM_BCLR_FIFO_ERROR(player); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + } + + ret = IRQ_HANDLED; +@@ -105,7 +105,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + SET_UNIPERIF_ITM_BCLR_DMA_ERROR(player); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +@@ -138,7 +138,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id) + dev_err(player->dev, "Underflow recovery failed\n"); + + /* Stop the player */ +- snd_pcm_stop_xrun(player->substream); ++ snd_pcm_stop(player->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c +index 136059331211d..065c5f0d1f5f0 100644 +--- a/sound/soc/sti/uniperif_reader.c ++++ b/sound/soc/sti/uniperif_reader.c +@@ -65,7 +65,7 @@ static irqreturn_t uni_reader_irq_handler(int irq, void *dev_id) + if (unlikely(status & UNIPERIF_ITS_FIFO_ERROR_MASK(reader))) { + dev_err(reader->dev, "FIFO error detected\n"); + +- snd_pcm_stop_xrun(reader->substream); ++ snd_pcm_stop(reader->substream, SNDRV_PCM_STATE_XRUN); + + ret = IRQ_HANDLED; + } +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index d926869c031b1..1f7c80541d03b 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -2370,9 +2370,10 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, + if (unitid == 7 && cval->control == UAC_FU_VOLUME) + snd_dragonfly_quirk_db_scale(mixer, cval, kctl); + break; +- /* lowest playback value is muted on C-Media devices */ +- case USB_ID(0x0d8c, 0x000c): +- case USB_ID(0x0d8c, 0x0014): ++ /* lowest playback value is muted on some devices */ ++ case USB_ID(0x0d8c, 0x000c): /* C-Media */ ++ case USB_ID(0x0d8c, 0x0014): /* C-Media */ ++ case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */ + if (strstr(kctl->id.name, "Playback")) + cval->min_mute = 1; + break; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch new file mode 100644 index 0000000000..fb36f2cec2 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.188-189.patch @@ -0,0 +1,14679 @@ +diff --git a/Documentation/DMA-attributes.txt b/Documentation/DMA-attributes.txt +index 8f8d97f65d737..7193505a98cab 100644 +--- a/Documentation/DMA-attributes.txt ++++ b/Documentation/DMA-attributes.txt +@@ -156,3 +156,13 @@ accesses to DMA buffers in both privileged "supervisor" and unprivileged + subsystem that the buffer is fully accessible at the elevated privilege + level (and ideally inaccessible or at least read-only at the + lesser-privileged levels). ++ ++DMA_ATTR_PRIVILEGED ++------------------- ++ ++Some advanced peripherals such as remote processors and GPUs perform ++accesses to DMA buffers in both privileged "supervisor" and unprivileged ++"user" modes. This attribute is used to indicate to the DMA-mapping ++subsystem that the buffer is fully accessible at the elevated privilege ++level (and ideally inaccessible or at least read-only at the ++lesser-privileged levels). +diff --git a/Documentation/devicetree/bindings/mtd/nand-controller.yaml b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +index d261b7096c696..2767f182fd3c5 100644 +--- a/Documentation/devicetree/bindings/mtd/nand-controller.yaml ++++ b/Documentation/devicetree/bindings/mtd/nand-controller.yaml +@@ -44,7 +44,7 @@ patternProperties: + properties: + reg: + description: +- Contains the native Ready/Busy IDs. ++ Contains the chip-select IDs. + + nand-ecc-mode: + allOf: +@@ -139,6 +139,6 @@ examples: + nand-ecc-mode = "soft"; + nand-ecc-algo = "bch"; + +- /* controller specific properties */ ++ /* NAND chip specific properties */ + }; + }; +diff --git a/Documentation/devicetree/bindings/spi/spi-mxic.txt b/Documentation/devicetree/bindings/spi/spi-mxic.txt +index 529f2dab2648a..7bcbb229b78bb 100644 +--- a/Documentation/devicetree/bindings/spi/spi-mxic.txt ++++ b/Documentation/devicetree/bindings/spi/spi-mxic.txt +@@ -8,11 +8,13 @@ Required properties: + - reg: should contain 2 entries, one for the registers and one for the direct + mapping area + - reg-names: should contain "regs" and "dirmap" +-- interrupts: interrupt line connected to the SPI controller + - clock-names: should contain "ps_clk", "send_clk" and "send_dly_clk" + - clocks: should contain 3 entries for the "ps_clk", "send_clk" and + "send_dly_clk" clocks + ++Optional properties: ++- interrupts: interrupt line connected to the SPI controller ++ + Example: + + spi@43c30000 { +diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst +index 06f743b612c48..bb53707f72cc5 100644 +--- a/Documentation/process/stable-kernel-rules.rst ++++ b/Documentation/process/stable-kernel-rules.rst +@@ -174,7 +174,16 @@ Trees + - The finalized and tagged releases of all stable kernels can be found + in separate branches per version at: + +- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git ++ ++ - The release candidate of all stable kernel versions can be found at: ++ ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/ ++ ++ .. warning:: ++ The -stable-rc tree is a snapshot in time of the stable-queue tree and ++ will change frequently, hence will be rebased often. It should only be ++ used for testing purposes (e.g. to be consumed by CI systems). + + + Review committee +diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst +index 0ea967d345838..4c91abad7b35c 100644 +--- a/Documentation/sound/hd-audio/models.rst ++++ b/Documentation/sound/hd-audio/models.rst +@@ -261,6 +261,10 @@ alc-sense-combo + huawei-mbx-stereo + Enable initialization verbs for Huawei MBX stereo speakers; + might be risky, try this at your own risk ++alc298-samsung-headphone ++ Samsung laptops with ALC298 ++alc256-samsung-headphone ++ Samsung laptops with ALC256 + + ALC66x/67x/892 + ============== +diff --git a/Makefile b/Makefile +index 8684857148066..cbb71900d3dcf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 188 ++SUBLEVEL = 189 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +index beb6c502dadc7..bcad098a7fccb 100644 +--- a/arch/arm/boot/dts/bcm2837.dtsi ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -38,12 +38,26 @@ + #size-cells = <0>; + enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit + ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system ++ * /about-the-l1-memory-system?lang=en ++ * ++ * Source for d/i-cache-size ++ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks ++ */ + cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a53"; + reg = <0>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000d8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu1: cpu@1 { +@@ -52,6 +66,13 @@ + reg = <1>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu2: cpu@2 { +@@ -60,6 +81,13 @@ + reg = <2>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu3: cpu@3 { +@@ -68,6 +96,27 @@ + reg = <3>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000f0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; ++ }; ++ ++ /* Source for cache-line-size + cache-sets ++ * https://developer.arm.com/documentation/ddi0500 ++ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en ++ * Source for cache-size ++ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf ++ */ ++ l2: l2-cache0 { ++ compatible = "cache"; ++ cache-size = <0x80000>; ++ cache-line-size = <64>; ++ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set ++ cache-level = <2>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +index d31a68672bfac..d7d756614edd1 100644 +--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +@@ -260,7 +260,7 @@ + }; + + uart3_data: uart3-data { +- samsung,pins = "gpa1-4", "gpa1-4"; ++ samsung,pins = "gpa1-4", "gpa1-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + samsung,pin-drv = ; +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 70a2b6e2ad3fa..fa5dd992e3273 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -117,6 +117,9 @@ + status = "okay"; + ddc = <&i2c_2>; + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; ++ vdd-supply = <&ldo8_reg>; ++ vdd_osc-supply = <&ldo10_reg>; ++ vdd_pll-supply = <&ldo8_reg>; + }; + + &i2c_0 { +diff --git a/arch/arm/boot/dts/exynos5420-smdk5420.dts b/arch/arm/boot/dts/exynos5420-smdk5420.dts +index 8240e51869729..fb92d87d8dedc 100644 +--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts ++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts +@@ -132,6 +132,9 @@ + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_hpd_irq>; ++ vdd-supply = <&ldo6_reg>; ++ vdd_osc-supply = <&ldo7_reg>; ++ vdd_pll-supply = <&ldo6_reg>; + }; + + &hsi2c_4 { +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 03c43c1912a7e..d002c8f738b53 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -53,6 +53,31 @@ + }; + }; + ++ lvds-decoder { ++ compatible = "ti,ds90cf364a", "lvds-decoder"; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ ++ lvds_decoder_in: endpoint { ++ remote-endpoint = <&lvds0_out>; ++ }; ++ }; ++ ++ port@1 { ++ reg = <1>; ++ ++ lvds_decoder_out: endpoint { ++ remote-endpoint = <&panel_in>; ++ }; ++ }; ++ }; ++ }; ++ + panel { + compatible = "edt,etm0700g0dh6"; + pinctrl-0 = <&pinctrl_display_gpio>; +@@ -61,7 +86,7 @@ + + port { + panel_in: endpoint { +- remote-endpoint = <&lvds0_out>; ++ remote-endpoint = <&lvds_decoder_out>; + }; + }; + }; +@@ -450,7 +475,7 @@ + reg = <2>; + + lvds0_out: endpoint { +- remote-endpoint = <&panel_in>; ++ remote-endpoint = <&lvds_decoder_in>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 56f51599852d0..338256c59ca5a 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -141,7 +141,8 @@ + clocks { + sleep_clk: sleep_clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32000>; ++ clock-output-names = "gcc_sleep_clk_src"; + #clock-cells = <0>; + }; + +diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi +index f2aeaccdc1ad6..15ff0e8fd0d30 100644 +--- a/arch/arm/boot/dts/qcom-msm8960.dtsi ++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi +@@ -145,7 +145,9 @@ + reg = <0x108000 0x1000>; + qcom,ipc = <&l2cc 0x8 2>; + +- interrupts = <0 19 0>, <0 21 0>, <0 22 0>; ++ interrupts = , ++ , ++ ; + interrupt-names = "ack", "err", "wakeup"; + + regulators { +@@ -191,7 +193,7 @@ + compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm"; + reg = <0x16440000 0x1000>, + <0x16400000 0x1000>; +- interrupts = <0 154 0x0>; ++ interrupts = ; + clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>; + clock-names = "core", "iface"; + status = "disabled"; +@@ -317,7 +319,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x16080000 0x1000>; +- interrupts = <0 147 0>; ++ interrupts = ; + spi-max-frequency = <24000000>; + cs-gpios = <&msmgpio 8 0>; + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index b05bab57f90a3..09816a2ee3670 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -526,7 +526,7 @@ + pmecc: ecc-engine@f8014070 { + compatible = "atmel,sama5d2-pmecc"; + reg = <0xf8014070 0x490>, +- <0xf8014500 0x100>; ++ <0xf8014500 0x200>; + }; + }; + +diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi +index 1a8f5e8b10e3a..66cd473ecb617 100644 +--- a/arch/arm/boot/dts/spear1340.dtsi ++++ b/arch/arm/boot/dts/spear1340.dtsi +@@ -136,9 +136,9 @@ + reg = <0xb4100000 0x1000>; + interrupts = <0 105 0x4>; + status = "disabled"; +- dmas = <&dwdma0 12 0 1>, +- <&dwdma0 13 1 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 13 0 1>, ++ <&dwdma0 12 1 0>; ++ dma-names = "rx", "tx"; + }; + + thermal@e07008c4 { +diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi +index f187da4485f46..78672db9068be 100644 +--- a/arch/arm/boot/dts/spear13xx.dtsi ++++ b/arch/arm/boot/dts/spear13xx.dtsi +@@ -284,9 +284,9 @@ + #size-cells = <0>; + interrupts = <0 31 0x4>; + status = "disabled"; +- dmas = <&dwdma0 4 0 0>, +- <&dwdma0 5 0 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 5 0 0>, ++ <&dwdma0 4 0 0>; ++ dma-names = "rx", "tx"; + }; + + rtc@e0580000 { +diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi +index 394a6b4dc69d5..69cb65d86c467 100644 +--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi ++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi +@@ -183,8 +183,8 @@ + }; + conf_ata { + nvidia,pins = "ata", "atb", "atc", "atd", "ate", +- "cdev1", "cdev2", "dap1", "dtb", "gma", +- "gmb", "gmc", "gmd", "gme", "gpu7", ++ "cdev1", "cdev2", "dap1", "dtb", "dtf", ++ "gma", "gmb", "gmc", "gmd", "gme", "gpu7", + "gpv", "i2cp", "irrx", "irtx", "pta", + "rm", "slxa", "slxk", "spia", "spib", + "uac"; +@@ -203,7 +203,7 @@ + }; + conf_crtp { + nvidia,pins = "crtp", "dap2", "dap3", "dap4", +- "dtc", "dte", "dtf", "gpu", "sdio1", ++ "dtc", "dte", "gpu", "sdio1", + "slxc", "slxd", "spdi", "spdo", "spig", + "uda"; + nvidia,pull = ; +diff --git a/arch/arm/mach-iop32x/include/mach/entry-macro.S b/arch/arm/mach-iop32x/include/mach/entry-macro.S +index 8e6766d4621eb..341e5d9a6616d 100644 +--- a/arch/arm/mach-iop32x/include/mach/entry-macro.S ++++ b/arch/arm/mach-iop32x/include/mach/entry-macro.S +@@ -20,7 +20,7 @@ + mrc p6, 0, \irqstat, c8, c0, 0 @ Read IINTSRC + cmp \irqstat, #0 + clzne \irqnr, \irqstat +- rsbne \irqnr, \irqnr, #31 ++ rsbne \irqnr, \irqnr, #32 + .endm + + .macro arch_ret_to_user, tmp1, tmp2 +diff --git a/arch/arm/mach-iop32x/include/mach/irqs.h b/arch/arm/mach-iop32x/include/mach/irqs.h +index c4e78df428e86..e09ae5f48aec5 100644 +--- a/arch/arm/mach-iop32x/include/mach/irqs.h ++++ b/arch/arm/mach-iop32x/include/mach/irqs.h +@@ -9,6 +9,6 @@ + #ifndef __IRQS_H + #define __IRQS_H + +-#define NR_IRQS 32 ++#define NR_IRQS 33 + + #endif +diff --git a/arch/arm/mach-iop32x/irq.c b/arch/arm/mach-iop32x/irq.c +index 2d48bf1398c10..d1e8824cbd824 100644 +--- a/arch/arm/mach-iop32x/irq.c ++++ b/arch/arm/mach-iop32x/irq.c +@@ -32,14 +32,14 @@ static void intstr_write(u32 val) + static void + iop32x_irq_mask(struct irq_data *d) + { +- iop32x_mask &= ~(1 << d->irq); ++ iop32x_mask &= ~(1 << (d->irq - 1)); + intctl_write(iop32x_mask); + } + + static void + iop32x_irq_unmask(struct irq_data *d) + { +- iop32x_mask |= 1 << d->irq; ++ iop32x_mask |= 1 << (d->irq - 1); + intctl_write(iop32x_mask); + } + +@@ -65,7 +65,7 @@ void __init iop32x_init_irq(void) + machine_is_em7210()) + *IOP3XX_PCIIRSR = 0x0f; + +- for (i = 0; i < NR_IRQS; i++) { ++ for (i = 1; i < NR_IRQS; i++) { + irq_set_chip_and_handler(i, &ext_chip, handle_level_irq); + irq_clear_status_flags(i, IRQ_NOREQUEST | IRQ_NOPROBE); + } +diff --git a/arch/arm/mach-iop32x/irqs.h b/arch/arm/mach-iop32x/irqs.h +index 69858e4e905d1..e1dfc8b4e7d7e 100644 +--- a/arch/arm/mach-iop32x/irqs.h ++++ b/arch/arm/mach-iop32x/irqs.h +@@ -7,36 +7,40 @@ + #ifndef __IOP32X_IRQS_H + #define __IOP32X_IRQS_H + ++/* Interrupts in Linux start at 1, hardware starts at 0 */ ++ ++#define IOP_IRQ(x) ((x) + 1) ++ + /* + * IOP80321 chipset interrupts + */ +-#define IRQ_IOP32X_DMA0_EOT 0 +-#define IRQ_IOP32X_DMA0_EOC 1 +-#define IRQ_IOP32X_DMA1_EOT 2 +-#define IRQ_IOP32X_DMA1_EOC 3 +-#define IRQ_IOP32X_AA_EOT 6 +-#define IRQ_IOP32X_AA_EOC 7 +-#define IRQ_IOP32X_CORE_PMON 8 +-#define IRQ_IOP32X_TIMER0 9 +-#define IRQ_IOP32X_TIMER1 10 +-#define IRQ_IOP32X_I2C_0 11 +-#define IRQ_IOP32X_I2C_1 12 +-#define IRQ_IOP32X_MESSAGING 13 +-#define IRQ_IOP32X_ATU_BIST 14 +-#define IRQ_IOP32X_PERFMON 15 +-#define IRQ_IOP32X_CORE_PMU 16 +-#define IRQ_IOP32X_BIU_ERR 17 +-#define IRQ_IOP32X_ATU_ERR 18 +-#define IRQ_IOP32X_MCU_ERR 19 +-#define IRQ_IOP32X_DMA0_ERR 20 +-#define IRQ_IOP32X_DMA1_ERR 21 +-#define IRQ_IOP32X_AA_ERR 23 +-#define IRQ_IOP32X_MSG_ERR 24 +-#define IRQ_IOP32X_SSP 25 +-#define IRQ_IOP32X_XINT0 27 +-#define IRQ_IOP32X_XINT1 28 +-#define IRQ_IOP32X_XINT2 29 +-#define IRQ_IOP32X_XINT3 30 +-#define IRQ_IOP32X_HPI 31 ++#define IRQ_IOP32X_DMA0_EOT IOP_IRQ(0) ++#define IRQ_IOP32X_DMA0_EOC IOP_IRQ(1) ++#define IRQ_IOP32X_DMA1_EOT IOP_IRQ(2) ++#define IRQ_IOP32X_DMA1_EOC IOP_IRQ(3) ++#define IRQ_IOP32X_AA_EOT IOP_IRQ(6) ++#define IRQ_IOP32X_AA_EOC IOP_IRQ(7) ++#define IRQ_IOP32X_CORE_PMON IOP_IRQ(8) ++#define IRQ_IOP32X_TIMER0 IOP_IRQ(9) ++#define IRQ_IOP32X_TIMER1 IOP_IRQ(10) ++#define IRQ_IOP32X_I2C_0 IOP_IRQ(11) ++#define IRQ_IOP32X_I2C_1 IOP_IRQ(12) ++#define IRQ_IOP32X_MESSAGING IOP_IRQ(13) ++#define IRQ_IOP32X_ATU_BIST IOP_IRQ(14) ++#define IRQ_IOP32X_PERFMON IOP_IRQ(15) ++#define IRQ_IOP32X_CORE_PMU IOP_IRQ(16) ++#define IRQ_IOP32X_BIU_ERR IOP_IRQ(17) ++#define IRQ_IOP32X_ATU_ERR IOP_IRQ(18) ++#define IRQ_IOP32X_MCU_ERR IOP_IRQ(19) ++#define IRQ_IOP32X_DMA0_ERR IOP_IRQ(20) ++#define IRQ_IOP32X_DMA1_ERR IOP_IRQ(21) ++#define IRQ_IOP32X_AA_ERR IOP_IRQ(23) ++#define IRQ_IOP32X_MSG_ERR IOP_IRQ(24) ++#define IRQ_IOP32X_SSP IOP_IRQ(25) ++#define IRQ_IOP32X_XINT0 IOP_IRQ(27) ++#define IRQ_IOP32X_XINT1 IOP_IRQ(28) ++#define IRQ_IOP32X_XINT2 IOP_IRQ(29) ++#define IRQ_IOP32X_XINT3 IOP_IRQ(30) ++#define IRQ_IOP32X_HPI IOP_IRQ(31) + + #endif +diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c +index 6794e2db1ad5f..ecc46c31004f6 100644 +--- a/arch/arm/mach-mmp/sram.c ++++ b/arch/arm/mach-mmp/sram.c +@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev) + if (!info) + return -ENOMEM; + ++ platform_set_drvdata(pdev, info); ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { + dev_err(&pdev->dev, "no memory resource defined\n"); +@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev) + list_add(&info->node, &sram_bank_list); + mutex_unlock(&sram_lock); + +- platform_set_drvdata(pdev, info); +- + dev_info(&pdev->dev, "initialized\n"); + return 0; + +@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev) + struct sram_bank_info *info; + + info = platform_get_drvdata(pdev); +- if (info == NULL) +- return -ENODEV; + +- mutex_lock(&sram_lock); +- list_del(&info->node); +- mutex_unlock(&sram_lock); ++ if (info->sram_size) { ++ mutex_lock(&sram_lock); ++ list_del(&info->node); ++ mutex_unlock(&sram_lock); ++ ++ gen_pool_destroy(info->gpool); ++ iounmap(info->sram_virt); ++ kfree(info->pool_name); ++ } + +- gen_pool_destroy(info->gpool); +- iounmap(info->sram_virt); +- kfree(info->pool_name); + kfree(info); ++ + return 0; + } + +diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c +index 885e8f12e4b91..eedc9f8ed2109 100644 +--- a/arch/arm/mach-s3c24xx/mach-jive.c ++++ b/arch/arm/mach-s3c24xx/mach-jive.c +@@ -237,11 +237,11 @@ static int __init jive_mtdset(char *options) + unsigned long set; + + if (options == NULL || options[0] == '\0') +- return 0; ++ return 1; + + if (kstrtoul(options, 10, &set)) { + printk(KERN_ERR "failed to parse mtdset=%s\n", options); +- return 0; ++ return 1; + } + + switch (set) { +@@ -256,7 +256,7 @@ static int __init jive_mtdset(char *options) + "using default.", set); + } + +- return 0; ++ return 1; + } + + /* parse the mtdset= option given to the kernel command line */ +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +index ec19fbf928a14..12a4b1c03390c 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +@@ -111,8 +111,8 @@ + compatible = "silabs,si3226x"; + reg = <0>; + spi-max-frequency = <5000000>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +@@ -135,8 +135,8 @@ + at25,byte-len = <0x8000>; + at25,addr-mode = <2>; + at25,page-size = <64>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 39802066232e1..edc1a8a4c4bc0 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -687,7 +687,7 @@ + }; + }; + +- sata: ahci@663f2000 { ++ sata: sata@663f2000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; + reg = <0x663f2000 0x1000>; + dma-coherent; +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 9573da378826b..1954cef8c6f0b 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -459,9 +459,9 @@ + qcom,tcs-offset = <0xd00>; + qcom,drv-id = <2>; + qcom,tcs-config = , +- , +- , +- ; ++ , ++ , ++ ; + + rpmhcc: clock-controller { + compatible = "qcom,sm8150-rpmh-clk"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +index 76f5db696009b..5b7e8fbf1ffec 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +@@ -666,8 +666,8 @@ + sd-uhs-sdr104; + + /* Power supply */ +- vqmmc-supply = &vcc1v8_s3; /* IO line */ +- vmmc-supply = &vcc_sdio; /* card's power */ ++ vqmmc-supply = <&vcc1v8_s3>; /* IO line */ ++ vmmc-supply = <&vcc_sdio>; /* card's power */ + + #address-cells = <1>; + #size-cells = <0>; +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index 78d110667c0c7..ffe0aad96b17b 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -479,7 +479,8 @@ static inline void *kvm_get_hyp_vector(void) + int slot = -1; + + if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || +- cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { ++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && ++ data && data->template_start) { + vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); + slot = data->hyp_vectors_slot; + } +diff --git a/arch/arm64/kernel/cpuidle.c b/arch/arm64/kernel/cpuidle.c +index e4d6af2fdec71..5397f0d9e5bbb 100644 +--- a/arch/arm64/kernel/cpuidle.c ++++ b/arch/arm64/kernel/cpuidle.c +@@ -53,6 +53,9 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) + struct acpi_lpi_state *lpi; + struct acpi_processor *pr = per_cpu(processors, cpu); + ++ if (unlikely(!pr || !pr->flags.has_lpi)) ++ return -EINVAL; ++ + /* + * If the PSCI cpu_suspend function hook has not been initialized + * idle states must not be enabled, so bail out +@@ -60,9 +63,6 @@ static int psci_acpi_cpu_init_idle(unsigned int cpu) + if (!psci_ops.cpu_suspend) + return -EOPNOTSUPP; + +- if (unlikely(!pr || !pr->flags.has_lpi)) +- return -EINVAL; +- + count = pr->power.count - 1; + if (count <= 0) + return -ENODEV; +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index 53bcf5386907f..a02c294a47530 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -207,8 +207,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg) + int i, ret = 0; + struct aarch64_insn_patch *pp = arg; + +- /* The first CPU becomes master */ +- if (atomic_inc_return(&pp->cpu_count) == 1) { ++ /* The last CPU becomes master */ ++ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { + for (i = 0; ret == 0 && i < pp->insn_cnt; i++) + ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], + pp->new_insns[i]); +diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds +index 09a0eef71d12b..9371abe2f4c2d 100644 +--- a/arch/arm64/kernel/module.lds ++++ b/arch/arm64/kernel/module.lds +@@ -1,5 +1,5 @@ + SECTIONS { +- .plt 0 (NOLOAD) : { BYTE(0) } +- .init.plt 0 (NOLOAD) : { BYTE(0) } +- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) } ++ .plt 0 : { BYTE(0) } ++ .init.plt 0 : { BYTE(0) } ++ .text.ftrace_trampoline 0 : { BYTE(0) } + } +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index a343677837c77..17a8d1484f9b9 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -909,15 +909,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + goto out_off; + } + +- /* 1. Initial fake pass to compute ctx->idx. */ +- +- /* Fake pass to fill in ctx->offset. */ +- if (build_body(&ctx, extra_pass)) { ++ /* ++ * 1. Initial fake pass to compute ctx->idx and ctx->offset. ++ * ++ * BPF line info needs ctx->offset[i] to be the offset of ++ * instruction[i] in jited image, so build prologue first. ++ */ ++ if (build_prologue(&ctx, was_classic)) { + prog = orig_prog; + goto out_off; + } + +- if (build_prologue(&ctx, was_classic)) { ++ if (build_body(&ctx, extra_pass)) { + prog = orig_prog; + goto out_off; + } +@@ -983,6 +986,11 @@ skip_init_ctx: + prog->jited_len = image_size; + + if (!prog->is_func || extra_pass) { ++ int i; ++ ++ /* offset[prog->len] is the size of program */ ++ for (i = 0; i <= prog->len; i++) ++ ctx.offset[i] *= AARCH64_INSN_SIZE; + bpf_prog_fill_jited_linfo(prog, ctx.offset + 1); + out_off: + kfree(ctx.offset); +diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h +index a1f206b90753a..c8cd66c8d2577 100644 +--- a/arch/microblaze/include/asm/uaccess.h ++++ b/arch/microblaze/include/asm/uaccess.h +@@ -171,27 +171,27 @@ extern long __user_bad(void); + + #define __get_user(x, ptr) \ + ({ \ +- unsigned long __gu_val = 0; \ + long __gu_err; \ + switch (sizeof(*(ptr))) { \ + case 1: \ +- __get_user_asm("lbu", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lbu", (ptr), x, __gu_err); \ + break; \ + case 2: \ +- __get_user_asm("lhu", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lhu", (ptr), x, __gu_err); \ + break; \ + case 4: \ +- __get_user_asm("lw", (ptr), __gu_val, __gu_err); \ ++ __get_user_asm("lw", (ptr), x, __gu_err); \ + break; \ +- case 8: \ +- __gu_err = __copy_from_user(&__gu_val, ptr, 8); \ +- if (__gu_err) \ +- __gu_err = -EFAULT; \ ++ case 8: { \ ++ __u64 __x = 0; \ ++ __gu_err = raw_copy_from_user(&__x, ptr, 8) ? \ ++ -EFAULT : 0; \ ++ (x) = (typeof(x))(typeof((x) - (x)))__x; \ + break; \ ++ } \ + default: \ + /* __gu_val = 0; __gu_err = -EINVAL;*/ __gu_err = __user_bad();\ + } \ +- x = (__force __typeof__(*(ptr))) __gu_val; \ + __gu_err; \ + }) + +diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S +index a25ef822e7250..5ed38e6180190 100644 +--- a/arch/mips/dec/int-handler.S ++++ b/arch/mips/dec/int-handler.S +@@ -131,7 +131,7 @@ + */ + mfc0 t0,CP0_CAUSE # get pending interrupts + mfc0 t1,CP0_STATUS +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + lw t2,cpu_fpu_mask + #endif + andi t0,ST0_IM # CAUSE.CE may be non-zero! +@@ -139,7 +139,7 @@ + + beqz t0,spurious + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + and t2,t0 + bnez t2,fpu # handle FPU immediately + #endif +@@ -280,7 +280,7 @@ handle_it: + j dec_irq_dispatch + nop + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + fpu: + lw t0,fpu_kstat_irq + nop +diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile +index d95016016b42b..2bad87551203b 100644 +--- a/arch/mips/dec/prom/Makefile ++++ b/arch/mips/dec/prom/Makefile +@@ -6,4 +6,4 @@ + + lib-y += init.o memory.o cmdline.o identify.o console.o + +-lib-$(CONFIG_32BIT) += locore.o ++lib-$(CONFIG_CPU_R3000) += locore.o +diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c +index 1fc8dffa8d1d0..649b50ae5b1e3 100644 +--- a/arch/mips/dec/setup.c ++++ b/arch/mips/dec/setup.c +@@ -766,7 +766,8 @@ void __init arch_init_irq(void) + dec_interrupt[DEC_IRQ_HALT] = -1; + + /* Register board interrupts: FPU and cascade. */ +- if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { ++ if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) && ++ dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { + struct irq_desc *desc_fpu; + int irq_fpu; + +diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h +index 62c7dfb90e06c..1e1247add1cf8 100644 +--- a/arch/mips/include/asm/dec/prom.h ++++ b/arch/mips/include/asm/dec/prom.h +@@ -43,16 +43,11 @@ + */ + #define REX_PROM_MAGIC 0x30464354 + +-#ifdef CONFIG_64BIT +- +-#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */ +- +-#else /* !CONFIG_64BIT */ +- +-#define prom_is_rex(magic) ((magic) == REX_PROM_MAGIC) +- +-#endif /* !CONFIG_64BIT */ +- ++/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */ ++static inline bool prom_is_rex(u32 magic) ++{ ++ return !IS_ENABLED(CONFIG_CPU_R3000) || magic == REX_PROM_MAGIC; ++} + + /* + * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and +diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h +index bb36a400203df..8c56b862fd9c2 100644 +--- a/arch/mips/include/asm/setup.h ++++ b/arch/mips/include/asm/setup.h +@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, + unsigned int reg_shift, unsigned int timeout) {} + #endif + +-extern void set_handler(unsigned long offset, void *addr, unsigned long len); ++void set_handler(unsigned long offset, const void *addr, unsigned long len); + extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); + + typedef void (*vi_handler_t)(void); +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 8282d0feb0b21..749089c25d5e6 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2020,19 +2020,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) + * If no shadow set is selected then use the default handler + * that does normal register saving and standard interrupt exit + */ +- extern char except_vec_vi, except_vec_vi_lui; +- extern char except_vec_vi_ori, except_vec_vi_end; +- extern char rollback_except_vec_vi; +- char *vec_start = using_rollback_handler() ? +- &rollback_except_vec_vi : &except_vec_vi; ++ extern const u8 except_vec_vi[], except_vec_vi_lui[]; ++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; ++ extern const u8 rollback_except_vec_vi[]; ++ const u8 *vec_start = using_rollback_handler() ? ++ rollback_except_vec_vi : except_vec_vi; + #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) +- const int lui_offset = &except_vec_vi_lui - vec_start + 2; +- const int ori_offset = &except_vec_vi_ori - vec_start + 2; ++ const int lui_offset = except_vec_vi_lui - vec_start + 2; ++ const int ori_offset = except_vec_vi_ori - vec_start + 2; + #else +- const int lui_offset = &except_vec_vi_lui - vec_start; +- const int ori_offset = &except_vec_vi_ori - vec_start; ++ const int lui_offset = except_vec_vi_lui - vec_start; ++ const int ori_offset = except_vec_vi_ori - vec_start; + #endif +- const int handler_len = &except_vec_vi_end - vec_start; ++ const int handler_len = except_vec_vi_end - vec_start; + + if (handler_len > VECTORSPACING) { + /* +@@ -2240,7 +2240,7 @@ void per_cpu_trap_init(bool is_boot_cpu) + } + + /* Install CPU exception handler */ +-void set_handler(unsigned long offset, void *addr, unsigned long size) ++void set_handler(unsigned long offset, const void *addr, unsigned long size) + { + #ifdef CONFIG_CPU_MICROMIPS + memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); +diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c +index 0ddeb31afa93a..45ca2b84f0962 100644 +--- a/arch/mips/ralink/ill_acc.c ++++ b/arch/mips/ralink/ill_acc.c +@@ -61,6 +61,7 @@ static int __init ill_acc_of_setup(void) + pdev = of_find_device_by_node(np); + if (!pdev) { + pr_err("%pOFn: failed to lookup pdev\n", np); ++ of_node_put(np); + return -EINVAL; + } + +diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c +index c9ecf17f86605..74808619fefeb 100644 +--- a/arch/mips/rb532/devices.c ++++ b/arch/mips/rb532/devices.c +@@ -310,11 +310,9 @@ static int __init plat_setup_devices(void) + static int __init setup_kmac(char *s) + { + printk(KERN_INFO "korina mac = %s\n", s); +- if (!mac_pton(s, korina_dev0_data.mac)) { ++ if (!mac_pton(s, korina_dev0_data.mac)) + printk(KERN_ERR "Invalid mac\n"); +- return -EINVAL; +- } +- return 0; ++ return 1; + } + + __setup("kmac=", setup_kmac); +diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h +index e83f831a76f93..6be5e913c42e4 100644 +--- a/arch/nios2/include/asm/uaccess.h ++++ b/arch/nios2/include/asm/uaccess.h +@@ -89,6 +89,7 @@ extern __must_check long strnlen_user(const char __user *s, long n); + /* Optimized macros */ + #define __get_user_asm(val, insn, addr, err) \ + { \ ++ unsigned long __gu_val; \ + __asm__ __volatile__( \ + " movi %0, %3\n" \ + "1: " insn " %1, 0(%2)\n" \ +@@ -97,14 +98,20 @@ extern __must_check long strnlen_user(const char __user *s, long n); + " .section __ex_table,\"a\"\n" \ + " .word 1b, 2b\n" \ + " .previous" \ +- : "=&r" (err), "=r" (val) \ ++ : "=&r" (err), "=r" (__gu_val) \ + : "r" (addr), "i" (-EFAULT)); \ ++ val = (__force __typeof__(*(addr)))__gu_val; \ + } + +-#define __get_user_unknown(val, size, ptr, err) do { \ ++extern void __get_user_unknown(void); ++ ++#define __get_user_8(val, ptr, err) do { \ ++ u64 __val = 0; \ + err = 0; \ +- if (__copy_from_user(&(val), ptr, size)) { \ ++ if (raw_copy_from_user(&(__val), ptr, sizeof(val))) { \ + err = -EFAULT; \ ++ } else { \ ++ val = (typeof(val))(typeof((val) - (val)))__val; \ + } \ + } while (0) + +@@ -120,8 +127,11 @@ do { \ + case 4: \ + __get_user_asm(val, "ldw", ptr, err); \ + break; \ ++ case 8: \ ++ __get_user_8(val, ptr, err); \ ++ break; \ + default: \ +- __get_user_unknown(val, size, ptr, err); \ ++ __get_user_unknown(); \ + break; \ + } \ + } while (0) +@@ -130,9 +140,7 @@ do { \ + ({ \ + long __gu_err = -EFAULT; \ + const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ +- unsigned long __gu_val = 0; \ +- __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\ +- (x) = (__force __typeof__(x))__gu_val; \ ++ __get_user_common(x, sizeof(*(ptr)), __gu_ptr, __gu_err); \ + __gu_err; \ + }) + +@@ -140,11 +148,9 @@ do { \ + ({ \ + long __gu_err = -EFAULT; \ + const __typeof__(*(ptr)) __user *__gu_ptr = (ptr); \ +- unsigned long __gu_val = 0; \ + if (access_ok( __gu_ptr, sizeof(*__gu_ptr))) \ +- __get_user_common(__gu_val, sizeof(*__gu_ptr), \ ++ __get_user_common(x, sizeof(*__gu_ptr), \ + __gu_ptr, __gu_err); \ +- (x) = (__force __typeof__(x))__gu_val; \ + __gu_err; \ + }) + +diff --git a/arch/parisc/kernel/patch.c b/arch/parisc/kernel/patch.c +index 80a0ab372802d..e59574f65e641 100644 +--- a/arch/parisc/kernel/patch.c ++++ b/arch/parisc/kernel/patch.c +@@ -40,10 +40,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags, + + *need_unmap = 1; + set_fixmap(fixmap, page_to_phys(page)); +- if (flags) +- raw_spin_lock_irqsave(&patch_lock, *flags); +- else +- __acquire(&patch_lock); ++ raw_spin_lock_irqsave(&patch_lock, *flags); + + return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK)); + } +@@ -52,10 +49,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) + { + clear_fixmap(fixmap); + +- if (flags) +- raw_spin_unlock_irqrestore(&patch_lock, *flags); +- else +- __release(&patch_lock); ++ raw_spin_unlock_irqrestore(&patch_lock, *flags); + } + + void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) +@@ -67,8 +61,9 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + int mapped; + + /* Make sure we don't have any aliases in cache */ +- flush_kernel_vmap_range(addr, len); +- flush_icache_range(start, end); ++ flush_kernel_dcache_range_asm(start, end); ++ flush_kernel_icache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped); + +@@ -81,8 +76,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + * We're crossing a page boundary, so + * need to remap + */ +- flush_kernel_vmap_range((void *)fixmap, +- (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, ++ (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, ++ (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, +@@ -90,10 +87,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + } + } + +- flush_kernel_vmap_range((void *)fixmap, (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); +- flush_icache_range(start, end); + } + + void __kprobes __patch_text(void *addr, u32 insn) +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 9f73fb6b1cc91..b9d2fcf030d0d 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -174,7 +174,7 @@ else + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) + endif +-else ++else ifdef CONFIG_PPC_BOOK3E_64 + CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64 + endif + +diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +index 099a598c74c00..bfe1ed5be3374 100644 +--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +@@ -139,12 +139,12 @@ + fman@400000 { + ethernet@e6000 { + phy-handle = <&phy_rgmii_0>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + ethernet@e8000 { + phy-handle = <&phy_rgmii_1>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + mdio0: mdio@fc000 { +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index a63ec938636de..daba2d2a02a0b 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -345,25 +345,37 @@ static inline void __raw_writeq_be(unsigned long v, volatile void __iomem *addr) + */ + static inline void __raw_rm_writeb(u8 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stbcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stbcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writew(u16 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("sthcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ sthcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writel(u32 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stwcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stwcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writeq(u64 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stdcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stdcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + +@@ -375,7 +387,10 @@ static inline void __raw_rm_writeq_be(u64 val, volatile void __iomem *paddr) + static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + { + u8 ret; +- __asm__ __volatile__("lbzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lbzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -383,7 +398,10 @@ static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + { + u16 ret; +- __asm__ __volatile__("lhzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lhzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -391,7 +409,10 @@ static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + { + u32 ret; +- __asm__ __volatile__("lwzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lwzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -399,7 +420,10 @@ static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + static inline u64 __raw_rm_readq(volatile void __iomem *paddr) + { + u64 ret; +- __asm__ __volatile__("ldcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ ldcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index cafad1960e766..a14a32f6c3ccd 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -191,8 +191,11 @@ extern long __get_user_bad(void); + */ + #define __get_user_atomic_128_aligned(kaddr, uaddr, err) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine altivec\n" \ + "1: lvx 0,0,%1 # get user\n" \ + " stvx 0,0,%2 # put kernel\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c +index 617eba82531cb..d89cf802d9aa7 100644 +--- a/arch/powerpc/kernel/kvm.c ++++ b/arch/powerpc/kernel/kvm.c +@@ -669,7 +669,7 @@ static void __init kvm_use_magic_page(void) + on_each_cpu(kvm_map_magic_page, &features, 1); + + /* Quick self-test to see if the mapping works */ +- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { ++ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { + kvm_patching_worked = false; + return; + } +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 7a1c11a7cba5a..716f8bb17461c 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -146,11 +146,18 @@ void __init reserve_crashkernel(void) + if (!crashk_res.start) { + #ifdef CONFIG_PPC64 + /* +- * On 64bit we split the RMO in half but cap it at half of +- * a small SLB (128MB) since the crash kernel needs to place +- * itself and some stacks to be in the first segment. ++ * On the LPAR platform place the crash kernel to mid of ++ * RMA size (512MB or more) to ensure the crash kernel ++ * gets enough space to place itself and some stack to be ++ * in the first segment. At the same time normal kernel ++ * also get enough space to allocate memory for essential ++ * system resource in the first segment. Keep the crash ++ * kernel starts at 128MB offset on other platforms. + */ +- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); ++ if (firmware_has_feature(FW_FEATURE_LPAR)) ++ crashk_res.start = ppc64_rma_size / 2; ++ else ++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); + #else + crashk_res.start = KDUMP_KERNELBASE; + #endif +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index c1e2e351ebff8..9392661ac8a87 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -1244,6 +1244,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, + entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); + sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); + ++#ifdef CONFIG_PPC64 ++ /* need this feature to decide the crashkernel offset */ ++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) ++ powerpc_firmware_features |= FW_FEATURE_LPAR; ++#endif ++ + if (basep && entryp && sizep) { + rtas.base = *basep; + rtas.entry = *entryp; +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 8dd4d2b83677b..eb8c72846b7fc 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -1495,7 +1495,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu, + { + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + while (vcpu->arch.mmio_vmx_copy_nums) { +@@ -1592,7 +1592,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu, + unsigned int index = rs & KVM_MMIO_REG_MASK; + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + vcpu->arch.io_gpr = rs; +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index dc6728dacbc6b..27650cd5857f9 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -906,7 +906,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __put_user_asmx(x, addr, err, op, cr) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: " op " %2,0,%3\n" \ ++ ".machine pop\n" \ + " mfcr %1\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ +@@ -919,7 +922,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __get_user_asmx(x, addr, err, op) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: "op" %1,0,%2\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +@@ -2912,7 +2918,7 @@ int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op) + __put_user_asmx(op->val, ea, err, "stbcx.", cr); + break; + case 2: +- __put_user_asmx(op->val, ea, err, "stbcx.", cr); ++ __put_user_asmx(op->val, ea, err, "sthcx.", cr); + break; + #endif + case 4: +diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c +index 1cfe57b51d7e3..3f78007a72822 100644 +--- a/arch/powerpc/mm/kasan/kasan_init_32.c ++++ b/arch/powerpc/mm/kasan/kasan_init_32.c +@@ -121,7 +121,7 @@ static void __init kasan_remap_early_shadow_ro(void) + pmd_t *pmd = pmd_offset(pud_offset(pgd_offset_k(k_cur), k_cur), k_cur); + pte_t *ptep = pte_offset_kernel(pmd, k_cur); + +- if ((pte_val(*ptep) & PTE_RPN_MASK) != pa) ++ if (pte_page(*ptep) != virt_to_page(lm_alias(kasan_early_shadow_page))) + continue; + + __set_pte_at(&init_mm, k_cur, ptep, pfn_pte(PHYS_PFN(pa), prot), 0); +diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c +index eb82dda884e51..d76e800a1f337 100644 +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -1441,7 +1441,11 @@ static int trace_imc_event_init(struct perf_event *event) + event->hw.idx = -1; + target = event->hw.target; + +- event->pmu->task_ctx_nr = perf_hw_context; ++ /* ++ * There can only be a single PMU for perf_hw_context events which is assigned to ++ * core PMU. Hence use "perf_sw_context" for trace_imc. ++ */ ++ event->pmu->task_ctx_nr = perf_sw_context; + event->destroy = reset_global_refc; + return 0; + } +diff --git a/arch/powerpc/platforms/8xx/pic.c b/arch/powerpc/platforms/8xx/pic.c +index e9617d35fd1f6..209b12323aa4c 100644 +--- a/arch/powerpc/platforms/8xx/pic.c ++++ b/arch/powerpc/platforms/8xx/pic.c +@@ -153,6 +153,7 @@ int mpc8xx_pic_init(void) + if (mpc8xx_pic_host == NULL) { + printk(KERN_ERR "MPC8xx PIC: failed to allocate irq host!\n"); + ret = -ENOMEM; ++ goto out; + } + + ret = 0; +diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c +index 8035caf6e297d..1c31863a9be6c 100644 +--- a/arch/powerpc/platforms/powernv/rng.c ++++ b/arch/powerpc/platforms/powernv/rng.c +@@ -43,7 +43,11 @@ static unsigned long rng_whiten(struct powernv_rng *rng, unsigned long val) + unsigned long parity; + + /* Calculate the parity of the value */ +- asm ("popcntd %0,%1" : "=r" (parity) : "r" (val)); ++ asm (".machine push; \ ++ .machine power7; \ ++ popcntd %0,%1; \ ++ .machine pop;" ++ : "=r" (parity) : "r" (val)); + + /* xor our value with the previous mask */ + val ^= rng->mask; +diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c +index 8963eaffb1b7b..39186ad6b3c3a 100644 +--- a/arch/powerpc/sysdev/fsl_gtm.c ++++ b/arch/powerpc/sysdev/fsl_gtm.c +@@ -86,7 +86,7 @@ static LIST_HEAD(gtms); + */ + struct gtm_timer *gtm_get_timer16(void) + { +- struct gtm *gtm = NULL; ++ struct gtm *gtm; + int i; + + list_for_each_entry(gtm, >ms, list_node) { +@@ -103,7 +103,7 @@ struct gtm_timer *gtm_get_timer16(void) + spin_unlock_irq(>m->lock); + } + +- if (gtm) ++ if (!list_empty(>ms)) + return ERR_PTR(-EBUSY); + return ERR_PTR(-ENODEV); + } +diff --git a/arch/riscv/kernel/module.lds b/arch/riscv/kernel/module.lds +index 295ecfb341a29..18ec719899e28 100644 +--- a/arch/riscv/kernel/module.lds ++++ b/arch/riscv/kernel/module.lds +@@ -2,7 +2,7 @@ + /* Copyright (C) 2017 Andes Technology Corporation */ + + SECTIONS { +- .plt (NOLOAD) : { BYTE(0) } +- .got (NOLOAD) : { BYTE(0) } +- .got.plt (NOLOAD) : { BYTE(0) } ++ .plt : { BYTE(0) } ++ .got : { BYTE(0) } ++ .got.plt : { BYTE(0) } + } +diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c +index 22a93009362d7..1de5991916eb9 100644 +--- a/arch/riscv/kernel/perf_callchain.c ++++ b/arch/riscv/kernel/perf_callchain.c +@@ -77,7 +77,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry, + + bool fill_callchain(unsigned long pc, void *entry) + { +- return perf_callchain_store(entry, pc); ++ return perf_callchain_store(entry, pc) == 0; + } + + void notrace walk_stackframe(struct task_struct *task, +diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c +index 0117489e9b30a..750acc1344328 100644 +--- a/arch/um/drivers/mconsole_kern.c ++++ b/arch/um/drivers/mconsole_kern.c +@@ -217,7 +217,7 @@ void mconsole_go(struct mc_request *req) + + void mconsole_stop(struct mc_request *req) + { +- deactivate_fd(req->originating_fd, MCONSOLE_IRQ); ++ block_signals(); + os_set_fd_block(req->originating_fd, 1); + mconsole_reply(req, "stopped", 0, 0); + for (;;) { +@@ -240,6 +240,7 @@ void mconsole_stop(struct mc_request *req) + } + os_set_fd_block(req->originating_fd, 0); + mconsole_reply(req, "", 0, 0); ++ unblock_signals(); + } + + static DEFINE_SPINLOCK(mc_devices_lock); +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index da289a44d5116..f4d2322f4c629 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event) + pt->filters.filter[range].msr_b = filter->msr_b; + } + +- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off; ++ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off; + } + + return rtit_ctl; +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index 6ff2c7cac4c46..408b51aba2930 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -487,7 +487,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector) + } else if (apic_id < min && max - apic_id < KVM_IPI_CLUSTER_SIZE) { + ipi_bitmap <<= min - apic_id; + min = apic_id; +- } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) { ++ } else if (apic_id > min && apic_id < min + KVM_IPI_CLUSTER_SIZE) { + max = apic_id < max ? max : apic_id; + } else { + ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap, +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 60c8dcb907a50..ea48a2fb1677d 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1714,11 +1714,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + goto exception; + } + +- if (!seg_desc.p) { +- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; +- goto exception; +- } +- + dpl = seg_desc.dpl; + + switch (seg) { +@@ -1758,6 +1753,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; ++ if (!seg_desc.p) { ++ err_vec = NP_VECTOR; ++ goto exception; ++ } + old_desc = seg_desc; + seg_desc.type |= 2; /* busy */ + ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +@@ -1782,6 +1781,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + break; + } + ++ if (!seg_desc.p) { ++ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; ++ goto exception; ++ } ++ + if (seg_desc.s) { + /* mark segment as accessed */ + if (!(seg_desc.type & 1)) { +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index be92e8dccda3d..ca66459a2e895 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -205,7 +205,7 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + struct kvm_vcpu *vcpu = synic_to_vcpu(synic); + int ret; + +- if (!synic->active && !host) ++ if (!synic->active && (!host || data)) + return 1; + + trace_kvm_hv_synic_set_msr(vcpu->vcpu_id, msr, data, host); +@@ -251,6 +251,9 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + case HV_X64_MSR_EOM: { + int i; + ++ if (!synic->active) ++ break; ++ + for (i = 0; i < ARRAY_SIZE(synic->sint); i++) + kvm_hv_notify_acked_sint(vcpu, i); + break; +@@ -514,6 +517,11 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + { + union hv_stimer_config new_config = {.as_uint64 = config}, + old_config = {.as_uint64 = stimer->config.as_uint64}; ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || config)) ++ return 1; + + trace_kvm_hv_stimer_set_config(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, config, host); +@@ -533,6 +541,12 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count, + bool host) + { ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || count)) ++ return 1; ++ + trace_kvm_hv_stimer_set_count(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, count, host); + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index eea2d6f10f59a..afe3b8e615146 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2099,10 +2099,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) + + void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8) + { +- struct kvm_lapic *apic = vcpu->arch.apic; +- +- apic_set_tpr(apic, ((cr8 & 0x0f) << 4) +- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4)); ++ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4); + } + + u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h +index d4a8ad6c6a4bb..1a1d2b5e7b357 100644 +--- a/arch/x86/kvm/paging_tmpl.h ++++ b/arch/x86/kvm/paging_tmpl.h +@@ -34,9 +34,8 @@ + #define PT_HAVE_ACCESSED_DIRTY(mmu) true + #ifdef CONFIG_X86_64 + #define PT_MAX_FULL_LEVELS PT64_ROOT_MAX_LEVEL +- #define CMPXCHG cmpxchg ++ #define CMPXCHG "cmpxchgq" + #else +- #define CMPXCHG cmpxchg64 + #define PT_MAX_FULL_LEVELS 2 + #endif + #elif PTTYPE == 32 +@@ -52,7 +51,7 @@ + #define PT_GUEST_DIRTY_SHIFT PT_DIRTY_SHIFT + #define PT_GUEST_ACCESSED_SHIFT PT_ACCESSED_SHIFT + #define PT_HAVE_ACCESSED_DIRTY(mmu) true +- #define CMPXCHG cmpxchg ++ #define CMPXCHG "cmpxchgl" + #elif PTTYPE == PTTYPE_EPT + #define pt_element_t u64 + #define guest_walker guest_walkerEPT +@@ -65,8 +64,10 @@ + #define PT_GUEST_DIRTY_SHIFT 9 + #define PT_GUEST_ACCESSED_SHIFT 8 + #define PT_HAVE_ACCESSED_DIRTY(mmu) ((mmu)->ept_ad) +- #define CMPXCHG cmpxchg64 + #define PT_MAX_FULL_LEVELS 4 ++ #ifdef CONFIG_X86_64 ++ #define CMPXCHG "cmpxchgq" ++ #endif + #else + #error Invalid PTTYPE value + #endif +@@ -132,43 +133,39 @@ static int FNAME(cmpxchg_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu, + pt_element_t __user *ptep_user, unsigned index, + pt_element_t orig_pte, pt_element_t new_pte) + { +- int npages; +- pt_element_t ret; +- pt_element_t *table; +- struct page *page; +- +- npages = get_user_pages_fast((unsigned long)ptep_user, 1, FOLL_WRITE, &page); +- if (likely(npages == 1)) { +- table = kmap_atomic(page); +- ret = CMPXCHG(&table[index], orig_pte, new_pte); +- kunmap_atomic(table); +- +- kvm_release_page_dirty(page); +- } else { +- struct vm_area_struct *vma; +- unsigned long vaddr = (unsigned long)ptep_user & PAGE_MASK; +- unsigned long pfn; +- unsigned long paddr; +- +- down_read(¤t->mm->mmap_sem); +- vma = find_vma_intersection(current->mm, vaddr, vaddr + PAGE_SIZE); +- if (!vma || !(vma->vm_flags & VM_PFNMAP)) { +- up_read(¤t->mm->mmap_sem); +- return -EFAULT; +- } +- pfn = ((vaddr - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; +- paddr = pfn << PAGE_SHIFT; +- table = memremap(paddr, PAGE_SIZE, MEMREMAP_WB); +- if (!table) { +- up_read(¤t->mm->mmap_sem); +- return -EFAULT; +- } +- ret = CMPXCHG(&table[index], orig_pte, new_pte); +- memunmap(table); +- up_read(¤t->mm->mmap_sem); +- } ++ int r = -EFAULT; ++ ++ if (!user_access_begin(ptep_user, sizeof(pt_element_t))) ++ return -EFAULT; ++ ++#ifdef CMPXCHG ++ asm volatile("1:" LOCK_PREFIX CMPXCHG " %[new], %[ptr]\n" ++ "mov $0, %[r]\n" ++ "setnz %b[r]\n" ++ "2:" ++ _ASM_EXTABLE_UA(1b, 2b) ++ : [ptr] "+m" (*ptep_user), ++ [old] "+a" (orig_pte), ++ [r] "+q" (r) ++ : [new] "r" (new_pte) ++ : "memory"); ++#else ++ asm volatile("1:" LOCK_PREFIX "cmpxchg8b %[ptr]\n" ++ "movl $0, %[r]\n" ++ "jz 2f\n" ++ "incl %[r]\n" ++ "2:" ++ _ASM_EXTABLE_UA(1b, 2b) ++ : [ptr] "+m" (*ptep_user), ++ [old] "+A" (orig_pte), ++ [r] "+rm" (r) ++ : [new_lo] "b" ((u32)new_pte), ++ [new_hi] "c" ((u32)(new_pte >> 32)) ++ : "memory"); ++#endif + +- return (ret != orig_pte); ++ user_access_end(); ++ return r; + } + + static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcpu *vcpu, +diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c +index d9990951fd0ac..6bc656abbe66d 100644 +--- a/arch/x86/kvm/pmu_amd.c ++++ b/arch/x86/kvm/pmu_amd.c +@@ -245,12 +245,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_EVNTSELn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); + if (pmc) { +- if (data == pmc->eventsel) +- return 0; +- if (!(data & pmu->reserved_bits)) { ++ data &= ~pmu->reserved_bits; ++ if (data != pmc->eventsel) + reprogram_gp_counter(pmc, data); +- return 0; +- } ++ return 0; + } + + return 1; +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index 915bb16397632..1bff0f68f0273 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -40,7 +40,8 @@ static void msr_save_context(struct saved_context *ctxt) + struct saved_msr *end = msr + ctxt->saved_msrs.num; + + while (msr < end) { +- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); ++ if (msr->valid) ++ rdmsrl(msr->info.msr_no, msr->info.reg.q); + msr++; + } + } +@@ -421,8 +422,10 @@ static int msr_build_context(const u32 *msr_id, const int num) + } + + for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { ++ u64 dummy; ++ + msr_array[i].info.msr_no = msr_id[j]; +- msr_array[i].valid = false; ++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); + msr_array[i].info.reg.q = 0; + } + saved_msrs->num = total_num; +@@ -509,10 +512,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c) + return ret; + } + ++static void pm_save_spec_msr(void) ++{ ++ u32 spec_msr_id[] = { ++ MSR_IA32_SPEC_CTRL, ++ MSR_IA32_TSX_CTRL, ++ MSR_TSX_FORCE_ABORT, ++ MSR_IA32_MCU_OPT_CTRL, ++ MSR_AMD64_LS_CFG, ++ }; ++ ++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); ++} ++ + static int pm_check_save_msr(void) + { + dmi_check_system(msr_save_dmi_table); + pm_cpu_check(msr_save_cpu_table); ++ pm_save_spec_msr(); + + return 0; + } +diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c +index e13b0b49fcdfc..d7249f4c90f1b 100644 +--- a/arch/x86/xen/pmu.c ++++ b/arch/x86/xen/pmu.c +@@ -512,10 +512,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) + return ret; + } + +-bool is_xen_pmu(int cpu) +-{ +- return (get_xenpmu_data() != NULL); +-} ++bool is_xen_pmu; + + void xen_pmu_init(int cpu) + { +@@ -526,7 +523,7 @@ void xen_pmu_init(int cpu) + + BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE); + +- if (xen_hvm_domain()) ++ if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu)) + return; + + xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL); +@@ -547,7 +544,8 @@ void xen_pmu_init(int cpu) + per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data; + per_cpu(xenpmu_shared, cpu).flags = 0; + +- if (cpu == 0) { ++ if (!is_xen_pmu) { ++ is_xen_pmu = true; + perf_register_guest_info_callbacks(&xen_guest_cbs); + xen_pmu_arch_init(); + } +diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h +index 0e83a160589bc..65c58894fc79f 100644 +--- a/arch/x86/xen/pmu.h ++++ b/arch/x86/xen/pmu.h +@@ -4,6 +4,8 @@ + + #include + ++extern bool is_xen_pmu; ++ + irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id); + #ifdef CONFIG_XEN_HAVE_VPMU + void xen_pmu_init(int cpu); +@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu); + static inline void xen_pmu_init(int cpu) {} + static inline void xen_pmu_finish(int cpu) {} + #endif +-bool is_xen_pmu(int cpu); + bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err); + bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err); + int pmu_apic_update(uint32_t reg); +diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c +index f8d39440b2923..e5bd9eb421915 100644 +--- a/arch/x86/xen/smp_hvm.c ++++ b/arch/x86/xen/smp_hvm.c +@@ -18,6 +18,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) + */ + xen_vcpu_setup(0); + ++ /* ++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. ++ * Refer to comments in xen_hvm_init_time_ops(). ++ */ ++ xen_hvm_init_time_ops(); ++ + /* + * The alternative logic (which patches the unlock/lock) runs before + * the smp bootup up code is activated. Hence we need to set this up +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index 0cebe5db691d9..64e6ec2c32a76 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -129,7 +129,7 @@ int xen_smp_intr_init_pv(unsigned int cpu) + per_cpu(xen_irq_work, cpu).irq = rc; + per_cpu(xen_irq_work, cpu).name = callfunc_name; + +- if (is_xen_pmu(cpu)) { ++ if (is_xen_pmu) { + pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu); + rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu, + xen_pmu_irq_handler, +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index befbdd8b17f01..4ec6c80f76872 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -547,6 +547,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + + void __init xen_hvm_init_time_ops(void) + { ++ static bool hvm_time_initialized; ++ ++ if (hvm_time_initialized) ++ return; ++ + /* + * vector callback is needed otherwise we cannot receive interrupts + * on cpu > 0 and at this point we don't know how many cpus are +@@ -556,7 +561,22 @@ void __init xen_hvm_init_time_ops(void) + return; + + if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { +- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); ++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); ++ return; ++ } ++ ++ /* ++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. ++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest ++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access ++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. ++ * ++ * The xen_hvm_init_time_ops() should be called again later after ++ * __this_cpu_read(xen_vcpu) is available. ++ */ ++ if (!__this_cpu_read(xen_vcpu)) { ++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", ++ xen_vcpu_nr(0)); + return; + } + +@@ -568,6 +588,8 @@ void __init xen_hvm_init_time_ops(void) + x86_platform.calibrate_tsc = xen_tsc_khz; + x86_platform.get_wallclock = xen_get_wallclock; + x86_platform.set_wallclock = xen_set_wallclock; ++ ++ hvm_time_initialized = true; + } + #endif + +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +index 9bf8bad1dd18a..c33932568aa73 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x00000000 0x08000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "data"; + reg = <0x00000000 0x06000000>; + }; +- partition@0x6000000 { ++ partition@6000000 { + label = "boot loader area"; + reg = <0x06000000 0x00800000>; + }; +- partition@0x6800000 { ++ partition@6800000 { + label = "kernel image"; + reg = <0x06800000 0x017e0000>; + }; +- partition@0x7fe0000 { ++ partition@7fe0000 { + label = "boot environment"; + reg = <0x07fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +index 40c2f81f7cb66..7bde2ab2d6fb5 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x08000000 0x01000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x00400000>; + }; +- partition@0x400000 { ++ partition@400000 { + label = "kernel image"; + reg = <0x00400000 0x00600000>; + }; +- partition@0xa00000 { ++ partition@a00000 { + label = "data"; + reg = <0x00a00000 0x005e0000>; + }; +- partition@0xfe0000 { ++ partition@fe0000 { + label = "boot environment"; + reg = <0x00fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +index fb8d3a9f33c23..0655b868749a4 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +@@ -8,11 +8,11 @@ + reg = <0x08000000 0x00400000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x003f0000>; + }; +- partition@0x3f0000 { ++ partition@3f0000 { + label = "boot environment"; + reg = <0x003f0000 0x00010000>; + }; +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index 7495520d7a3e9..fd1161de45356 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -225,8 +225,8 @@ extern unsigned long get_wchan(struct task_struct *p); + + #define xtensa_set_sr(x, sr) \ + ({ \ +- unsigned int v = (unsigned int)(x); \ +- __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: "a"(v)); \ ++ __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: \ ++ "a"((unsigned int)(x))); \ + }) + + #define xtensa_get_sr(sr) \ +diff --git a/arch/xtensa/kernel/jump_label.c b/arch/xtensa/kernel/jump_label.c +index 61cf6497a646b..0dde21e0d3de4 100644 +--- a/arch/xtensa/kernel/jump_label.c ++++ b/arch/xtensa/kernel/jump_label.c +@@ -61,7 +61,7 @@ static void patch_text(unsigned long addr, const void *data, size_t sz) + .data = data, + }; + stop_machine_cpuslocked(patch_text_stop_machine, +- &patch, NULL); ++ &patch, cpu_online_mask); + } else { + unsigned long flags; + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 342a1cfa48c57..c17eb794f0aef 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -625,6 +625,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_entity *entity = &bfqq->entity; + ++ /* ++ * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group ++ * until elevator exit. ++ */ ++ if (bfqq == &bfqd->oom_bfqq) ++ return; + /* + * Get extra reference to prevent bfqq from being freed in + * next possible expire or deactivate. +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 1a0c581512f28..1d443d17cf7c5 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2523,6 +2523,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) + * are likely to increase the throughput. + */ + bfqq->new_bfqq = new_bfqq; ++ /* ++ * The above assignment schedules the following redirections: ++ * each time some I/O for bfqq arrives, the process that ++ * generated that I/O is disassociated from bfqq and ++ * associated with new_bfqq. Here we increases new_bfqq->ref ++ * in advance, adding the number of processes that are ++ * expected to be associated with new_bfqq as they happen to ++ * issue I/O. ++ */ + new_bfqq->ref += process_refs; + return new_bfqq; + } +@@ -2582,6 +2591,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_queue *in_service_bfqq, *new_bfqq; + ++ /* if a merge has already been setup, then proceed with that first */ ++ if (bfqq->new_bfqq) ++ return bfqq->new_bfqq; ++ + /* + * Do not perform queue merging if the device is non + * rotational and performs internal queueing. In fact, such a +@@ -2636,9 +2649,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (bfq_too_late_for_merging(bfqq)) + return NULL; + +- if (bfqq->new_bfqq) +- return bfqq->new_bfqq; +- + if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) + return NULL; + +@@ -4793,7 +4803,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; + struct request *rq; + struct bfq_queue *in_serv_queue; +- bool waiting_rq, idle_timer_disabled; ++ bool waiting_rq, idle_timer_disabled = false; + + spin_lock_irq(&bfqd->lock); + +@@ -4801,14 +4811,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue); + + rq = __bfq_dispatch_request(hctx); +- +- idle_timer_disabled = +- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ if (in_serv_queue == bfqd->in_service_queue) { ++ idle_timer_disabled = ++ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ } + + spin_unlock_irq(&bfqd->lock); +- +- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue, +- idle_timer_disabled); ++ bfq_update_dispatch_stats(hctx->queue, rq, ++ idle_timer_disabled ? in_serv_queue : NULL, ++ idle_timer_disabled); + + return rq; + } +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 4b022f0c49d20..a62692d135660 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include + +@@ -571,6 +572,9 @@ static inline unsigned int blk_rq_get_max_segments(struct request *rq) + static inline int ll_new_hw_segment(struct request *req, struct bio *bio, + unsigned int nr_phys_segs) + { ++ if (!blk_cgroup_mergeable(req, bio)) ++ goto no_merge; ++ + if (blk_integrity_merge_bio(req->q, req, bio) == false) + goto no_merge; + +@@ -662,6 +666,9 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + if (total_phys_segments > blk_rq_get_max_segments(req)) + return 0; + ++ if (!blk_cgroup_mergeable(req, next->bio)) ++ return 0; ++ + if (blk_integrity_merge_rq(q, req, next) == false) + return 0; + +@@ -885,6 +892,10 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio) + if (rq->rq_disk != bio->bi_disk) + return false; + ++ /* don't merge across cgroup boundaries */ ++ if (!blk_cgroup_mergeable(rq, bio)) ++ return false; ++ + /* only merge integrity protected bio into ditto rq */ + if (blk_integrity_merge_bio(rq->q, rq, bio) == false) + return false; +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index bf33570da5ac7..3fb37135264b2 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -1060,15 +1060,17 @@ void blk_unregister_queue(struct gendisk *disk) + */ + if (queue_is_mq(q)) + blk_mq_unregister_dev(disk_to_dev(disk), q); +- +- kobject_uevent(&q->kobj, KOBJ_REMOVE); +- kobject_del(&q->kobj); + blk_trace_remove_sysfs(disk_to_dev(disk)); + + mutex_lock(&q->sysfs_lock); + if (q->elevator) + elv_unregister_queue(q); + mutex_unlock(&q->sysfs_lock); ++ ++ /* Now that we've deleted all child objects, we can delete the queue. */ ++ kobject_uevent(&q->kobj, KOBJ_REMOVE); ++ kobject_del(&q->kobj); ++ + mutex_unlock(&q->sysfs_dir_lock); + + kobject_put(&disk_to_dev(disk)->kobj); +diff --git a/crypto/authenc.c b/crypto/authenc.c +index 3f0ed94025820..321da90389957 100644 +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -263,7 +263,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, + dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); + + skcipher_request_set_tfm(skreq, ctx->enc); +- skcipher_request_set_callback(skreq, aead_request_flags(req), ++ skcipher_request_set_callback(skreq, flags, + req->base.complete, req->base.data); + skcipher_request_set_crypt(skreq, src, dst, + req->cryptlen - authsize, req->iv); +diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c +index 0aa489711ec49..9cbafaf6dd851 100644 +--- a/crypto/rsa-pkcs1pad.c ++++ b/crypto/rsa-pkcs1pad.c +@@ -475,6 +475,8 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) + pos++; + + if (digest_info) { ++ if (digest_info->size > dst_len - pos) ++ goto done; + if (crypto_memneq(out_buf + pos, digest_info->data, + digest_info->size)) + goto done; +@@ -494,7 +496,7 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err) + sg_nents_for_len(req->src, + req->src_len + req->dst_len), + req_ctx->out_buf + ctx->key_size, +- req->dst_len, ctx->key_size); ++ req->dst_len, req->src_len); + /* Do the actual verification step. */ + if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos, + req->dst_len) != 0) +@@ -537,7 +539,7 @@ static int pkcs1pad_verify(struct akcipher_request *req) + + if (WARN_ON(req->dst) || + WARN_ON(!req->dst_len) || +- !ctx->key_size || req->src_len < ctx->key_size) ++ !ctx->key_size || req->src_len != ctx->key_size) + return -EINVAL; + + req_ctx->out_buf = kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL); +diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c +index ceea6af79d121..bf4eb642f4232 100644 +--- a/drivers/acpi/acpica/nswalk.c ++++ b/drivers/acpi/acpica/nswalk.c +@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type, + + if (start_node == ACPI_ROOT_OBJECT) { + start_node = acpi_gbl_root_node; ++ if (!start_node) { ++ return_ACPI_STATUS(AE_NO_NAMESPACE); ++ } + } + + /* Null child means "get first node" */ +diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c +index 1155fb9dcc3ad..76b7539a37a93 100644 +--- a/drivers/acpi/apei/bert.c ++++ b/drivers/acpi/apei/bert.c +@@ -29,6 +29,7 @@ + + #undef pr_fmt + #define pr_fmt(fmt) "BERT: " fmt ++#define ACPI_BERT_PRINT_MAX_LEN 1024 + + static int bert_disable; + +@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region, + } + + pr_info_once("Error records from previous boot:\n"); +- +- cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ if (region_len < ACPI_BERT_PRINT_MAX_LEN) ++ cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ else ++ pr_info_once("Max print length exceeded, table data is available at:\n" ++ "/sys/firmware/acpi/tables/data/BERT"); + + /* + * Because the boot error source is "one-time polled" type, +@@ -77,7 +81,7 @@ static int __init setup_bert_disable(char *str) + { + bert_disable = 1; + +- return 0; ++ return 1; + } + __setup("bert_disable", setup_bert_disable); + +diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c +index 2015a0967cbbf..5ee3cb7fcd906 100644 +--- a/drivers/acpi/apei/erst.c ++++ b/drivers/acpi/apei/erst.c +@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear); + static int __init setup_erst_disable(char *str) + { + erst_disable = 1; +- return 0; ++ return 1; + } + + __setup("erst_disable", setup_erst_disable); +diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c +index 267bdbf6a7bf0..add6416e78f23 100644 +--- a/drivers/acpi/apei/hest.c ++++ b/drivers/acpi/apei/hest.c +@@ -219,7 +219,7 @@ err: + static int __init setup_hest_disable(char *str) + { + hest_disable = HEST_DISABLED; +- return 0; ++ return 1; + } + + __setup("hest_disable", setup_hest_disable); +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 2826bd45c61a1..0521b1d4c2fd0 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -738,6 +738,11 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj = &out_obj->package.elements[0]; + if (cpc_obj->type == ACPI_TYPE_INTEGER) { + num_ent = cpc_obj->integer.value; ++ if (num_ent <= 1) { ++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } + } else { + pr_debug("Unexpected entry type(%d) for NumEntries\n", + cpc_obj->type); +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 53ae679c00f01..0ea5e677f00ee 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -1201,6 +1201,11 @@ static int flatten_lpi_states(struct acpi_processor *pr, + return 0; + } + ++int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) ++{ ++ return -EOPNOTSUPP; ++} ++ + static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + { + int ret, i; +@@ -1209,6 +1214,11 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + struct acpi_device *d = NULL; + struct acpi_lpi_states_array info[2], *tmp, *prev, *curr; + ++ /* make sure our architecture has support */ ++ ret = acpi_processor_ffh_lpi_probe(pr->id); ++ if (ret == -EOPNOTSUPP) ++ return ret; ++ + if (!osc_pc_lpi_support_confirmed) + return -EOPNOTSUPP; + +@@ -1260,11 +1270,6 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr) + return 0; + } + +-int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) +-{ +- return -ENODEV; +-} +- + int __weak acpi_processor_ffh_lpi_enter(struct acpi_lpi_state *lpi) + { + return -ENODEV; +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index a08e3eb2a6f9f..a4b7cdd0c8446 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -692,7 +692,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, + */ + if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) { + if (index) +- return -EINVAL; ++ return -ENOENT; + + ret = acpi_bus_get_device(obj->reference.handle, &device); + if (ret) +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index 982fe91125322..464260f668708 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -145,7 +145,11 @@ struct sata_dwc_device { + #endif + }; + +-#define SATA_DWC_QCMD_MAX 32 ++/* ++ * Allow one extra special slot for commands and DMA management ++ * to account for libata internal commands. ++ */ ++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) + + struct sata_dwc_device_port { + struct sata_dwc_device *hsdev; +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index cf7e5b4afc1be..26cd4ce3ac75f 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -747,7 +747,7 @@ static int __init save_async_options(char *buf) + "Too long list of driver names for 'driver_async_probe'!\n"); + + strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN); +- return 0; ++ return 1; + } + __setup("driver_async_probe=", save_async_options); + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 23af545120534..ae382c4018fd8 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -2121,7 +2121,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops) + + void device_pm_check_callbacks(struct device *dev) + { +- spin_lock_irq(&dev->power.lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dev->power.lock, flags); + dev->power.no_pm_callbacks = + (!dev->bus || (pm_ops_is_empty(dev->bus->pm) && + !dev->bus->suspend && !dev->bus->resume)) && +@@ -2130,7 +2132,7 @@ void device_pm_check_callbacks(struct device *dev) + (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) && + (!dev->driver || (pm_ops_is_empty(dev->driver->pm) && + !dev->driver->suspend && !dev->driver->resume)); +- spin_unlock_irq(&dev->power.lock); ++ spin_unlock_irqrestore(&dev->power.lock, flags); + } + + bool dev_pm_smart_suspend_and_suspended(struct device *dev) +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index ddbf56014c51a..6da7f5749a7c4 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1673,22 +1673,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 5d52a2d321559..bfb00d3b091f1 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4630,7 +4630,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4672,16 +4672,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4721,16 +4722,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4770,16 +4772,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4820,13 +4823,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4877,7 +4881,7 @@ fail: + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4891,11 +4895,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4922,6 +4927,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4930,32 +4936,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4970,7 +4976,10 @@ next: + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index f86cea4c0f8df..5e92632881d81 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -195,7 +195,8 @@ void start_new_tl_epoch(struct drbd_connection *connection) + void complete_master_bio(struct drbd_device *device, + struct bio_and_error *m) + { +- m->bio->bi_status = errno_to_blk_status(m->error); ++ if (unlikely(m->error)) ++ m->bio->bi_status = errno_to_blk_status(m->error); + bio_endio(m->bio); + dec_ap_bio(device); + } +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index eeaa3b49b2649..4dad4dd0ceb66 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1537,7 +1537,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1550,10 +1550,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1564,10 +1564,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1577,10 +1577,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1594,7 +1594,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1602,7 +1602,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *uninitialized_var(last_arg); + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6abb..d5b0479bc9a66 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ffbe792410d1c..6b3e27b8cd245 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -794,33 +794,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) + + static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset); + } + + static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); + } + + static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) + { + int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); + +- return sprintf(buf, "%s\n", autoclear ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0"); + } + + static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) + { + int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); + +- return sprintf(buf, "%s\n", partscan ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0"); + } + + static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf) + { + int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO); + +- return sprintf(buf, "%s\n", dio ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", dio ? "1" : "0"); + } + + LOOP_ATTR_RO(backing_file); +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 4b3645e648ee9..2a5cd502feae7 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -936,9 +936,17 @@ static int virtblk_probe(struct virtio_device *vdev) + err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, + struct virtio_blk_config, blk_size, + &blk_size); +- if (!err) ++ if (!err) { ++ err = blk_validate_block_size(blk_size); ++ if (err) { ++ dev_err(&vdev->dev, ++ "virtio_blk: invalid block size: 0x%x\n", ++ blk_size); ++ goto out_free_tags; ++ } ++ + blk_queue_logical_block_size(q, blk_size); +- else ++ } else + blk_size = queue_logical_block_size(q); + + /* Use topology information if available */ +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index c2eb64bcd5d5d..0e7f44461946e 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -980,6 +980,8 @@ static int btmtksdio_probe(struct sdio_func *func, + hdev->manufacturer = 70; + set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); + ++ sdio_set_drvdata(func, bdev); ++ + err = hci_register_dev(hdev); + if (err < 0) { + dev_err(&func->dev, "Can't register HCI device\n"); +@@ -987,8 +989,6 @@ static int btmtksdio_probe(struct sdio_func *func, + return err; + } + +- sdio_set_drvdata(func, bdev); +- + /* pm_runtime_enable would be done after the firmware is being + * downloaded because the core layer probably already enables + * runtime PM for this func such as the case host->caps & +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 1b4ad231e6ed3..fd081bdd2dd8a 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -279,6 +279,8 @@ int hci_uart_register_device(struct hci_uart *hu, + if (err) + return err; + ++ percpu_init_rwsem(&hu->proto_lock); ++ + err = p->open(hu); + if (err) + goto err_open; +@@ -301,7 +303,6 @@ int hci_uart_register_device(struct hci_uart *hu, + + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); +- percpu_init_rwsem(&hu->proto_lock); + + /* Only when vendor specific setup callback is provided, consider + * the manufacturer information valid. This avoids filling in the +diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c +index e55705745d5e4..f4c94f8acfe0d 100644 +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev) + + err_register: + clk_disable_unprepare(trng->clk); ++ atmel_trng_disable(trng); + return ret; + } + +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index 1838039b03333..17fbd7f7a2954 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -274,14 +274,6 @@ static void tpm_dev_release(struct device *dev) + kfree(chip); + } + +-static void tpm_devs_release(struct device *dev) +-{ +- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); +- +- /* release the master device reference */ +- put_device(&chip->dev); +-} +- + /** + * tpm_class_shutdown() - prepare the TPM device for loss of power. + * @dev: device to which the chip is associated. +@@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev_num = rc; + + device_initialize(&chip->dev); +- device_initialize(&chip->devs); + + chip->dev.class = tpm_class; + chip->dev.class->shutdown_pre = tpm_class_shutdown; +@@ -352,29 +343,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev.parent = pdev; + chip->dev.groups = chip->groups; + +- chip->devs.parent = pdev; +- chip->devs.class = tpmrm_class; +- chip->devs.release = tpm_devs_release; +- /* get extra reference on main device to hold on +- * behalf of devs. This holds the chip structure +- * while cdevs is in use. The corresponding put +- * is in the tpm_devs_release (TPM2 only) +- */ +- if (chip->flags & TPM_CHIP_FLAG_TPM2) +- get_device(&chip->dev); +- + if (chip->dev_num == 0) + chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); + else + chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); + +- chip->devs.devt = +- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); +- + rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); +- if (rc) +- goto out; +- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out; + +@@ -382,9 +356,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->flags |= TPM_CHIP_FLAG_VIRTUAL; + + cdev_init(&chip->cdev, &tpm_fops); +- cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdev.owner = THIS_MODULE; +- chip->cdevs.owner = THIS_MODULE; + + rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { +@@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + return chip; + + out: +- put_device(&chip->devs); + put_device(&chip->dev); + return ERR_PTR(rc); + } +@@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) + } + + if (chip->flags & TPM_CHIP_FLAG_TPM2) { +- rc = cdev_device_add(&chip->cdevs, &chip->devs); +- if (rc) { +- dev_err(&chip->devs, +- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", +- dev_name(&chip->devs), MAJOR(chip->devs.devt), +- MINOR(chip->devs.devt), rc); +- return rc; +- } ++ rc = tpm_devs_add(chip); ++ if (rc) ++ goto err_del_cdev; + } + + /* Make the chip available. */ +@@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) + idr_replace(&dev_nums_idr, chip, chip->dev_num); + mutex_unlock(&idr_lock); + ++ return 0; ++ ++err_del_cdev: ++ cdev_device_del(&chip->cdev, &chip->dev); + return rc; + } + +@@ -641,7 +611,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) + hwrng_unregister(&chip->hwrng); + tpm_bios_log_teardown(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) +- cdev_device_del(&chip->cdevs, &chip->devs); ++ tpm_devs_remove(chip); + tpm_del_char_device(chip); + } + EXPORT_SYMBOL_GPL(tpm_chip_unregister); +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 37f010421a369..58312062d435c 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -466,6 +466,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u8 *cmd, + size_t cmdsiz); + int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void *buf, + size_t *bufsiz); ++int tpm_devs_add(struct tpm_chip *chip); ++void tpm_devs_remove(struct tpm_chip *chip); + + void tpm_bios_log_setup(struct tpm_chip *chip); + void tpm_bios_log_teardown(struct tpm_chip *chip); +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index d2225020e4d2c..ffb35f0154c16 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -574,3 +574,68 @@ out: + dev_err(&chip->dev, "%s: error %d\n", __func__, rc); + return rc; + } ++ ++/* ++ * Put the reference to the main device. ++ */ ++static void tpm_devs_release(struct device *dev) ++{ ++ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); ++ ++ /* release the master device reference */ ++ put_device(&chip->dev); ++} ++ ++/* ++ * Remove the device file for exposed TPM spaces and release the device ++ * reference. This may also release the reference to the master device. ++ */ ++void tpm_devs_remove(struct tpm_chip *chip) ++{ ++ cdev_device_del(&chip->cdevs, &chip->devs); ++ put_device(&chip->devs); ++} ++ ++/* ++ * Add a device file to expose TPM spaces. Also take a reference to the ++ * main device. ++ */ ++int tpm_devs_add(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ device_initialize(&chip->devs); ++ chip->devs.parent = chip->dev.parent; ++ chip->devs.class = tpmrm_class; ++ ++ /* ++ * Get extra reference on main device to hold on behalf of devs. ++ * This holds the chip structure while cdevs is in use. The ++ * corresponding put is in the tpm_devs_release. ++ */ ++ get_device(&chip->dev); ++ chip->devs.release = tpm_devs_release; ++ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); ++ cdev_init(&chip->cdevs, &tpmrm_fops); ++ chip->cdevs.owner = THIS_MODULE; ++ ++ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); ++ if (rc) ++ goto err_put_devs; ++ ++ rc = cdev_device_add(&chip->cdevs, &chip->devs); ++ if (rc) { ++ dev_err(&chip->devs, ++ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", ++ dev_name(&chip->devs), MAJOR(chip->devs.devt), ++ MINOR(chip->devs.devt), rc); ++ goto err_put_devs; ++ } ++ ++ return 0; ++ ++err_put_devs: ++ put_device(&chip->devs); ++ ++ return rc; ++} +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index b453029487a12..c736adef9d3c8 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1961,6 +1961,13 @@ static void virtcons_remove(struct virtio_device *vdev) + list_del(&portdev->list); + spin_unlock_irq(&pdrvdata_lock); + ++ /* Device is going away, exit any polling for buffers */ ++ virtio_break_device(vdev); ++ if (use_multiport(portdev)) ++ flush_work(&portdev->control_work); ++ else ++ flush_work(&portdev->config_work); ++ + /* Disable interrupts for vqs */ + vdev->config->reset(vdev); + /* Finish up work that's lined up */ +@@ -2234,7 +2241,7 @@ static struct virtio_driver virtio_rproc_serial = { + .remove = virtcons_remove, + }; + +-static int __init init(void) ++static int __init virtio_console_init(void) + { + int err; + +@@ -2271,7 +2278,7 @@ free: + return err; + } + +-static void __exit fini(void) ++static void __exit virtio_console_fini(void) + { + reclaim_dma_bufs(); + +@@ -2281,8 +2288,8 @@ static void __exit fini(void) + class_destroy(pdrvdata.class); + debugfs_remove_recursive(pdrvdata.debugfs_dir); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_console_init); ++module_exit(virtio_console_fini); + + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c +index a2f34d13fb543..6ea7da1d6d755 100644 +--- a/drivers/clk/actions/owl-s700.c ++++ b/drivers/clk/actions/owl-s700.c +@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = { + + static struct clk_div_table rmii_div_table[] = { + {0, 4}, {1, 10}, ++ {0, 0} + }; + + /* divider clocks */ +diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c +index 790890978424a..5144ada2c7e1a 100644 +--- a/drivers/clk/actions/owl-s900.c ++++ b/drivers/clk/actions/owl-s900.c +@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = { + + static struct clk_div_table usb3_mac_div_table[] = { + { 1, 2 }, { 2, 3 }, { 3, 4 }, +- { 0, 8 }, ++ { 0, 0 } + }; + + static struct clk_div_table i2s_div_table[] = { +diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c +index a2c6486ef1708..f8417ee2961aa 100644 +--- a/drivers/clk/clk-clps711x.c ++++ b/drivers/clk/clk-clps711x.c +@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = { + { .val = 1, .div = 8, }, + { .val = 2, .div = 2, }, + { .val = 3, .div = 1, }, ++ { /* sentinel */ } + }; + + static const struct clk_div_table timer_div_table[] = { + { .val = 0, .div = 256, }, + { .val = 1, .div = 1, }, ++ { /* sentinel */ } + }; + + struct clps711x_clk { +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 20ed0955416a3..07ef9995b3cb1 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -638,6 +638,15 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + u32 r_divider; + u8 r[3]; + ++ err = regmap_read(output->data->regmap, ++ SI5341_OUT_CONFIG(output), &val); ++ if (err < 0) ++ return err; ++ ++ /* If SI5341_OUT_CFG_RDIV_FORCE2 is set, r_divider is 2 */ ++ if (val & SI5341_OUT_CFG_RDIV_FORCE2) ++ return parent_rate / 2; ++ + err = regmap_bulk_read(output->data->regmap, + SI5341_OUT_R_REG(output), r, 3); + if (err < 0) +@@ -654,13 +663,6 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + r_divider += 1; + r_divider <<= 1; + +- err = regmap_read(output->data->regmap, +- SI5341_OUT_CONFIG(output), &val); +- if (err < 0) +- return err; +- +- if (val & SI5341_OUT_CFG_RDIV_FORCE2) +- r_divider = 2; + + return parent_rate / r_divider; + } +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index e4e1b4e94a67b..13332f89e034b 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -637,6 +637,24 @@ static void clk_core_get_boundaries(struct clk_core *core, + *max_rate = min(*max_rate, clk_user->max_rate); + } + ++static bool clk_core_check_boundaries(struct clk_core *core, ++ unsigned long min_rate, ++ unsigned long max_rate) ++{ ++ struct clk *user; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ if (min_rate > core->max_rate || max_rate < core->min_rate) ++ return false; ++ ++ hlist_for_each_entry(user, &core->clks, clks_node) ++ if (min_rate > user->max_rate || max_rate < user->min_rate) ++ return false; ++ ++ return true; ++} ++ + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate) + { +@@ -2306,6 +2324,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + clk->min_rate = min; + clk->max_rate = max; + ++ if (!clk_core_check_boundaries(clk->core, min, max)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + rate = clk_core_get_rate_nolock(clk->core); + if (rate < min || rate > max) { + /* +@@ -2334,6 +2357,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + } + } + ++out: + if (clk->exclusive_count) + clk_core_rate_protect(clk->core); + +@@ -3278,6 +3302,19 @@ static void clk_core_reparent_orphans_nolock(void) + __clk_set_parent_after(orphan, parent, NULL); + __clk_recalc_accuracies(orphan); + __clk_recalc_rates(orphan, 0); ++ ++ /* ++ * __clk_init_parent() will set the initial req_rate to ++ * 0 if the clock doesn't have clk_ops::recalc_rate and ++ * is an orphan when it's registered. ++ * ++ * 'req_rate' is used by clk_set_rate_range() and ++ * clk_put() to trigger a clk_set_rate() call whenever ++ * the boundaries are modified. Let's make sure ++ * 'req_rate' is set to something non-zero so that ++ * clk_set_rate_range() doesn't drop the frequency. ++ */ ++ orphan->req_rate = orphan->rate; + } + } + } +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c +index fbea774ef6877..58577548fe212 100644 +--- a/drivers/clk/imx/clk-imx7d.c ++++ b/drivers/clk/imx/clk-imx7d.c +@@ -859,7 +859,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) + hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0); + hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0); + hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0); +- hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0); + hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0); + hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0); + hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0); +diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c +index 703f87622cf5f..1ebf740380efb 100644 +--- a/drivers/clk/loongson1/clk-loongson1c.c ++++ b/drivers/clk/loongson1/clk-loongson1c.c +@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = { + [1] = { .val = 1, .div = 4 }, + [2] = { .val = 2, .div = 3 }, + [3] = { .val = 3, .div = 3 }, ++ [4] = { /* sentinel */ } + }; + + void __init ls1x_clk_init(void) +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index a88101480e337..89c1adeb84d44 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -263,7 +263,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw, + + static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + { +- u32 cfg, mask; ++ u32 cfg, mask, d_val, not2d_val, n_minus_m; + struct clk_hw *hw = &rcg->clkr.hw; + int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src); + +@@ -282,8 +282,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + if (ret) + return ret; + ++ /* Calculate 2d value */ ++ d_val = f->n; ++ ++ n_minus_m = f->n - f->m; ++ n_minus_m *= 2; ++ ++ d_val = clamp_t(u32, d_val, f->m, n_minus_m); ++ not2d_val = ~d_val & mask; ++ + ret = regmap_update_bits(rcg->clkr.regmap, +- RCG_D_OFFSET(rcg), mask, ~f->n); ++ RCG_D_OFFSET(rcg), mask, not2d_val); + if (ret) + return ret; + } +@@ -638,6 +647,7 @@ static const struct frac_entry frac_table_pixel[] = { + { 2, 9 }, + { 4, 9 }, + { 1, 1 }, ++ { 2, 3 }, + { } + }; + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index e01f5f591d1e2..de48ba7eba3a1 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c +index b7fc8c7ba1957..14f0d5d840802 100644 +--- a/drivers/clk/qcom/gcc-msm8994.c ++++ b/drivers/clk/qcom/gcc-msm8994.c +@@ -107,6 +107,7 @@ static struct clk_alpha_pll gpll4_early = { + + static struct clk_alpha_pll_postdiv gpll4 = { + .offset = 0x1dc0, ++ .width = 4, + .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data) + { +diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c +index ea39caf3d7622..0c1b83bedb73d 100644 +--- a/drivers/clk/tegra/clk-emc.c ++++ b/drivers/clk/tegra/clk-emc.c +@@ -191,6 +191,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) + + tegra->emc = platform_get_drvdata(pdev); + if (!tegra->emc) { ++ put_device(&pdev->dev); + pr_err("%s: cannot find EMC driver\n", __func__); + return NULL; + } +diff --git a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +index 5319cd3804801..3bc55ab75314b 100644 +--- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c ++++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +@@ -24,6 +24,7 @@ struct clk_hw *uniphier_clk_register_fixed_rate(struct device *dev, + + init.name = name; + init.ops = &clk_fixed_rate_ops; ++ init.flags = 0; + init.parent_names = NULL; + init.num_parents = 0; + +diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c +index eb596ff9e7bb3..279ddff81ab49 100644 +--- a/drivers/clocksource/acpi_pm.c ++++ b/drivers/clocksource/acpi_pm.c +@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg) + int ret; + + ret = kstrtouint(arg, 16, &base); +- if (ret) +- return ret; ++ if (ret) { ++ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg); ++ return 1; ++ } + + pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport, + base); +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index a3c73e972fce1..bf2a6f64ba0c5 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np, + of_base->base = of_base->name ? + of_io_request_and_map(np, of_base->index, of_base->name) : + of_iomap(np, of_base->index); +- if (IS_ERR(of_base->base)) { +- pr_err("Failed to iomap (%s)\n", of_base->name); +- return PTR_ERR(of_base->base); ++ if (IS_ERR_OR_NULL(of_base->base)) { ++ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name); ++ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM; + } + + return 0; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 0770a83bf1a57..b3eea329f840f 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -633,6 +633,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) + return 0; + } + ++static void ccp_dma_release(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ tasklet_kill(&chan->cleanup_tasklet); ++ list_del_rcu(&dma_chan->device_node); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -737,6 +751,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) + return 0; + + err_reg: ++ ccp_dma_release(ccp); + kmem_cache_destroy(ccp->dma_desc_cache); + + err_cache: +@@ -753,6 +768,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + return; + + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index 954f14bddf1d7..dce30ae2b7040 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -295,6 +295,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg, + { + int ret = 0; + ++ if (!nbytes) { ++ *mapped_nents = 0; ++ *lbytes = 0; ++ *nents = 0; ++ return 0; ++ } ++ + *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes); + if (*nents > max_sg_nents) { + *nents = 0; +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 5471110792071..9443f31acd27b 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -329,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); + } + +- for_each_sg(req->src, src, sg_nents(src), i) { ++ for_each_sg(req->src, src, sg_nents(req->src), i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); + tlen += len; +diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig +index c85fab7ef0bdd..b2c28b87f14b3 100644 +--- a/drivers/crypto/vmx/Kconfig ++++ b/drivers/crypto/vmx/Kconfig +@@ -2,7 +2,11 @@ + config CRYPTO_DEV_VMX_ENCRYPT + tristate "Encryption acceleration support on P8 CPU" + depends on CRYPTO_DEV_VMX ++ select CRYPTO_AES ++ select CRYPTO_CBC ++ select CRYPTO_CTR + select CRYPTO_GHASH ++ select CRYPTO_XTS + default m + help + Support for VMX cryptographic acceleration instructions on Power8 CPU. +diff --git a/drivers/dax/super.c b/drivers/dax/super.c +index 8074e5de815b9..5005b92b197d7 100644 +--- a/drivers/dax/super.c ++++ b/drivers/dax/super.c +@@ -691,6 +691,7 @@ static int dax_fs_init(void) + static void dax_fs_exit(void) + { + kern_unmount(dax_mnt); ++ rcu_barrier(); + kmem_cache_destroy(dax_cache); + } + +diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c +index 9635897458a09..e553c6a937f69 100644 +--- a/drivers/dma-buf/udmabuf.c ++++ b/drivers/dma-buf/udmabuf.c +@@ -145,6 +145,10 @@ static long udmabuf_create(const struct udmabuf_create_list *head, + if (ubuf->pagecount > pglimit) + goto err; + } ++ ++ if (!ubuf->pagecount) ++ goto err; ++ + ubuf->pages = kmalloc_array(ubuf->pagecount, sizeof(*ubuf->pages), + GFP_KERNEL); + if (!ubuf->pages) { +diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c +index 19eee3d0900b0..c51de498b5b4b 100644 +--- a/drivers/dma/sh/shdma-base.c ++++ b/drivers/dma/sh/shdma-base.c +@@ -115,10 +115,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) + ret = pm_runtime_get(schan->dev); + + spin_unlock_irq(&schan->chan_lock); +- if (ret < 0) { ++ if (ret < 0) + dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); +- pm_runtime_put(schan->dev); +- } + + pm_runtime_barrier(schan->dev); + +diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig +index 2fba0aa7fc54d..20dfe39a0537a 100644 +--- a/drivers/firmware/google/Kconfig ++++ b/drivers/firmware/google/Kconfig +@@ -21,7 +21,7 @@ config GOOGLE_SMI + + config GOOGLE_COREBOOT_TABLE + tristate "Coreboot Table Access" +- depends on ACPI || OF ++ depends on HAS_IOMEM && (ACPI || OF) + help + This option enables the coreboot_table module, which provides other + firmware modules access to the coreboot table. The coreboot table +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c +index ce30d4e8bf25f..f7c4337c1ffe6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v10.c +@@ -165,7 +165,7 @@ static const struct kfd2kgd_calls kfd2kgd = { + .get_tile_config = amdgpu_amdkfd_get_tile_config, + }; + +-struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions() ++struct kfd2kgd_calls *amdgpu_amdkfd_gfx_10_0_get_functions(void) + { + return (struct kfd2kgd_calls *)&kfd2kgd; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 82823d9a8ba88..fddeea2b17e50 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1542,6 +1542,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, + return 0; + + default: ++ dma_fence_put(fence); + return -EINVAL; + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index f9bef3154b998..2659202f2026b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -263,7 +263,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, + * adev->gfx.mec.num_pipe_per_mec + * adev->gfx.mec.num_queue_per_pipe; + +- while (queue_bit-- >= 0) { ++ while (--queue_bit >= 0) { + if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) + continue; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 532d1842f6a30..4cc0dd494a42b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1305,7 +1305,8 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) + return; + +- dma_resv_lock(bo->base.resv, NULL); ++ if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) ++ return; + + r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->base.resv, &fence); + if (!WARN_ON(r)) { +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index 66387caf966e2..3685e89415d5c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -758,7 +758,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) + /* Fetch the CRAT table from ACPI */ + status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); + if (status == AE_NOT_FOUND) { +- pr_warn("CRAT table not found\n"); ++ pr_info("CRAT table not found\n"); + return -ENODATA; + } else if (ACPI_FAILURE(status)) { + const char *err = acpi_format_exception(status); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_module.c b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +index 986ff52d5750c..f4b7f7e6c40e4 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_module.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_module.c +@@ -82,7 +82,7 @@ static void kfd_exit(void) + kfd_chardev_exit(); + } + +-int kgd2kfd_init() ++int kgd2kfd_init(void) + { + return kfd_init(); + } +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 8e4d863c7570b..c5231c50c4126 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5013,6 +5013,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, + mode = amdgpu_dm_create_common_mode(encoder, + common_modes[i].name, common_modes[i].w, + common_modes[i].h); ++ if (!mode) ++ continue; ++ + drm_mode_probed_add(connector, mode); + amdgpu_dm_connector->num_modes++; + } +@@ -7265,10 +7268,13 @@ cleanup: + static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc) + { + struct drm_connector *connector; +- struct drm_connector_state *conn_state; ++ struct drm_connector_state *conn_state, *old_conn_state; + struct amdgpu_dm_connector *aconnector = NULL; + int i; +- for_each_new_connector_in_state(state, connector, conn_state, i) { ++ for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) { ++ if (!conn_state->crtc) ++ conn_state = old_conn_state; ++ + if (conn_state->crtc != crtc) + continue; + +diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +index 623455cd75203..d6f988403941b 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +@@ -227,14 +227,6 @@ static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = { + .funcs = &pflip_irq_info_funcs\ + } + +-#define vupdate_int_entry(reg_num)\ +- [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ +- IRQ_REG_ENTRY(OTG, reg_num,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\ +- .funcs = &vblank_irq_info_funcs\ +- } +- + /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic + * of DCE's DC_IRQ_SOURCE_VUPDATEx. + */ +@@ -348,12 +340,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = { + dc_underflow_int_entry(6), + [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), + [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), +- vupdate_int_entry(0), +- vupdate_int_entry(1), +- vupdate_int_entry(2), +- vupdate_int_entry(3), +- vupdate_int_entry(4), +- vupdate_int_entry(5), + vupdate_no_lock_int_entry(0), + vupdate_no_lock_int_entry(1), + vupdate_no_lock_int_entry(2), +diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c +index 0cb9dd6986ec3..9c3f9110895e8 100644 +--- a/drivers/gpu/drm/bridge/cdns-dsi.c ++++ b/drivers/gpu/drm/bridge/cdns-dsi.c +@@ -1284,6 +1284,7 @@ static const struct of_device_id cdns_dsi_of_match[] = { + { .compatible = "cdns,dsi" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match); + + static struct platform_driver cdns_dsi_platform_driver = { + .probe = cdns_dsi_drm_probe, +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 04431dbac4a4f..fb0b64c965b74 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -2118,7 +2118,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx) + if (ret) { + dev_err(ctx->dev, "Failed to register RC device\n"); + ctx->error = ret; +- rc_free_device(ctx->rc_dev); ++ rc_free_device(rc_dev); + return; + } + ctx->rc_dev = rc_dev; +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +index 77384c49fb8dd..2fc27931d3b56 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +@@ -1057,6 +1057,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev, + ret = mipi_dsi_host_register(&dsi->dsi_host); + if (ret) { + dev_err(dev, "Failed to register MIPI host: %d\n", ret); ++ pm_runtime_disable(dev); + dw_mipi_dsi_debugfs_remove(dsi); + return ERR_PTR(ret); + } +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 3f0a798906004..aeeab1b57aad3 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4380,7 +4380,8 @@ bool drm_detect_monitor_audio(struct edid *edid) + if (!edid_ext) + goto end; + +- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0); ++ has_audio = (edid_ext[0] == CEA_EXT && ++ (edid_ext[3] & EDID_BASIC_AUDIO) != 0); + + if (has_audio) { + DRM_DEBUG_KMS("Monitor has basic audio support\n"); +@@ -4533,16 +4534,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector, + connector->name, dc_bpc); + info->bpc = dc_bpc; + +- /* +- * Deep color support mandates RGB444 support for all video +- * modes and forbids YCRCB422 support for all video modes per +- * HDMI 1.3 spec. +- */ +- info->color_formats = DRM_COLOR_FORMAT_RGB444; +- + /* YCRCB444 is optional according to spec. */ + if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) { +- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; + DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n", + connector->name); + } +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 448c2f2d803a6..f5ab891731d0b 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index be55548f352af..e24272428744c 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -68,8 +68,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ drm_mode_destroy(connector->dev, mode); + return ret; ++ } + + drm_mode_copy(mode, &imxpd->mode); + mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, +diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c +index a5d47e301c5f7..13413d2b26028 100644 +--- a/drivers/gpu/drm/tegra/dsi.c ++++ b/drivers/gpu/drm/tegra/dsi.c +@@ -1455,8 +1455,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi) + dsi->slave = platform_get_drvdata(gangster); + of_node_put(np); + +- if (!dsi->slave) ++ if (!dsi->slave) { ++ put_device(&gangster->dev); + return -EPROBE_DEFER; ++ } + + dsi->slave->master = dsi; + } +diff --git a/drivers/greybus/svc.c b/drivers/greybus/svc.c +index ce7740ef449ba..51d0875a34800 100644 +--- a/drivers/greybus/svc.c ++++ b/drivers/greybus/svc.c +@@ -866,8 +866,14 @@ static int gb_svc_hello(struct gb_operation *op) + + gb_svc_debugfs_init(svc); + +- return gb_svc_queue_deferred_request(op); ++ ret = gb_svc_queue_deferred_request(op); ++ if (ret) ++ goto err_remove_debugfs; ++ ++ return 0; + ++err_remove_debugfs: ++ gb_svc_debugfs_exit(svc); + err_unregister_device: + gb_svc_watchdog_destroy(svc); + device_del(&svc->dev); +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 4267e2f2e70f4..a663cbb7b6832 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -1000,6 +1000,7 @@ static void logi_hidpp_recv_queue_notif(struct hid_device *hdev, + workitem.reports_supported |= STD_KEYBOARD; + break; + case 0x0f: ++ case 0x11: + device_type = "eQUAD Lightspeed 1.2"; + logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); + workitem.reports_supported |= STD_KEYBOARD; +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index ac076ac73de5d..1547b0ec6a113 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -622,6 +622,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + if (report_type == HID_OUTPUT_REPORT) + return -EINVAL; + ++ /* ++ * In case of unnumbered reports the response from the device will ++ * not have the report ID that the upper layers expect, so we need ++ * to stash it the buffer ourselves and adjust the data size. ++ */ ++ if (!report_number) { ++ buf[0] = 0; ++ buf++; ++ count--; ++ } ++ + /* +2 bytes to include the size of the reply in the query buffer */ + ask_count = min(count + 2, (size_t)ihid->bufsize); + +@@ -643,6 +654,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + count = min(count, ret_count - 2); + memcpy(buf, ihid->rawbuf + 2, count); + ++ if (!report_number) ++ count++; ++ + return count; + } + +@@ -659,17 +673,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf, + + mutex_lock(&ihid->reset_lock); + +- if (report_id) { +- buf++; +- count--; +- } +- ++ /* ++ * Note that both numbered and unnumbered reports passed here ++ * are supposed to have report ID stored in the 1st byte of the ++ * buffer, so we strip it off unconditionally before passing payload ++ * to i2c_hid_set_or_send_report which takes care of encoding ++ * everything properly. ++ */ + ret = i2c_hid_set_or_send_report(client, + report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, +- report_id, buf, count, use_data); ++ report_id, buf + 1, count - 1, use_data); + +- if (report_id && ret >= 0) +- ret++; /* add report_id to the number of transfered bytes */ ++ if (ret >= 0) ++ ret++; /* add report_id to the number of transferred bytes */ + + mutex_unlock(&ihid->reset_lock); + +diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c +index 6cf59fd26ad78..b6d6d119035ca 100644 +--- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c ++++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c +@@ -656,21 +656,12 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + */ + payload_max_size &= ~(L1_CACHE_BYTES - 1); + +- dma_buf = kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32); ++ dma_buf = dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_KERNEL); + if (!dma_buf) { + client_data->flag_retry = true; + return -ENOMEM; + } + +- dma_buf_phy = dma_map_single(devc, dma_buf, payload_max_size, +- DMA_TO_DEVICE); +- if (dma_mapping_error(devc, dma_buf_phy)) { +- dev_err(cl_data_to_dev(client_data), "DMA map failed\n"); +- client_data->flag_retry = true; +- rv = -ENOMEM; +- goto end_err_dma_buf_release; +- } +- + ldr_xfer_dma_frag.fragment.hdr.command = LOADER_CMD_XFER_FRAGMENT; + ldr_xfer_dma_frag.fragment.xfer_mode = LOADER_XFER_MODE_DIRECT_DMA; + ldr_xfer_dma_frag.ddr_phys_addr = (u64)dma_buf_phy; +@@ -690,14 +681,7 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + ldr_xfer_dma_frag.fragment.size = fragment_size; + memcpy(dma_buf, &fw->data[fragment_offset], fragment_size); + +- dma_sync_single_for_device(devc, dma_buf_phy, +- payload_max_size, +- DMA_TO_DEVICE); +- +- /* +- * Flush cache here because the dma_sync_single_for_device() +- * does not do for x86. +- */ ++ /* Flush cache to be sure the data is in main memory. */ + clflush_cache_range(dma_buf, payload_max_size); + + dev_dbg(cl_data_to_dev(client_data), +@@ -720,15 +704,8 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data, + fragment_offset += fragment_size; + } + +- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); +- kfree(dma_buf); +- return 0; +- + end_err_resp_buf_release: +- /* Free ISH buffer if not done already, in error case */ +- dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); +-end_err_dma_buf_release: +- kfree(dma_buf); ++ dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy); + return rv; + } + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index bd4e72f6dfd49..44d6de6fc03da 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1550,7 +1550,7 @@ static void balloon_onchannelcallback(void *context) + break; + + default: +- pr_warn("Unhandled message: type: %d\n", dm_hdr->type); ++ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type); + + } + } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 6b7ab8f234e87..943654ded73d0 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2493,10 +2493,15 @@ static void __exit vmbus_exit(void) + if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { + kmsg_dump_unregister(&hv_kmsg_dumper); + unregister_die_notifier(&hyperv_die_block); +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &hyperv_panic_block); + } + ++ /* ++ * The panic notifier is always registered, hence we should ++ * also unconditionally unregister it here as well. ++ */ ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &hyperv_panic_block); ++ + free_page((unsigned long)hv_panic_page); + unregister_sysctl_table(hv_ctl_table_hdr); + hv_ctl_table_hdr = NULL; +diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h +index d198af3a92b6f..9731f1f830b16 100644 +--- a/drivers/hwmon/pmbus/pmbus.h ++++ b/drivers/hwmon/pmbus/pmbus.h +@@ -292,6 +292,7 @@ enum pmbus_fan_mode { percent = 0, rpm }; + /* + * STATUS_VOUT, STATUS_INPUT + */ ++#define PB_VOLTAGE_VIN_OFF BIT(3) + #define PB_VOLTAGE_UV_FAULT BIT(4) + #define PB_VOLTAGE_UV_WARNING BIT(5) + #define PB_VOLTAGE_OV_WARNING BIT(6) +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index 8470097907bc2..beb443d020c20 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -1324,7 +1324,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { + .reg = PMBUS_VIN_UV_FAULT_LIMIT, + .attr = "lcrit", + .alarm = "lcrit_alarm", +- .sbit = PB_VOLTAGE_UV_FAULT, ++ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF, + }, { + .reg = PMBUS_VIN_OV_WARN_LIMIT, + .attr = "max", +@@ -2174,10 +2174,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); + int ret; + ++ mutex_lock(&data->update_lock); + ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION); ++ mutex_unlock(&data->update_lock); ++ + if (ret < 0) + return ret; + +@@ -2188,11 +2192,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); ++ int ret; + +- return pmbus_update_byte_data(client, page, PMBUS_OPERATION, +- PB_OPERATION_CONTROL_ON, +- enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_lock(&data->update_lock); ++ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION, ++ PB_OPERATION_CONTROL_ON, ++ enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_unlock(&data->update_lock); ++ ++ return ret; + } + + static int pmbus_regulator_enable(struct regulator_dev *rdev) +diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c +index 6c84780e358e8..066b12990fbfb 100644 +--- a/drivers/hwmon/sch56xx-common.c ++++ b/drivers/hwmon/sch56xx-common.c +@@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent, + if (nowayout) + set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); + if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) +- set_bit(WDOG_ACTIVE, &data->wddev.status); ++ set_bit(WDOG_HW_RUNNING, &data->wddev.status); + + /* Since the watchdog uses a downcounter there is no register to read + the BIOS set timeout from (if any was set at all) -> +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index ee44640edeb52..4c9e2fc533529 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -364,8 +364,12 @@ static ssize_t mode_store(struct device *dev, + mode = ETM_MODE_QELEM(config->mode); + /* start by clearing QE bits */ + config->cfg &= ~(BIT(13) | BIT(14)); +- /* if supported, Q elements with instruction counts are enabled */ +- if ((mode & BIT(0)) && (drvdata->q_support & BIT(0))) ++ /* ++ * if supported, Q elements with instruction counts are enabled. ++ * Always set the low bit for any requested mode. Valid combos are ++ * 0b00, 0b01 and 0b11. ++ */ ++ if (mode && drvdata->q_support) + config->cfg |= BIT(13); + /* + * if supported, Q elements with and without instruction +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 37b3b9307d076..a48bee59dcdec 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -715,7 +715,6 @@ static const struct i2c_adapter_quirks xiic_quirks = { + + static const struct i2c_adapter xiic_adapter = { + .owner = THIS_MODULE, +- .name = DRIVER_NAME, + .class = I2C_CLASS_DEPRECATED, + .algo = &xiic_algorithm, + .quirks = &xiic_quirks, +@@ -752,6 +751,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ snprintf(i2c->adap.name, sizeof(i2c->adap.name), ++ DRIVER_NAME " %s", pdev->name); + + mutex_init(&i2c->lock); + init_waitqueue_head(&i2c->wait); +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 5365199a31f41..f7a7405d4350a 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +- goto err_rollback; ++ goto err_rollback_activation; + + err = device_create_file(&pdev->dev, &dev_attr_current_master); + if (err) +@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); +-err_rollback: ++err_rollback_activation: + i2c_demux_deactivate_master(priv); ++err_rollback: + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index f24148bd15de4..fb77c3ff5a3e4 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) + ret = devm_request_threaded_irq(dev, irq, NULL, + twl6030_gpadc_irq_handler, + IRQF_ONESHOT, "twl6030_gpadc", indio_dev); ++ if (ret) ++ return ret; + + ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK); + if (ret < 0) { +diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c +index e9ceee66d1e7c..d9c41db8155f9 100644 +--- a/drivers/iio/afe/iio-rescale.c ++++ b/drivers/iio/afe/iio-rescale.c +@@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + int *val, int *val2, long mask) + { + struct rescale *rescale = iio_priv(indio_dev); +- unsigned long long tmp; ++ s64 tmp; + int ret; + + switch (mask) { +@@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + *val2 = rescale->denominator; + return IIO_VAL_FRACTIONAL; + case IIO_VAL_FRACTIONAL_LOG2: +- tmp = *val * 1000000000LL; +- do_div(tmp, rescale->denominator); ++ tmp = (s64)*val * 1000000000LL; ++ tmp = div_s64(tmp, rescale->denominator); + tmp *= rescale->numerator; +- do_div(tmp, 1000000000LL); ++ tmp = div_s64(tmp, 1000000000LL); + *val = tmp; + return ret; + default: +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 5a8351c9a4265..ca0fe902a7db4 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -588,28 +588,50 @@ EXPORT_SYMBOL_GPL(iio_read_channel_average_raw); + static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + int raw, int *processed, unsigned int scale) + { +- int scale_type, scale_val, scale_val2, offset; ++ int scale_type, scale_val, scale_val2; ++ int offset_type, offset_val, offset_val2; + s64 raw64 = raw; +- int ret; + +- ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET); +- if (ret >= 0) +- raw64 += offset; ++ offset_type = iio_channel_read(chan, &offset_val, &offset_val2, ++ IIO_CHAN_INFO_OFFSET); ++ if (offset_type >= 0) { ++ switch (offset_type) { ++ case IIO_VAL_INT: ++ break; ++ case IIO_VAL_INT_PLUS_MICRO: ++ case IIO_VAL_INT_PLUS_NANO: ++ /* ++ * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO ++ * implicitely truncate the offset to it's integer form. ++ */ ++ break; ++ case IIO_VAL_FRACTIONAL: ++ offset_val /= offset_val2; ++ break; ++ case IIO_VAL_FRACTIONAL_LOG2: ++ offset_val >>= offset_val2; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ raw64 += offset_val; ++ } + + scale_type = iio_channel_read(chan, &scale_val, &scale_val2, + IIO_CHAN_INFO_SCALE); + if (scale_type < 0) { + /* +- * Just pass raw values as processed if no scaling is +- * available. ++ * If no channel scaling is available apply consumer scale to ++ * raw value and return. + */ +- *processed = raw; ++ *processed = raw * scale; + return 0; + } + + switch (scale_type) { + case IIO_VAL_INT: +- *processed = raw64 * scale_val; ++ *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: + if (scale_val2 < 0) +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 5e2b688e36fca..de7df5ab06f3b 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2559,7 +2559,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout) + { + struct rdma_id_private *id_priv; + +- if (id->qp_type != IB_QPT_RC) ++ if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI) + return -EINVAL; + + id_priv = container_of(id, struct rdma_id_private, id); +diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c +index 664e0f374ac00..747f42855b7bd 100644 +--- a/drivers/infiniband/hw/mlx5/devx.c ++++ b/drivers/infiniband/hw/mlx5/devx.c +@@ -1844,8 +1844,10 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, + key_level2, + obj_event, + GFP_KERNEL); +- if (err) ++ if (err) { ++ kfree(obj_event); + return err; ++ } + INIT_LIST_HEAD(&obj_event->obj_sub_list); + } + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index a5152f097cb7a..48e8612c1bc8d 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -3227,7 +3227,11 @@ serr_no_r_lock: + spin_lock_irqsave(&sqp->s_lock, flags); + rvt_send_complete(sqp, wqe, send_status); + if (sqp->ibqp.qp_type == IB_QPT_RC) { +- int lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ int lastwqe; ++ ++ spin_lock(&sqp->r_lock); ++ lastwqe = rvt_error_qp(sqp, IB_WC_WR_FLUSH_ERR); ++ spin_unlock(&sqp->r_lock); + + sqp->s_flags &= ~RVT_S_BUSY; + spin_unlock_irqrestore(&sqp->s_lock, flags); +diff --git a/drivers/input/input.c b/drivers/input/input.c +index f7398b996bacf..e2eb9b9b8363d 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -2181,12 +2181,6 @@ int input_register_device(struct input_dev *dev) + /* KEY_RESERVED is not supposed to be transmitted to userspace. */ + __clear_bit(KEY_RESERVED, dev->keybit); + +- /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ +- if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { +- __clear_bit(BTN_RIGHT, dev->keybit); +- __clear_bit(BTN_MIDDLE, dev->keybit); +- } +- + /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ + input_cleanse_bitmasks(dev); + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index ef6af714a7e64..02c2fb551f381 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1708,6 +1708,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + dev_info(smmu->dev, "\t0x%016llx\n", + (unsigned long long)evt[i]); + ++ cond_resched(); + } + + /* +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 906582a21124d..628a586be6959 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -138,10 +138,11 @@ __cached_rbnode_delete_update(struct iova_domain *iovad, struct iova *free) + cached_iova = rb_entry(iovad->cached32_node, struct iova, node); + if (free == cached_iova || + (free->pfn_hi < iovad->dma_32bit_pfn && +- free->pfn_lo >= cached_iova->pfn_lo)) { ++ free->pfn_lo >= cached_iova->pfn_lo)) + iovad->cached32_node = rb_next(&free->node); ++ ++ if (free->pfn_lo < iovad->dma_32bit_pfn) + iovad->max32_alloc_size = iovad->dma_32bit_pfn; +- } + + cached_iova = rb_entry(iovad->cached_node, struct iova, node); + if (free->pfn_lo >= cached_iova->pfn_lo) +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 2639fc7181171..584eefab1dbcd 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -1061,7 +1061,9 @@ static int ipmmu_probe(struct platform_device *pdev) + bitmap_zero(mmu->ctx, IPMMU_CTX_MAX); + mmu->features = of_device_get_match_data(&pdev->dev); + memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs); +- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ if (ret) ++ return ret; + + /* Map I/O memory and request IRQ. */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 9d0b42cb9903e..f589ca2480a1d 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -162,11 +162,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d) + } + } + +-static void gic_do_wait_for_rwp(void __iomem *base) ++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) + { + u32 count = 1000000; /* 1s! */ + +- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { ++ while (readl_relaxed(base + GICD_CTLR) & bit) { + count--; + if (!count) { + pr_err_ratelimited("RWP timeout, gone fishing\n"); +@@ -180,13 +180,13 @@ static void gic_do_wait_for_rwp(void __iomem *base) + /* Wait for completion of a distributor change */ + static void gic_dist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data.dist_base); ++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); + } + + /* Wait for completion of a redistributor change */ + static void gic_redist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); ++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); + } + + #ifdef CONFIG_ARM64 +diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c +index 160b39b5cd108..128a26d219e2c 100644 +--- a/drivers/irqchip/irq-nvic.c ++++ b/drivers/irqchip/irq-nvic.c +@@ -105,6 +105,7 @@ static int __init nvic_of_init(struct device_node *node, + + if (!nvic_irq_domain) { + pr_warn("Failed to allocate irq domain\n"); ++ iounmap(nvic_base); + return -ENOMEM; + } + +@@ -114,6 +115,7 @@ static int __init nvic_of_init(struct device_node *node, + if (ret) { + pr_warn("Failed to allocate irq chips\n"); + irq_domain_remove(nvic_irq_domain); ++ iounmap(nvic_base); + return ret; + } + +diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c +index faa7d61b9d6c4..239a889df6080 100644 +--- a/drivers/irqchip/qcom-pdc.c ++++ b/drivers/irqchip/qcom-pdc.c +@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i) + static void pdc_enable_intr(struct irq_data *d, bool on) + { + int pin_out = d->hwirq; ++ unsigned long flags; + u32 index, mask; + u32 enable; + + index = pin_out / 32; + mask = pin_out % 32; + +- raw_spin_lock(&pdc_lock); ++ raw_spin_lock_irqsave(&pdc_lock, flags); + enable = pdc_reg_read(IRQ_ENABLE_BANK, index); + enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask); + pdc_reg_write(IRQ_ENABLE_BANK, index, enable); +- raw_spin_unlock(&pdc_lock); ++ raw_spin_unlock_irqrestore(&pdc_lock, flags); + } + + static void qcom_pdc_gic_mask(struct irq_data *d) +diff --git a/drivers/mailbox/tegra-hsp.c b/drivers/mailbox/tegra-hsp.c +index 834b35dc3b137..e9b392dc09bc2 100644 +--- a/drivers/mailbox/tegra-hsp.c ++++ b/drivers/mailbox/tegra-hsp.c +@@ -403,6 +403,11 @@ static int tegra_hsp_mailbox_flush(struct mbox_chan *chan, + value = tegra_hsp_channel_readl(ch, HSP_SM_SHRD_MBOX); + if ((value & HSP_SM_SHRD_MBOX_FULL) == 0) { + mbox_chan_txdone(chan, 0); ++ ++ /* Wait until channel is empty */ ++ if (chan->active_req != NULL) ++ continue; ++ + return 0; + } + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 571c04e70343a..3ed8ca47bc6e6 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2010,7 +2010,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string + + static int get_key_size(char **key_string) + { +- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1; ++ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1); + } + + #endif +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 3f15d8dc2b71f..7a73f2fa0ad72 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) + if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) + return NULL; + ++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); + *ioctl_flags = _ioctls[cmd].flags; + return _ioctls[cmd].fn; + } +diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c +index 809fa44ed9880..86267e01c2511 100644 +--- a/drivers/media/i2c/adv7511-v4l2.c ++++ b/drivers/media/i2c/adv7511-v4l2.c +@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ + buffer[3] = 0; + buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index b887299ac195f..1cee69919e1b9 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2444,7 +2444,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, + buffer[i + 3] = infoframe_read(sd, + adv76xx_cri[index].payload_addr + i); + +- if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, + adv76xx_cri[index].desc); + return -ENOENT; +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index 02cbab826d0b6..a581e822ce6f5 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, struct adv7842_cfg_read_infofr + for (i = 0; i < len; i++) + buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 570530d976d21..6441e7d63d971 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -3898,7 +3898,7 @@ static int bttv_register_video(struct bttv *btv) + + /* video */ + vdev_init(btv, &btv->video_dev, &bttv_video_template, "video"); +- btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER | ++ btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | + V4L2_CAP_READWRITE | V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->video_dev.device_caps |= V4L2_CAP_TUNER; +@@ -3919,7 +3919,7 @@ static int bttv_register_video(struct bttv *btv) + /* vbi */ + vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi"); + btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE | +- V4L2_CAP_STREAMING | V4L2_CAP_TUNER; ++ V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->vbi_dev.device_caps |= V4L2_CAP_TUNER; + +diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c +index a57c991b165b1..10d2971ef0624 100644 +--- a/drivers/media/pci/cx88/cx88-mpeg.c ++++ b/drivers/media/pci/cx88/cx88-mpeg.c +@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev *dev, + cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET); + q->count = 0; + ++ /* clear interrupt status register */ ++ cx_write(MO_TS_INTSTAT, 0x1f1111); ++ + /* enable irqs */ + dprintk(1, "setting the interrupt mask\n"); + cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT); +diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h +index cafba6b1055df..90f38552bd362 100644 +--- a/drivers/media/pci/ivtv/ivtv-driver.h ++++ b/drivers/media/pci/ivtv/ivtv-driver.h +@@ -333,7 +333,6 @@ struct ivtv_stream { + struct ivtv *itv; /* for ease of use */ + const char *name; /* name of the stream */ + int type; /* stream type */ +- u32 caps; /* V4L2 capabilities */ + + struct v4l2_fh *fh; /* pointer to the streaming filehandle */ + spinlock_t qlock; /* locks access to the queues */ +diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c +index 137853944e461..396cc931f41a2 100644 +--- a/drivers/media/pci/ivtv/ivtv-ioctl.c ++++ b/drivers/media/pci/ivtv/ivtv-ioctl.c +@@ -443,7 +443,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct v4l2_window *winfmt = &fmt->fmt.win; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -554,7 +554,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2 + u32 chromakey = fmt->fmt.win.chromakey; + u8 global_alpha = fmt->fmt.win.global_alpha; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -1386,7 +1386,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb) + 0, + }; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1453,7 +1453,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct yuv_playback_info *yi = &itv->yuv_info; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1473,7 +1473,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on) + struct ivtv *itv = id->itv; + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c +index f7de9118f609d..200d2100dbffd 100644 +--- a/drivers/media/pci/ivtv/ivtv-streams.c ++++ b/drivers/media/pci/ivtv/ivtv-streams.c +@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type) + s->itv = itv; + s->type = type; + s->name = ivtv_stream_info[type].name; +- s->caps = ivtv_stream_info[type].v4l2_caps; ++ s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps; + + if (ivtv_stream_info[type].pio) + s->dma = PCI_DMA_NONE; +@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type) + if (s_mpg->vdev.v4l2_dev) + num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset; + } +- s->vdev.device_caps = s->caps; +- if (itv->osd_video_pbase) { +- itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; +- itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; ++ if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV || ++ type == IVTV_DEC_STREAM_TYPE_MPG)) { ++ s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + } + video_set_drvdata(&s->vdev, s); +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index 1e0867016bf37..c87eddb1c93f7 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -151,7 +151,7 @@ + #define VE_SRC_TB_EDGE_DET_BOT GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF) + + #define VE_MODE_DETECT_STATUS 0x098 +-#define VE_MODE_DETECT_H_PIXELS GENMASK(11, 0) ++#define VE_MODE_DETECT_H_PERIOD GENMASK(11, 0) + #define VE_MODE_DETECT_V_LINES_SHF 16 + #define VE_MODE_DETECT_V_LINES GENMASK(27, VE_MODE_DETECT_V_LINES_SHF) + #define VE_MODE_DETECT_STATUS_VSYNC BIT(28) +@@ -162,6 +162,8 @@ + #define VE_SYNC_STATUS_VSYNC_SHF 16 + #define VE_SYNC_STATUS_VSYNC GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF) + ++#define VE_H_TOTAL_PIXELS 0x0A0 ++ + #define VE_INTERRUPT_CTRL 0x304 + #define VE_INTERRUPT_STATUS 0x308 + #define VE_INTERRUPT_MODE_DETECT_WD BIT(0) +@@ -743,6 +745,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + u32 src_lr_edge; + u32 src_tb_edge; + u32 sync; ++ u32 htotal; + struct v4l2_bt_timings *det = &video->detected_timings; + + det->width = MIN_WIDTH; +@@ -787,6 +790,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET); + mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS); + sync = aspeed_video_read(video, VE_SYNC_STATUS); ++ htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS); + + video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >> + VE_SRC_TB_EDGE_DET_BOT_SHF; +@@ -803,8 +807,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + VE_SRC_LR_EDGE_DET_RT_SHF; + video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT; + det->hfrontporch = video->frame_left; +- det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) - +- video->frame_right; ++ det->hbackporch = htotal - video->frame_right; + det->hsync = sync & VE_SYNC_STATUS_HSYNC; + if (video->frame_left > video->frame_right) + continue; +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 834f11fe9dc29..0adc54832657b 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -372,6 +372,7 @@ static struct vdoa_data *coda_get_vdoa_data(void) + if (!vdoa_data) + vdoa_data = ERR_PTR(-EPROBE_DEFER); + ++ put_device(&vdoa_pdev->dev); + out: + of_node_put(vdoa_node); + +diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c +index df66461f5d4f1..e7e8eba048acf 100644 +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -496,6 +496,7 @@ static int vpif_probe(struct platform_device *pdev) + + static int vpif_remove(struct platform_device *pdev) + { ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return 0; + } +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index bfca9d0a1fe15..5ae13ee9272d5 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3821,6 +3821,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + goto err_free; + } + ++ kref_init(&dev->ref); ++ + dev->devno = nr; + dev->model = id->driver_info; + dev->alt = -1; +@@ -3921,6 +3923,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + } + + if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { ++ kref_init(&dev->dev_next->ref); ++ + dev->dev_next->ts = SECONDARY_TS; + dev->dev_next->alt = -1; + dev->dev_next->is_audio_only = has_vendor_audio && +@@ -3975,12 +3979,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + em28xx_write_reg(dev, 0x0b, 0x82); + mdelay(100); + } +- +- kref_init(&dev->dev_next->ref); + } + +- kref_init(&dev->ref); +- + request_modules(dev); + + /* +@@ -4035,11 +4035,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + + em28xx_close_extension(dev); + +- if (dev->dev_next) { +- em28xx_close_extension(dev->dev_next); ++ if (dev->dev_next) + em28xx_release_resources(dev->dev_next); +- } +- + em28xx_release_resources(dev); + + if (dev->dev_next) { +diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c +index 49e75a1a1f3f8..af3b18c6d9e17 100644 +--- a/drivers/media/usb/go7007/s2250-board.c ++++ b/drivers/media/usb/go7007/s2250-board.c +@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client, + u8 *data; + struct go7007 *go = i2c_get_adapdata(adapter); + struct go7007_usb *usb = go->hpi_context; ++ int err = -EIO; + + audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1); + if (IS_ERR(audio)) +@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client, + V4L2_CID_HUE, -512, 511, 1, 0); + sd->ctrl_handler = &state->hdl; + if (state->hdl.error) { +- int err = state->hdl.error; +- +- v4l2_ctrl_handler_free(&state->hdl); +- kfree(state); +- return err; ++ err = state->hdl.error; ++ goto fail; + } + + state->std = V4L2_STD_NTSC; +@@ -600,7 +598,7 @@ fail: + i2c_unregister_device(audio); + v4l2_ctrl_handler_free(&state->hdl); + kfree(state); +- return -EIO; ++ return err; + } + + static int s2250_remove(struct i2c_client *client) +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index bad71d863d395..7849f1fbbcc4d 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev) + + dev->status = STATUS_STREAMING; + +- INIT_WORK(&dev->worker, hdpvr_transmit_buffers); + schedule_work(&dev->worker); + + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, +@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, + bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP; + int res; + ++ // initialize dev->worker ++ INIT_WORK(&dev->worker, hdpvr_transmit_buffers); ++ + dev->cur_std = V4L2_STD_525_60; + dev->width = 720; + dev->height = 480; +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index 4e1698f788187..ce717502ea4c3 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface) + /* Here is the only place where isoc get released */ + stk1160_uninit_isoc(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + video_unregister_device(&dev->vdev); + v4l2_device_disconnect(&dev->v4l2_dev); +diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c +index bcd14c66e8dfa..a307807571ab9 100644 +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -258,7 +258,7 @@ out_uninit: + stk1160_uninit_isoc(dev); + out_stop_hw: + usb_set_interface(dev->udev, 0, 0); +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); + + mutex_unlock(&dev->v4l_lock); + +@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) + + stk1160_stop_hw(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + stk1160_dbg("streaming stopped\n"); + +@@ -745,7 +745,7 @@ static const struct video_device v4l_template = { + /********************************************************************/ + + /* Must be called with both v4l_lock and vb_queue_lock hold */ +-void stk1160_clear_queue(struct stk1160 *dev) ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) + { + struct stk1160_buffer *buf; + unsigned long flags; +@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = list_first_entry(&dev->avail_bufs, + struct stk1160_buffer, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = dev->isoc_ctl.buf; + dev->isoc_ctl.buf = NULL; + +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h +index a31ea1c80f255..a70963ce87533 100644 +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -166,7 +166,7 @@ struct regval { + int stk1160_vb2_setup(struct stk1160 *dev); + int stk1160_video_register(struct stk1160 *dev); + void stk1160_video_unregister(struct stk1160 *dev); +-void stk1160_clear_queue(struct stk1160 *dev); ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); + + /* Provided by stk1160-video.c */ + int stk1160_alloc_isoc(struct stk1160 *dev); +diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c +index af296b6fcbbdc..9c4c668f9a88a 100644 +--- a/drivers/memory/emif.c ++++ b/drivers/memory/emif.c +@@ -1423,7 +1423,7 @@ static struct emif_data *__init_or_module get_device_details( + temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); + dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL); + +- if (!emif || !pd || !dev_info) { ++ if (!emif || !temp || !dev_info) { + dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__); + goto error; + } +@@ -1515,7 +1515,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + { + struct emif_data *emif; + struct resource *res; +- int irq; ++ int irq, ret; + + if (pdev->dev.of_node) + emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev); +@@ -1549,7 +1549,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + emif_onetime_settings(emif); + emif_debugfs_init(emif); + disable_and_clear_all_interrupts(emif); +- setup_interrupts(emif, irq); ++ ret = setup_interrupts(emif, irq); ++ if (ret) ++ goto error; + + /* One-time actions taken on probing the first device */ + if (!emif1) { +diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c +index a6bd2134cea2a..14e4bbe6a9da3 100644 +--- a/drivers/mfd/asic3.c ++++ b/drivers/mfd/asic3.c +@@ -914,14 +914,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + if (mem_sdio && (irq >= 0)) { + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_mmc, 1, mem_sdio, irq, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + ret = 0; +@@ -935,8 +935,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, 0, + asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL); + } ++ return ret; + +- out: ++out_unmap: ++ if (asic->tmio_cnf) ++ iounmap(asic->tmio_cnf); ++out: + return ret; + } + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index 1abe7432aad82..e281a9202f110 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + adc1 |= MC13783_ADC1_ATOX; + + dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__); +- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, ++ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, + mc13xxx_handler_adcdone, __func__, &adcdone_data); ++ if (ret) ++ goto out; + + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0); + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1); +diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c +index 1fadb95b85b09..ba5d5c102b3cc 100644 +--- a/drivers/misc/cardreader/alcor_pci.c ++++ b/drivers/misc/cardreader/alcor_pci.c +@@ -260,7 +260,7 @@ static int alcor_pci_probe(struct pci_dev *pdev, + if (!priv) + return -ENOMEM; + +- ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL); ++ ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL); + if (ret < 0) + return ret; + priv->id = ret; +@@ -274,7 +274,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI); + if (ret) { + dev_err(&pdev->dev, "Cannot request region\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto error_free_ida; + } + + if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) { +@@ -318,6 +319,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + + error_release_regions: + pci_release_regions(pdev); ++error_free_ida: ++ ida_free(&alcor_pci_idr, priv->id); + return ret; + } + +@@ -331,7 +334,7 @@ static void alcor_pci_remove(struct pci_dev *pdev) + + mfd_remove_devices(&pdev->dev); + +- ida_simple_remove(&alcor_pci_idr, priv->id); ++ ida_free(&alcor_pci_idr, priv->id); + + pci_release_regions(pdev); + pci_set_drvdata(pdev, NULL); +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index 8d18f19c99c4b..2f88581057335 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -1060,10 +1060,10 @@ static int kgdbts_option_setup(char *opt) + { + if (strlen(opt) >= MAX_CONFIG_LEN) { + printk(KERN_ERR "kgdbts: config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); +- return 0; ++ return 1; + } + + __setup("kgdbts=", kgdbts_option_setup); +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index e955f1ef25643..32801639e0be5 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -497,6 +497,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + + EXPORT_SYMBOL(mmc_alloc_host); + ++static int mmc_validate_host_caps(struct mmc_host *host) ++{ ++ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) { ++ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * mmc_add_host - initialise host hardware + * @host: mmc host +@@ -509,8 +519,9 @@ int mmc_add_host(struct mmc_host *host) + { + int err; + +- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) && +- !host->ops->enable_sdio_irq); ++ err = mmc_validate_host_caps(host); ++ if (err) ++ return err; + + err = device_add(&host->class_dev); + if (err) +diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c +index ebfaeb33bc8c0..ade7c022a33c0 100644 +--- a/drivers/mmc/host/davinci_mmc.c ++++ b/drivers/mmc/host/davinci_mmc.c +@@ -1376,8 +1376,12 @@ static int davinci_mmcsd_suspend(struct device *dev) + static int davinci_mmcsd_resume(struct device *dev) + { + struct mmc_davinci_host *host = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(host->clk); ++ if (ret) ++ return ret; + +- clk_enable(host->clk); + mmc_davinci_reset_ctrl(host, 0); + + return 0; +diff --git a/drivers/mmc/host/mmci_stm32_sdmmc.c b/drivers/mmc/host/mmci_stm32_sdmmc.c +index 0953bd8a4f79d..3bb59d670220f 100644 +--- a/drivers/mmc/host/mmci_stm32_sdmmc.c ++++ b/drivers/mmc/host/mmci_stm32_sdmmc.c +@@ -36,8 +36,8 @@ int sdmmc_idma_validate_data(struct mmci_host *host, + * excepted the last element which has no constraint on idmasize + */ + for_each_sg(data->sg, sg, data->sg_len - 1, i) { +- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32)) || +- !IS_ALIGNED(sg_dma_len(data->sg), SDMMC_IDMA_BURST)) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32)) || ++ !IS_ALIGNED(sg->length, SDMMC_IDMA_BURST)) { + dev_err(mmc_dev(host->mmc), + "unaligned scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +@@ -45,7 +45,7 @@ int sdmmc_idma_validate_data(struct mmci_host *host, + } + } + +- if (!IS_ALIGNED(sg_dma_address(data->sg), sizeof(u32))) { ++ if (!IS_ALIGNED(sg->offset, sizeof(u32))) { + dev_err(mmc_dev(host->mmc), + "unaligned last scatterlist: ofst:%x length:%d\n", + data->sg->offset, data->sg->length); +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index 689eb119d44fc..23fd93407eced 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -349,10 +349,10 @@ static void renesas_sdhi_hs400_complete(struct tmio_mmc_host *host) + SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) | + sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2)); + +- /* Set the sampling clock selection range of HS400 mode */ + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL, + SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN | +- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT); ++ sd_scc_read32(host, priv, ++ SH_MOBILE_SDHI_SCC_DTCNTL)); + + + if (host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400) +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index 5f57e78e5f13f..6f6fb4c4448f0 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -240,16 +240,6 @@ static void xenon_voltage_switch(struct sdhci_host *host) + { + /* Wait for 5ms after set 1.8V signal enable bit */ + usleep_range(5000, 5500); +- +- /* +- * For some reason the controller's Host Control2 register reports +- * the bit representing 1.8V signaling as 0 when read after it was +- * written as 1. Subsequent read reports 1. +- * +- * Since this may cause some issues, do an empty read of the Host +- * Control2 register here to circumvent this. +- */ +- sdhci_readw(host, SDHCI_HOST_CONTROL2); + } + + static const struct sdhci_ops sdhci_xenon_ops = { +diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c +index 8b6f4da5d7201..a4b8b65fe15f5 100644 +--- a/drivers/mtd/nand/onenand/generic.c ++++ b/drivers/mtd/nand/onenand/generic.c +@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev) + } + + info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL; +- info->onenand.irq = platform_get_irq(pdev, 0); ++ ++ err = platform_get_irq(pdev, 0); ++ if (err < 0) ++ goto out_iounmap; ++ ++ info->onenand.irq = err; + + info->mtd.dev.parent = &pdev->dev; + info->mtd.priv = &info->onenand; +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 23d11e8b56441..17c751f359d3d 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -2004,13 +2004,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + nc->mck = of_clk_get(dev->parent->of_node, 0); + if (IS_ERR(nc->mck)) { + dev_err(dev, "Failed to retrieve MCK clk\n"); +- return PTR_ERR(nc->mck); ++ ret = PTR_ERR(nc->mck); ++ goto out_release_dma; + } + + np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0); + if (!np) { + dev_err(dev, "Missing or invalid atmel,smc property\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_release_dma; + } + + nc->smc = syscon_node_to_regmap(np); +@@ -2018,10 +2020,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + if (IS_ERR(nc->smc)) { + ret = PTR_ERR(nc->smc); + dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); +- return ret; ++ goto out_release_dma; + } + + return 0; ++ ++out_release_dma: ++ if (nc->dmac) ++ dma_release_channel(nc->dmac); ++ ++ return ret; + } + + static int +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index ab2f824abf549..02218c3b548f9 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -645,6 +645,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + const struct nand_sdr_timings *sdr) + { + struct gpmi_nfc_hardware_timing *hw = &this->hw; ++ struct resources *r = &this->resources; + unsigned int dll_threshold_ps = this->devdata->max_chain_delay; + unsigned int period_ps, reference_period_ps; + unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles; +@@ -668,6 +669,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; + } + ++ hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); ++ + /* SDR core timings are given in picoseconds */ + period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate); + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index d636bbe214cb9..df521ff0b3280 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -350,9 +350,6 @@ static ssize_t dev_attribute_show(struct device *dev, + * we still can use 'ubi->ubi_num'. + */ + ubi = container_of(dev, struct ubi_device, dev); +- ubi = ubi_get_device(ubi->ubi_num); +- if (!ubi) +- return -ENODEV; + + if (attr == &dev_eraseblock_size) + ret = sprintf(buf, "%d\n", ubi->leb_size); +@@ -381,7 +378,6 @@ static ssize_t dev_attribute_show(struct device *dev, + else + ret = -EINVAL; + +- ubi_put_device(ubi); + return ret; + } + +@@ -956,9 +952,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + goto out_detach; + } + +- /* Make device "available" before it becomes accessible via sysfs */ +- ubi_devices[ubi_num] = ubi; +- + err = uif_init(ubi); + if (err) + goto out_detach; +@@ -1003,6 +996,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + wake_up_process(ubi->bgt_thread); + spin_unlock(&ubi->wl_lock); + ++ ubi_devices[ubi_num] = ubi; + ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); + return ubi_num; + +@@ -1011,7 +1005,6 @@ out_debugfs: + out_uif: + uif_close(ubi); + out_detach: +- ubi_devices[ubi_num] = NULL; + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index 53f448e7433a9..6e95c4b1473e6 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -468,7 +468,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, + if (err == UBI_IO_FF_BITFLIPS) + scrub = 1; + +- add_aeb(ai, free, pnum, ec, scrub); ++ ret = add_aeb(ai, free, pnum, ec, scrub); ++ if (ret) ++ goto out; + continue; + } else if (err == 0 || err == UBI_IO_BITFLIPS) { + dbg_bld("Found non empty PEB:%i in pool", pnum); +@@ -638,8 +640,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from used list */ +@@ -649,8 +653,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from scrub list */ +@@ -660,8 +666,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + /* read EC values from erase list */ +@@ -671,8 +679,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count); +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 139ee132bfbcf..1bc7b3a056046 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -56,16 +56,11 @@ static ssize_t vol_attribute_show(struct device *dev, + { + int ret; + struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev); +- struct ubi_device *ubi; +- +- ubi = ubi_get_device(vol->ubi->ubi_num); +- if (!ubi) +- return -ENODEV; ++ struct ubi_device *ubi = vol->ubi; + + spin_lock(&ubi->volumes_lock); + if (!ubi->volumes[vol->vol_id]) { + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return -ENODEV; + } + /* Take a reference to prevent volume removal */ +@@ -103,7 +98,6 @@ static ssize_t vol_attribute_show(struct device *dev, + vol->ref_count -= 1; + ubi_assert(vol->ref_count >= 0); + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return ret; + } + +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 249d2fba28c7f..6458da9c13b95 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -823,7 +823,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne + + usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); +- dev_kfree_skb(skb); + + atomic_dec(&dev->active_tx_urbs); + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 41eee6f0491c6..957e51a77d4d1 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -33,10 +33,6 @@ + #define MCBA_USB_RX_BUFF_SIZE 64 + #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) + +-/* MCBA endpoint numbers */ +-#define MCBA_USB_EP_IN 1 +-#define MCBA_USB_EP_OUT 1 +- + /* Microchip command id */ + #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 + #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 +@@ -84,6 +80,8 @@ struct mcba_priv { + atomic_t free_ctx_cnt; + void *rxbuf[MCBA_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; ++ int rx_pipe; ++ int tx_pipe; + }; + + /* CAN frame */ +@@ -272,10 +270,8 @@ static netdev_tx_t mcba_usb_xmit(struct mcba_priv *priv, + + memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); + +- usb_fill_bulk_urb(urb, priv->udev, +- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, +- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, +- ctx); ++ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, ++ mcba_usb_write_bulk_callback, ctx); + + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + usb_anchor_urb(urb, &priv->tx_submitted); +@@ -368,7 +364,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + xmit_failed: + can_free_echo_skb(priv->netdev, ctx->ndx); + mcba_usb_free_ctx(ctx); +- dev_kfree_skb(skb); + stats->tx_dropped++; + + return NETDEV_TX_OK; +@@ -611,7 +606,7 @@ static void mcba_usb_read_bulk_callback(struct urb *urb) + resubmit_urb: + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), ++ priv->rx_pipe, + urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + +@@ -656,7 +651,7 @@ static int mcba_usb_start(struct mcba_priv *priv) + urb->transfer_dma = buf_dma; + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), ++ priv->rx_pipe, + buf, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +@@ -810,6 +805,13 @@ static int mcba_usb_probe(struct usb_interface *intf, + struct mcba_priv *priv; + int err = -ENOMEM; + struct usb_device *usbdev = interface_to_usbdev(intf); ++ struct usb_endpoint_descriptor *in, *out; ++ ++ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); ++ if (err) { ++ dev_err(&intf->dev, "Can't find endpoints\n"); ++ return err; ++ } + + netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); + if (!netdev) { +@@ -855,6 +857,9 @@ static int mcba_usb_probe(struct usb_interface *intf, + goto cleanup_free_candev; + } + ++ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); ++ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); ++ + devm_can_led_init(netdev); + + /* Start USB dev only if we have successfully registered CAN device */ +diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c +index 7000c6cd1e48b..282c53ef76d23 100644 +--- a/drivers/net/can/vxcan.c ++++ b/drivers/net/can/vxcan.c +@@ -148,7 +148,7 @@ static void vxcan_setup(struct net_device *dev) + dev->hard_header_len = 0; + dev->addr_len = 0; + dev->tx_queue_len = 0; +- dev->flags = (IFF_NOARP|IFF_ECHO); ++ dev->flags = IFF_NOARP; + dev->netdev_ops = &vxcan_netdev_ops; + dev->needs_free_netdev = true; + +diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c +index e15d18bb981e9..5cc31118b97e9 100644 +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -542,14 +542,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv, + static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv, + int port, u32 location) + { +- struct cfp_rule *rule = NULL; ++ struct cfp_rule *rule; + + list_for_each_entry(rule, &priv->cfp.rules_list, next) { + if (rule->port == port && rule->fs.location == location) +- break; ++ return rule; + } + +- return rule; ++ return NULL; + } + + static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, +diff --git a/drivers/net/dsa/microchip/ksz8795_spi.c b/drivers/net/dsa/microchip/ksz8795_spi.c +index 8b00f8e6c02f4..5639c5c59e255 100644 +--- a/drivers/net/dsa/microchip/ksz8795_spi.c ++++ b/drivers/net/dsa/microchip/ksz8795_spi.c +@@ -86,12 +86,23 @@ static const struct of_device_id ksz8795_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, ksz8795_dt_ids); + ++static const struct spi_device_id ksz8795_spi_ids[] = { ++ { "ksz8765" }, ++ { "ksz8794" }, ++ { "ksz8795" }, ++ { "ksz8863" }, ++ { "ksz8873" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, ksz8795_spi_ids); ++ + static struct spi_driver ksz8795_spi_driver = { + .driver = { + .name = "ksz8795-switch", + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(ksz8795_dt_ids), + }, ++ .id_table = ksz8795_spi_ids, + .probe = ksz8795_spi_probe, + .remove = ksz8795_spi_remove, + .shutdown = ksz8795_spi_shutdown, +diff --git a/drivers/net/dsa/microchip/ksz9477_spi.c b/drivers/net/dsa/microchip/ksz9477_spi.c +index 1142768969c20..9bda83d063e8e 100644 +--- a/drivers/net/dsa/microchip/ksz9477_spi.c ++++ b/drivers/net/dsa/microchip/ksz9477_spi.c +@@ -88,12 +88,24 @@ static const struct of_device_id ksz9477_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, ksz9477_dt_ids); + ++static const struct spi_device_id ksz9477_spi_ids[] = { ++ { "ksz9477" }, ++ { "ksz9897" }, ++ { "ksz9893" }, ++ { "ksz9563" }, ++ { "ksz8563" }, ++ { "ksz9567" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(spi, ksz9477_spi_ids); ++ + static struct spi_driver ksz9477_spi_driver = { + .driver = { + .name = "ksz9477-switch", + .owner = THIS_MODULE, + .of_match_table = of_match_ptr(ksz9477_dt_ids), + }, ++ .id_table = ksz9477_spi_ids, + .probe = ksz9477_spi_probe, + .remove = ksz9477_spi_remove, + .shutdown = ksz9477_spi_shutdown, +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 40b105daaf9e7..87d28ef82559e 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3062,6 +3062,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { + .port_set_duplex = mv88e6xxx_port_set_duplex, + .port_set_speed = mv88e6185_port_set_speed, + .port_tag_remap = mv88e6095_port_tag_remap, ++ .port_set_policy = mv88e6352_port_set_policy, + .port_set_frame_mode = mv88e6351_port_set_frame_mode, + .port_set_egress_floods = mv88e6352_port_set_egress_floods, + .port_set_ether_type = mv88e6351_port_set_ether_type, +diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c +index 4ad8031ab6695..065fdbe66c425 100644 +--- a/drivers/net/ethernet/8390/mcf8390.c ++++ b/drivers/net/ethernet/8390/mcf8390.c +@@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev) + static int mcf8390_probe(struct platform_device *pdev) + { + struct net_device *dev; +- struct resource *mem, *irq; ++ struct resource *mem; + resource_size_t msize; +- int ret; ++ int ret, irq; + +- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (irq == NULL) { ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { + dev_err(&pdev->dev, "no IRQ specified?\n"); + return -ENXIO; + } +@@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev) + SET_NETDEV_DEV(dev, &pdev->dev); + platform_set_drvdata(pdev, dev); + +- dev->irq = irq->start; ++ dev->irq = irq; + dev->base_addr = mem->start; + + ret = mcf8390_init(dev); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 8ba369c0100b4..9e8a0c772ca93 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -559,7 +559,8 @@ struct nqe_cn { + #define BNXT_MAX_MTU 9500 + #define BNXT_MAX_PAGE_MODE_MTU \ + ((unsigned int)PAGE_SIZE - VLAN_ETH_HLEN - NET_IP_ALIGN - \ +- XDP_PACKET_HEADROOM) ++ XDP_PACKET_HEADROOM - \ ++ SKB_DATA_ALIGN((unsigned int)sizeof(struct skb_shared_info))) + + #define BNXT_MIN_PKT_SIZE 52 + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 97aff84fd1d17..d74c6a34b936a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1673,9 +1673,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, + } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; +- if (bp->hwrm_spec_code >= 0x10201) +- link_info->req_flow_ctrl = +- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; ++ link_info->req_flow_ctrl = 0; + } else { + /* when transition from auto pause to force pause, + * force a link change +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index 6437fe6b9abf0..a6b8f573ab5b5 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -148,7 +148,7 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + base = of_iomap(node, 0); + if (!base) { + err = -ENOMEM; +- goto err_close; ++ goto err_put; + } + + err = fsl_mc_allocate_irqs(mc_dev); +@@ -191,6 +191,8 @@ err_free_mc_irq: + fsl_mc_free_irqs(mc_dev); + err_unmap: + iounmap(base); ++err_put: ++ of_node_put(node); + err_close: + dprtc_close(mc_dev->mc_io, 0, mc_dev->mc_handle); + err_free_mcp: +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 8ecfabaefa85b..d58abdfdb9b7b 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -8344,11 +8344,11 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto, + } + + if (!ret) { +- if (is_kill) +- hclge_rm_vport_vlan_table(vport, vlan_id, false); +- else ++ if (!is_kill) + hclge_add_vport_vlan_table(vport, vlan_id, + writen_to_tbl); ++ else if (is_kill && vlan_id != 0) ++ hclge_rm_vport_vlan_table(vport, vlan_id, false); + } else if (is_kill) { + /* when remove hw vlan filter failed, record the vlan id, + * and try to remove it from hw later, to be consistence +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index a9ad788c4913d..fd2da58c71401 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -505,13 +505,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring, + struct sk_buff *skb; + + /* allocate a skb to store the frags */ +- skb = __napi_alloc_skb(&rx_ring->q_vector->napi, +- xdp->data_end - xdp->data_hard_start, ++ skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize, + GFP_ATOMIC | __GFP_NOWARN); + if (unlikely(!skb)) + return NULL; + +- skb_reserve(skb, xdp->data - xdp->data_hard_start); + memcpy(__skb_put(skb, datasize), xdp->data, datasize); + if (metasize) + skb_metadata_set(skb, metasize); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 5e8f8eb916e64..20f840ea05030 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3003,12 +3003,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; + struct qed_filter_accept_flags *flags = ¶ms->accept_flags; + struct qed_public_vf_info *vf_info; ++ u16 tlv_mask; ++ ++ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | ++ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); + + /* Untrusted VFs can't even be trusted to know that fact. + * Simply indicate everything is configured fine, and trace + * configuration 'behind their back'. + */ +- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) ++ if (!(*tlvs & tlv_mask)) + return 0; + + vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true); +@@ -3025,6 +3029,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + flags->tx_accept_filter &= ~mask; + } + ++ if (params->update_accept_any_vlan_flg) { ++ vf_info->accept_any_vlan = params->accept_any_vlan; ++ ++ if (vf_info->forced_vlan && !vf_info->is_trusted_configured) ++ params->accept_any_vlan = false; ++ } ++ + return 0; + } + +@@ -4717,6 +4728,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + tx_rate = vf_info->tx_rate; + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id); ++ ivi->trusted = vf_info->is_trusted_request; + + return 0; + } +@@ -5147,6 +5159,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + params.update_ctl_frame_check = 1; + params.mac_chk_en = !vf_info->is_trusted_configured; ++ params.update_accept_any_vlan_flg = 0; ++ ++ if (vf_info->accept_any_vlan && vf_info->forced_vlan) { ++ params.update_accept_any_vlan_flg = 1; ++ params.accept_any_vlan = vf_info->accept_any_vlan; ++ } + + if (vf_info->rx_accept_mode & mask) { + flags->update_rx_mode_config = 1; +@@ -5162,13 +5180,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + if (!vf_info->is_trusted_configured) { + flags->rx_accept_filter &= ~mask; + flags->tx_accept_filter &= ~mask; ++ params.accept_any_vlan = false; + } + + if (flags->update_rx_mode_config || + flags->update_tx_mode_config || +- params.update_ctl_frame_check) ++ params.update_ctl_frame_check || ++ params.update_accept_any_vlan_flg) { ++ DP_VERBOSE(hwfn, QED_MSG_IOV, ++ "vport update config for %s VF[abs 0x%x rel 0x%x]\n", ++ vf_info->is_trusted_configured ? "trusted" : "untrusted", ++ vf->abs_vf_id, vf->relative_vf_id); + qed_sp_vport_update(hwfn, ¶ms, + QED_SPQ_MODE_EBLOCK, NULL); ++ } + } + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +index 9a8fd79611f24..853be06bccdf6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +@@ -88,6 +88,7 @@ struct qed_public_vf_info { + bool is_trusted_request; + u8 rx_accept_mode; + u8 tx_accept_mode; ++ bool accept_any_vlan; + }; + + struct qed_iov_vf_init_params { +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index b81579afa361d..f16032635ba73 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -723,6 +723,9 @@ qede_build_skb(struct qede_rx_queue *rxq, + buf = page_address(bd->data) + bd->page_offset; + skb = build_skb(buf, rxq->rx_buf_seg_size); + ++ if (unlikely(!skb)) ++ return NULL; ++ + skb_reserve(skb, pad); + skb_put(skb, len); + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +index f4aa6331b367b..0a9d24e86715d 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_hw_capability) + return dcb->ops->get_hw_capability(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb) +@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->attach) + return dcb->ops->attach(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int +@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf) + if (dcb && dcb->ops->query_hw_capability) + return dcb->ops->query_hw_capability(dcb, buf); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb) +@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type) + if (dcb && dcb->ops->query_cee_param) + return dcb->ops->query_cee_param(dcb, buf, type); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) +@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_cee_cfg) + return dcb->ops->get_cee_cfg(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index a46fea472bc46..70cbf48c2c038 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -428,8 +428,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->phylink_node = np; + + /* Get max speed of operation from device tree */ +- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) +- plat->max_speed = -1; ++ of_property_read_u32(np, "max-speed", &plat->max_speed); + + plat->bus_id = of_alias_get_id(np, "ethernet"); + if (plat->bus_id < 0) +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index d007dfeba5c35..3133f903279ce 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -3164,7 +3164,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + if (err) { + printk(KERN_ERR "happymeal(PCI): Cannot register net device, " + "aborting.\n"); +- goto err_out_iounmap; ++ goto err_out_free_coherent; + } + + pci_set_drvdata(pdev, hp); +@@ -3197,6 +3197,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + + return 0; + ++err_out_free_coherent: ++ dma_free_coherent(hp->dma_dev, PAGE_SIZE, ++ hp->happy_block, hp->hblock_dvma); ++ + err_out_iounmap: + iounmap(hp->gregs); + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index bd0beb16d68a9..02d6f3ad9aca8 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -674,14 +674,14 @@ static void sixpack_close(struct tty_struct *tty) + */ + netif_stop_queue(sp->dev); + ++ unregister_netdev(sp->dev); ++ + del_timer_sync(&sp->tx_t); + del_timer_sync(&sp->resync_t); + + /* Free all 6pack frame buffers. */ + kfree(sp->rbuff); + kfree(sp->xbuff); +- +- unregister_netdev(sp->dev); + } + + /* Perform I/O control on an active 6pack channel. */ +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 694e2f5dbbe59..39801c31e5071 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -133,11 +133,17 @@ static void macvtap_setup(struct net_device *dev) + dev->tx_queue_len = TUN_READQ_SIZE; + } + ++static struct net *macvtap_link_net(const struct net_device *dev) ++{ ++ return dev_net(macvlan_dev_real_dev(dev)); ++} ++ + static struct rtnl_link_ops macvtap_link_ops __read_mostly = { + .kind = "macvtap", + .setup = macvtap_setup, + .newlink = macvtap_newlink, + .dellink = macvtap_dellink, ++ .get_link_net = macvtap_link_net, + .priv_size = sizeof(struct macvtap_dev), + }; + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index c23fec34b50e9..7be75a611e9e8 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -11,6 +11,7 @@ + */ + + #include "bcm-phy-lib.h" ++#include + #include + #include + #include +@@ -479,6 +480,26 @@ static int brcm_fet_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ /* The datasheet indicates the PHY needs up to 1us to complete a reset, ++ * build some slack here. ++ */ ++ usleep_range(1000, 2000); ++ ++ /* The PHY requires 65 MDC clock cycles to complete a write operation ++ * and turnaround the line properly. ++ * ++ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac) ++ * may flag the lack of turn-around as a read failure. This is ++ * particularly true with this combination since the MDIO controller ++ * only used 64 MDC cycles. This is not a critical failure in this ++ * specific case and it has no functional impact otherwise, so we let ++ * that one go through. If there is a genuine bus error, the next read ++ * of MII_BRCM_FET_INTREG will error out. ++ */ ++ err = phy_read(phydev, MII_BMCR); ++ if (err < 0 && err != -EIO) ++ return err; ++ + reg = phy_read(phydev, MII_BRCM_FET_INTREG); + if (reg < 0) + return reg; +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index f285422a80717..f870d08bb1f86 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1214,7 +1214,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, + struct xdp_buff *xdp; + int i; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + for (i = 0; i < ctl->num; i++) { + xdp = &((struct xdp_buff *)ctl->ptr)[i]; + tap_get_user_xdp(q, xdp); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 10211ea605140..d9993884a97d9 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2561,7 +2561,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + if (!tun) + return -EBADFD; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + struct tun_page tpage; + int n = ctl->num; + int flush = 0; +diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c +index 8c26adddd034e..b4f54ca127561 100644 +--- a/drivers/net/wireless/ath/ath10k/wow.c ++++ b/drivers/net/wireless/ath/ath10k/wow.c +@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif, + if (patterns[i].mask[j / 8] & BIT(j % 8)) + bitmask[j] = 0xff; + old_pattern.mask = bitmask; +- new_pattern = old_pattern; + + if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) { +- if (patterns[i].pkt_offset < ETH_HLEN) ++ if (patterns[i].pkt_offset < ETH_HLEN) { + ath10k_wow_convert_8023_to_80211(&new_pattern, + &old_pattern); +- else ++ } else { ++ new_pattern = old_pattern; + new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN; ++ } + } + + if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 94d34ee02265d..01163b3339451 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, + } + } + ++ if (idx == AR5K_EEPROM_N_PD_CURVES) ++ goto err_out; ++ + ee->ee_pd_gains[mode] = 1; + + pd = &chinfo[pier].pd_curves[idx]; +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 510e61e97dbcb..994ec48b2f669 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, + hdr->endpoint_id = epid; + hdr->flags = flags; + hdr->payload_len = cpu_to_be16(len); ++ memset(hdr->control, 0, sizeof(hdr->control)); + + status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); + +@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target, + conn_msg->dl_pipeid = endpoint->dl_pipeid; + conn_msg->ul_pipeid = endpoint->ul_pipeid; + ++ /* To prevent infoleak */ ++ conn_msg->svc_meta_len = 0; ++ conn_msg->pad = 0; ++ + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); + if (ret) + goto err; +diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c +index 21ca62b06214a..8d708e7588bcb 100644 +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -1917,7 +1917,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar) + WARN_ON(!(tx_streams >= 1 && tx_streams <= + IEEE80211_HT_MCS_TX_MAX_STREAMS)); + +- tx_params = (tx_streams - 1) << ++ tx_params |= (tx_streams - 1) << + IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; + + carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +index 3aed4c4b887aa..544ad80629a99 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -207,6 +207,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp, + size = BRCMF_FW_MAX_NVRAM_SIZE; + else + size = data_len; ++ /* Add space for properties we may add */ ++ size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1; + /* Alloc for extra 0 byte + roundup by 4 + length field */ + size += 1 + 3 + sizeof(u32); + nvp->nvram = kzalloc(size, GFP_KERNEL); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index e6001f0a81a3a..b5d2e5b9f67cc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -444,47 +445,6 @@ brcmf_pcie_write_ram32(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + } + + +-static void +-brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offset, +- void *srcaddr, u32 len) +-{ +- void __iomem *address = devinfo->tcm + mem_offset; +- __le32 *src32; +- __le16 *src16; +- u8 *src8; +- +- if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) { +- if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) { +- src8 = (u8 *)srcaddr; +- while (len) { +- iowrite8(*src8, address); +- address++; +- src8++; +- len--; +- } +- } else { +- len = len / 2; +- src16 = (__le16 *)srcaddr; +- while (len) { +- iowrite16(le16_to_cpu(*src16), address); +- address += 2; +- src16++; +- len--; +- } +- } +- } else { +- len = len / 4; +- src32 = (__le32 *)srcaddr; +- while (len) { +- iowrite32(le32_to_cpu(*src32), address); +- address += 4; +- src32++; +- len--; +- } +- } +-} +- +- + static void + brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + void *dstaddr, u32 len) +@@ -1346,6 +1306,18 @@ static void brcmf_pcie_down(struct device *dev) + { + } + ++static int brcmf_pcie_preinit(struct device *dev) ++{ ++ struct brcmf_bus *bus_if = dev_get_drvdata(dev); ++ struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie; ++ ++ brcmf_dbg(PCIE, "Enter\n"); ++ ++ brcmf_pcie_intr_enable(buspub->devinfo); ++ brcmf_pcie_hostready(buspub->devinfo); ++ ++ return 0; ++} + + static int brcmf_pcie_tx(struct device *dev, struct sk_buff *skb) + { +@@ -1454,6 +1426,7 @@ static int brcmf_pcie_reset(struct device *dev) + } + + static const struct brcmf_bus_ops brcmf_pcie_bus_ops = { ++ .preinit = brcmf_pcie_preinit, + .txdata = brcmf_pcie_tx, + .stop = brcmf_pcie_down, + .txctl = brcmf_pcie_tx_ctlpkt, +@@ -1561,8 +1534,8 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + return err; + + brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name); +- brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase, +- (void *)fw->data, fw->size); ++ memcpy_toio(devinfo->tcm + devinfo->ci->rambase, ++ (void *)fw->data, fw->size); + + resetintr = get_unaligned_le32(fw->data); + release_firmware(fw); +@@ -1576,7 +1549,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name); + address = devinfo->ci->rambase + devinfo->ci->ramsize - + nvram_len; +- brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len); ++ memcpy_toio(devinfo->tcm + address, nvram, nvram_len); + brcmf_fw_nvram_free(nvram); + } else { + brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", +@@ -1775,6 +1748,8 @@ static void brcmf_pcie_setup(struct device *dev, int ret, + ret = brcmf_chip_get_raminfo(devinfo->ci); + if (ret) { + brcmf_err(bus, "Failed to get RAM info\n"); ++ release_firmware(fw); ++ brcmf_fw_nvram_free(nvram); + goto fail; + } + +@@ -1824,9 +1799,6 @@ static void brcmf_pcie_setup(struct device *dev, int ret, + + init_waitqueue_head(&devinfo->mbdata_resp_wait); + +- brcmf_pcie_intr_enable(devinfo); +- brcmf_pcie_hostready(devinfo); +- + ret = brcmf_attach(&devinfo->pdev->dev); + if (ret) + goto fail; +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +index 6512d25e35630..f3bb1f91b5878 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +@@ -303,7 +303,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw) + + priv->is_open = 1; + IWL_DEBUG_MAC80211(priv, "leave\n"); +- return 0; ++ return ret; + } + + static void iwlagn_mac_stop(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 7272d8522a9e9..c5b08a68f6fa1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1417,8 +1417,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + while (!sband && i < NUM_NL80211_BANDS) + sband = mvm->hw->wiphy->bands[i++]; + +- if (WARN_ON_ONCE(!sband)) ++ if (WARN_ON_ONCE(!sband)) { ++ ret = -ENODEV; + goto error; ++ } + + chan = &sband->channels[0]; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +index 0a5695c3d9241..625492284389c 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +@@ -605,6 +605,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index 38183aef0eb92..5ad8b0afa41f0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -385,6 +385,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index cf372684b6812..3836d6ac53049 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -382,6 +382,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->sram = ioremap(link->resource[2]->start, + resource_size(link->resource[2])); ++ if (!local->sram) ++ goto failed; + + /*** Set up 16k window for shared memory (receive buffer) ***************/ + link->resource[3]->flags |= +@@ -396,6 +398,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->rmem = ioremap(link->resource[3]->start, + resource_size(link->resource[3])); ++ if (!local->rmem) ++ goto failed; + + /*** Set up window for attribute memory ***********************************/ + link->resource[4]->flags |= +@@ -410,6 +414,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->amem = ioremap(link->resource[4]->start, + resource_size(link->resource[4])); ++ if (!local->amem) ++ goto failed; + + dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram); + dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem); +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index 544287e9f449b..f4de8be05c614 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -142,9 +142,8 @@ struct dino_device + { + struct pci_hba_data hba; /* 'C' inheritance - must be first */ + spinlock_t dinosaur_pen; +- unsigned long txn_addr; /* EIR addr to generate interrupt */ +- u32 txn_data; /* EIR data assign to each dino */ + u32 imr; /* IRQ's which are enabled */ ++ struct gsc_irq gsc_irq; + int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ + #ifdef DINO_DEBUG + unsigned int dino_irr0; /* save most recent IRQ line stat */ +@@ -339,14 +338,43 @@ static void dino_unmask_irq(struct irq_data *d) + if (tmp & DINO_MASK_IRQ(local_irq)) { + DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", + __func__, tmp); +- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); ++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); + } + } + ++#ifdef CONFIG_SMP ++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ u32 eim; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; ++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ + static struct irq_chip dino_interrupt_type = { + .name = "GSC-PCI", + .irq_unmask = dino_unmask_irq, + .irq_mask = dino_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = dino_set_affinity_irq, ++#endif + }; + + +@@ -806,7 +834,6 @@ static int __init dino_common_init(struct parisc_device *dev, + { + int status; + u32 eim; +- struct gsc_irq gsc_irq; + struct resource *res; + + pcibios_register_hba(&dino_dev->hba); +@@ -821,10 +848,8 @@ static int __init dino_common_init(struct parisc_device *dev, + ** still only has 11 IRQ input lines - just map some of them + ** to a different processor. + */ +- dev->irq = gsc_alloc_irq(&gsc_irq); +- dino_dev->txn_addr = gsc_irq.txn_addr; +- dino_dev->txn_data = gsc_irq.txn_data; +- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; + + /* + ** Dino needs a PA "IRQ" to get a processor's attention. +diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c +index ed9371acf37eb..ec175ae998733 100644 +--- a/drivers/parisc/gsc.c ++++ b/drivers/parisc/gsc.c +@@ -135,10 +135,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) + */ + } + ++#ifdef CONFIG_SMP ++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; ++ ++ /* switch IRQ's for devices below LASI/WAX to other CPU */ ++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ ++ + static struct irq_chip gsc_asic_interrupt_type = { + .name = "GSC-ASIC", + .irq_unmask = gsc_asic_unmask_irq, + .irq_mask = gsc_asic_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = gsc_set_affinity_irq, ++#endif + }; + + int gsc_assign_irq(struct irq_chip *type, void *data) +diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h +index 86abad3fa2150..73cbd0bb1975a 100644 +--- a/drivers/parisc/gsc.h ++++ b/drivers/parisc/gsc.h +@@ -31,6 +31,7 @@ struct gsc_asic { + int version; + int type; + int eim; ++ struct gsc_irq gsc_irq; + int global_irq[32]; + }; + +diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c +index 4e4fd12c2112e..6ef621adb63a8 100644 +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -163,7 +163,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) + { + extern void (*chassis_power_off)(void); + struct gsc_asic *lasi; +- struct gsc_irq gsc_irq; + int ret; + + lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); +@@ -185,7 +184,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) + lasi_init_irq(lasi); + + /* the IRQ lasi should use */ +- dev->irq = gsc_alloc_irq(&gsc_irq); ++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -193,9 +192,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); ++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { + kfree(lasi); + return ret; +diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c +index 5b6df15162354..73a2b01f8d9ca 100644 +--- a/drivers/parisc/wax.c ++++ b/drivers/parisc/wax.c +@@ -68,7 +68,6 @@ static int __init wax_init_chip(struct parisc_device *dev) + { + struct gsc_asic *wax; + struct parisc_device *parent; +- struct gsc_irq gsc_irq; + int ret; + + wax = kzalloc(sizeof(*wax), GFP_KERNEL); +@@ -85,7 +84,7 @@ static int __init wax_init_chip(struct parisc_device *dev) + wax_init_irq(wax); + + /* the IRQ wax should use */ +- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); ++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -93,9 +92,9 @@ static int __init wax_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); ++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); + if (ret < 0) { + kfree(wax); + return ret; +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 0914ddeae17f4..c909c66a63e2d 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn, + * write happen to have any RW1C (write-one-to-clear) bits set, we + * just inadvertently cleared something we shouldn't have. + */ +- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", +- size, pci_domain_nr(bus), bus->number, +- PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ if (!bus->unsafe_warn) { ++ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", ++ size, pci_domain_nr(bus), bus->number, ++ PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ bus->unsafe_warn = 1; ++ } + + mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8)); + tmp = readl(addr) & mask; +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index d2f8cd3a9568b..721d2652319ce 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -835,7 +835,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, + case PCI_EXP_RTSTA: { + u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG); + u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG); +- *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16); ++ *value = msglog >> 16; ++ if (isr0 & PCIE_MSG_PM_PME_MASK) ++ *value |= PCI_EXP_RTSTA_PME; + return PCI_BRIDGE_EMUL_HANDLED; + } + +@@ -1168,7 +1170,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, + + msg->address_lo = lower_32_bits(msi_msg); + msg->address_hi = upper_32_bits(msi_msg); +- msg->data = data->irq; ++ msg->data = data->hwirq; + } + + static int advk_msi_set_affinity(struct irq_data *irq_data, +@@ -1185,15 +1187,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + int hwirq, i; + + mutex_lock(&pcie->msi_used_lock); +- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, +- 0, nr_irqs, 0); +- if (hwirq >= MSI_IRQ_NUM) { +- mutex_unlock(&pcie->msi_used_lock); +- return -ENOSPC; +- } +- +- bitmap_set(pcie->msi_used, hwirq, nr_irqs); ++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, ++ order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); ++ if (hwirq < 0) ++ return -ENOSPC; + + for (i = 0; i < nr_irqs; i++) + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -1211,7 +1209,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, + struct advk_pcie *pcie = domain->host_data; + + mutex_lock(&pcie->msi_used_lock); +- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); + } + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 907b8be86ce04..13f3bc239c660 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -79,6 +79,8 @@ static int pcie_poll_cmd(struct controller *ctrl, int timeout) + if (slot_status & PCI_EXP_SLTSTA_CC) { + pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, + PCI_EXP_SLTSTA_CC); ++ ctrl->cmd_busy = 0; ++ smp_mb(); + return 1; + } + if (timeout < 0) +@@ -957,6 +959,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, ++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, +diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c +index 4da37f650f983..7018eb21d1892 100644 +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -781,7 +781,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + { + u64 mpidr; + int cpu_cluster_id; +- struct cluster_pmu *cluster = NULL; ++ struct cluster_pmu *cluster; + + /* + * This assumes that the cluster_id is in MPIDR[aff1] for +@@ -803,10 +803,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + cluster->cluster_id); + cpumask_set_cpu(cpu, &cluster->cluster_cpus); + *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; +- break; ++ return cluster; + } + +- return cluster; ++ return NULL; + } + + static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c +index 14e0551cd3190..0aa740b73d0db 100644 +--- a/drivers/phy/phy-core-mipi-dphy.c ++++ b/drivers/phy/phy-core-mipi-dphy.c +@@ -66,10 +66,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock, + cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui); + + cfg->init = 100; +- cfg->lpx = 60000; ++ cfg->lpx = 50000; + cfg->ta_get = 5 * cfg->lpx; + cfg->ta_go = 4 * cfg->lpx; +- cfg->ta_sure = 2 * cfg->lpx; ++ cfg->ta_sure = cfg->lpx; + cfg->wakeup = 1000; + + cfg->hs_clk_rate = hs_clk_rate; +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +index 53f52b9a0acdc..c2df70712ca22 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +@@ -1038,6 +1038,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 0); + if (node) { + pctl->regmap1 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap1)) + return PTR_ERR(pctl->regmap1); + } else if (regmap) { +@@ -1051,6 +1052,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 1); + if (node) { + pctl->regmap2 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap2)) + return PTR_ERR(pctl->regmap2); + } +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 923264d0e9ef2..31449514a8c0c 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -198,8 +198,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, + } + + static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, +- enum pin_config_param param, +- enum pin_config_param arg) ++ enum pin_config_param param, u32 arg) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); + const struct mtk_pin_desc *desc; +@@ -647,10 +646,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group, + unsigned long *config) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); ++ struct mtk_pinctrl_group *grp = &hw->groups[group]; + +- *config = hw->groups[group].config; +- +- return 0; ++ /* One pin per group only */ ++ return mtk_pinconf_get(pctldev, grp->pin, config); + } + + static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, +@@ -666,8 +665,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + pinconf_to_config_argument(configs[i])); + if (ret < 0) + return ret; +- +- grp->config = configs[i]; + } + + return 0; +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index 2a8190b11d104..9f00adfefba8e 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1923,8 +1923,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev) + } + + prcm_np = of_parse_phandle(np, "prcm", 0); +- if (prcm_np) ++ if (prcm_np) { + npct->prcm_base = of_iomap(prcm_np, 0); ++ of_node_put(prcm_np); ++ } + if (!npct->prcm_base) { + if (version == PINCTRL_NMK_STN8815) { + dev_info(&pdev->dev, +diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +index 17f909d8b63a9..2dccd24c65557 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +@@ -78,7 +78,6 @@ struct npcm7xx_gpio { + struct gpio_chip gc; + int irqbase; + int irq; +- void *priv; + struct irq_chip irq_chip; + u32 pinctrl_id; + int (*direction_input)(struct gpio_chip *chip, unsigned offset); +@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc) + chained_irq_enter(chip, desc); + sts = ioread32(bank->base + NPCM7XX_GP_N_EVST); + en = ioread32(bank->base + NPCM7XX_GP_N_EVEN); +- dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts, ++ dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts, + en); + + sts &= en; +@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = BIT(d->hwirq); + +- dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio, ++ dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio, + d->irq, type); + switch (type) { + case IRQ_TYPE_EDGE_RISING: +- dev_dbg(d->chip->parent_device, "edge.rising\n"); ++ dev_dbg(bank->gc.parent, "edge.rising\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_FALLING: +- dev_dbg(d->chip->parent_device, "edge.falling\n"); ++ dev_dbg(bank->gc.parent, "edge.falling\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_BOTH: +- dev_dbg(d->chip->parent_device, "edge.both\n"); ++ dev_dbg(bank->gc.parent, "edge.both\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + break; + case IRQ_TYPE_LEVEL_LOW: +- dev_dbg(d->chip->parent_device, "level.low\n"); ++ dev_dbg(bank->gc.parent, "level.low\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_LEVEL_HIGH: +- dev_dbg(d->chip->parent_device, "level.high\n"); ++ dev_dbg(bank->gc.parent, "level.high\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + default: +- dev_dbg(d->chip->parent_device, "invalid irq type\n"); ++ dev_dbg(bank->gc.parent, "invalid irq type\n"); + return -EINVAL; + } + +@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = d->hwirq; + +- dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST); + } + +@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Clear events */ +- dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC); + } + +@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Enable events */ +- dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS); + } + +@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* active-high, input, clear interrupt, enable interrupt */ +- dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq); ++ dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq); + npcmgpio_direction_input(gc, gpio); + npcmgpio_irq_ack(d); + npcmgpio_irq_unmask(d); +@@ -905,7 +904,7 @@ static struct npcm7xx_func npcm7xx_funcs[] = { + #define DRIVE_STRENGTH_HI_SHIFT 12 + #define DRIVE_STRENGTH_MASK 0x0000FF00 + +-#define DS(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ ++#define DSTR(lo, hi) (((lo) << DRIVE_STRENGTH_LO_SHIFT) | \ + ((hi) << DRIVE_STRENGTH_HI_SHIFT)) + #define DSLO(x) (((x) >> DRIVE_STRENGTH_LO_SHIFT) & 0xF) + #define DSHI(x) (((x) >> DRIVE_STRENGTH_HI_SHIFT) & 0xF) +@@ -925,31 +924,31 @@ struct npcm7xx_pincfg { + static const struct npcm7xx_pincfg pincfg[] = { + /* PIN FUNCTION 1 FUNCTION 2 FUNCTION 3 FLAGS */ + NPCM7XX_PINCFG(0, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(1, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(2, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(3, iox1, MFSEL1, 30, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(4, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(5, iox2, MFSEL3, 14, smb1d, I2CSEGSEL, 7, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(6, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(7, iox2, MFSEL3, 14, smb2d, I2CSEGSEL, 10, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(8, lkgpo1, FLOCKR1, 4, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(9, lkgpo2, FLOCKR1, 8, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(10, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(11, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(12, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(13, gspi, MFSEL1, 24, smb5b, I2CSEGSEL, 19, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(14, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(15, gspi, MFSEL1, 24, smb5c, I2CSEGSEL, 20, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(16, lkgpo0, FLOCKR1, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(17, pspi2, MFSEL3, 13, smb4den, I2CSEGSEL, 23, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(18, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(19, pspi2, MFSEL3, 13, smb4b, I2CSEGSEL, 14, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(20, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), + NPCM7XX_PINCFG(21, smb4c, I2CSEGSEL, 15, smb15, MFSEL3, 8, none, NONE, 0, 0), + NPCM7XX_PINCFG(22, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), + NPCM7XX_PINCFG(23, smb4d, I2CSEGSEL, 16, smb14, MFSEL3, 7, none, NONE, 0, 0), +- NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(24, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(25, ioxh, MFSEL3, 18, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(26, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(27, smb5, MFSEL1, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(28, smb4, MFSEL1, 1, none, NONE, 0, none, NONE, 0, 0), +@@ -965,12 +964,12 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(39, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(40, smb3b, I2CSEGSEL, 11, none, NONE, 0, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(41, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DS(2, 4) | GPO), ++ NPCM7XX_PINCFG(42, bmcuart0a, MFSEL1, 9, none, NONE, 0, none, NONE, 0, DSTR(2, 4) | GPO), + NPCM7XX_PINCFG(43, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), + NPCM7XX_PINCFG(44, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, bmcuart1, MFSEL3, 24, 0), + NPCM7XX_PINCFG(45, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), +- NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DS(2, 8)), ++ NPCM7XX_PINCFG(46, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), ++ NPCM7XX_PINCFG(47, uart1, MFSEL1, 10, jtag2, MFSEL4, 0, none, NONE, 0, DSTR(2, 8)), + NPCM7XX_PINCFG(48, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, GPO), + NPCM7XX_PINCFG(49, uart2, MFSEL1, 11, bmcuart0b, MFSEL4, 1, none, NONE, 0, 0), + NPCM7XX_PINCFG(50, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), +@@ -980,8 +979,8 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(54, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(55, uart2, MFSEL1, 11, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(56, r1err, MFSEL1, 12, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DS(2, 4)), ++ NPCM7XX_PINCFG(57, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(58, r1md, MFSEL1, 13, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), + NPCM7XX_PINCFG(59, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(60, smb3d, I2CSEGSEL, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(61, uart1, MFSEL1, 10, none, NONE, 0, none, NONE, 0, GPO), +@@ -1004,19 +1003,19 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(77, fanin13, MFSEL2, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(78, fanin14, MFSEL2, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(79, fanin15, MFSEL2, 15, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(80, pwm0, MFSEL2, 16, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(81, pwm1, MFSEL2, 17, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(82, pwm2, MFSEL2, 18, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(83, pwm3, MFSEL2, 19, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(84, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(85, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(86, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(87, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(88, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(89, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(90, r2err, MFSEL1, 15, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DS(2, 4)), ++ NPCM7XX_PINCFG(91, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(92, r2md, MFSEL1, 16, none, NONE, 0, none, NONE, 0, DSTR(2, 4)), + NPCM7XX_PINCFG(93, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), + NPCM7XX_PINCFG(94, ga20kbc, MFSEL1, 17, smb5d, I2CSEGSEL, 21, none, NONE, 0, 0), + NPCM7XX_PINCFG(95, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), +@@ -1062,34 +1061,34 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(133, smb10, MFSEL4, 13, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(134, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(135, smb11, MFSEL4, 14, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(136, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(137, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(138, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(139, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(140, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(141, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(142, sd1, MFSEL3, 12, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(143, sd1, MFSEL3, 12, sd1pwr, MFSEL4, 5, none, NONE, 0, 0), +- NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(144, pwm4, MFSEL2, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(145, pwm5, MFSEL2, 21, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(146, pwm6, MFSEL2, 22, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(147, pwm7, MFSEL2, 23, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(148, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(149, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(150, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(151, mmc8, MFSEL3, 11, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(152, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(153, mmcwp, FLOCKR1, 24, none, NONE, 0, none, NONE, 0, 0), /* Z1/A1 */ +- NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(154, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(155, mmccd, MFSEL3, 25, mmcrst, MFSEL4, 6, none, NONE, 0, 0), /* Z1/A1 */ +- NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- +- NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DS(8, 12)), +- NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(156, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(157, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(158, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(159, mmc, MFSEL3, 10, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ ++ NPCM7XX_PINCFG(160, clkout, MFSEL1, 21, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(161, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, DSTR(8, 12)), ++ NPCM7XX_PINCFG(162, serirq, NONE, 0, gpio, MFSEL1, 31, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(163, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, 0), + NPCM7XX_PINCFG(164, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), + NPCM7XX_PINCFG(165, lpc, NONE, 0, espi, MFSEL4, 8, gpio, MFSEL1, 26, SLEWLPC), +@@ -1102,25 +1101,25 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(172, smb6, MFSEL3, 1, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(173, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(174, smb7, MFSEL3, 2, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), ++ NPCM7XX_PINCFG(175, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(176, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(177, pspi1, MFSEL3, 4, faninx, MFSEL3, 3, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(178, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(179, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(180, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), + NPCM7XX_PINCFG(181, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(182, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DS(8, 12)), +- NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DS(2, 4)), +- NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ +- +- NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DS(8, 12)), /* XX */ ++ NPCM7XX_PINCFG(183, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(184, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(185, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(186, spi3, MFSEL4, 16, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(187, spi3cs1, MFSEL4, 17, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), ++ NPCM7XX_PINCFG(188, spi3quad, MFSEL4, 20, spi3cs2, MFSEL4, 18, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(189, spi3quad, MFSEL4, 20, spi3cs3, MFSEL4, 19, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(190, gpio, FLOCKR1, 20, nprd_smi, NONE, 0, none, NONE, 0, DSTR(2, 4)), ++ NPCM7XX_PINCFG(191, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ ++ ++ NPCM7XX_PINCFG(192, none, NONE, 0, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), /* XX */ + NPCM7XX_PINCFG(193, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(194, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(195, smb0b, I2CSEGSEL, 0, none, NONE, 0, none, NONE, 0, 0), +@@ -1131,11 +1130,11 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(200, r2, MFSEL1, 14, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(201, r1, MFSEL3, 9, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(202, smb0c, I2CSEGSEL, 1, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(203, faninx, MFSEL3, 3, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(204, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), + NPCM7XX_PINCFG(205, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), +- NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DS(4, 8)), ++ NPCM7XX_PINCFG(206, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), ++ NPCM7XX_PINCFG(207, ddc, NONE, 0, gpio, MFSEL3, 22, none, NONE, 0, DSTR(4, 8)), + NPCM7XX_PINCFG(208, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(209, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(210, rg2, MFSEL4, 24, ddr, MFSEL3, 26, none, NONE, 0, 0), +@@ -1147,20 +1146,20 @@ static const struct npcm7xx_pincfg pincfg[] = { + NPCM7XX_PINCFG(216, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(217, rg2mdio, MFSEL4, 23, ddr, MFSEL3, 26, none, NONE, 0, 0), + NPCM7XX_PINCFG(218, wdog1, MFSEL3, 19, none, NONE, 0, none, NONE, 0, 0), +- NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DS(4, 8)), ++ NPCM7XX_PINCFG(219, wdog2, MFSEL3, 20, none, NONE, 0, none, NONE, 0, DSTR(4, 8)), + NPCM7XX_PINCFG(220, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(221, smb12, MFSEL3, 5, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(222, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), + NPCM7XX_PINCFG(223, smb13, MFSEL3, 6, none, NONE, 0, none, NONE, 0, 0), + + NPCM7XX_PINCFG(224, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, SLEW), +- NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW | GPO), +- NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DS(8, 12) | SLEW), +- NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DS(8, 12)), ++ NPCM7XX_PINCFG(225, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(226, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW | GPO), ++ NPCM7XX_PINCFG(227, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(228, spixcs1, MFSEL4, 28, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(229, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(230, spix, MFSEL4, 27, none, NONE, 0, none, NONE, 0, DSTR(8, 12) | SLEW), ++ NPCM7XX_PINCFG(231, clkreq, MFSEL4, 9, none, NONE, 0, none, NONE, 0, DSTR(8, 12)), + NPCM7XX_PINCFG(253, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC1 power */ + NPCM7XX_PINCFG(254, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* SDHC2 power */ + NPCM7XX_PINCFG(255, none, NONE, 0, none, NONE, 0, none, NONE, 0, GPI), /* DACOSEL */ +@@ -1561,7 +1560,7 @@ static int npcm7xx_get_groups_count(struct pinctrl_dev *pctldev) + { + struct npcm7xx_pinctrl *npcm = pinctrl_dev_get_drvdata(pctldev); + +- dev_dbg(npcm->dev, "group size: %d\n", ARRAY_SIZE(npcm7xx_groups)); ++ dev_dbg(npcm->dev, "group size: %zu\n", ARRAY_SIZE(npcm7xx_groups)); + return ARRAY_SIZE(npcm7xx_groups); + } + +diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c +index 9eb86309c70bf..355bc4c748e26 100644 +--- a/drivers/pinctrl/pinconf-generic.c ++++ b/drivers/pinctrl/pinconf-generic.c +@@ -30,10 +30,10 @@ static const struct pin_config_item conf_items[] = { + PCONFDUMP(PIN_CONFIG_BIAS_BUS_HOLD, "input bias bus hold", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_DISABLE, "input bias disabled", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_HIGH_IMPEDANCE, "input bias high impedance", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", NULL, false), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", "ohms", true), + PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, +- "input bias pull to pin specific state", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false), ++ "input bias pull to pin specific state", "ohms", true), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", "ohms", true), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false), +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 59fe3204e965d..4b972be3487f9 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3433,6 +3433,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,grf", 0); + if (node) { + info->regmap_base = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_base)) + return PTR_ERR(info->regmap_base); + } else { +@@ -3469,6 +3470,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,pmu", 0); + if (node) { + info->regmap_pmu = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_pmu)) + return PTR_ERR(info->regmap_pmu); + } +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index 601fffeba39fe..131fa7958f754 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) + return &(of_data->ctrl[id]); + } + ++static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) ++{ ++ struct samsung_pin_bank *bank; ++ unsigned int i; ++ ++ bank = d->pin_banks; ++ for (i = 0; i < d->nr_banks; ++i, ++bank) ++ of_node_put(bank->of_node); ++} ++ + /* retrieve the soc specific data */ + static const struct samsung_pin_ctrl * + samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, +@@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + if (ctrl->retention_data) { + drvdata->retention_ctrl = ctrl->retention_data->init(drvdata, + ctrl->retention_data); +- if (IS_ERR(drvdata->retention_ctrl)) +- return PTR_ERR(drvdata->retention_ctrl); ++ if (IS_ERR(drvdata->retention_ctrl)) { ++ ret = PTR_ERR(drvdata->retention_ctrl); ++ goto err_put_banks; ++ } + } + + ret = samsung_pinctrl_register(pdev, drvdata); + if (ret) +- return ret; ++ goto err_put_banks; + + ret = samsung_gpiolib_register(pdev, drvdata); +- if (ret) { +- samsung_pinctrl_unregister(pdev, drvdata); +- return ret; +- } ++ if (ret) ++ goto err_unregister; + + if (ctrl->eint_gpio_init) + ctrl->eint_gpio_init(drvdata); +@@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, drvdata); + + return 0; ++ ++err_unregister: ++ samsung_pinctrl_unregister(pdev, drvdata); ++err_put_banks: ++ samsung_banks_of_node_put(drvdata); ++ return ret; + } + + /** +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c +index b3b116da1bb0d..14005725a726b 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a77470.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77470.c +@@ -2121,7 +2121,7 @@ static const unsigned int vin0_clk_mux[] = { + VI0_CLK_MARK, + }; + /* - VIN1 ------------------------------------------------------------------- */ +-static const union vin_data vin1_data_pins = { ++static const union vin_data12 vin1_data_pins = { + .data12 = { + RCAR_GP_PIN(3, 1), RCAR_GP_PIN(3, 2), + RCAR_GP_PIN(3, 3), RCAR_GP_PIN(3, 4), +@@ -2131,7 +2131,7 @@ static const union vin_data vin1_data_pins = { + RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16), + }, + }; +-static const union vin_data vin1_data_mux = { ++static const union vin_data12 vin1_data_mux = { + .data12 = { + VI1_DATA0_MARK, VI1_DATA1_MARK, + VI1_DATA2_MARK, VI1_DATA3_MARK, +diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c +index 90e35c07240ae..b7f7a8225f22e 100644 +--- a/drivers/power/reset/gemini-poweroff.c ++++ b/drivers/power/reset/gemini-poweroff.c +@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev) + return PTR_ERR(gpw->base); + + irq = platform_get_irq(pdev, 0); +- if (!irq) +- return -EINVAL; ++ if (irq < 0) ++ return irq; + + gpw->dev = dev; + +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 69452fc085b99..4c229e6fb750a 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di) + ret = kobject_init_and_add(&di->fg_kobject, + &ab8500_fg_ktype, + NULL, "battery"); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(&di->fg_kobject); + dev_err(di->dev, "failed to create sysfs entry\n"); ++ } + + return ret; + } +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index e84b6e4da14a8..9fda98b950bab 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + union power_supply_propval *val) + { + struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); +- struct iio_channel *chan; + int ret = 0, reg, val1; + + switch (psp) { +@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + if (ret) + return ret; + +- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) +- chan = axp20x_batt->batt_chrg_i; +- else +- chan = axp20x_batt->batt_dischrg_i; +- +- ret = iio_read_channel_processed(chan, &val->intval); ++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { ++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); ++ } else { ++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); ++ val->intval = -val1; ++ } + if (ret) + return ret; + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index 7d09e49f04d3b..2ee6bb7c08045 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -41,11 +41,11 @@ + #define VBUS_ISPOUT_CUR_LIM_1500MA 0x1 /* 1500mA */ + #define VBUS_ISPOUT_CUR_LIM_2000MA 0x2 /* 2000mA */ + #define VBUS_ISPOUT_CUR_NO_LIM 0x3 /* 2500mA */ +-#define VBUS_ISPOUT_VHOLD_SET_MASK 0x31 ++#define VBUS_ISPOUT_VHOLD_SET_MASK 0x38 + #define VBUS_ISPOUT_VHOLD_SET_BIT_POS 0x3 + #define VBUS_ISPOUT_VHOLD_SET_OFFSET 4000 /* 4000mV */ + #define VBUS_ISPOUT_VHOLD_SET_LSB_RES 100 /* 100mV */ +-#define VBUS_ISPOUT_VHOLD_SET_4300MV 0x3 /* 4300mV */ ++#define VBUS_ISPOUT_VHOLD_SET_4400MV 0x4 /* 4400mV */ + #define VBUS_ISPOUT_VBUS_PATH_DIS BIT(7) + + #define CHRG_CCCV_CC_MASK 0xf /* 4 bits */ +@@ -744,6 +744,16 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + ret = axp288_charger_vbus_path_select(info, true); + if (ret < 0) + return ret; ++ } else { ++ /* Set Vhold to the factory default / recommended 4.4V */ ++ val = VBUS_ISPOUT_VHOLD_SET_4400MV << VBUS_ISPOUT_VHOLD_SET_BIT_POS; ++ ret = regmap_update_bits(info->regmap, AXP20X_VBUS_IPSOUT_MGMT, ++ VBUS_ISPOUT_VHOLD_SET_MASK, val); ++ if (ret < 0) { ++ dev_err(&info->pdev->dev, "register(%x) write error(%d)\n", ++ AXP20X_VBUS_IPSOUT_MGMT, ret); ++ return ret; ++ } + } + + /* Read current charge voltage and current limit */ +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 1ae5d6d42c9e3..64d87dccea82c 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -41,6 +41,7 @@ + #define BQ24190_REG_POC_CHG_CONFIG_DISABLE 0x0 + #define BQ24190_REG_POC_CHG_CONFIG_CHARGE 0x1 + #define BQ24190_REG_POC_CHG_CONFIG_OTG 0x2 ++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT 0x3 + #define BQ24190_REG_POC_SYS_MIN_MASK (BIT(3) | BIT(2) | BIT(1)) + #define BQ24190_REG_POC_SYS_MIN_SHIFT 1 + #define BQ24190_REG_POC_SYS_MIN_MIN 3000 +@@ -550,7 +551,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev) + pm_runtime_mark_last_busy(bdi->dev); + pm_runtime_put_autosuspend(bdi->dev); + +- return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG; ++ if (ret) ++ return ret; ++ ++ return (val == BQ24190_REG_POC_CHG_CONFIG_OTG || ++ val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT); + } + + static const struct regulator_ops bq24190_vbus_ops = { +diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c +index 26923af574f43..4fe9ea9721b39 100644 +--- a/drivers/power/supply/wm8350_power.c ++++ b/drivers/power/supply/wm8350_power.c +@@ -408,44 +408,112 @@ static const struct power_supply_desc wm8350_usb_desc = { + * Initialisation + *********************************************************************/ + +-static void wm8350_init_charger(struct wm8350 *wm8350) ++static int wm8350_init_charger(struct wm8350 *wm8350) + { ++ int ret; ++ + /* register our interest in charger events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, + wm8350_charger_handler, 0, "Battery hot", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, ++ if (ret) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, + wm8350_charger_handler, 0, "Battery cold", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, ++ if (ret) ++ goto free_chg_bat_hot; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, + wm8350_charger_handler, 0, "Battery fail", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, ++ if (ret) ++ goto free_chg_bat_cold; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, + wm8350_charger_handler, 0, + "Charger timeout", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, ++ if (ret) ++ goto free_chg_bat_fail; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, + wm8350_charger_handler, 0, + "Charge end", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, ++ if (ret) ++ goto free_chg_to; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, + wm8350_charger_handler, 0, + "Charge start", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, ++ if (ret) ++ goto free_chg_end; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, + wm8350_charger_handler, 0, + "Fast charge ready", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, ++ if (ret) ++ goto free_chg_start; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, + wm8350_charger_handler, 0, + "Battery <3.9V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, ++ if (ret) ++ goto free_chg_fast_rdy; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, + wm8350_charger_handler, 0, + "Battery <3.1V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, ++ if (ret) ++ goto free_chg_vbatt_lt_3p9; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, + wm8350_charger_handler, 0, + "Battery <2.85V", wm8350); ++ if (ret) ++ goto free_chg_vbatt_lt_3p1; + + /* and supply change events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, + wm8350_charger_handler, 0, "USB", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, ++ if (ret) ++ goto free_chg_vbatt_lt_2p85; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, + wm8350_charger_handler, 0, "Wall", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, ++ if (ret) ++ goto free_ext_usb_fb; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, + wm8350_charger_handler, 0, "Battery", wm8350); ++ if (ret) ++ goto free_ext_wall_fb; ++ ++ return 0; ++ ++free_ext_wall_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350); ++free_ext_usb_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350); ++free_chg_vbatt_lt_2p85: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); ++free_chg_vbatt_lt_3p1: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); ++free_chg_vbatt_lt_3p9: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); ++free_chg_fast_rdy: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); ++free_chg_start: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++free_chg_end: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); ++free_chg_to: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); ++free_chg_bat_fail: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350); ++free_chg_bat_cold: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350); ++free_chg_bat_hot: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350); ++err: ++ return ret; + } + + static void free_charger_irq(struct wm8350 *wm8350) +@@ -456,6 +524,7 @@ static void free_charger_irq(struct wm8350 *wm8350) + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index be076a91e20e6..8cd59e8481631 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -13,7 +13,7 @@ static ssize_t clock_name_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); ++ return sysfs_emit(page, "%s\n", ptp->info->name); + } + static DEVICE_ATTR_RO(clock_name); + +@@ -227,7 +227,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, + + mutex_unlock(&ptp->pincfg_mux); + +- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); ++ return sysfs_emit(page, "%u %u\n", func, chan); + } + + static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c +index 5ff11145c1a30..9b15b6a79082a 100644 +--- a/drivers/pwm/pwm-lpc18xx-sct.c ++++ b/drivers/pwm/pwm-lpc18xx-sct.c +@@ -400,12 +400,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT, + BIT(lpc18xx_pwm->period_event)); + +- ret = pwmchip_add(&lpc18xx_pwm->chip); +- if (ret < 0) { +- dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); +- goto disable_pwmclk; +- } +- + for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) { + struct lpc18xx_pwm_data *data; + +@@ -415,14 +409,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto remove_pwmchip; ++ goto disable_pwmclk; + } + + pwm_set_chip_data(pwm, data); + } + +- platform_set_drvdata(pdev, lpc18xx_pwm); +- + val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL); + val &= ~LPC18XX_PWM_BIDIR; + val &= ~LPC18XX_PWM_CTRL_HALT; +@@ -430,10 +422,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + val |= LPC18XX_PWM_PRE(0); + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val); + ++ ret = pwmchip_add(&lpc18xx_pwm->chip); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); ++ goto disable_pwmclk; ++ } ++ ++ platform_set_drvdata(pdev, lpc18xx_pwm); ++ + return 0; + +-remove_pwmchip: +- pwmchip_remove(&lpc18xx_pwm->chip); + disable_pwmclk: + clk_disable_unprepare(lpc18xx_pwm->pwm_clk); + return ret; +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index e6601c28ab431..a4c82f5e2dae7 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -854,8 +854,10 @@ static int rpm_reg_probe(struct platform_device *pdev) + + for_each_available_child_of_node(dev->of_node, node) { + vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); +- if (!vreg) ++ if (!vreg) { ++ of_node_put(node); + return -ENOMEM; ++ } + + ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); + +diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c +index 24e8b7e271773..6b131a490ebf8 100644 +--- a/drivers/remoteproc/qcom_q6v5_adsp.c ++++ b/drivers/remoteproc/qcom_q6v5_adsp.c +@@ -389,6 +389,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index dc135754bb9c5..c72f1b3b60858 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -440,6 +440,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 5c1378d2fab3d..ba345a379e262 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -793,9 +793,13 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); + struct rtc_time tm; + ktime_t now; ++ int err; ++ ++ err = __rtc_read_time(rtc, &tm); ++ if (err) ++ return err; + + timer->enabled = 1; +- __rtc_read_time(rtc, &tm); + now = rtc_tm_to_ktime(tm); + + /* Skip over expired timers */ +@@ -809,7 +813,6 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + trace_rtc_timer_enqueue(timer); + if (!next || ktime_before(timer->node.expires, next->expires)) { + struct rtc_wkalrm alarm; +- int err; + + alarm.time = rtc_ktime_to_tm(timer->node.expires); + alarm.enabled = 1; +diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c +index 2018614f258f6..6eaa9321c0741 100644 +--- a/drivers/rtc/rtc-wm8350.c ++++ b/drivers/rtc/rtc-wm8350.c +@@ -432,14 +432,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) + return ret; + } + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, + wm8350_rtc_update_handler, 0, + "RTC Seconds", wm8350); ++ if (ret) ++ return ret; ++ + wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, + wm8350_rtc_alarm_handler, 0, + "RTC Alarm", wm8350); ++ if (ret) { ++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); ++ return ret; ++ } + + return 0; + } +diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c +index eb466c2e1839e..fdd9f1a5100c7 100644 +--- a/drivers/scsi/aha152x.c ++++ b/drivers/scsi/aha152x.c +@@ -3368,13 +3368,11 @@ static int __init aha152x_setup(char *str) + setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; + setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; + setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; +- if (ints[0] > 8) { /*}*/ ++ if (ints[0] > 8) + printk(KERN_NOTICE "aha152x: usage: aha152x=[,[," + "[,[,[,[,[,]]]]]]]\n"); +- } else { ++ else + setup_count++; +- return 0; +- } + + return 1; + } +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index fbfce02e5b935..c285f401ff7b5 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -711,7 +711,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, + char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; + + bfa_get_adapter_serial_num(&bfad->bfa, serial_num); +- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); ++ return sysfs_emit(buf, "%s\n", serial_num); + } + + static ssize_t +@@ -725,7 +725,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, + char model[BFA_ADAPTER_MODEL_NAME_LEN]; + + bfa_get_adapter_model(&bfad->bfa, model); +- return snprintf(buf, PAGE_SIZE, "%s\n", model); ++ return sysfs_emit(buf, "%s\n", model); + } + + static ssize_t +@@ -805,7 +805,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, + snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, + "Invalid Model"); + +- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); ++ return sysfs_emit(buf, "%s\n", model_descr); + } + + static ssize_t +@@ -819,7 +819,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, + u64 nwwn; + + nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); +- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); ++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); + } + + static ssize_t +@@ -836,7 +836,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); + strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); +- return snprintf(buf, PAGE_SIZE, "%s\n", symname); ++ return sysfs_emit(buf, "%s\n", symname); + } + + static ssize_t +@@ -850,14 +850,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, + char hw_ver[BFA_VERSION_LEN]; + + bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); ++ return sysfs_emit(buf, "%s\n", hw_ver); + } + + static ssize_t + bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); + } + + static ssize_t +@@ -871,7 +871,7 @@ bfad_im_optionrom_version_show(struct device *dev, + char optrom_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); ++ return sysfs_emit(buf, "%s\n", optrom_ver); + } + + static ssize_t +@@ -885,7 +885,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, + char fw_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); ++ return sysfs_emit(buf, "%s\n", fw_ver); + } + + static ssize_t +@@ -897,7 +897,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, + (struct bfad_im_port_s *) shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + +- return snprintf(buf, PAGE_SIZE, "%d\n", ++ return sysfs_emit(buf, "%d\n", + bfa_get_nports(&bfad->bfa)); + } + +@@ -905,7 +905,7 @@ static ssize_t + bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); + } + + static ssize_t +@@ -924,14 +924,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, + rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), + GFP_ATOMIC); + if (rports == NULL) +- return snprintf(buf, PAGE_SIZE, "Failed\n"); ++ return sysfs_emit(buf, "Failed\n"); + + spin_lock_irqsave(&bfad->bfad_lock, flags); + bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); + kfree(rports); + +- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); ++ return sysfs_emit(buf, "%d\n", nrports); + } + + static DEVICE_ATTR(serial_number, S_IRUGO, +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 13f314fa757e8..a86aae52d94f4 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -504,7 +504,7 @@ MODULE_PARM_DESC(intr_conv, "interrupt converge enable (0-1)"); + + /* permit overriding the host protection capabilities mask (EEDP/T10 PI) */ + static int prot_mask; +-module_param(prot_mask, int, 0); ++module_param(prot_mask, int, 0444); + MODULE_PARM_DESC(prot_mask, " host protection capabilities mask, def=0x0 "); + + static bool auto_affine_msi_experimental; +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index e5b18e5d46dac..6e2a36eeb12a7 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1697,6 +1697,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) + if (cancel_delayed_work_sync(&ep->timeout_work)) { + FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); + fc_exch_release(ep); /* release from pending timer hold */ ++ return; + } + + spin_lock_bh(&ep->ex_lock); +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index 5d28bb7f2ca40..5c801705c4700 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -201,7 +201,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) + task->total_xfer_len = qc->nbytes; + task->num_scatter = qc->n_elem; + task->data_dir = qc->dma_dir; +- } else if (qc->tf.protocol == ATA_PROT_NODATA) { ++ } else if (!ata_is_data(qc->tf.protocol)) { + task->data_dir = DMA_NONE; + } else { + for_each_sg(qc->sg, sg, qc->n_elem, si) +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 52405ce58ade8..c16d7fb0fdcbb 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -697,7 +697,7 @@ static ssize_t + mvs_show_driver_version(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); ++ return sysfs_emit(buffer, "%s\n", DRV_VERSION); + } + + static DEVICE_ATTR(driver_version, +@@ -749,7 +749,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, + static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); ++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); + } + + static DEVICE_ATTR(interrupt_coalescing, +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 68a8217032d0f..fec653b54307a 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1750,6 +1750,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1812,6 +1813,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; + pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; + +@@ -1828,7 +1830,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9)); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +@@ -3773,12 +3775,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + mb(); + + if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { +- pm8001_tag_free(pm8001_ha, tag); + sas_free_task(t); +- /* clear the flag */ +- pm8001_dev->id &= 0xBFFFFFFF; +- } else ++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; ++ } else { + t->task_done(t); ++ } + + return 0; + } +@@ -4727,7 +4728,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha, + memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8); + sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag); + if (pm8001_ha->chip_id != chip_8001) +- sspTMCmd.ds_ads_m = 0x08; ++ sspTMCmd.ds_ads_m = cpu_to_le32(0x08); + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0); + return ret; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index 161bf4760eac7..ce67965a504fa 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha) + else + page_code = THERMAL_PAGE_CODE_8H; + +- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) | +- (THERMAL_ENABLE << 8) | page_code; +- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8); ++ payload.cfg_pg[0] = ++ cpu_to_le32((THERMAL_LOG_ENABLE << 9) | ++ (THERMAL_ENABLE << 8) | page_code); ++ payload.cfg_pg[1] = ++ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8)); + + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); + if (rc) +@@ -1435,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1516,7 +1519,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9))); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 8f85ca0112961..59f5dc9876cc5 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -527,7 +527,7 @@ qla2x00_sysfs_read_vpd(struct file *filp, struct kobject *kobj, + if (!capable(CAP_SYS_ADMIN)) + return -EINVAL; + +- if (IS_NOCACHE_VPD_TYPE(ha)) ++ if (!IS_NOCACHE_VPD_TYPE(ha)) + goto skip; + + faddr = ha->flt_region_vpd << 2; +@@ -710,7 +710,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + ql_log(ql_log_info, vha, 0x706f, + "Issuing MPI reset.\n"); + +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { ++ if (IS_QLA83XX(ha)) { + uint32_t idc_control; + + qla83xx_idc_lock(vha, 0); +@@ -1020,9 +1020,6 @@ qla2x00_free_sysfs_attr(scsi_qla_host_t *vha, bool stop_beacon) + continue; + if (iter->type == 3 && !(IS_CNA_CAPABLE(ha))) + continue; +- if (iter->type == 0x27 && +- (!IS_QLA27XX(ha) || !IS_QLA28XX(ha))) +- continue; + + sysfs_remove_bin_file(&host->shost_gendev.kobj, + iter->attr); +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 7c22f8eea3ead..caf28c5281aa5 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2725,7 +2725,11 @@ struct ct_fdmiv2_hba_attributes { + #define FDMI_PORT_SPEED_8GB 0x10 + #define FDMI_PORT_SPEED_16GB 0x20 + #define FDMI_PORT_SPEED_32GB 0x40 +-#define FDMI_PORT_SPEED_64GB 0x80 ++#define FDMI_PORT_SPEED_20GB 0x80 ++#define FDMI_PORT_SPEED_40GB 0x100 ++#define FDMI_PORT_SPEED_128GB 0x200 ++#define FDMI_PORT_SPEED_64GB 0x400 ++#define FDMI_PORT_SPEED_256GB 0x800 + #define FDMI_PORT_SPEED_UNKNOWN 0x8000 + + #define FC_CLASS_2 0x04 +@@ -4866,4 +4870,8 @@ struct sff_8247_a0 { + #include "qla_gbl.h" + #include "qla_dbg.h" + #include "qla_inline.h" ++ ++#define IS_SESSION_DELETED(_fcport) (_fcport->disc_state == DSC_DELETE_PEND || \ ++ _fcport->disc_state == DSC_DELETED) ++ + #endif +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index d9b5ea77fde99..e9f03370afba3 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -675,8 +675,7 @@ qla2x00_rff_id(scsi_qla_host_t *vha, u8 type) + return (QLA_SUCCESS); + } + +- return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), +- FC4_TYPE_FCP_SCSI); ++ return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), type); + } + + static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, +@@ -726,7 +725,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, + /* Prepare CT arguments -- port_id, FC-4 feature, FC-4 type */ + ct_req->req.rff_id.port_id = port_id_to_be_id(*d_id); + ct_req->req.rff_id.fc4_feature = fc4feature; +- ct_req->req.rff_id.fc4_type = fc4type; /* SCSI - FCP */ ++ ct_req->req.rff_id.fc4_type = fc4type; /* SCSI-FCP or FC-NVMe */ + + sp->u.iocb_cmd.u.ctarg.req_size = RFF_ID_REQ_SIZE; + sp->u.iocb_cmd.u.ctarg.rsp_size = RFF_ID_RSP_SIZE; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 37c1f27a76cf6..a6e24cef89a0b 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -572,6 +572,14 @@ qla2x00_async_adisc(struct scsi_qla_host *vha, fc_port_t *fcport, + struct srb_iocb *lio; + int rval = QLA_FUNCTION_FAILED; + ++ if (IS_SESSION_DELETED(fcport)) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; ++ return rval; ++ } ++ + if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT)) + return rval; + +@@ -955,6 +963,9 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + } + break; ++ case ISP_CFG_NL: ++ qla24xx_fcport_handle_login(vha, fcport); ++ break; + default: + break; + } +@@ -1311,14 +1322,21 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) + struct port_database_24xx *pd; + struct qla_hw_data *ha = vha->hw; + +- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) || +- fcport->loop_id == FC_NO_LOOP_ID) { ++ if (IS_SESSION_DELETED(fcport)) { + ql_log(ql_log_warn, vha, 0xffff, +- "%s: %8phC - not sending command.\n", +- __func__, fcport->port_name); ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; + return rval; + } + ++ if (!vha->flags.online || fcport->flags & FCF_ASYNC_SENT) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC online %d flags %x - not sending command.\n", ++ __func__, fcport->port_name, vha->flags.online, fcport->flags); ++ goto done; ++ } ++ + sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL); + if (!sp) + goto done; +@@ -1477,6 +1495,11 @@ static void qla_chk_n2n_b4_login(struct scsi_qla_host *vha, fc_port_t *fcport) + u8 login = 0; + int rc; + ++ ql_dbg(ql_dbg_disc, vha, 0x307b, ++ "%s %8phC DS %d LS %d lid %d retries=%d\n", ++ __func__, fcport->port_name, fcport->disc_state, ++ fcport->fw_login_state, fcport->loop_id, fcport->login_retry); ++ + if (qla_tgt_mode_enabled(vha)) + return; + +@@ -1534,7 +1557,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + fcport->conflict, fcport->last_rscn_gen, fcport->rscn_gen, + fcport->login_gen, fcport->loop_id, fcport->scan_state); + +- if (fcport->scan_state != QLA_FCPORT_FOUND) ++ if (fcport->scan_state != QLA_FCPORT_FOUND || ++ fcport->disc_state == DSC_DELETE_PEND) + return 0; + + if ((fcport->loop_id != FC_NO_LOOP_ID) && +@@ -1555,7 +1579,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + if (vha->host->active_mode == MODE_TARGET) + return 0; + +- if (fcport->flags & FCF_ASYNC_SENT) { ++ if (fcport->flags & (FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE)) { + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + return 0; + } +@@ -3223,6 +3247,14 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + struct rsp_que *rsp = ha->rsp_q_map[0]; + struct qla2xxx_fw_dump *fw_dump; + ++ if (ha->fw_dump) { ++ ql_dbg(ql_dbg_init, vha, 0x00bd, ++ "Firmware dump already allocated.\n"); ++ return; ++ } ++ ++ ha->fw_dumped = 0; ++ ha->fw_dump_cap_flags = 0; + dump_size = fixed_size = mem_size = eft_size = fce_size = mq_size = 0; + req_q_size = rsp_q_size = 0; + +@@ -3233,7 +3265,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + mem_size = (ha->fw_memory_size - 0x11000 + 1) * + sizeof(uint16_t); + } else if (IS_FWI2_CAPABLE(ha)) { +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) ++ if (IS_QLA83XX(ha)) + fixed_size = offsetof(struct qla83xx_fw_dump, ext_mem); + else if (IS_QLA81XX(ha)) + fixed_size = offsetof(struct qla81xx_fw_dump, ext_mem); +@@ -3245,8 +3277,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + mem_size = (ha->fw_memory_size - 0x100000 + 1) * + sizeof(uint32_t); + if (ha->mqenable) { +- if (!IS_QLA83XX(ha) && !IS_QLA27XX(ha) && +- !IS_QLA28XX(ha)) ++ if (!IS_QLA83XX(ha)) + mq_size = sizeof(struct qla2xxx_mq_chain); + /* + * Allocate maximum buffer size for all queues - Q0. +@@ -3743,8 +3774,7 @@ enable_82xx_npiv: + ha->fw_major_version, ha->fw_minor_version, + ha->fw_subminor_version); + +- if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) { ++ if (IS_QLA83XX(ha)) { + ha->flags.fac_supported = 0; + rval = QLA_SUCCESS; + } +@@ -5217,6 +5247,13 @@ skip_login: + memcpy(fcport->node_name, new_fcport->node_name, + WWN_SIZE); + fcport->scan_state = QLA_FCPORT_FOUND; ++ if (fcport->login_retry == 0) { ++ fcport->login_retry = vha->hw->login_retry_count; ++ ql_dbg(ql_dbg_disc, vha, 0x2135, ++ "Port login retry %8phN, lid 0x%04x retry cnt=%d.\n", ++ fcport->port_name, fcport->loop_id, ++ fcport->login_retry); ++ } + found++; + break; + } +@@ -5351,6 +5388,8 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport) + if (atomic_read(&fcport->state) == FCS_ONLINE) + return; + ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + rport_ids.node_name = wwn_to_u64(fcport->node_name); + rport_ids.port_name = wwn_to_u64(fcport->port_name); + rport_ids.port_id = fcport->d_id.b.domain << 16 | +@@ -5446,6 +5485,7 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + qla2x00_reg_remote_port(vha, fcport); + break; + case MODE_TARGET: ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); + if (!vha->vha_tgt.qla_tgt->tgt_stop && + !vha->vha_tgt.qla_tgt->tgt_stopped) + qlt_fc_port_added(vha, fcport); +@@ -5460,8 +5500,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + break; + } + +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { + if (fcport->id_changed) { + fcport->id_changed = 0; +@@ -9001,7 +9039,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, + qpair->rsp->req = qpair->req; + qpair->rsp->qpair = qpair; + /* init qpair to this cpu. Will adjust at run time. */ +- qla_cpu_update(qpair, smp_processor_id()); ++ qla_cpu_update(qpair, raw_smp_processor_id()); + + if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { + if (ha->fw_attributes & BIT_4) +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 936103604d02d..103288b0377e0 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2859,6 +2859,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + set_bit(ISP_ABORT_NEEDED, + &vha->dpc_flags); + qla2xxx_wake_dpc(vha); ++ break; + } + /* fall through */ + default: +@@ -2868,9 +2869,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + fw_status[0], fw_status[1], fw_status[2]); + + fcport->flags &= ~FCF_ASYNC_SENT; +- qla2x00_set_fcport_disc_state(fcport, +- DSC_LOGIN_FAILED); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ qlt_schedule_sess_for_deletion(fcport); + break; + } + break; +@@ -2882,8 +2881,7 @@ static void qla2x00_els_dcmd2_sp_done(srb_t *sp, int res) + fw_status[0], fw_status[1], fw_status[2]); + + sp->fcport->flags &= ~FCF_ASYNC_SENT; +- qla2x00_set_fcport_disc_state(fcport, DSC_LOGIN_FAILED); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ qlt_schedule_sess_for_deletion(fcport); + break; + } + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 3e9c5768815e5..d7cf7f9570874 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1839,6 +1839,7 @@ qla24xx_tm_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, void *tsk) + iocb->u.tmf.data = QLA_FUNCTION_FAILED; + } else if ((le16_to_cpu(sts->scsi_status) & + SS_RESPONSE_INFO_LEN_VALID)) { ++ host_to_fcp_swap(sts->data, sizeof(sts->data)); + if (le32_to_cpu(sts->rsp_data_len) < 4) { + ql_log(ql_log_warn, fcport->vha, 0x503b, + "Async-%s error - hdl=%x not enough response(%d).\n", +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 098388a12febc..29f2730fbf66a 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -10,6 +10,12 @@ + #include + #include + ++#ifdef CONFIG_PPC ++#define IS_PPCARCH true ++#else ++#define IS_PPCARCH false ++#endif ++ + static struct mb_cmd_name { + uint16_t cmd; + const char *str; +@@ -731,6 +737,9 @@ qla2x00_execute_fw(scsi_qla_host_t *vha, uint32_t risc_addr) + vha->min_supported_speed = + nv->min_supported_speed; + } ++ ++ if (IS_PPCARCH) ++ mcp->mb[11] |= BIT_4; + } + + if (ha->flags.exlogins_enabled) +@@ -2897,8 +2906,7 @@ qla2x00_get_resource_cnts(scsi_qla_host_t *vha) + ha->orig_fw_iocb_count = mcp->mb[10]; + if (ha->flags.npiv_supported) + ha->max_npiv_vports = mcp->mb[11]; +- if (IS_QLA81XX(ha) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) ++ if (IS_QLA81XX(ha) || IS_QLA83XX(ha)) + ha->fw_max_fcf_count = mcp->mb[12]; + } + +@@ -5391,7 +5399,7 @@ qla2x00_get_data_rate(scsi_qla_host_t *vha) + mcp->out_mb = MBX_1|MBX_0; + mcp->in_mb = MBX_2|MBX_1|MBX_0; + if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) +- mcp->in_mb |= MBX_3; ++ mcp->in_mb |= MBX_4|MBX_3; + mcp->tov = MBX_TOV_SECONDS; + mcp->flags = 0; + rval = qla2x00_mailbox_command(vha, mcp); +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 97453c12b7358..a15af048cd820 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -36,6 +36,11 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + (fcport->nvme_flag & NVME_FLAG_REGISTERED)) + return 0; + ++ if (atomic_read(&fcport->state) == FCS_ONLINE) ++ return 0; ++ ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + fcport->nvme_flag &= ~NVME_FLAG_RESETTING; + + memset(&req, 0, sizeof(struct nvme_fc_port_info)); +@@ -152,6 +157,18 @@ out: + qla2xxx_rel_qpair_sp(sp->qpair, sp); + } + ++static void qla_nvme_ls_unmap(struct srb *sp, struct nvmefc_ls_req *fd) ++{ ++ if (sp->flags & SRB_DMA_VALID) { ++ struct srb_iocb *nvme = &sp->u.iocb_cmd; ++ struct qla_hw_data *ha = sp->fcport->vha->hw; ++ ++ dma_unmap_single(&ha->pdev->dev, nvme->u.nvme.cmd_dma, ++ fd->rqstlen, DMA_TO_DEVICE); ++ sp->flags &= ~SRB_DMA_VALID; ++ } ++} ++ + static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + { + struct srb *sp = container_of(kref, struct srb, cmd_kref); +@@ -168,6 +185,8 @@ static void qla_nvme_release_ls_cmd_kref(struct kref *kref) + spin_unlock_irqrestore(&priv->cmd_lock, flags); + + fd = priv->fd; ++ ++ qla_nvme_ls_unmap(sp, fd); + fd->done(fd, priv->comp_status); + out: + qla2x00_rel_sp(sp); +@@ -314,6 +333,8 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + dma_sync_single_for_device(&ha->pdev->dev, nvme->u.nvme.cmd_dma, + fd->rqstlen, DMA_TO_DEVICE); + ++ sp->flags |= SRB_DMA_VALID; ++ + rval = qla2x00_start_sp(sp); + if (rval != QLA_SUCCESS) { + ql_log(ql_log_warn, vha, 0x700e, +@@ -321,6 +342,7 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, + wake_up(&sp->nvme_ls_waitq); + sp->priv = NULL; + priv->sp = NULL; ++ qla_nvme_ls_unmap(sp, fd); + qla2x00_rel_sp(sp); + return rval; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index c1d4c964b0dd4..a5dbaa3491f82 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3627,8 +3627,7 @@ qla2x00_unmap_iobases(struct qla_hw_data *ha) + if (ha->mqiobase) + iounmap(ha->mqiobase); + +- if ((IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) && +- ha->msixbase) ++ if (ha->msixbase) + iounmap(ha->msixbase); + } + } +@@ -5348,6 +5347,11 @@ void qla2x00_relogin(struct scsi_qla_host *vha) + memset(&ea, 0, sizeof(ea)); + ea.fcport = fcport; + qla24xx_handle_relogin_event(vha, &ea); ++ } else if (vha->hw->current_topology == ++ ISP_CFG_NL && ++ IS_QLA2XXX_MIDTYPE(vha->hw)) { ++ (void)qla24xx_fcport_handle_login(vha, ++ fcport); + } else if (vha->hw->current_topology == + ISP_CFG_NL) { + fcport->login_retry--; +diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c +index bbe90354f49b0..d306f3ca0f3bf 100644 +--- a/drivers/scsi/qla2xxx/qla_sup.c ++++ b/drivers/scsi/qla2xxx/qla_sup.c +@@ -843,7 +843,7 @@ qla2xxx_get_flt_info(scsi_qla_host_t *vha, uint32_t flt_addr) + ha->flt_region_nvram = start; + break; + case FLT_REG_IMG_PRI_27XX: +- if (IS_QLA27XX(ha) && !IS_QLA28XX(ha)) ++ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) + ha->flt_region_img_status_pri = start; + break; + case FLT_REG_IMG_SEC_27XX: +@@ -1355,7 +1355,7 @@ next: + flash_data_addr(ha, faddr), cpu_to_le32(*dwptr)); + if (ret) { + ql_dbg(ql_dbg_user, vha, 0x7006, +- "Failed slopw write %x (%x)\n", faddr, *dwptr); ++ "Failed slow write %x (%x)\n", faddr, *dwptr); + break; + } + } +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 0111c543f0e64..df598c377161d 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3251,6 +3251,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); ++ res = 0; + goto out_unmap_unlock; + } + +@@ -7083,8 +7084,7 @@ qlt_probe_one_stage1(struct scsi_qla_host *base_vha, struct qla_hw_data *ha) + if (!QLA_TGT_MODE_ENABLED()) + return; + +- if ((ql2xenablemsix == 0) || IS_QLA83XX(ha) || IS_QLA27XX(ha) || +- IS_QLA28XX(ha)) { ++ if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { + ISP_ATIO_Q_IN(base_vha) = &ha->mqiobase->isp25mq.atio_q_in; + ISP_ATIO_Q_OUT(base_vha) = &ha->mqiobase->isp25mq.atio_q_out; + } else { +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index 27b9e2baab1a6..7acf9193a9e80 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -159,6 +159,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); +diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c +index 45c5aa712edac..f16d6ec780644 100644 +--- a/drivers/soc/qcom/qcom_aoss.c ++++ b/drivers/soc/qcom/qcom_aoss.c +@@ -544,7 +544,7 @@ static int qmp_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- ret = devm_request_irq(&pdev->dev, irq, qmp_intr, IRQF_ONESHOT, ++ ret = devm_request_irq(&pdev->dev, irq, qmp_intr, 0, + "aoss-qmp", qmp); + if (ret < 0) { + dev_err(&pdev->dev, "failed to request interrupt\n"); +diff --git a/drivers/soc/qcom/rpmpd.c b/drivers/soc/qcom/rpmpd.c +index 3c1a55cf25d62..4715acfecff49 100644 +--- a/drivers/soc/qcom/rpmpd.c ++++ b/drivers/soc/qcom/rpmpd.c +@@ -362,6 +362,9 @@ static int rpmpd_probe(struct platform_device *pdev) + + data->domains = devm_kcalloc(&pdev->dev, num, sizeof(*data->domains), + GFP_KERNEL); ++ if (!data->domains) ++ return -ENOMEM; ++ + data->num_domains = num; + + for (i = 0; i < num; i++) { +diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c +index e9ece45d7a333..ef3f95fefab58 100644 +--- a/drivers/soc/ti/wkup_m3_ipc.c ++++ b/drivers/soc/ti/wkup_m3_ipc.c +@@ -447,9 +447,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { ++ if (irq < 0) { + dev_err(&pdev->dev, "no irq resource\n"); +- return -ENXIO; ++ return irq; + } + + ret = devm_request_irq(dev, irq, wkup_m3_txev_handler, +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 3755be04346a6..d933a6eda5fdc 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -960,7 +960,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + addr = op->addr.val; + len = op->data.nbytes; + +- if (bcm_qspi_bspi_ver_three(qspi) == true) { ++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { + /* + * The address coming into this function is a raw flash offset. + * But for BSPI <= V3, we need to convert it to a remapped BSPI +@@ -979,7 +979,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + len < 4) + mspi_read = true; + +- if (mspi_read) ++ if (!has_bspi(qspi) || mspi_read) + return bcm_qspi_mspi_exec_mem_op(spi, op); + + ret = bcm_qspi_bspi_set_mode(qspi, op, 0); +diff --git a/drivers/spi/spi-mxic.c b/drivers/spi/spi-mxic.c +index eba706d5671e2..d0b5db88cd164 100644 +--- a/drivers/spi/spi-mxic.c ++++ b/drivers/spi/spi-mxic.c +@@ -304,25 +304,21 @@ static int mxic_spi_data_xfer(struct mxic_spi *mxic, const void *txbuf, + + writel(data, mxic->regs + TXD(nbytes % 4)); + ++ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, ++ sts & INT_TX_EMPTY, 0, USEC_PER_SEC); ++ if (ret) ++ return ret; ++ ++ ret = readl_poll_timeout(mxic->regs + INT_STS, sts, ++ sts & INT_RX_NOT_EMPTY, 0, ++ USEC_PER_SEC); ++ if (ret) ++ return ret; ++ ++ data = readl(mxic->regs + RXD); + if (rxbuf) { +- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, +- sts & INT_TX_EMPTY, 0, +- USEC_PER_SEC); +- if (ret) +- return ret; +- +- ret = readl_poll_timeout(mxic->regs + INT_STS, sts, +- sts & INT_RX_NOT_EMPTY, 0, +- USEC_PER_SEC); +- if (ret) +- return ret; +- +- data = readl(mxic->regs + RXD); + data >>= (8 * (4 - nbytes)); + memcpy(rxbuf + pos, &data, nbytes); +- WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); +- } else { +- readl(mxic->regs + RXD); + } + WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); + +diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c +index aafac128bb5f1..4eb979a096c78 100644 +--- a/drivers/spi/spi-pxa2xx-pci.c ++++ b/drivers/spi/spi-pxa2xx-pci.c +@@ -74,14 +74,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param) + return true; + } + ++static void lpss_dma_put_device(void *dma_dev) ++{ ++ pci_dev_put(dma_dev); ++} ++ + static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { + struct pci_dev *dma_dev; ++ int ret; + + c->num_chipselect = 1; + c->max_clk_rate = 50000000; + + dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; + + if (c->tx_param) { + struct dw_dma_slave *slave = c->tx_param; +@@ -105,8 +114,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + + static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { +- struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); + struct dw_dma_slave *tx, *rx; ++ struct pci_dev *dma_dev; ++ int ret; + + switch (PCI_FUNC(dev->devfn)) { + case 0: +@@ -131,6 +141,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + return -ENODEV; + } + ++ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; ++ + tx = c->tx_param; + tx->dma_dev = &dma_dev->dev; + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 594905bf89aa8..3f7a64b2a5d06 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -1352,6 +1352,10 @@ static int tegra_spi_probe(struct platform_device *pdev) + tspi->phys = r->start; + + spi_irq = platform_get_irq(pdev, 0); ++ if (spi_irq < 0) { ++ ret = spi_irq; ++ goto exit_free_master; ++ } + tspi->irq = spi_irq; + + tspi->clk = devm_clk_get(&pdev->dev, "spi"); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 9b59539c87359..e6b12f78c8f01 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1011,14 +1011,8 @@ static int tegra_slink_probe(struct platform_device *pdev) + struct resource *r; + int ret, spi_irq; + const struct tegra_slink_chip_data *cdata = NULL; +- const struct of_device_id *match; + +- match = of_match_device(tegra_slink_of_match, &pdev->dev); +- if (!match) { +- dev_err(&pdev->dev, "Error: No device match found\n"); +- return -ENODEV; +- } +- cdata = match->data; ++ cdata = of_device_get_match_data(&pdev->dev); + + master = spi_alloc_master(&pdev->dev, sizeof(*tspi)); + if (!master) { +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index ac05c9c864884..b18ae50db1f52 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -844,10 +844,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev, + int i, ret; + + if (vmalloced_buf || kmap_buf) { +- desc_len = min_t(int, max_seg_size, PAGE_SIZE); ++ desc_len = min_t(unsigned long, max_seg_size, PAGE_SIZE); + sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len); + } else if (virt_addr_valid(buf)) { +- desc_len = min_t(int, max_seg_size, ctlr->max_dma_len); ++ desc_len = min_t(size_t, max_seg_size, ctlr->max_dma_len); + sgs = DIV_ROUND_UP(len, desc_len); + } else { + return -EINVAL; +diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c +index 19a5f244dcae2..d8886c5c0d1f2 100644 +--- a/drivers/staging/iio/adc/ad7280a.c ++++ b/drivers/staging/iio/adc/ad7280a.c +@@ -107,9 +107,9 @@ + static unsigned int ad7280a_devaddr(unsigned int addr) + { + return ((addr & 0x1) << 4) | +- ((addr & 0x2) << 3) | ++ ((addr & 0x2) << 2) | + (addr & 0x4) | +- ((addr & 0x8) >> 3) | ++ ((addr & 0x8) >> 2) | + ((addr & 0x10) >> 4); + } + +diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +index 8b76f1f13b062..e81a354b88720 100644 +--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c ++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu, + + reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width) + | H1_REG_IN_IMG_CTRL_OVRFLR_D4(0) +- | H1_REG_IN_IMG_CTRL_OVRFLB_D4(0) ++ | H1_REG_IN_IMG_CTRL_OVRFLB(0) + | H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt); + vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL); + } +diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h +index d6e9825bb5c7b..30e7e7b920b55 100644 +--- a/drivers/staging/media/hantro/hantro_h1_regs.h ++++ b/drivers/staging/media/hantro/hantro_h1_regs.h +@@ -47,7 +47,7 @@ + #define H1_REG_IN_IMG_CTRL 0x03c + #define H1_REG_IN_IMG_CTRL_ROW_LEN(x) ((x) << 12) + #define H1_REG_IN_IMG_CTRL_OVRFLR_D4(x) ((x) << 10) +-#define H1_REG_IN_IMG_CTRL_OVRFLB_D4(x) ((x) << 6) ++#define H1_REG_IN_IMG_CTRL_OVRFLB(x) ((x) << 6) + #define H1_REG_IN_IMG_CTRL_FMT(x) ((x) << 2) + #define H1_REG_ENC_CTRL0 0x040 + #define H1_REG_ENC_CTRL0_INIT_QP(x) ((x) << 26) +diff --git a/drivers/staging/mt7621-dts/gbpc1.dts b/drivers/staging/mt7621-dts/gbpc1.dts +index 1fb560ff059c8..1713283e60d4e 100644 +--- a/drivers/staging/mt7621-dts/gbpc1.dts ++++ b/drivers/staging/mt7621-dts/gbpc1.dts +@@ -11,7 +11,8 @@ + + memory@0 { + device_type = "memory"; +- reg = <0x0 0x1c000000>, <0x20000000 0x4000000>; ++ reg = <0x00000000 0x1c000000>, ++ <0x20000000 0x04000000>; + }; + + chosen { +@@ -37,24 +38,16 @@ + gpio-leds { + compatible = "gpio-leds"; + +- system { +- label = "gb-pc1:green:system"; ++ power { ++ label = "green:power"; + gpios = <&gpio 6 GPIO_ACTIVE_LOW>; ++ linux,default-trigger = "default-on"; + }; + +- status { +- label = "gb-pc1:green:status"; ++ system { ++ label = "green:system"; + gpios = <&gpio 8 GPIO_ACTIVE_LOW>; +- }; +- +- lan1 { +- label = "gb-pc1:green:lan1"; +- gpios = <&gpio 24 GPIO_ACTIVE_LOW>; +- }; +- +- lan2 { +- label = "gb-pc1:green:lan2"; +- gpios = <&gpio 25 GPIO_ACTIVE_LOW>; ++ linux,default-trigger = "disk-activity"; + }; + }; + }; +@@ -94,9 +87,8 @@ + + partition@50000 { + label = "firmware"; +- reg = <0x50000 0x1FB0000>; ++ reg = <0x50000 0x1fb0000>; + }; +- + }; + }; + +@@ -118,9 +110,12 @@ + }; + + &pinctrl { +- state_default: pinctrl0 { +- default_gpio: gpio { +- groups = "wdt", "rgmii2", "uart3"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&state_default>; ++ ++ state_default: state-default { ++ gpio-pinmux { ++ groups = "rgmii2", "uart3", "wdt"; + function = "gpio"; + }; + }; +@@ -129,12 +124,13 @@ + &switch0 { + ports { + port@0 { ++ status = "okay"; + label = "ethblack"; +- status = "ok"; + }; ++ + port@4 { ++ status = "okay"; + label = "ethblue"; +- status = "ok"; + }; + }; + }; +diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +index a31163547fbaa..3a1a28a79d463 100644 +--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +@@ -49,7 +49,7 @@ struct int3400_thermal_priv { + struct art *arts; + int trt_count; + struct trt *trts; +- u8 uuid_bitmap; ++ u32 uuid_bitmap; + int rel_misc_dev_res; + int current_uuid_index; + }; +diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c +index 2af1e5751bd63..796fbff623f6e 100644 +--- a/drivers/tty/hvc/hvc_iucv.c ++++ b/drivers/tty/hvc/hvc_iucv.c +@@ -1470,7 +1470,9 @@ out_error: + */ + static int __init hvc_iucv_config(char *val) + { +- return kstrtoul(val, 10, &hvc_iucv_devices); ++ if (kstrtoul(val, 10, &hvc_iucv_devices)) ++ pr_warn("hvc_iucv= invalid parameter value '%s'\n", val); ++ return 1; + } + + +diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c +index 9d00ff5ef9611..085dc8dd1327b 100644 +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + struct mxser_port *info = container_of(port, struct mxser_port, port); + unsigned long page; + unsigned long flags; ++ int ret; + + page = __get_free_page(GFP_KERNEL); + if (!page) +@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + + if (!info->ioaddr || !info->type) { + set_bit(TTY_IO_ERROR, &tty->flags); +- free_page(page); + spin_unlock_irqrestore(&info->slock, flags); +- return 0; ++ ret = 0; ++ goto err_free_xmit; + } + info->port.xmit_buf = (unsigned char *) page; + +@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + if (capable(CAP_SYS_ADMIN)) { + set_bit(TTY_IO_ERROR, &tty->flags); + return 0; +- } else +- return -ENODEV; ++ } ++ ++ ret = -ENODEV; ++ goto err_free_xmit; + } + + /* +@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + spin_unlock_irqrestore(&info->slock, flags); + + return 0; ++err_free_xmit: ++ free_page(page); ++ info->port.xmit_buf = NULL; ++ return ret; + } + + /* +diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c +index efa0515139f8e..e6c1791609ddf 100644 +--- a/drivers/tty/serial/8250/8250_mid.c ++++ b/drivers/tty/serial/8250/8250_mid.c +@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void pnw_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int tng_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void tng_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int dnv_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + pci_set_drvdata(pdev, mid); + return 0; ++ + err: +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + return ret; + } + +@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev) + + serial8250_unregister_port(mid->line); + +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + } + + static const struct mid8250_board pnw_board = { +@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = { + .freq = 50000000, + .base_baud = 115200, + .setup = pnw_setup, ++ .exit = pnw_exit, + }; + + static const struct mid8250_board tng_board = { +@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = { + .freq = 38400000, + .base_baud = 1843200, + .setup = tng_setup, ++ .exit = tng_exit, + }; + + static const struct mid8250_board dnv_board = { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 777ef1a9591c0..87567515591e1 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1545,6 +1545,18 @@ static inline void start_tx_rs485(struct uart_port *port) + if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) + serial8250_stop_rx(&up->port); + ++ /* ++ * While serial8250_em485_handle_stop_tx() is a noop if ++ * em485->active_timer != &em485->stop_tx_timer, it might happen that ++ * the timer is still armed and triggers only after the current bunch of ++ * chars is send and em485->active_timer == &em485->stop_tx_timer again. ++ * So cancel the timer. There is still a theoretical race condition if ++ * the timer is already running and only comes around to check for ++ * em485->active_timer when &em485->stop_tx_timer is armed again. ++ */ ++ if (em485->active_timer == &em485->stop_tx_timer) ++ hrtimer_try_to_cancel(&em485->stop_tx_timer); ++ + em485->active_timer = NULL; + + mcr = serial8250_in_MCR(up); +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index f5608ad68ae1a..6d4792ec9e5fa 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -391,16 +391,16 @@ static int kgdboc_option_setup(char *opt) + { + if (!opt) { + pr_err("config string not provided\n"); +- return -EINVAL; ++ return 1; + } + + if (strlen(opt) >= MAX_CONFIG_LEN) { + pr_err("config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); + +- return 0; ++ return 1; + } + + __setup("kgdboc=", kgdboc_option_setup); +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index c7683beb3412a..6040d5a6139ab 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -761,11 +761,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) + goto out; + } + +- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { +- spin_unlock(&port->lock); ++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- spin_lock(&port->lock); +- } + + if (uart_circ_empty(xmit)) + s3c24xx_serial_stop_tx(port); +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index e8acad49a53a8..81ee1cd794f7d 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -242,7 +242,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + break; + + case OMAP_DWC3_ID_FLOAT: +- if (omap->vbus_reg) ++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) + regulator_disable(omap->vbus_reg); + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index 774ccaa5aceea..1962140a59f20 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; + /* defined here to avoid adding to pci_ids.h for single instance use */ + #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 + ++#define PCI_VENDOR_ID_ASPEED 0x1a03 ++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 ++ + /*-------------------------------------------------------------------------*/ + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 + static inline bool is_intel_quark_x1000(struct pci_dev *pdev) +@@ -223,6 +226,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci->has_synopsys_hc_bug = 1; + } + break; ++ case PCI_VENDOR_ID_ASPEED: ++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { ++ ehci_info(ehci, "applying Aspeed HC workaround\n"); ++ ehci->is_aspeed = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 48832f7f2fc3c..db65e1ad00deb 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -674,7 +674,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci) + } + pm_runtime_allow(xhci_to_hcd(xhci)->self.controller); + xhci->test_mode = 0; +- return xhci_reset(xhci); ++ return xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + } + + void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, +@@ -1000,6 +1000,9 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status, + if (link_state == XDEV_U2) + *status |= USB_PORT_STAT_L1; + if (link_state == XDEV_U0) { ++ if (bus_state->resume_done[portnum]) ++ usb_hcd_end_port_resume(&port->rhub->hcd->self, ++ portnum); + bus_state->resume_done[portnum] = 0; + clear_bit(portnum, &bus_state->resuming_ports); + if (bus_state->suspended_ports & (1 << portnum)) { +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 160caef09c5ea..ef23a69c6553a 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2583,7 +2583,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) + + fail: + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + xhci_mem_cleanup(xhci); + return -ENOMEM; + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 8f029d44e9c9e..476dc6abd5a21 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring) + * handshake done). There are two failure modes: "usec" have passed (major + * hardware flakeout), or the register reads as all-ones (hardware removed). + */ +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us) + { + u32 result; + int ret; +@@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) + ret = readl_poll_timeout_atomic(ptr, result, + (result & mask) == done || + result == U32_MAX, +- 1, usec); ++ 1, timeout_us); + if (result == U32_MAX) /* card removed */ + return -ENODEV; + +@@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci) + * Transactions will be terminated immediately, and operational registers + * will be set to their defaults. + */ +-int xhci_reset(struct xhci_hcd *xhci) ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) + { + u32 command; + u32 state; +@@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci) + if (xhci->quirks & XHCI_INTEL_HOST) + udelay(1000); + +- ret = xhci_handshake(&xhci->op_regs->command, +- CMD_RESET, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us); + if (ret) + return ret; + +@@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci) + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ +- ret = xhci_handshake(&xhci->op_regs->status, +- STS_CNR, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us); + + xhci->usb2_rhub.bus_state.port_c_suspend = 0; + xhci->usb2_rhub.bus_state.suspended_ports = 0; +@@ -732,7 +730,7 @@ static void xhci_stop(struct usb_hcd *hcd) + xhci->xhc_state |= XHCI_STATE_HALTED; + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -785,7 +783,7 @@ void xhci_shutdown(struct usb_hcd *hcd) + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */ + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -1170,7 +1168,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + xhci_dbg(xhci, "Stop HCD\n"); + xhci_halt(xhci); + xhci_zero_64b_regs(xhci); +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + spin_unlock_irq(&xhci->lock); + if (retval) + return retval; +@@ -5272,7 +5270,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + + xhci_dbg(xhci, "Resetting HCD\n"); + /* Reset the internal HC memory state and registers. */ +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + if (retval) + return retval; + xhci_dbg(xhci, "Reset complete\n"); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 02df309e44093..4b05d767e08f7 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -229,6 +229,9 @@ struct xhci_op_regs { + #define CMD_ETE (1 << 14) + /* bits 15:31 are reserved (and should be preserved on writes). */ + ++#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000) ++#define XHCI_RESET_SHORT_USEC (250 * 1000) ++ + /* IMAN - Interrupt Management Register */ + #define IMAN_IE (1 << 1) + #define IMAN_IP (1 << 0) +@@ -2061,11 +2064,11 @@ void xhci_free_container_ctx(struct xhci_hcd *xhci, + + /* xHCI host controller glue */ + typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec); ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us); + void xhci_quiesce(struct xhci_hcd *xhci); + int xhci_halt(struct xhci_hcd *xhci); + int xhci_start(struct xhci_hcd *xhci); +-int xhci_reset(struct xhci_hcd *xhci); ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us); + int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + void xhci_shutdown(struct usb_hcd *hcd); +@@ -2449,6 +2452,8 @@ static inline const char *xhci_decode_ctrl_ctx(unsigned long drop, + unsigned int bit; + int ret = 0; + ++ str[0] = '\0'; ++ + if (drop) { + ret = sprintf(str, "Drop:"); + for_each_set_bit(bit, &drop, 32) +diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig +index 67279c6bce338..31ad8682ad9b8 100644 +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -66,6 +66,7 @@ config USB_SERIAL_SIMPLE + - Libtransistor USB console + - a number of Motorola phones + - Motorola Tetra devices ++ - Nokia mobile phones + - Novatel Wireless GPS receivers + - Siemens USB/MPI adapter. + - ViVOtech ViVOpay USB device. +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 9600cee957697..2a91219dee7e6 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, + { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, + { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, ++ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 3e5442573fe4e..15f746e977a71 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -29,6 +29,9 @@ + #define ATEN_PRODUCT_UC232B 0x2022 + #define ATEN_PRODUCT_ID2 0x2118 + ++#define IBM_VENDOR_ID 0x04b3 ++#define IBM_PRODUCT_ID 0x4016 ++ + #define IODATA_VENDOR_ID 0x04bb + #define IODATA_PRODUCT_ID 0x0a03 + #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index bd23a7cb1be2b..4c6747889a194 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); + { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + ++/* Nokia mobile phone driver */ ++#define NOKIA_IDS() \ ++ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ ++DEVICE(nokia, NOKIA_IDS); ++ + /* Novatel Wireless GPS driver */ + #define NOVATEL_IDS() \ + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ +@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = { + &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, ++ &nokia_device, + &novatel_gps_device, + &hp4x_device, + &suunto_device, +@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = { + VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), ++ NOKIA_IDS(), + NOVATEL_IDS(), + HP4X_IDS(), + SUUNTO_IDS(), +diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c +index 8b1b730654218..9c984f3c7248a 100644 +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -237,36 +237,33 @@ static struct us_unusual_dev ene_ub6250_unusual_dev_list[] = { + #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0)) + + +-struct SD_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMMC:1; +- u8 HiCapacity:1; +- u8 HiSpeed:1; +- u8 WtP:1; +- u8 Reserved:1; +-}; +- +-struct MS_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMSPro:1; +- u8 IsMSPHG:1; +- u8 Reserved1:1; +- u8 WtP:1; +- u8 Reserved2:1; +-}; +- +-struct SM_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 Reserved:3; +- u8 WtP:1; +- u8 IsMS:1; +-}; ++/* SD_STATUS bits */ ++#define SD_Insert BIT(0) ++#define SD_Ready BIT(1) ++#define SD_MediaChange BIT(2) ++#define SD_IsMMC BIT(3) ++#define SD_HiCapacity BIT(4) ++#define SD_HiSpeed BIT(5) ++#define SD_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* MS_STATUS bits */ ++#define MS_Insert BIT(0) ++#define MS_Ready BIT(1) ++#define MS_MediaChange BIT(2) ++#define MS_IsMSPro BIT(3) ++#define MS_IsMSPHG BIT(4) ++ /* Bit 5 reserved */ ++#define MS_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* SM_STATUS bits */ ++#define SM_Insert BIT(0) ++#define SM_Ready BIT(1) ++#define SM_MediaChange BIT(2) ++ /* Bits 3-5 reserved */ ++#define SM_WtP BIT(6) ++#define SM_IsMS BIT(7) + + struct ms_bootblock_cis { + u8 bCistplDEVICE[6]; /* 0 */ +@@ -437,9 +434,9 @@ struct ene_ub6250_info { + u8 *bbuf; + + /* for 6250 code */ +- struct SD_STATUS SD_Status; +- struct MS_STATUS MS_Status; +- struct SM_STATUS SM_Status; ++ u8 SD_Status; ++ u8 MS_Status; ++ u8 SM_Status; + + /* ----- SD Control Data ---------------- */ + /*SD_REGISTER SD_Regs; */ +@@ -602,7 +599,7 @@ static int sd_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + { + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + +- if (info->SD_Status.Insert && info->SD_Status.Ready) ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) + return USB_STOR_TRANSPORT_GOOD; + else { + ene_sd_init(us); +@@ -622,7 +619,7 @@ static int sd_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->SD_Status.WtP) ++ if (info->SD_Status & SD_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -641,9 +638,9 @@ static int sd_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + + usb_stor_dbg(us, "sd_scsi_read_capacity\n"); +- if (info->SD_Status.HiCapacity) { ++ if (info->SD_Status & SD_HiCapacity) { + bl_len = 0x200; +- if (info->SD_Status.IsMMC) ++ if (info->SD_Status & SD_IsMMC) + bl_num = info->HC_C_SIZE-1; + else + bl_num = (info->HC_C_SIZE + 1) * 1024 - 1; +@@ -693,7 +690,7 @@ static int sd_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -733,7 +730,7 @@ static int sd_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -1455,7 +1452,7 @@ static int ms_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ +- if (info->MS_Status.Insert && info->MS_Status.Ready) { ++ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { + return USB_STOR_TRANSPORT_GOOD; + } else { + ene_ms_init(us); +@@ -1475,7 +1472,7 @@ static int ms_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->MS_Status.WtP) ++ if (info->MS_Status & MS_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -1494,7 +1491,7 @@ static int ms_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + + usb_stor_dbg(us, "ms_scsi_read_capacity\n"); + bl_len = 0x200; +- if (info->MS_Status.IsMSPro) ++ if (info->MS_Status & MS_IsMSPro) + bl_num = info->MSP_TotalBlock - 1; + else + bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1; +@@ -1649,7 +1646,7 @@ static int ms_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); +@@ -1750,7 +1747,7 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + pr_info("Load MSP RW pattern Fail !!\n"); +@@ -1858,12 +1855,12 @@ static int ene_get_card_status(struct us_data *us, u8 *buf) + + tmpreg = (u16) reg4b; + reg4b = *(u32 *)(&buf[0x14]); +- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff; + + info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); + info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07; +- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = *(u32 *)(&buf[0x100]); + + if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { +@@ -2075,6 +2072,7 @@ static int ene_ms_init(struct us_data *us) + u16 MSP_BlockSize, MSP_UserAreaBlocks; + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + u8 *bbuf = info->bbuf; ++ unsigned int s; + + printk(KERN_INFO "transport --- ENE_MSInit\n"); + +@@ -2099,15 +2097,16 @@ static int ene_ms_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + /* the same part to test ENE */ +- info->MS_Status = *(struct MS_STATUS *) bbuf; +- +- if (info->MS_Status.Insert && info->MS_Status.Ready) { +- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); +- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready); +- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro); +- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); +- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); +- if (info->MS_Status.IsMSPro) { ++ info->MS_Status = bbuf[0]; ++ ++ s = info->MS_Status; ++ if ((s & MS_Insert) && (s & MS_Ready)) { ++ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert)); ++ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready)); ++ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro)); ++ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG)); ++ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP)); ++ if (s & MS_IsMSPro) { + MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; + MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; + info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; +@@ -2168,17 +2167,17 @@ static int ene_sd_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + +- info->SD_Status = *(struct SD_STATUS *) bbuf; +- if (info->SD_Status.Insert && info->SD_Status.Ready) { +- struct SD_STATUS *s = &info->SD_Status; ++ info->SD_Status = bbuf[0]; ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { ++ unsigned int s = info->SD_Status; + + ene_get_card_status(us, bbuf); +- usb_stor_dbg(us, "Insert = %x\n", s->Insert); +- usb_stor_dbg(us, "Ready = %x\n", s->Ready); +- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); +- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity); +- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); +- usb_stor_dbg(us, "WtP = %x\n", s->WtP); ++ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert)); ++ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready)); ++ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC)); ++ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity)); ++ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed)); ++ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP)); + } else { + usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); + return USB_STOR_TRANSPORT_ERROR; +@@ -2200,14 +2199,14 @@ static int ene_init(struct us_data *us) + + misc_reg03 = bbuf[0]; + if (misc_reg03 & 0x01) { +- if (!info->SD_Status.Ready) { ++ if (!(info->SD_Status & SD_Ready)) { + result = ene_sd_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + } + } + if (misc_reg03 & 0x02) { +- if (!info->MS_Status.Ready) { ++ if (!(info->MS_Status & MS_Ready)) { + result = ene_ms_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; +@@ -2306,14 +2305,14 @@ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) ++ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready))) + result = ene_init(us); + if (result == USB_STOR_XFER_GOOD) { + result = USB_STOR_TRANSPORT_ERROR; +- if (info->SD_Status.Ready) ++ if (info->SD_Status & SD_Ready) + result = sd_scsi_irp(us, srb); + +- if (info->MS_Status.Ready) ++ if (info->MS_Status & MS_Ready) + result = ms_scsi_irp(us, srb); + } + return result; +@@ -2377,7 +2376,6 @@ static int ene_ub6250_probe(struct usb_interface *intf, + + static int ene_ub6250_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2389,17 +2387,16 @@ static int ene_ub6250_resume(struct usb_interface *iface) + mutex_unlock(&us->dev_mutex); + + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } + + static int ene_ub6250_reset_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2411,10 +2408,10 @@ static int ene_ub6250_reset_resume(struct usb_interface *iface) + * the device + */ + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } +diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c +index 3789698d9d3c6..0c423916d7bfa 100644 +--- a/drivers/usb/storage/realtek_cr.c ++++ b/drivers/usb/storage/realtek_cr.c +@@ -365,7 +365,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len) + + buf = kmalloc(len, GFP_NOIO); + if (buf == NULL) +- return USB_STOR_TRANSPORT_ERROR; ++ return -ENOMEM; + + usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len); + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index cec9173aac6f5..1058aba8d5734 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, + goto signal_used; + + msghdr->msg_control = &ctl; ++ msghdr->msg_controllen = sizeof(ctl); + err = sock->ops->sendmsg(sock, msghdr, 0); + if (unlikely(err < 0)) { + vq_err(&nvq->vq, "Fail to batch sending packets\n"); +diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c +index 51f5d1c56fd9c..c1ee817d7dcc5 100644 +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1692,9 +1692,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red, + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -1980,9 +1980,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red, + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | +diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c +index cf2bfff2efbf1..b91919861075b 100644 +--- a/drivers/video/fbdev/atmel_lcdfb.c ++++ b/drivers/video/fbdev/atmel_lcdfb.c +@@ -1062,15 +1062,16 @@ static int __init atmel_lcdfb_probe(struct platform_device *pdev) + + INIT_LIST_HEAD(&info->modelist); + +- if (pdev->dev.of_node) { +- ret = atmel_lcdfb_of_init(sinfo); +- if (ret) +- goto free_info; +- } else { ++ if (!pdev->dev.of_node) { + dev_err(dev, "cannot get default configuration\n"); + goto free_info; + } + ++ ret = atmel_lcdfb_of_init(sinfo); ++ if (ret) ++ goto free_info; ++ ++ ret = -ENODEV; + if (!sinfo->config) + goto free_info; + +diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c +index e4ce5667b1251..1b0a58f96af25 100644 +--- a/drivers/video/fbdev/cirrusfb.c ++++ b/drivers/video/fbdev/cirrusfb.c +@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) + return 0; + } + +-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, ++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, + struct fb_info *info) + { + long freq; +@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + unsigned maxclockidx = var->bits_per_pixel >> 3; + + /* convert from ps to kHz */ +- freq = PICOS2KHZ(var->pixclock); +- +- dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ freq = PICOS2KHZ(var->pixclock ? : 1); + + maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; + cinfo->multiplexing = 0; +@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + /* If the frequency is greater than we can support, we might be able + * to use multiplexing for the video mode */ + if (freq > maxclock) { +- dev_err(info->device, +- "Frequency greater than maxclock (%ld kHz)\n", +- maxclock); +- return -EINVAL; ++ var->pixclock = KHZ2PICOS(maxclock); ++ ++ while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) ++ var->pixclock++; + } ++ dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ + /* + * Additional constraint: 8bpp uses DAC clock doubling to allow maximum + * pixel clock +diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c +index 55d2bd0ce5c02..64843464c6613 100644 +--- a/drivers/video/fbdev/core/fbcvt.c ++++ b/drivers/video/fbdev/core/fbcvt.c +@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt) + static void fb_cvt_print_name(struct fb_cvt_data *cvt) + { + u32 pixcount, pixcount_mod; +- int cnt = 255, offset = 0, read = 0; +- u8 *buf = kzalloc(256, GFP_KERNEL); ++ int size = 256; ++ int off = 0; ++ u8 *buf; + ++ buf = kzalloc(size, GFP_KERNEL); + if (!buf) + return; + +@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt) + pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000; + pixcount_mod /= 1000; + +- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ", +- cvt->xres, cvt->yres, cvt->refresh); +- offset += read; +- cnt -= read; ++ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ", ++ cvt->xres, cvt->yres, cvt->refresh); + +- if (cvt->status) +- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega " +- "Pixel Image\n", pixcount, pixcount_mod); +- else { +- if (pixcount) { +- read = snprintf(buf+offset, cnt, "%d", pixcount); +- cnt -= read; +- offset += read; +- } ++ if (cvt->status) { ++ off += scnprintf(buf + off, size - off, ++ "Not a CVT standard - %d.%03d Mega Pixel Image\n", ++ pixcount, pixcount_mod); ++ } else { ++ if (pixcount) ++ off += scnprintf(buf + off, size - off, "%d", pixcount); + +- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod); +- cnt -= read; +- offset += read; ++ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod); + + if (cvt->aspect_ratio == 0) +- read = snprintf(buf+offset, cnt, "3"); ++ off += scnprintf(buf + off, size - off, "3"); + else if (cvt->aspect_ratio == 3) +- read = snprintf(buf+offset, cnt, "4"); ++ off += scnprintf(buf + off, size - off, "4"); + else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4) +- read = snprintf(buf+offset, cnt, "9"); ++ off += scnprintf(buf + off, size - off, "9"); + else if (cvt->aspect_ratio == 2) +- read = snprintf(buf+offset, cnt, "A"); +- else +- read = 0; +- cnt -= read; +- offset += read; +- +- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) { +- read = snprintf(buf+offset, cnt, "-R"); +- cnt -= read; +- offset += read; +- } ++ off += scnprintf(buf + off, size - off, "A"); ++ ++ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) ++ off += scnprintf(buf + off, size - off, "-R"); + } + + printk(KERN_INFO "%s\n", buf); +diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c +index d7994a1732459..0b48965a6420c 100644 +--- a/drivers/video/fbdev/nvidia/nv_i2c.c ++++ b/drivers/video/fbdev/nvidia/nv_i2c.c +@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, + { + int rc; + +- strcpy(chan->adapter.name, name); ++ strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); + chan->adapter.owner = THIS_MODULE; + chan->adapter.class = i2c_class; + chan->adapter.algo_data = &chan->algo; +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +index b4a1aefff7661..777f6d66c28c3 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +@@ -251,6 +251,7 @@ static int dvic_probe_of(struct platform_device *pdev) + adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0); + if (adapter_node) { + adapter = of_get_i2c_adapter_by_node(adapter_node); ++ of_node_put(adapter_node); + if (adapter == NULL) { + dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n"); + omap_dss_put_device(ddata->in); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +index 4b0793abdd84b..a2c7c5cb15234 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +@@ -409,7 +409,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%d\n", errors); ++ return sysfs_emit(buf, "%d\n", errors); + } + + static ssize_t dsicm_hw_revision_show(struct device *dev, +@@ -439,7 +439,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3); ++ return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3); + } + + static ssize_t dsicm_store_ulps(struct device *dev, +@@ -487,7 +487,7 @@ static ssize_t dsicm_show_ulps(struct device *dev, + t = ddata->ulps_enabled; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static ssize_t dsicm_store_ulps_timeout(struct device *dev, +@@ -532,7 +532,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev, + t = ddata->ulps_timeout; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +index 1293515e4b169..0cbc5b9183f89 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +@@ -476,7 +476,7 @@ static ssize_t show_cabc_available_modes(struct device *dev, + int i; + + if (!ddata->has_cabc) +- return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]); ++ return sysfs_emit(buf, "%s\n", cabc_modes[0]); + + for (i = 0, len = 0; + len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++) +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +index bb85b21f07248..9f6ef9e04d9ce 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +@@ -169,7 +169,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror); ++ return sysfs_emit(buf, "%d\n", ddata->vmirror); + } + + static ssize_t tpo_td043_vmirror_store(struct device *dev, +@@ -199,7 +199,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode); ++ return sysfs_emit(buf, "%d\n", ddata->mode); + } + + static ssize_t tpo_td043_mode_store(struct device *dev, +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index 2466814145779..83d05600360dd 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; ++ ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; + dst++; + } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; +- } + + if (copy_to_user(buf, buffer, c)) { + err = -EFAULT; +@@ -1130,7 +1119,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + count = total_size - p; + } + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1148,24 +1137,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + break; + } + +- for (i = c >> 2; i--;) { +- fb_writel(big_swap(*src), dst++); ++ for (i = (c + 3) >> 2; i--;) { ++ fb_writel(big_swap(*src), dst); ++ dst++; + src++; + } +- if (c & 3) { +- u8 *src8 = (u8 *)src; +- u8 __iomem *dst8 = (u8 __iomem *)dst; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- fb_writeb(*src8++, ++dst8); +- } else { +- fb_writeb(*src8++, --dst8); +- dst8 += 2; +- } +- } +- dst = (u32 __iomem *)dst8; +- } + + *ppos += c; + buf += c; +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index 0e0f5bbfc5efc..ad60f739c6a19 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -1657,6 +1657,7 @@ static int ufx_usb_probe(struct usb_interface *interface, + info->par = dev; + info->pseudo_palette = dev->pseudo_palette; + info->fbops = &ufx_ops; ++ INIT_LIST_HEAD(&info->modelist); + + retval = fb_alloc_cmap(&info->cmap, 256, 0); + if (retval < 0) { +@@ -1667,8 +1668,6 @@ static int ufx_usb_probe(struct usb_interface *interface, + INIT_DELAYED_WORK(&dev->free_framebuffer_work, + ufx_free_framebuffer_work); + +- INIT_LIST_HEAD(&info->modelist); +- + retval = ufx_reg_read(dev, 0x3000, &id_rev); + check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); + dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index ecbfbbf1c1a79..e269b1391e146 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1427,7 +1427,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_rendered)); + } + +@@ -1435,7 +1435,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_identical)); + } + +@@ -1443,7 +1443,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_sent)); + } + +@@ -1451,7 +1451,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->cpu_kcycles_used)); + } + +diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c +index e30f9427b3355..52ec80bbfe5ea 100644 +--- a/drivers/video/fbdev/w100fb.c ++++ b/drivers/video/fbdev/w100fb.c +@@ -770,12 +770,18 @@ out: + fb_dealloc_cmap(&info->cmap); + kfree(info->pseudo_palette); + } +- if (remapped_fbuf != NULL) ++ if (remapped_fbuf != NULL) { + iounmap(remapped_fbuf); +- if (remapped_regs != NULL) ++ remapped_fbuf = NULL; ++ } ++ if (remapped_regs != NULL) { + iounmap(remapped_regs); +- if (remapped_base != NULL) ++ remapped_regs = NULL; ++ } ++ if (remapped_base != NULL) { + iounmap(remapped_base); ++ remapped_base = NULL; ++ } + if (info) + framebuffer_release(info); + return err; +@@ -795,8 +801,11 @@ static int w100fb_remove(struct platform_device *pdev) + fb_dealloc_cmap(&info->cmap); + + iounmap(remapped_base); ++ remapped_base = NULL; + iounmap(remapped_regs); ++ remapped_regs = NULL; + iounmap(remapped_fbuf); ++ remapped_fbuf = NULL; + + framebuffer_release(info); + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index e028e00927991..cf1e01f0dede3 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -679,16 +679,20 @@ static ssize_t w1_seq_show(struct device *device, + if (sl->reg_num.id == reg_num->id) + seq = i; + ++ if (w1_reset_bus(sl->master)) ++ goto error; ++ ++ /* Put the device into chain DONE state */ ++ w1_write_8(sl->master, W1_MATCH_ROM); ++ w1_write_block(sl->master, (u8 *)&rn, 8); + w1_write_8(sl->master, W1_42_CHAIN); + w1_write_8(sl->master, W1_42_CHAIN_DONE); + w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); +- w1_read_block(sl->master, &ack, sizeof(ack)); + + /* check for acknowledgment */ + ack = w1_read_8(sl->master); + if (ack != W1_42_SUCCESS_CONFIRM_BYTE) + goto error; +- + } + + /* Exit from CHAIN state */ +diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h +index fcf1807cc8dd7..c8def2bdf2474 100644 +--- a/fs/btrfs/extent_io.h ++++ b/fs/btrfs/extent_io.h +@@ -202,7 +202,7 @@ struct extent_buffer { + */ + struct extent_changeset { + /* How many bytes are set/cleared in this operation */ +- unsigned int bytes_changed; ++ u64 bytes_changed; + + /* Changed ranges */ + struct ulist range_changed; +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 065cd2d1bdc68..db403c01d4d5c 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -770,8 +770,12 @@ static loff_t ext2_max_size(int bits) + res += 1LL << (bits-2); + res += 1LL << (2*(bits-2)); + res += 1LL << (3*(bits-2)); ++ /* Compute how many metadata blocks are needed */ ++ meta_blocks = 1; ++ meta_blocks += 1 + ppb; ++ meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ +- if (res < upper_limit) ++ if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index dcbd8ac8d4711..0d62f05f89256 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2161,6 +2161,15 @@ static int ext4_writepage(struct page *page, + else + len = PAGE_SIZE; + ++ /* Should never happen but for bugs in other kernel subsystems */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(inode, ++ "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ return 0; ++ } ++ + page_bufs = page_buffers(page); + /* + * We cannot do block allocation or other extent handling in this +@@ -2710,6 +2719,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) + wait_on_page_writeback(page); + BUG_ON(PageWriteback(page)); + ++ /* ++ * Should never happen but for buggy code in ++ * other subsystems that call ++ * set_page_dirty() without properly warning ++ * the file system first. See [1] for more ++ * information. ++ * ++ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz ++ */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ continue; ++ } ++ + if (mpd->map.m_len == 0) + mpd->first_page = page->index; + mpd->next_page = page->index + 1; +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 03dce3980d90a..54f0d2c4c7d87 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -848,6 +848,7 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, + struct page *cp_page_1 = NULL, *cp_page_2 = NULL; + struct f2fs_checkpoint *cp_block = NULL; + unsigned long long cur_version = 0, pre_version = 0; ++ unsigned int cp_blocks; + int err; + + err = get_checkpoint_version(sbi, cp_addr, &cp_block, +@@ -855,15 +856,16 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi, + if (err) + return NULL; + +- if (le32_to_cpu(cp_block->cp_pack_total_block_count) > +- sbi->blocks_per_seg) { ++ cp_blocks = le32_to_cpu(cp_block->cp_pack_total_block_count); ++ ++ if (cp_blocks > sbi->blocks_per_seg || cp_blocks <= F2FS_CP_PACKS) { + f2fs_warn(sbi, "invalid cp_pack_total_block_count:%u", + le32_to_cpu(cp_block->cp_pack_total_block_count)); + goto invalid_cp; + } + pre_version = *version; + +- cp_addr += le32_to_cpu(cp_block->cp_pack_total_block_count) - 1; ++ cp_addr += cp_blocks - 1; + err = get_checkpoint_version(sbi, cp_addr, &cp_block, + &cp_page_2, version); + if (err) +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 1679f9c0b63b3..773028921c481 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2467,8 +2467,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping, + /* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */ + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[DATA]); +- else if (atomic_read(&sbi->wb_sync_req[DATA])) ++ else if (atomic_read(&sbi->wb_sync_req[DATA])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + if (__should_serialize_io(inode, wbc)) { + mutex_lock(&sbi->writepages); +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 16abb017e497f..68d5c73c5ed1f 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -633,8 +633,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + set_sbi_flag(sbi, SBI_NEED_FSCK); + } + +- if (f2fs_check_nid_range(sbi, dni->ino)) ++ if (f2fs_check_nid_range(sbi, dni->ino)) { ++ f2fs_put_page(node_page, 1); + return false; ++ } + + *nofs = ofs_of_node(node_page); + source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 2383d52b1f424..264c19e177797 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -777,6 +777,7 @@ void f2fs_handle_failed_inode(struct inode *inode) + err = f2fs_get_node_info(sbi, inode->i_ino, &ni); + if (err) { + set_sbi_flag(sbi, SBI_NEED_FSCK); ++ set_inode_flag(inode, FI_FREE_NID); + f2fs_warn(sbi, "May loss orphan inode, run fsck to fix."); + goto out; + } +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 0cd1d51dde06d..3dc7cc3d6ac69 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1995,8 +1995,12 @@ static int f2fs_write_node_pages(struct address_space *mapping, + + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[NODE]); +- else if (atomic_read(&sbi->wb_sync_req[NODE])) ++ else if (atomic_read(&sbi->wb_sync_req[NODE])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + trace_f2fs_writepages(mapping->host, wbc, NODE); + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index a6c9c9fdf21d1..6bd8a944902ef 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2066,7 +2066,7 @@ int f2fs_quota_sync(struct super_block *sb, int type) + struct f2fs_sb_info *sbi = F2FS_SB(sb); + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +- int ret; ++ int ret = 0; + + /* + * Now when everything is written we can discard the pagecache so +@@ -2077,8 +2077,8 @@ int f2fs_quota_sync(struct super_block *sb, int type) + if (type != -1 && cnt != type) + continue; + +- if (!sb_has_quota_active(sb, type)) +- return 0; ++ if (!sb_has_quota_active(sb, cnt)) ++ continue; + + inode_lock(dqopt->files[cnt]); + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index c056ed5c6df30..d7ec0ac87fc03 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1429,7 +1429,8 @@ int gfs2_fitrim(struct file *filp, void __user *argp) + + start = r.start >> bs_shift; + end = start + (r.len >> bs_shift); +- minlen = max_t(u64, r.minlen, ++ minlen = max_t(u64, r.minlen, sdp->sd_sb.sb_bsize); ++ minlen = max_t(u64, minlen, + q->limits.discard_granularity) >> bs_shift; + + if (end <= start || minlen > sdp->sd_max_rg_data) +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 478df7e10767a..e73969fa96bcb 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -438,6 +438,22 @@ static struct io_ring_ctx *io_ring_ctx_alloc(struct io_uring_params *p) + return ctx; + } + ++static void io_req_put_fs(struct io_kiocb *req) ++{ ++ struct fs_struct *fs = req->fs; ++ ++ if (!fs) ++ return; ++ ++ spin_lock(&req->fs->lock); ++ if (--fs->users) ++ fs = NULL; ++ spin_unlock(&req->fs->lock); ++ if (fs) ++ free_fs_struct(fs); ++ req->fs = NULL; ++} ++ + static inline bool __io_sequence_defer(struct io_ring_ctx *ctx, + struct io_kiocb *req) + { +@@ -695,6 +711,7 @@ static void io_free_req_many(struct io_ring_ctx *ctx, void **reqs, int *nr) + + static void __io_free_req(struct io_kiocb *req) + { ++ io_req_put_fs(req); + if (req->file && !(req->flags & REQ_F_FIXED_FILE)) + fput(req->file); + percpu_ref_put(&req->ctx->refs); +@@ -1701,16 +1718,7 @@ static int io_send_recvmsg(struct io_kiocb *req, const struct io_uring_sqe *sqe, + ret = -EINTR; + } + +- if (req->fs) { +- struct fs_struct *fs = req->fs; +- +- spin_lock(&req->fs->lock); +- if (--fs->users) +- fs = NULL; +- spin_unlock(&req->fs->lock); +- if (fs) +- free_fs_struct(fs); +- } ++ io_req_put_fs(req); + io_cqring_add_event(req->ctx, sqe->user_data, ret); + io_put_req(req); + return 0; +diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c +index b288c8ae1236b..837cd55fd4c5e 100644 +--- a/fs/jffs2/build.c ++++ b/fs/jffs2/build.c +@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + ret = -EIO; +- goto out_free; ++ goto out_sum_exit; + } + + jffs2_calc_trigger_levels(c); + + return 0; + ++ out_sum_exit: ++ jffs2_sum_exit(c); + out_free: + kvfree(c->blocks); + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index ab8cdd9e93259..ad1eba809e7e1 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -602,8 +602,8 @@ out_root: + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + kvfree(c->blocks); +- out_inohash: + jffs2_clear_xattr_subsystem(c); ++ out_inohash: + kfree(c->inocache_list); + out_wbuf: + jffs2_flash_cleanup(c); +diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c +index 0b1a7f68b7122..f73904c08b39c 100644 +--- a/fs/jffs2/scan.c ++++ b/fs/jffs2/scan.c +@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + if (!s) { + JFFS2_WARNING("Can't allocate memory for summary\n"); + ret = -ENOMEM; +- goto out; ++ goto out_buf; + } + } + +@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + } + ret = 0; + out: ++ jffs2_sum_reset_collected(s); ++ kfree(s); ++ out_buf: + if (buf_size) + kfree(flashbuf); + #ifndef __ECOS + else + mtd_unpoint(c->mtd, 0, c->mtd->size); + #endif +- kfree(s); + return ret; + } + +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index d862cfc3d3a83..62c4a5450cda2 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode) + dquot_initialize(inode); + + if (JFS_IP(inode)->fileset == FILESYSTEM_I) { ++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; + truncate_inode_pages_final(&inode->i_data); + + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- if (JFS_SBI(inode->i_sb)->ipimap) ++ if (ipimap && JFS_IP(ipimap)->i_imap) + diFree(inode); + + /* +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 6fe82ce8663ef..79f3440e204b6 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -148,6 +148,7 @@ static const s8 budtab[256] = { + * 0 - success + * -ENOMEM - insufficient memory + * -EIO - i/o error ++ * -EINVAL - wrong bmap data + */ + int dbMount(struct inode *ipbmap) + { +@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap) + bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); ++ if (!bmp->db_numag) { ++ release_metapage(mp); ++ kfree(bmp); ++ return -EINVAL; ++ } ++ + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); + bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); + bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 7b09a9158e401..3fffc709afd43 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -447,7 +447,8 @@ static const struct address_space_operations minix_aops = { + .writepage = minix_writepage, + .write_begin = minix_write_begin, + .write_end = generic_write_end, +- .bmap = minix_bmap ++ .bmap = minix_bmap, ++ .direct_IO = noop_direct_IO + }; + + static const struct inode_operations minix_symlink_inode_operations = { +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index b8a7b223b5b18..31922657e836e 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + struct cb_process_state *cps) + { + struct cb_devicenotifyargs *args = argp; ++ const struct pnfs_layoutdriver_type *ld = NULL; + uint32_t i; + __be32 res = 0; +- struct nfs_client *clp = cps->clp; +- struct nfs_server *server = NULL; + +- if (!clp) { ++ if (!cps->clp) { + res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); + goto out; + } +@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + for (i = 0; i < args->ndevs; i++) { + struct cb_devicenotifyitem *dev = &args->devs[i]; + +- if (!server || +- server->pnfs_curr_ld->id != dev->cbd_layout_type) { +- rcu_read_lock(); +- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) +- if (server->pnfs_curr_ld && +- server->pnfs_curr_ld->id == dev->cbd_layout_type) { +- rcu_read_unlock(); +- goto found; +- } +- rcu_read_unlock(); +- continue; ++ if (!ld || ld->id != dev->cbd_layout_type) { ++ pnfs_put_layoutdriver(ld); ++ ld = pnfs_find_layoutdriver(dev->cbd_layout_type); ++ if (!ld) ++ continue; + } +- +- found: +- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id); ++ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id); + } +- ++ pnfs_put_layoutdriver(ld); + out: + kfree(args->devs); + return res; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 90b5511c4c440..04d27f0ed39ac 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -271,10 +271,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, + n = ntohl(*p++); + if (n == 0) + goto out; +- if (n > ULONG_MAX / sizeof(*args->devs)) { +- status = htonl(NFS4ERR_BADXDR); +- goto out; +- } + + args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL); + if (!args->devs) { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 6b0bf4ebd8124..0682037f972be 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -272,8 +272,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); + + if (iov_iter_rw(iter) == READ) +- return nfs_file_direct_read(iocb, iter); +- return nfs_file_direct_write(iocb, iter); ++ return nfs_file_direct_read(iocb, iter, true); ++ return nfs_file_direct_write(iocb, iter, true); + } + + static void nfs_direct_release_pages(struct page **pages, unsigned int npages) +@@ -524,6 +524,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_read - file direct read operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers into which to read data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct reads instead of calling + * generic_file_aio_read() in order to avoid gfar's check to see if +@@ -539,7 +540,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * client must read the updated atime from the server back into its + * cache. + */ +-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + struct file *file = iocb->ki_filp; + struct address_space *mapping = file->f_mapping; +@@ -581,12 +583,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (iter_is_iovec(iter)) + dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; + +- nfs_start_io_direct(inode); ++ if (!swap) ++ nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; + requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); + +- nfs_end_io_direct(inode); ++ if (!swap) ++ nfs_end_io_direct(inode); + + if (requested > 0) { + result = nfs_direct_wait(dreq); +@@ -851,7 +855,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { + */ + static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + struct iov_iter *iter, +- loff_t pos) ++ loff_t pos, int ioflags) + { + struct nfs_pageio_descriptor desc; + struct inode *inode = dreq->inode; +@@ -859,7 +863,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + size_t requested_bytes = 0; + size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); + +- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, ++ nfs_pageio_init_write(&desc, inode, ioflags, false, + &nfs_direct_write_completion_ops); + desc.pg_dreq = dreq; + get_dreq(dreq); +@@ -937,6 +941,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_write - file direct write operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers from which to write data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct writes instead of calling + * generic_file_aio_write() in order to avoid taking the inode +@@ -953,7 +958,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * Note that O_APPEND is not supported for NFS direct writes, as there + * is no atomic O_APPEND write facility in the NFS protocol. + */ +-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + ssize_t result = -EINVAL, requested; + size_t count; +@@ -967,7 +973,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", + file, iov_iter_count(iter), (long long) iocb->ki_pos); + +- result = generic_write_checks(iocb, iter); ++ if (swap) ++ /* bypass generic checks */ ++ result = iov_iter_count(iter); ++ else ++ result = generic_write_checks(iocb, iter); + if (result <= 0) + return result; + count = result; +@@ -997,16 +1007,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + if (!is_sync_kiocb(iocb)) + dreq->iocb = iocb; + +- nfs_start_io_direct(inode); ++ if (swap) { ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_STABLE); ++ } else { ++ nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_COND_STABLE); + +- if (mapping->nrpages) { +- invalidate_inode_pages2_range(mapping, +- pos >> PAGE_SHIFT, end); +- } ++ if (mapping->nrpages) { ++ invalidate_inode_pages2_range(mapping, ++ pos >> PAGE_SHIFT, end); ++ } + +- nfs_end_io_direct(inode); ++ nfs_end_io_direct(inode); ++ } + + if (requested > 0) { + result = nfs_direct_wait(dreq); +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 387a2cfa7e172..73415970af381 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -161,7 +161,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) + ssize_t result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_read(iocb, to); ++ return nfs_file_direct_read(iocb, to, false); + + dprintk("NFS: read(%pD2, %zu@%lu)\n", + iocb->ki_filp, +@@ -609,7 +609,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + return result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_write(iocb, from); ++ return nfs_file_direct_write(iocb, from, false); + + dprintk("NFS: write(%pD2, %zu@%Ld)\n", + file, iov_iter_count(from), (long long) iocb->ki_pos); +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index 887f9136a9db3..af557dc2cfe1d 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -953,7 +953,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 23d75cddbb2ee..84369d51353a5 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1968,7 +1968,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + bool plus) + { + struct user_namespace *userns = rpc_userns(entry->server->client); +- struct nfs_entry old = *entry; + __be32 *p; + int error; + u64 new_cookie; +@@ -1988,15 +1987,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_fileid3(xdr, &entry->ino); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + entry->d_type = DT_UNKNOWN; + +@@ -2004,7 +2003,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->fattr->valid = 0; + error = decode_post_op_attr(xdr, entry->fattr, userns); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + if (entry->fattr->valid & NFS_ATTR_FATTR_V3) + entry->d_type = nfs_umode_to_dtype(entry->fattr->mode); + +@@ -2019,11 +2018,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + return -EAGAIN; + if (*p != xdr_zero) { + error = decode_nfs_fh3(xdr, entry->fh); +- if (unlikely(error)) { +- if (error == -E2BIG) +- goto out_truncated; +- return error; +- } ++ if (unlikely(error)) ++ return -EAGAIN; + } else + zero_nfs_fh3(entry->fh); + } +@@ -2032,11 +2028,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->cookie = new_cookie; + + return 0; +- +-out_truncated: +- dprintk("NFS: directory entry contains invalid file handle\n"); +- *entry = old; +- return -EAGAIN; + } + + /* +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index fb3d1532f11dd..76baf7b441f3c 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7918,6 +7918,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata) + case -NFS4ERR_DEADSESSION: + nfs4_schedule_session_recovery(clp->cl_session, + task->tk_status); ++ return; + } + if (args->dir == NFS4_CDFC4_FORE_OR_BOTH && + res->dir != NFS4_CDFS4_BOTH) { +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index aa2caba38a014..1d2b81a233bbb 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2504,9 +2505,17 @@ static int nfs4_bind_conn_to_session(struct nfs_client *clp) + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); +@@ -2600,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2616,6 +2626,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2627,6 +2638,7 @@ out_error: + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 1b512df1003f9..0471b6e0da16f 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) + return local; + } + ++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id) ++{ ++ return find_pnfs_driver(id); ++} ++ ++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld) ++{ ++ if (ld) ++ module_put(ld->owner); ++} ++ + void + unset_pnfs_layoutdriver(struct nfs_server *nfss) + { +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 3d55edd6b25ad..68339680bb7d1 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -226,6 +226,8 @@ struct pnfs_devicelist { + + extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); + extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); ++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id); ++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld); + + /* nfs4proc.c */ + extern size_t max_response_pages(struct nfs_server *server); +diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c +index 754c763374dd5..4aca93e11af77 100644 +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -230,7 +230,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) + unsigned long cnt = argp->len; + unsigned int nvecs; + +- dprintk("nfsd: WRITE %s %d bytes at %d\n", ++ dprintk("nfsd: WRITE %s %u bytes at %d\n", + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h +index ea7cca3a64b76..6251d8754c82b 100644 +--- a/fs/nfsd/xdr.h ++++ b/fs/nfsd/xdr.h +@@ -33,7 +33,7 @@ struct nfsd_readargs { + struct nfsd_writeargs { + svc_fh fh; + __u32 offset; +- int len; ++ __u32 len; + struct kvec first; + }; + +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index ea18e4a2a691d..cf222c9225d6d 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi) + } + /* Now allocate memory for the attribute list. */ + ni->attr_list_size = (u32)ntfs_attr_size(a); ++ if (!ni->attr_list_size) { ++ ntfs_error(sb, "Attr_list_size is zero"); ++ goto put_err_out; ++ } + ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size); + if (!ni->attr_list) { + ntfs_error(sb, "Not enough memory to allocate buffer " +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index eeb93f009b282..83a173feb6989 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -361,15 +361,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, + { + struct inode *inode; + struct ubifs_info *c = dir->i_sb->s_fs_info; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; + struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); + int err, instantiated = 0; + struct fscrypt_name nm; + + /* +- * Budget request settings: new dirty inode, new direntry, +- * budget for dirtied inode will be released via writeback. ++ * Budget request settings: new inode, new direntry, changing the ++ * parent directory inode. ++ * Allocate budget separately for new dirtied inode, the budget will ++ * be released via writeback. + */ + + dbg_gen("dent '%pd', mode %#hx in dir ino %lu", +@@ -439,6 +442,8 @@ out_inode: + make_bad_inode(inode); + if (!instantiated) + iput(inode); ++ else if (whiteout) ++ iput(*whiteout); + out_budg: + ubifs_release_budget(c, &req); + if (!instantiated) +@@ -955,7 +960,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + struct ubifs_inode *dir_ui = ubifs_inode(dir); + struct ubifs_info *c = dir->i_sb->s_fs_info; + int err, sz_change; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct fscrypt_name nm; + + /* +@@ -1330,6 +1336,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + if (flags & RENAME_WHITEOUT) { + union ubifs_dev_desc *dev = NULL; ++ struct ubifs_budget_req wht_req; + + dev = kmalloc(sizeof(union ubifs_dev_desc), GFP_NOFS); + if (!dev) { +@@ -1351,6 +1358,23 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); + ubifs_assert(c, !whiteout_ui->dirty); ++ ++ memset(&wht_req, 0, sizeof(struct ubifs_budget_req)); ++ wht_req.dirtied_ino = 1; ++ wht_req.dirtied_ino_d = ALIGN(whiteout_ui->data_len, 8); ++ /* ++ * To avoid deadlock between space budget (holds ui_mutex and ++ * waits wb work) and writeback work(waits ui_mutex), do space ++ * budget before ubifs inodes locked. ++ */ ++ err = ubifs_budget_space(c, &wht_req); ++ if (err) { ++ iput(whiteout); ++ goto out_release; ++ } ++ ++ /* Add the old_dentry size to the old_dir size. */ ++ old_sz -= CALC_DENT_SIZE(fname_len(&old_nm)); + } + + lock_4_inodes(old_dir, new_dir, new_inode, whiteout); +@@ -1425,18 +1449,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + } + + if (whiteout) { +- struct ubifs_budget_req wht_req = { .dirtied_ino = 1, +- .dirtied_ino_d = \ +- ALIGN(ubifs_inode(whiteout)->data_len, 8) }; +- +- err = ubifs_budget_space(c, &wht_req); +- if (err) { +- kfree(whiteout_ui->data); +- whiteout_ui->data_len = 0; +- iput(whiteout); +- goto out_release; +- } +- + inc_nlink(whiteout); + mark_inode_dirty(whiteout); + +diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c +index eae9cf5a57b05..89b671ad0f9aa 100644 +--- a/fs/ubifs/io.c ++++ b/fs/ubifs/io.c +@@ -846,16 +846,42 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) + */ + n = aligned_len >> c->max_write_shift; + if (n) { +- n <<= c->max_write_shift; ++ int m = n - 1; ++ + dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, + wbuf->offs); +- err = ubifs_leb_write(c, wbuf->lnum, buf + written, +- wbuf->offs, n); ++ ++ if (m) { ++ /* '(n-1)<max_write_shift < len' is always true. */ ++ m <<= c->max_write_shift; ++ err = ubifs_leb_write(c, wbuf->lnum, buf + written, ++ wbuf->offs, m); ++ if (err) ++ goto out; ++ wbuf->offs += m; ++ aligned_len -= m; ++ len -= m; ++ written += m; ++ } ++ ++ /* ++ * The non-written len of buf may be less than 'n' because ++ * parameter 'len' is not 8 bytes aligned, so here we read ++ * min(len, n) bytes from buf. ++ */ ++ n = 1 << c->max_write_shift; ++ memcpy(wbuf->buf, buf + written, min(len, n)); ++ if (n > len) { ++ ubifs_assert(c, n - len < 8); ++ ubifs_pad(c, wbuf->buf + len, n - len); ++ } ++ ++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n); + if (err) + goto out; + wbuf->offs += n; + aligned_len -= n; +- len -= n; ++ len -= min(len, n); + written += n; + } + +diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c +index eeb1be2598881..2923d5a6a7c0b 100644 +--- a/fs/ubifs/ioctl.c ++++ b/fs/ubifs/ioctl.c +@@ -101,7 +101,7 @@ static int setflags(struct inode *inode, int flags) + struct ubifs_inode *ui = ubifs_inode(inode); + struct ubifs_info *c = inode->i_sb->s_fs_info; + struct ubifs_budget_req req = { .dirtied_ino = 1, +- .dirtied_ino_d = ui->data_len }; ++ .dirtied_ino_d = ALIGN(ui->data_len, 8) }; + + err = ubifs_budget_space(c, &req); + if (err) +diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h +index bed9e43f94260..46139c0f510fa 100644 +--- a/include/linux/blk-cgroup.h ++++ b/include/linux/blk-cgroup.h +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */ + #define BLKG_STAT_CPU_BATCH (INT_MAX / 2) +@@ -768,6 +769,21 @@ static inline void blkcg_use_delay(struct blkcg_gq *blkg) + atomic_inc(&blkg->blkcg->css.cgroup->congestion_count); + } + ++/** ++ * blk_cgroup_mergeable - Determine whether to allow or disallow merges ++ * @rq: request to merge into ++ * @bio: bio to merge ++ * ++ * @bio and @rq should belong to the same cgroup and their issue_as_root should ++ * match. The latter is necessary as we don't want to throttle e.g. a metadata ++ * update because it happens to be next to a regular IO. ++ */ ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) ++{ ++ return rq->bio->bi_blkg == bio->bi_blkg && ++ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); ++} ++ + static inline int blkcg_unuse_delay(struct blkcg_gq *blkg) + { + int old = atomic_read(&blkg->use_delay); +@@ -868,6 +884,7 @@ static inline bool blkcg_punt_bio_submit(struct bio *bio) { return false; } + static inline void blkcg_bio_issue_init(struct bio *bio) { } + static inline bool blkcg_bio_issue_check(struct request_queue *q, + struct bio *bio) { return true; } ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; } + + #define blk_queue_for_each_rl(rl, q) \ + for ((rl) = &(q)->root_rl; (rl); (rl) = NULL) +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index d5338b9ee5502..8cc766743270f 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -59,6 +59,14 @@ struct blk_stat_callback; + */ + #define BLKCG_MAX_POLS 5 + ++static inline int blk_validate_block_size(unsigned int bsize) ++{ ++ if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize)) ++ return -EINVAL; ++ ++ return 0; ++} ++ + typedef void (rq_end_io_fn)(struct request *, blk_status_t); + + /* +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 4d450672b7d66..da90f20e11c1c 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -70,6 +70,14 @@ + */ + #define DMA_ATTR_PRIVILEGED (1UL << 9) + ++/* ++ * This is a hint to the DMA-mapping subsystem that the device is expected ++ * to overwrite the entire mapped size, thus the caller does not require any ++ * of the previous buffer contents to be preserved. This allows ++ * bounce-buffering implementations to optimise DMA_FROM_DEVICE transfers. ++ */ ++#define DMA_ATTR_OVERWRITE (1UL << 10) ++ + /* + * A dma_addr_t can hold any valid DMA or bus address for the platform. + * It can be given to a device to use as a DMA source or target. A CPU cannot +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index bbe297bbbca52..d5c507311efb1 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -50,7 +50,7 @@ struct ipv6_devconf { + __s32 use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- __s32 mc_forwarding; ++ atomic_t mc_forwarding; + #endif + __s32 disable_ipv6; + __s32 drop_unicast_in_l2_multicast; +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index bc8a70a7c5a13..e4f9df955040f 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -1250,13 +1250,16 @@ static inline unsigned long *section_to_usemap(struct mem_section *ms) + + static inline struct mem_section *__nr_to_section(unsigned long nr) + { ++ unsigned long root = SECTION_NR_TO_ROOT(nr); ++ ++ if (unlikely(root >= NR_SECTION_ROOTS)) ++ return NULL; ++ + #ifdef CONFIG_SPARSEMEM_EXTREME +- if (!mem_section) ++ if (!mem_section || !mem_section[root]) + return NULL; + #endif +- if (!mem_section[SECTION_NR_TO_ROOT(nr)]) +- return NULL; +- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK]; ++ return &mem_section[root][nr & SECTION_ROOT_MASK]; + } + extern unsigned long __section_nr(struct mem_section *ms); + extern size_t mem_section_usage_size(void); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 288a586782563..c70b79dba1dc1 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3777,7 +3777,8 @@ void netdev_run_todo(void); + */ + static inline void dev_put(struct net_device *dev) + { +- this_cpu_dec(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_dec(*dev->pcpu_refcnt); + } + + /** +@@ -3788,7 +3789,8 @@ static inline void dev_put(struct net_device *dev) + */ + static inline void dev_hold(struct net_device *dev) + { +- this_cpu_inc(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_inc(*dev->pcpu_refcnt); + } + + /* Carrier loss detection, dial on demand. The functions netif_carrier_on +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 978ef674f0388..49cf5c855cbe5 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -480,10 +480,10 @@ static inline const struct cred *nfs_file_cred(struct file *file) + * linux/fs/nfs/direct.c + */ + extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); +-extern ssize_t nfs_file_direct_read(struct kiocb *iocb, +- struct iov_iter *iter); +-extern ssize_t nfs_file_direct_write(struct kiocb *iocb, +- struct iov_iter *iter); ++ssize_t nfs_file_direct_read(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); ++ssize_t nfs_file_direct_write(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); + + /* + * linux/fs/nfs/dir.c +diff --git a/include/linux/pci.h b/include/linux/pci.h +index bc35b15efadd0..fc343d123127b 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -604,6 +604,7 @@ struct pci_bus { + struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ + struct bin_attribute *legacy_mem; /* Legacy mem */ + unsigned int is_added:1; ++ unsigned int unsafe_warn:1; /* warned about RW1C config write */ + }; + + #define to_pci_bus(n) container_of(n, struct pci_bus, dev) +diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h +index a8d68c5a4ca61..fb0a6d6c91e48 100644 +--- a/include/linux/sunrpc/xdr.h ++++ b/include/linux/sunrpc/xdr.h +@@ -536,6 +536,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr, + + if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) + return -EBADMSG; ++ if (len > SIZE_MAX / sizeof(*p)) ++ return -EBADMSG; + p = xdr_inline_decode(xdr, len * sizeof(*p)); + if (unlikely(!p)) + return -EBADMSG; +diff --git a/include/net/arp.h b/include/net/arp.h +index 4950191f6b2bf..4a23a97195f33 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, + const unsigned char *src_hw, const unsigned char *th); + int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); + void arp_ifdown(struct net_device *dev); ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force); + + struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, + struct net_device *dev, __be32 src_ip, +diff --git a/include/net/udp.h b/include/net/udp.h +index d9d39cc20a847..9787a42f7ed3e 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -459,6 +459,7 @@ void udp_init(void); + + DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key); + void udp_encap_enable(void); ++void udp_encap_disable(void); + #if IS_ENABLED(CONFIG_IPV6) + DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); + void udpv6_encap_enable(void); +diff --git a/include/net/udp_tunnel.h b/include/net/udp_tunnel.h +index 4b1f95e083070..27bf9f4dd1d45 100644 +--- a/include/net/udp_tunnel.h ++++ b/include/net/udp_tunnel.h +@@ -178,9 +178,8 @@ static inline void udp_tunnel_encap_enable(struct socket *sock) + #if IS_ENABLED(CONFIG_IPV6) + if (sock->sk->sk_family == PF_INET6) + ipv6_stub->udpv6_encap_enable(); +- else + #endif +- udp_encap_enable(); ++ udp_encap_enable(); + } + + #endif +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 63038eb23560b..cb0631098f918 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -1294,8 +1294,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +@@ -3068,7 +3068,8 @@ struct bpf_sock { + __u32 src_ip4; + __u32 src_ip6[4]; + __u32 src_port; /* host byte order */ +- __u32 dst_port; /* network byte order */ ++ __be16 dst_port; /* network byte order */ ++ __u16 :16; /* zero padding */ + __u32 dst_ip4; + __u32 dst_ip6[4]; + __u32 state; +diff --git a/init/main.c b/init/main.c +index e6a1fb14f3085..d292daabd9a22 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -831,7 +831,7 @@ static int __init initcall_blacklist(char *str) + } + } while (str_entry); + +- return 0; ++ return 1; + } + + static bool __init_or_module initcall_blacklisted(initcall_t fn) +@@ -1072,7 +1072,9 @@ static noinline void __init kernel_init_freeable(void); + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +- return strtobool(str, &rodata_enabled); ++ if (strtobool(str, &rodata_enabled)) ++ pr_warn("Invalid option string for rodata: '%s'\n", str); ++ return 1; + } + __setup("rodata=", set_debug_rodata); + #endif +diff --git a/kernel/audit.h b/kernel/audit.h +index ddc22878433d0..fed8e93ce1699 100644 +--- a/kernel/audit.h ++++ b/kernel/audit.h +@@ -191,6 +191,10 @@ struct audit_context { + struct { + char *name; + } module; ++ struct { ++ struct audit_ntp_data ntp_data; ++ struct timespec64 tk_injoffset; ++ } time; + }; + int fds[2]; + struct audit_proctitle proctitle; +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index d33c5dccde1c7..e8e90c0c49367 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1185,6 +1185,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) + from_kuid(&init_user_ns, name->fcap.rootid)); + } + ++static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) ++{ ++ const struct audit_ntp_data *ntp = &context->time.ntp_data; ++ const struct timespec64 *tk = &context->time.tk_injoffset; ++ static const char * const ntp_name[] = { ++ "offset", ++ "freq", ++ "status", ++ "tai", ++ "tick", ++ "adjust", ++ }; ++ int type; ++ ++ if (context->type == AUDIT_TIME_ADJNTPVAL) { ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) { ++ if (ntp->vals[type].newval != ntp->vals[type].oldval) { ++ if (!*ab) { ++ *ab = audit_log_start(context, ++ GFP_KERNEL, ++ AUDIT_TIME_ADJNTPVAL); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "op=%s old=%lli new=%lli", ++ ntp_name[type], ++ ntp->vals[type].oldval, ++ ntp->vals[type].newval); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++ } ++ } ++ if (tk->tv_sec != 0 || tk->tv_nsec != 0) { ++ if (!*ab) { ++ *ab = audit_log_start(context, GFP_KERNEL, ++ AUDIT_TIME_INJOFFSET); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "sec=%lli nsec=%li", ++ (long long)tk->tv_sec, tk->tv_nsec); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++} ++ + static void show_special(struct audit_context *context, int *call_panic) + { + struct audit_buffer *ab; +@@ -1290,6 +1337,11 @@ static void show_special(struct audit_context *context, int *call_panic) + audit_log_format(ab, "(null)"); + + break; ++ case AUDIT_TIME_ADJNTPVAL: ++ case AUDIT_TIME_INJOFFSET: ++ /* this call deviates from the rest, eating the buffer */ ++ audit_log_time(context, &ab); ++ break; + } + audit_log_end(ab); + } +@@ -2518,31 +2570,26 @@ void __audit_fanotify(unsigned int response) + + void __audit_tk_injoffset(struct timespec64 offset) + { +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, +- "sec=%lli nsec=%li", +- (long long)offset.tv_sec, offset.tv_nsec); +-} +- +-static void audit_log_ntp_val(const struct audit_ntp_data *ad, +- const char *op, enum audit_ntp_type type) +-{ +- const struct audit_ntp_val *val = &ad->vals[type]; +- +- if (val->newval == val->oldval) +- return; ++ struct audit_context *context = audit_context(); + +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, +- "op=%s old=%lli new=%lli", op, val->oldval, val->newval); ++ /* only set type if not already set by NTP */ ++ if (!context->type) ++ context->type = AUDIT_TIME_INJOFFSET; ++ memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); + } + + void __audit_ntp_log(const struct audit_ntp_data *ad) + { +- audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); +- audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); +- audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); +- audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); +- audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); +- audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); ++ struct audit_context *context = audit_context(); ++ int type; ++ ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) ++ if (ad->vals[type].newval != ad->vals[type].oldval) { ++ /* unconditionally set type, overwriting TK */ ++ context->type = AUDIT_TIME_ADJNTPVAL; ++ memcpy(&context->time.ntp_data, ad, sizeof(*ad)); ++ break; ++ } + } + + static void audit_log_task(struct audit_buffer *ab) +diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h +index 809e34a3c0172..236f290224aae 100644 +--- a/kernel/cgroup/cgroup-internal.h ++++ b/kernel/cgroup/cgroup-internal.h +@@ -65,6 +65,25 @@ static inline struct cgroup_fs_context *cgroup_fc2context(struct fs_context *fc) + return container_of(kfc, struct cgroup_fs_context, kfc); + } + ++struct cgroup_pidlist; ++ ++struct cgroup_file_ctx { ++ struct cgroup_namespace *ns; ++ ++ struct { ++ void *trigger; ++ } psi; ++ ++ struct { ++ bool started; ++ struct css_task_iter iter; ++ } procs; ++ ++ struct { ++ struct cgroup_pidlist *pidlist; ++ } procs1; ++}; ++ + /* + * A cgroup can be associated with multiple css_sets as different tasks may + * belong to different cgroups on different hierarchies. In the other +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 5e465c4b1e64c..117d70098cd49 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -398,6 +398,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + * next pid to display, if any + */ + struct kernfs_open_file *of = s->private; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = seq_css(s)->cgroup; + struct cgroup_pidlist *l; + enum cgroup_filetype type = seq_cft(s)->private; +@@ -407,25 +408,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + mutex_lock(&cgrp->pidlist_mutex); + + /* +- * !NULL @of->priv indicates that this isn't the first start() +- * after open. If the matching pidlist is around, we can use that. +- * Look for it. Note that @of->priv can't be used directly. It +- * could already have been destroyed. ++ * !NULL @ctx->procs1.pidlist indicates that this isn't the first ++ * start() after open. If the matching pidlist is around, we can use ++ * that. Look for it. Note that @ctx->procs1.pidlist can't be used ++ * directly. It could already have been destroyed. + */ +- if (of->priv) +- of->priv = cgroup_pidlist_find(cgrp, type); ++ if (ctx->procs1.pidlist) ++ ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type); + + /* + * Either this is the first start() after open or the matching + * pidlist has been destroyed inbetween. Create a new one. + */ +- if (!of->priv) { +- ret = pidlist_array_load(cgrp, type, +- (struct cgroup_pidlist **)&of->priv); ++ if (!ctx->procs1.pidlist) { ++ ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist); + if (ret) + return ERR_PTR(ret); + } +- l = of->priv; ++ l = ctx->procs1.pidlist; + + if (pid) { + int end = l->length; +@@ -453,7 +453,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + static void cgroup_pidlist_stop(struct seq_file *s, void *v) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + + if (l) + mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork, +@@ -464,7 +465,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v) + static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + pid_t *p = v; + pid_t *end = l->list + l->length; + /* +@@ -507,10 +509,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of, + goto out_unlock; + + /* +- * Even if we're attaching all tasks in the thread group, we only +- * need to check permissions on one of them. ++ * Even if we're attaching all tasks in the thread group, we only need ++ * to check permissions on one of them. Check permissions using the ++ * credentials from file open to protect against inherited fd attacks. + */ +- cred = current_cred(); ++ cred = of->file->f_cred; + tcred = get_task_cred(task); + if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && + !uid_eq(cred->euid, tcred->uid) && +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index ce1745ac7b8c0..177d57ce90164 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -3648,6 +3648,7 @@ static int cgroup_cpu_pressure_show(struct seq_file *seq, void *v) + static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, enum psi_res res) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct psi_trigger *new; + struct cgroup *cgrp; + struct psi_group *psi; +@@ -3660,7 +3661,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + cgroup_kn_unlock(of->kn); + + /* Allow only one trigger per file descriptor */ +- if (of->priv) { ++ if (ctx->psi.trigger) { + cgroup_put(cgrp); + return -EBUSY; + } +@@ -3672,7 +3673,7 @@ static ssize_t cgroup_pressure_write(struct kernfs_open_file *of, char *buf, + return PTR_ERR(new); + } + +- smp_store_release(&of->priv, new); ++ smp_store_release(&ctx->psi.trigger, new); + cgroup_put(cgrp); + + return nbytes; +@@ -3702,12 +3703,15 @@ static ssize_t cgroup_cpu_pressure_write(struct kernfs_open_file *of, + static __poll_t cgroup_pressure_poll(struct kernfs_open_file *of, + poll_table *pt) + { +- return psi_trigger_poll(&of->priv, of->file, pt); ++ struct cgroup_file_ctx *ctx = of->priv; ++ return psi_trigger_poll(&ctx->psi.trigger, of->file, pt); + } + + static void cgroup_pressure_release(struct kernfs_open_file *of) + { +- psi_trigger_destroy(of->priv); ++ struct cgroup_file_ctx *ctx = of->priv; ++ ++ psi_trigger_destroy(ctx->psi.trigger); + } + #endif /* CONFIG_PSI */ + +@@ -3748,24 +3752,43 @@ static ssize_t cgroup_freeze_write(struct kernfs_open_file *of, + static int cgroup_file_open(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx; ++ int ret; + +- if (cft->open) +- return cft->open(of); +- return 0; ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) ++ return -ENOMEM; ++ ++ ctx->ns = current->nsproxy->cgroup_ns; ++ get_cgroup_ns(ctx->ns); ++ of->priv = ctx; ++ ++ if (!cft->open) ++ return 0; ++ ++ ret = cft->open(of); ++ if (ret) { ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); ++ } ++ return ret; + } + + static void cgroup_file_release(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (cft->release) + cft->release(of); ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); + } + + static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, loff_t off) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = of->kn->parent->priv; + struct cftype *cft = of->kn->priv; + struct cgroup_subsys_state *css; +@@ -3779,7 +3802,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + */ + if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) && + !(cft->flags & CFTYPE_NS_DELEGATABLE) && +- ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp) ++ ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp) + return -EPERM; + + if (cft->write) +@@ -4687,21 +4710,21 @@ void css_task_iter_end(struct css_task_iter *it) + + static void cgroup_procs_release(struct kernfs_open_file *of) + { +- if (of->priv) { +- css_task_iter_end(of->priv); +- kfree(of->priv); +- } ++ struct cgroup_file_ctx *ctx = of->priv; ++ ++ if (ctx->procs.started) ++ css_task_iter_end(&ctx->procs.iter); + } + + static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (pos) + (*pos)++; + +- return css_task_iter_next(it); ++ return css_task_iter_next(&ctx->procs.iter); + } + + static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, +@@ -4709,21 +4732,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + { + struct kernfs_open_file *of = s->private; + struct cgroup *cgrp = seq_css(s)->cgroup; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct css_task_iter *it = &ctx->procs.iter; + + /* + * When a seq_file is seeked, it's always traversed sequentially + * from position 0, so we can simply keep iterating on !0 *pos. + */ +- if (!it) { ++ if (!ctx->procs.started) { + if (WARN_ON_ONCE((*pos))) + return ERR_PTR(-EINVAL); +- +- it = kzalloc(sizeof(*it), GFP_KERNEL); +- if (!it) +- return ERR_PTR(-ENOMEM); +- of->priv = it; + css_task_iter_start(&cgrp->self, iter_flags, it); ++ ctx->procs.started = true; + } else if (!(*pos)) { + css_task_iter_end(it); + css_task_iter_start(&cgrp->self, iter_flags, it); +@@ -4758,9 +4778,9 @@ static int cgroup_procs_show(struct seq_file *s, void *v) + + static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + struct cgroup *dst_cgrp, +- struct super_block *sb) ++ struct super_block *sb, ++ struct cgroup_namespace *ns) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; + struct cgroup *com_cgrp = src_cgrp; + struct inode *inode; + int ret; +@@ -4796,8 +4816,10 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + dst_cgrp = cgroup_kn_lock_live(of->kn, false); +@@ -4814,8 +4836,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +@@ -4837,8 +4867,10 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos) + static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + buf = strstrip(buf); +@@ -4857,9 +4889,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + +- /* thread migrations follow the cgroup.procs delegation rule */ ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index b28665f4d8c7a..4dc3bbfd3e3f3 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -980,7 +980,7 @@ static __init int dma_debug_cmdline(char *str) + global_disable = true; + } + +- return 0; ++ return 1; + } + + static __init int dma_debug_entries_cmdline(char *str) +@@ -989,7 +989,7 @@ static __init int dma_debug_entries_cmdline(char *str) + return -EINVAL; + if (!get_option(&str, &nr_prealloc_entries)) + nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES; +- return 0; ++ return 1; + } + + __setup("dma_debug=", dma_debug_cmdline); +diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c +index f99b79d7e1235..f17b771856d1c 100644 +--- a/kernel/dma/swiotlb.c ++++ b/kernel/dma/swiotlb.c +@@ -572,7 +572,8 @@ found: + for (i = 0; i < nslots; i++) + io_tlb_orig_addr[index+i] = orig_addr + (i << IO_TLB_SHIFT); + if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && +- (dir == DMA_TO_DEVICE || dir == DMA_BIDIRECTIONAL)) ++ (!(attrs & DMA_ATTR_OVERWRITE) || dir == DMA_TO_DEVICE || ++ dir == DMA_BIDIRECTIONAL)) + swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); + + return tlb_addr; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f720a40ccaf5f..52f4a9e467040 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9490,8 +9490,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + } + + /* ready to consume more filters */ ++ kfree(filename); ++ filename = NULL; + state = IF_STATE_ACTION; + filter = NULL; ++ kernel = 0; + } + } + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 6cafb2e910a11..406b4cbbec5e7 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -1216,7 +1216,7 @@ static int __init resumedelay_setup(char *str) + int rc = kstrtouint(str, 0, &resume_delay); + + if (rc) +- return rc; ++ pr_warn("resumedelay: bad option string '%s'\n", str); + return 1; + } + +diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c +index 60564b58de077..bfd2a96c695ca 100644 +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -157,22 +157,22 @@ static int __init setup_test_suspend(char *value) + value++; + suspend_type = strsep(&value, ","); + if (!suspend_type) +- return 0; ++ return 1; + + repeat = strsep(&value, ","); + if (repeat) { + if (kstrtou32(repeat, 0, &test_repeat_count_max)) +- return 0; ++ return 1; + } + + for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) + if (!strcmp(pm_labels[i], suspend_type)) { + test_state_label = pm_labels[i]; +- return 0; ++ return 1; + } + + printk(warn_bad_state, suspend_type); +- return 0; ++ return 1; + } + __setup("test_suspend", setup_test_suspend); + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 23e26a203a9e9..bb2198b40756d 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -146,8 +146,10 @@ static int __control_devkmsg(char *str) + + static int __init control_devkmsg(char *str) + { +- if (__control_devkmsg(str) < 0) ++ if (__control_devkmsg(str) < 0) { ++ pr_warn("printk.devkmsg: bad option string '%s'\n", str); + return 1; ++ } + + /* + * Set sysctl string accordingly: +@@ -166,7 +168,7 @@ static int __init control_devkmsg(char *str) + */ + devkmsg_log |= DEVKMSG_LOG_MASK_LOCK; + +- return 0; ++ return 1; + } + __setup("printk.devkmsg=", control_devkmsg); + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index eb4d04cb3aaf5..d99f73f83bf5f 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -370,6 +370,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) + return !err; + } + ++static int check_ptrace_options(unsigned long data) ++{ ++ if (data & ~(unsigned long)PTRACE_O_MASK) ++ return -EINVAL; ++ ++ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { ++ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || ++ !IS_ENABLED(CONFIG_SECCOMP)) ++ return -EINVAL; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || ++ current->ptrace & PT_SUSPEND_SECCOMP) ++ return -EPERM; ++ } ++ return 0; ++} ++ + static int ptrace_attach(struct task_struct *task, long request, + unsigned long addr, + unsigned long flags) +@@ -381,8 +401,16 @@ static int ptrace_attach(struct task_struct *task, long request, + if (seize) { + if (addr != 0) + goto out; ++ /* ++ * This duplicates the check in check_ptrace_options() because ++ * ptrace_attach() and ptrace_setoptions() have historically ++ * used different error codes for unknown ptrace options. ++ */ + if (flags & ~(unsigned long)PTRACE_O_MASK) + goto out; ++ retval = check_ptrace_options(flags); ++ if (retval) ++ return retval; + flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); + } else { + flags = PT_PTRACED; +@@ -655,22 +683,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds + static int ptrace_setoptions(struct task_struct *child, unsigned long data) + { + unsigned flags; ++ int ret; + +- if (data & ~(unsigned long)PTRACE_O_MASK) +- return -EINVAL; +- +- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { +- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || +- !IS_ENABLED(CONFIG_SECCOMP)) +- return -EINVAL; +- +- if (!capable(CAP_SYS_ADMIN)) +- return -EPERM; +- +- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || +- current->ptrace & PT_SUSPEND_SECCOMP) +- return -EPERM; +- } ++ ret = check_ptrace_options(data); ++ if (ret) ++ return ret; + + /* Avoid intermediate state when all opts are cleared */ + flags = child->ptrace; +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index faada713cfae8..d5f7fc7099bc4 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -847,25 +847,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, + static void sched_show_numa(struct task_struct *p, struct seq_file *m) + { + #ifdef CONFIG_NUMA_BALANCING +- struct mempolicy *pol; +- + if (p->mm) + P(mm->numa_scan_seq); + +- task_lock(p); +- pol = p->mempolicy; +- if (pol && !(pol->flags & MPOL_F_MORON)) +- pol = NULL; +- mpol_get(pol); +- task_unlock(p); +- + P(numa_pages_migrated); + P(numa_preferred_nid); + P(total_numa_faults); + SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", + task_node(p), task_numa_group_id(p)); + show_numa_stats(p, m); +- mpol_put(pol); + #endif + } + +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index 4d0b59fa5550f..46f24b7a32217 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -268,8 +268,12 @@ static FORCE_INLINE int LZ4_decompress_generic( + ip += length; + op += length; + +- /* Necessarily EOF, due to parsing restrictions */ +- if (!partialDecoding || (cpy == oend)) ++ /* Necessarily EOF when !partialDecoding. ++ * When partialDecoding, it is EOF if we've either ++ * filled the output buffer or ++ * can't proceed with reading an offset for following match. ++ */ ++ if (!partialDecoding || (cpy == oend) || (ip >= (iend - 2))) + break; + } else { + /* may overwrite up to WILDCOPYLENGTH beyond cpy */ +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index b9e6c3648be1a..98b9fd0354dd1 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -4,6 +4,8 @@ + # from userspace. + # + ++pound := \# ++ + CC = gcc + OPTFLAGS = -O2 # Adjust as desired + CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS) +@@ -47,7 +49,7 @@ else ifeq ($(HAS_NEON),yes) + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else +- HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ ++ HAS_ALTIVEC := $(shell printf '$(pound)include \nvector int a;\n' |\ + gcc -c -x c - >/dev/null && rm ./-.o && echo yes) + ifeq ($(HAS_ALTIVEC),yes) + CFLAGS += -I../../../arch/powerpc/include +diff --git a/lib/raid6/test/test.c b/lib/raid6/test/test.c +index a3cf071941ab4..841a55242abaa 100644 +--- a/lib/raid6/test/test.c ++++ b/lib/raid6/test/test.c +@@ -19,7 +19,6 @@ + #define NDISKS 16 /* Including P and Q */ + + const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +-struct raid6_calls raid6_call; + + char *dataptrs[NDISKS]; + char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index 87a0cc750ea23..6813b183aa348 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) + if (ret) { + pr_err("could not register misc device: %d\n", ret); + free_test_dev_kmod(test_dev); ++ test_dev = NULL; + goto out; + } + +diff --git a/lib/test_xarray.c b/lib/test_xarray.c +index 8262c3f05a5d3..aefa377c9c26a 100644 +--- a/lib/test_xarray.c ++++ b/lib/test_xarray.c +@@ -1438,6 +1438,25 @@ unlock: + XA_BUG_ON(xa, !xa_empty(xa)); + } + ++static noinline void check_create_range_5(struct xarray *xa, ++ unsigned long index, unsigned int order) ++{ ++ XA_STATE_ORDER(xas, xa, index, order); ++ unsigned int i; ++ ++ xa_store_order(xa, index, order, xa_mk_index(index), GFP_KERNEL); ++ ++ for (i = 0; i < order + 10; i++) { ++ do { ++ xas_lock(&xas); ++ xas_create_range(&xas); ++ xas_unlock(&xas); ++ } while (xas_nomem(&xas, GFP_KERNEL)); ++ } ++ ++ xa_destroy(xa); ++} ++ + static noinline void check_create_range(struct xarray *xa) + { + unsigned int order; +@@ -1465,6 +1484,9 @@ static noinline void check_create_range(struct xarray *xa) + check_create_range_4(xa, (3U << order) + 1, order); + check_create_range_4(xa, (3U << order) - 1, order); + check_create_range_4(xa, (1U << 24) + 1, order); ++ ++ check_create_range_5(xa, 0, order); ++ check_create_range_5(xa, (1U << order), order); + } + + check_create_range_3(); +diff --git a/lib/xarray.c b/lib/xarray.c +index 7d22b30591275..61464c52c20e6 100644 +--- a/lib/xarray.c ++++ b/lib/xarray.c +@@ -722,6 +722,8 @@ void xas_create_range(struct xa_state *xas) + + for (;;) { + struct xa_node *node = xas->xa_node; ++ if (node->shift >= shift) ++ break; + xas->xa_node = xa_parent_locked(xas->xa, node); + xas->xa_offset = node->offset - 1; + if (node->offset != 0) +@@ -1078,6 +1080,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) + xa_mk_node(child)); + if (xa_is_value(curr)) + values--; ++ xas_update(xas, child); + } else { + unsigned int canon = offset - xas->xa_sibs; + +@@ -1092,6 +1095,7 @@ void xas_split(struct xa_state *xas, void *entry, unsigned int order) + } while (offset-- > xas->xa_offset); + + node->nr_values += values; ++ xas_update(xas, node); + } + EXPORT_SYMBOL_GPL(xas_split); + #endif +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index 4a669c81f4e22..d8cde7292bf92 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -787,6 +787,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + unsigned long flags; + struct kmemleak_object *object; + struct kmemleak_scan_area *area = NULL; ++ unsigned long untagged_ptr; ++ unsigned long untagged_objp; + + object = find_and_get_object(ptr, 1); + if (!object) { +@@ -795,6 +797,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + return; + } + ++ untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr); ++ untagged_objp = (unsigned long)kasan_reset_tag((void *)object->pointer); ++ + if (scan_area_cache) + area = kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp)); + +@@ -806,8 +811,8 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + goto out_unlock; + } + if (size == SIZE_MAX) { +- size = object->pointer + object->size - ptr; +- } else if (ptr + size > object->pointer + object->size) { ++ size = untagged_objp + object->size - untagged_ptr; ++ } else if (untagged_ptr + size > untagged_objp + object->size) { + kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr); + dump_object_info(object); + kmem_cache_free(scan_area_cache, area); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 6d7fe3589e4a0..8fc6635454987 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6973,7 +6973,7 @@ static int __init cgroup_memory(char *s) + if (!strcmp(token, "nokmem")) + cgroup_memory_nokmem = true; + } +- return 0; ++ return 1; + } + __setup("cgroup.memory=", cgroup_memory); + +diff --git a/mm/memory.c b/mm/memory.c +index 4bb7c6a364c81..8a72fd3e73bf1 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1013,6 +1013,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, + return ret; + } + ++/* Whether we should zap all COWed (private) pages too */ ++static inline bool should_zap_cows(struct zap_details *details) ++{ ++ /* By default, zap all pages */ ++ if (!details) ++ return true; ++ ++ /* Or, we zap COWed pages only if the caller wants to */ ++ return !details->check_mapping; ++} ++ + static unsigned long zap_pte_range(struct mmu_gather *tlb, + struct vm_area_struct *vma, pmd_t *pmd, + unsigned long addr, unsigned long end, +@@ -1104,16 +1115,18 @@ again: + continue; + } + +- /* If details->check_mapping, we leave swap entries. */ +- if (unlikely(details)) +- continue; +- +- if (!non_swap_entry(entry)) ++ if (!non_swap_entry(entry)) { ++ /* Genuine swap entry, hence a private anon page */ ++ if (!should_zap_cows(details)) ++ continue; + rss[MM_SWAPENTS]--; +- else if (is_migration_entry(entry)) { ++ } else if (is_migration_entry(entry)) { + struct page *page; + + page = migration_entry_to_page(entry); ++ if (details && details->check_mapping && ++ details->check_mapping != page_rmapping(page)) ++ continue; + rss[mm_counter(page)]--; + } + if (unlikely(!free_swap_and_cache(entry))) +@@ -3245,11 +3258,20 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) + return ret; + + if (unlikely(PageHWPoison(vmf->page))) { +- if (ret & VM_FAULT_LOCKED) +- unlock_page(vmf->page); +- put_page(vmf->page); ++ struct page *page = vmf->page; ++ vm_fault_t poisonret = VM_FAULT_HWPOISON; ++ if (ret & VM_FAULT_LOCKED) { ++ if (page_mapped(page)) ++ unmap_mapping_pages(page_mapping(page), ++ page->index, 1, false); ++ /* Retry if a clean page was removed from the cache. */ ++ if (invalidate_inode_page(page)) ++ poisonret = VM_FAULT_NOPAGE; ++ unlock_page(page); ++ } ++ put_page(page); + vmf->page = NULL; +- return VM_FAULT_HWPOISON; ++ return poisonret; + } + + if (unlikely(!(ret & VM_FAULT_LOCKED))) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 2c4082f71d258..d79ab5116a7be 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -731,7 +731,6 @@ static int vma_replace_policy(struct vm_area_struct *vma, + static int mbind_range(struct mm_struct *mm, unsigned long start, + unsigned long end, struct mempolicy *new_pol) + { +- struct vm_area_struct *next; + struct vm_area_struct *prev; + struct vm_area_struct *vma; + int err = 0; +@@ -747,8 +746,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + if (start > vma->vm_start) + prev = vma; + +- for (; vma && vma->vm_start < end; prev = vma, vma = next) { +- next = vma->vm_next; ++ for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) { + vmstart = max(start, vma->vm_start); + vmend = min(end, vma->vm_end); + +@@ -762,10 +760,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + new_pol, vma->vm_userfaultfd_ctx); + if (prev) { + vma = prev; +- next = vma->vm_next; +- if (mpol_equal(vma_policy(vma), new_pol)) +- continue; +- /* vma_merge() joined vma && vma->next, case 8 */ + goto replace; + } + if (vma->vm_start != vmstart) { +@@ -2565,6 +2559,7 @@ alloc_new: + mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); + if (!mpol_new) + goto err_out; ++ atomic_set(&mpol_new->refcnt, 1); + goto restart; + } + +diff --git a/mm/mmap.c b/mm/mmap.c +index ba78f1f1b1bd1..58cfd5b1e0b16 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2515,7 +2515,7 @@ static int __init cmdline_parse_stack_guard_gap(char *p) + if (!*endptr) + stack_guard_gap = val << PAGE_SHIFT; + +- return 0; ++ return 1; + } + __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); + +diff --git a/mm/mremap.c b/mm/mremap.c +index 8005d0b2b8438..8ce1b7632fbb8 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -246,6 +246,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + struct mmu_notifier_range range; + pmd_t *old_pmd, *new_pmd; + ++ if (!len) ++ return 0; ++ + old_end = old_addr + len; + flush_cache_range(vma, old_addr, old_end); + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index c3835915d1157..5038611563dfb 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7326,10 +7326,17 @@ restart: + + out2: + /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */ +- for (nid = 0; nid < MAX_NUMNODES; nid++) ++ for (nid = 0; nid < MAX_NUMNODES; nid++) { ++ unsigned long start_pfn, end_pfn; ++ + zone_movable_pfn[nid] = + roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES); + ++ get_pfn_range_for_nid(nid, &start_pfn, &end_pfn); ++ if (zone_movable_pfn[nid] >= end_pfn) ++ zone_movable_pfn[nid] = 0; ++ } ++ + out: + /* restore the node_state */ + node_states[N_MEMORY] = saved_node_state; +diff --git a/mm/rmap.c b/mm/rmap.c +index 45f2106852e84..6d80e92688fe7 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1602,7 +1602,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + + /* MADV_FREE page check */ + if (!PageSwapBacked(page)) { +- if (!PageDirty(page)) { ++ int ref_count, map_count; ++ ++ /* ++ * Synchronize with gup_pte_range(): ++ * - clear PTE; barrier; read refcount ++ * - inc refcount; barrier; read PTE ++ */ ++ smp_mb(); ++ ++ ref_count = page_ref_count(page); ++ map_count = page_mapcount(page); ++ ++ /* ++ * Order reads for page refcount and dirty flag ++ * (see comments in __remove_mapping()). ++ */ ++ smp_rmb(); ++ ++ /* ++ * The only page refs must be one from isolation ++ * plus the rmap(s) (dropped by discard:). ++ */ ++ if (ref_count == 1 + map_count && ++ !PageDirty(page)) { + /* Invalidate as we cleared the pte */ + mmu_notifier_invalidate_range(mm, + address, address + PAGE_SIZE); +diff --git a/mm/usercopy.c b/mm/usercopy.c +index 660717a1ea5cd..f70455bad7f32 100644 +--- a/mm/usercopy.c ++++ b/mm/usercopy.c +@@ -294,7 +294,10 @@ static bool enable_checks __initdata = true; + + static int __init parse_hardened_usercopy(char *str) + { +- return strtobool(str, &enable_checks); ++ if (strtobool(str, &enable_checks)) ++ pr_warn("Invalid option string for hardened_usercopy: '%s'\n", ++ str); ++ return 1; + } + + __setup("hardened_usercopy=", parse_hardened_usercopy); +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 09d81f9c2a649..6f0a9f4392333 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -136,7 +136,7 @@ static u8 batadv_mcast_mla_rtr_flags_softif_get_ipv6(struct net_device *dev) + { + struct inet6_dev *in6_dev = __in6_dev_get(dev); + +- if (in6_dev && in6_dev->cnf.mc_forwarding) ++ if (in6_dev && atomic_read(&in6_dev->cnf.mc_forwarding)) + return BATADV_NO_FLAGS; + else + return BATADV_MCAST_WANT_NO_RTR6; +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 082a262ab49c3..ff6625493c9f8 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4911,8 +4911,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon) { ++ if (hcon && hcon->type == AMP_LINK) { + hcon->state = BT_CLOSED; ++ hci_disconn_cfm(hcon, ev->reason); + hci_conn_del(hcon); + } + +diff --git a/net/core/filter.c b/net/core/filter.c +index d39518f691b4b..e16b2b5cda981 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -5824,24 +5824,33 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len + if (!th->ack || th->rst || th->syn) + return -ENOENT; + ++ if (unlikely(iph_len < sizeof(struct iphdr))) ++ return -EINVAL; ++ + if (tcp_synq_no_recent_overflow(sk)) + return -ENOENT; + + cookie = ntohl(th->ack_seq) - 1; + +- switch (sk->sk_family) { +- case AF_INET: +- if (unlikely(iph_len < sizeof(struct iphdr))) ++ /* Both struct iphdr and struct ipv6hdr have the version field at the ++ * same offset so we can cast to the shorter header (struct iphdr). ++ */ ++ switch (((struct iphdr *)iph)->version) { ++ case 4: ++ if (sk->sk_family == AF_INET6 && ipv6_only_sock(sk)) + return -EINVAL; + + ret = __cookie_v4_check((struct iphdr *)iph, th, cookie); + break; + + #if IS_BUILTIN(CONFIG_IPV6) +- case AF_INET6: ++ case 6: + if (unlikely(iph_len < sizeof(struct ipv6hdr))) + return -EINVAL; + ++ if (sk->sk_family != AF_INET6) ++ return -EINVAL; ++ + ret = __cookie_v6_check((struct ipv6hdr *)iph, th, cookie); + break; + #endif /* CONFIG_IPV6 */ +@@ -6708,6 +6717,7 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info) + { + const int size_default = sizeof(__u32); ++ int field_size; + + if (off < 0 || off >= sizeof(struct bpf_sock)) + return false; +@@ -6719,7 +6729,6 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case offsetof(struct bpf_sock, family): + case offsetof(struct bpf_sock, type): + case offsetof(struct bpf_sock, protocol): +- case offsetof(struct bpf_sock, dst_port): + case offsetof(struct bpf_sock, src_port): + case bpf_ctx_range(struct bpf_sock, src_ip4): + case bpf_ctx_range_till(struct bpf_sock, src_ip6[0], src_ip6[3]): +@@ -6727,6 +6736,14 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case bpf_ctx_range_till(struct bpf_sock, dst_ip6[0], dst_ip6[3]): + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); ++ case bpf_ctx_range(struct bpf_sock, dst_port): ++ field_size = size == size_default ? ++ size_default : sizeof_field(struct bpf_sock, dst_port); ++ bpf_ctx_record_field_size(info, field_size); ++ return bpf_ctx_narrow_access_ok(off, size, field_size); ++ case offsetofend(struct bpf_sock, dst_port) ... ++ offsetof(struct bpf_sock, dst_ip4) - 1: ++ return false; + } + + return size == size_default; +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 17cc1edd149cb..a606ad8e8be25 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + int elem_first_coalesce) + { + struct page_frag *pfrag = sk_page_frag(sk); ++ u32 osize = msg->sg.size; + int ret = 0; + + len -= msg->sg.size; +@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + u32 orig_offset; + int use, i; + +- if (!sk_page_frag_refill(sk, pfrag)) +- return -ENOMEM; ++ if (!sk_page_frag_refill(sk, pfrag)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + orig_offset = pfrag->offset; + use = min_t(int, len, pfrag->size - orig_offset); +- if (!sk_wmem_schedule(sk, use)) +- return -ENOMEM; ++ if (!sk_wmem_schedule(sk, use)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + i = msg->sg.end; + sk_msg_iter_var_prev(i); +@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + } + + return ret; ++ ++msg_trim: ++ sk_msg_trim(sk, msg, osize); ++ return ret; + } + EXPORT_SYMBOL_GPL(sk_msg_alloc); + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index 7b951992c372b..b8fe943ae89d0 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1116,13 +1116,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) + return err; + } + +-static int arp_invalidate(struct net_device *dev, __be32 ip) ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force) + { + struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); + int err = -ENXIO; + struct neigh_table *tbl = &arp_tbl; + + if (neigh) { ++ if ((neigh->nud_state & NUD_VALID) && !force) { ++ neigh_release(neigh); ++ return 0; ++ } ++ + if (neigh->nud_state & ~NUD_NOARP) + err = neigh_update(neigh, NULL, NUD_FAILED, + NEIGH_UPDATE_F_OVERRIDE| +@@ -1169,7 +1174,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, + if (!dev) + return -EINVAL; + } +- return arp_invalidate(dev, ip); ++ return arp_invalidate(dev, ip, true); + } + + /* +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index a95102fe66371..ef3e7a3e3a29e 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1122,9 +1122,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + return; + + /* Add broadcast address, if it is explicitly assigned. */ +- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) ++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, + prim, 0); ++ arp_invalidate(dev, ifa->ifa_broadcast, false); ++ } + + if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && + (prefix != addr || ifa->ifa_prefixlen < 32)) { +@@ -1140,6 +1142,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + prim, 0); + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, + 32, prim, 0); ++ arp_invalidate(dev, prefix | ~mask, false); + } + } + } +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 692ba6d6180f8..f99ad4a98907d 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -876,8 +876,13 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, + } + + if (cfg->fc_oif || cfg->fc_gw_family) { +- struct fib_nh *nh = fib_info_nh(fi, 0); ++ struct fib_nh *nh; ++ ++ /* cannot match on nexthop object attributes */ ++ if (fi->nh) ++ return 1; + ++ nh = fib_info_nh(fi, 0); + if (cfg->fc_encap) { + if (fib_encap_match(cfg->fc_encap_type, cfg->fc_encap, + nh, cfg, extack)) +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 7df7ec74807ac..bcc13368c8363 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -296,10 +296,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg, + struct sk_psock *psock = sk_psock_get(sk); + int ret; + +- if (unlikely(!psock)) { +- sk_msg_free(sk, msg); +- return 0; +- } ++ if (unlikely(!psock)) ++ return -EPIPE; ++ + ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) : + tcp_bpf_push_locked(sk, msg, bytes, flags, false); + sk_psock_put(sk, psock); +@@ -367,7 +366,7 @@ more_data: + cork = true; + psock->cork = NULL; + } +- sk_msg_return(sk, msg, tosend); ++ sk_msg_return(sk, msg, msg->sg.size); + release_sock(sk); + + ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); +@@ -407,8 +406,11 @@ more_data: + } + if (msg && + msg->sg.data[msg->sg.start].page_link && +- msg->sg.data[msg->sg.start].length) ++ msg->sg.data[msg->sg.start].length) { ++ if (eval == __SK_REDIRECT) ++ sk_mem_charge(sk, msg->sg.size); + goto more_data; ++ } + } + return ret; + } +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 638d7b49ad716..139e962d1aef3 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3492,6 +3492,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb) + */ + static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + { ++ struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_fastopen_request *fo = tp->fastopen_req; + int space, err = 0; +@@ -3506,8 +3507,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + * private TCP options. The cost is reduced data space in SYN :( + */ + tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp); ++ /* Sync mss_cache after updating the mss_clamp */ ++ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); + +- space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - ++ space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) - + MAX_TCP_OPTION_SPACE; + + space = min_t(size_t, space, fo->size); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 3cdf011a8dd8d..83fd4fa40d5e6 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -544,6 +544,12 @@ void udp_encap_enable(void) + } + EXPORT_SYMBOL(udp_encap_enable); + ++void udp_encap_disable(void) ++{ ++ static_branch_dec(&udp_encap_needed_key); ++} ++EXPORT_SYMBOL(udp_encap_disable); ++ + /* Handler for tunnels with arbitrary destination ports: no socket lookup, go + * through error handlers in encapsulations looking for a match. + */ +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 60d070b254846..69aef71f32ea7 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -542,7 +542,7 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex, + #ifdef CONFIG_IPV6_MROUTE + if ((all || type == NETCONFA_MC_FORWARDING) && + nla_put_s32(skb, NETCONFA_MC_FORWARDING, +- devconf->mc_forwarding) < 0) ++ atomic_read(&devconf->mc_forwarding)) < 0) + goto nla_put_failure; + #endif + if ((all || type == NETCONFA_PROXY_NEIGH) && +@@ -5460,7 +5460,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, + array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding; ++ array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding); + #endif + array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6; + array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index 7e5df23cbe7bf..e6c4966aa956c 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -485,7 +485,7 @@ int ip6_mc_input(struct sk_buff *skb) + /* + * IPv6 multicast router mode is now supported ;) + */ +- if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && ++ if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) && + !(ipv6_addr_type(&hdr->daddr) & + (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && + likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index aee1f6bc039ab..6248e00c2bf72 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -736,7 +736,7 @@ static int mif6_delete(struct mr_table *mrt, int vifi, int notify, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding--; ++ atomic_dec(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -904,7 +904,7 @@ static int mif6_add(struct net *net, struct mr_table *mrt, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding++; ++ atomic_inc(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -1553,7 +1553,7 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) + } else { + rcu_assign_pointer(mrt->mroute_sk, sk); + sock_set_flag(sk, SOCK_RCU_FREE); +- net->ipv6.devconf_all->mc_forwarding++; ++ atomic_inc(&net->ipv6.devconf_all->mc_forwarding); + } + write_unlock_bh(&mrt_lock); + +@@ -1586,7 +1586,7 @@ int ip6mr_sk_done(struct sock *sk) + * so the RCU grace period before sk freeing + * is guaranteed by sk_destruct() + */ +- net->ipv6.devconf_all->mc_forwarding--; ++ atomic_dec(&net->ipv6.devconf_all->mc_forwarding); + write_unlock_bh(&mrt_lock); + inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 2a13394ab8541..619d9dffa9e44 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -4403,7 +4403,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes) + struct inet6_dev *idev; + int type; + +- if (netif_is_l3_master(skb->dev) && ++ if (netif_is_l3_master(skb->dev) || + dst->dev == net->loopback_dev) + idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif)); + else +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index a71bfa5b02770..040869f45682d 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1553,8 +1553,10 @@ void udpv6_destroy_sock(struct sock *sk) + if (encap_destroy) + encap_destroy(sk); + } +- if (up->encap_enabled) ++ if (up->encap_enabled) { + static_branch_dec(&udpv6_encap_needed_key); ++ udp_encap_disable(); ++ } + } + + inet6_destroy_sock(sk); +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index 6b0ed6c593e2b..a6f13fab963f7 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -140,6 +140,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf + return __xfrm6_output_state_finish(x, sk, skb); + } + ++static int xfrm6_noneed_fragment(struct sk_buff *skb) ++{ ++ struct frag_hdr *fh; ++ u8 prevhdr = ipv6_hdr(skb)->nexthdr; ++ ++ if (prevhdr != NEXTHDR_FRAGMENT) ++ return 0; ++ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr)); ++ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH) ++ return 1; ++ return 0; ++} ++ + static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +@@ -168,6 +181,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + xfrm6_local_rxpmtu(skb, mtu); + kfree_skb(skb); + return -EMSGSIZE; ++ } else if (toobig && xfrm6_noneed_fragment(skb)) { ++ skb->ignore_df = 1; ++ goto skip_frag; + } else if (!skb->ignore_df && toobig && skb->sk) { + xfrm_local_error(skb, mtu); + kfree_skb(skb); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 406e13478b01b..2ac9560020f91 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad + + xfrm_probe_algs(); + +- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); ++ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); + if (!supp_skb) { + if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) + pfk->registered &= ~(1<sadb_msg_satype); +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 848b137151c26..b8cc3339a2495 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb, + length, buff); + BUG_ON(ptr == NULL); + +- state->td_scale = +- state->flags = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; + + while (length > 0) { + int opcode=*ptr++; +@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) + test_bit(IPS_ASSURED_BIT, &ct->status); + } + ++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) ++{ ++ state->td_end = 0; ++ state->td_maxend = 0; ++ state->td_maxwin = 0; ++ state->td_maxack = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + int nf_conntrack_tcp_packet(struct nf_conn *ct, + struct sk_buff *skb, +@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; + ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = + ct->proto.tcp.last_flags; +- memset(&ct->proto.tcp.seen[dir], 0, +- sizeof(struct ip_ct_tcp_state)); ++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); + break; + } + ct->proto.tcp.last_index = index; +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 5e1239cef0005..91b35b7c80d82 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -885,6 +885,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, + unsigned char bitmask; + unsigned char byte; + ++ if (offset >= bitmap_len) ++ return -1; + byte_offset = offset / 8; + byte = bitmap[byte_offset]; + bit_spot = offset; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 891e029ad0f89..fb28969899af0 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -148,6 +148,8 @@ static const struct rhashtable_params netlink_rhashtable_params; + + static inline u32 netlink_group_mask(u32 group) + { ++ if (group > 32) ++ return 0; + return group ? 1 << (group - 1) : 0; + } + +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 2c0f8cbc5c43b..ae40593daf214 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1037,7 +1037,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, + int rem = nla_len(attr); + bool dont_clone_flow_key; + +- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ ++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ + clone_arg = nla_data(attr); + dont_clone_flow_key = nla_get_u32(clone_arg); + actions = nla_next(clone_arg, &rem); +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index b6f98eba71f1b..816036b9c223a 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -730,6 +730,57 @@ static bool skb_nfct_cached(struct net *net, + } + + #if IS_ENABLED(CONFIG_NF_NAT) ++static void ovs_nat_update_key(struct sw_flow_key *key, ++ const struct sk_buff *skb, ++ enum nf_nat_manip_type maniptype) ++{ ++ if (maniptype == NF_NAT_MANIP_SRC) { ++ __be16 src; ++ ++ key->ct_state |= OVS_CS_F_SRC_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.src = ip_hdr(skb)->saddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, ++ sizeof(key->ipv6.addr.src)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ src = udp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_TCP) ++ src = tcp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ src = sctp_hdr(skb)->source; ++ else ++ return; ++ ++ key->tp.src = src; ++ } else { ++ __be16 dst; ++ ++ key->ct_state |= OVS_CS_F_DST_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.dst = ip_hdr(skb)->daddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, ++ sizeof(key->ipv6.addr.dst)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ dst = udp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_TCP) ++ dst = tcp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ dst = sctp_hdr(skb)->dest; ++ else ++ return; ++ ++ key->tp.dst = dst; ++ } ++} ++ + /* Modelled after nf_nat_ipv[46]_fn(). + * range is only used for new, uninitialized NAT state. + * Returns either NF_ACCEPT or NF_DROP. +@@ -737,7 +788,7 @@ static bool skb_nfct_cached(struct net *net, + static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, + enum ip_conntrack_info ctinfo, + const struct nf_nat_range2 *range, +- enum nf_nat_manip_type maniptype) ++ enum nf_nat_manip_type maniptype, struct sw_flow_key *key) + { + int hooknum, nh_off, err = NF_ACCEPT; + +@@ -810,58 +861,11 @@ push: + skb_push(skb, nh_off); + skb_postpush_rcsum(skb, skb->data, nh_off); + +- return err; +-} +- +-static void ovs_nat_update_key(struct sw_flow_key *key, +- const struct sk_buff *skb, +- enum nf_nat_manip_type maniptype) +-{ +- if (maniptype == NF_NAT_MANIP_SRC) { +- __be16 src; +- +- key->ct_state |= OVS_CS_F_SRC_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.src = ip_hdr(skb)->saddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, +- sizeof(key->ipv6.addr.src)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- src = udp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_TCP) +- src = tcp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_SCTP) +- src = sctp_hdr(skb)->source; +- else +- return; +- +- key->tp.src = src; +- } else { +- __be16 dst; +- +- key->ct_state |= OVS_CS_F_DST_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.dst = ip_hdr(skb)->daddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, +- sizeof(key->ipv6.addr.dst)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- dst = udp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_TCP) +- dst = tcp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_SCTP) +- dst = sctp_hdr(skb)->dest; +- else +- return; ++ /* Update the flow key if NAT successful. */ ++ if (err == NF_ACCEPT) ++ ovs_nat_update_key(key, skb, maniptype); + +- key->tp.dst = dst; +- } ++ return err; + } + + /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ +@@ -903,7 +907,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } else { + return NF_ACCEPT; /* Connection is not NATed. */ + } +- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key); + + if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { + if (ct->status & IPS_SRC_NAT) { +@@ -913,17 +917,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + maniptype = NF_NAT_MANIP_SRC; + + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, +- maniptype); ++ maniptype, key); + } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { + err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, +- NF_NAT_MANIP_SRC); ++ NF_NAT_MANIP_SRC, key); + } + } + +- /* Mark NAT done if successful and update the flow key. */ +- if (err == NF_ACCEPT) +- ovs_nat_update_key(key, skb, maniptype); +- + return err; + } + #else /* !CONFIG_NF_NAT */ +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index d7559c64795dc..d3f068ad154cb 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2179,8 +2179,8 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, + icmpv6_key->icmpv6_type = ntohs(output->tp.src); + icmpv6_key->icmpv6_code = ntohs(output->tp.dst); + +- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || +- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { ++ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || ++ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { + struct ovs_key_nd *nd_key; + + nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); +@@ -3284,7 +3284,9 @@ static int clone_action_to_attr(const struct nlattr *attr, + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); ++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ ++ attr = nla_next(nla_data(attr), &rem); ++ err = ovs_nla_put_actions(attr, rem, skb); + + if (err) + nla_nest_cancel(skb, start); +diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c +index b312aab80fed6..9a76b74af37bc 100644 +--- a/net/rxrpc/net_ns.c ++++ b/net/rxrpc/net_ns.c +@@ -116,8 +116,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) + struct rxrpc_net *rxnet = rxrpc_net(net); + + rxnet->live = false; +- del_timer_sync(&rxnet->peer_keepalive_timer); + cancel_work_sync(&rxnet->peer_keepalive_work); ++ del_timer_sync(&rxnet->peer_keepalive_timer); + rxrpc_destroy_all_calls(rxnet); + rxrpc_destroy_all_connections(rxnet); + rxrpc_destroy_all_peers(rxnet); +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 12672019f76c5..66cdfd5725acf 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -734,7 +734,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, + */ + static inline int smc_rmb_wnd_update_limit(int rmbe_size) + { +- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); ++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); + } + + static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index b6039642df67e..08e1ccc01e983 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2223,6 +2223,7 @@ call_transmit_status(struct rpc_task *task) + * socket just returned a connection error, + * then hold onto the transport lock. + */ ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ +@@ -2308,6 +2309,7 @@ call_bc_transmit_status(struct rpc_task *task) + case -ENOTCONN: + case -EPIPE: + break; ++ case -ENOMEM: + case -ENOBUFS: + rpc_delay(task, HZ>>2); + /* fall through */ +@@ -2392,6 +2394,11 @@ call_status(struct rpc_task *task) + case -EPIPE: + case -EAGAIN: + break; ++ case -ENFILE: ++ case -ENOBUFS: ++ case -ENOMEM: ++ rpc_delay(task, HZ>>2); ++ break; + case -EIO: + /* shutdown or soft timeout */ + goto out_exit; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 8fc4a6b3422f4..32ffa801a5b97 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -1039,8 +1039,10 @@ int rpc_malloc(struct rpc_task *task) + struct rpc_buffer *buf; + gfp_t gfp = GFP_NOFS; + ++ if (RPC_IS_ASYNC(task)) ++ gfp = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ gfp |= __GFP_MEMALLOC; + + size += sizeof(struct rpc_buffer); + if (size <= RPC_BUFFER_MAXSIZE) +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 93b6afd28405e..8ac579778e487 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -2006,7 +2006,14 @@ static void xprt_destroy(struct rpc_xprt *xprt) + */ + wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE); + ++ /* ++ * xprt_schedule_autodisconnect() can run after XPRT_LOCKED ++ * is cleared. We use ->transport_lock to ensure the mod_timer() ++ * can only run *before* del_time_sync(), never after. ++ */ ++ spin_lock(&xprt->transport_lock); + del_timer_sync(&xprt->timer); ++ spin_unlock(&xprt->transport_lock); + + /* + * Destroy sockets etc from the system workqueue so they can +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index 2f21e3c52bfc1..866bcd99bdc0e 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -626,8 +626,10 @@ xprt_rdma_allocate(struct rpc_task *task) + gfp_t flags; + + flags = RPCRDMA_DEF_GFP; ++ if (RPC_IS_ASYNC(task)) ++ flags = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ flags |= __GFP_MEMALLOC; + + if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize, + flags)) +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 8ffc54b6661f8..480e879e74ae5 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -872,12 +872,12 @@ out: + /** + * xs_nospace - handle transmit was incomplete + * @req: pointer to RPC request ++ * @transport: pointer to struct sock_xprt + * + */ +-static int xs_nospace(struct rpc_rqst *req) ++static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) + { +- struct rpc_xprt *xprt = req->rq_xprt; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct rpc_xprt *xprt = &transport->xprt; + struct sock *sk = transport->inet; + int ret = -EAGAIN; + +@@ -891,25 +891,49 @@ static int xs_nospace(struct rpc_rqst *req) + + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { ++ struct socket_wq *wq; ++ ++ rcu_read_lock(); ++ wq = rcu_dereference(sk->sk_wq); ++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); ++ rcu_read_unlock(); ++ + /* wait for more buffer space */ ++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_pending++; + xprt_wait_for_buffer_space(xprt); + } else + ret = -ENOTCONN; + + spin_unlock(&xprt->transport_lock); ++ return ret; ++} + +- /* Race breaker in case memory is freed before above code is called */ +- if (ret == -EAGAIN) { +- struct socket_wq *wq; ++static int xs_sock_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; + +- rcu_read_lock(); +- wq = rcu_dereference(sk->sk_wq); +- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); +- rcu_read_unlock(); ++ lock_sock(sk); ++ if (!sock_writeable(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); ++ return ret; ++} + +- sk->sk_write_space(sk); +- } ++static int xs_stream_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; ++ ++ lock_sock(sk); ++ if (!sk_stream_memory_free(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); + return ret; + } + +@@ -996,7 +1020,7 @@ static int xs_local_send_request(struct rpc_rqst *req) + case -ENOBUFS: + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + default: + dprintk("RPC: sendmsg returned unrecognized error %d\n", +@@ -1068,7 +1092,7 @@ process_status: + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_sock_nospace(req); + break; + case -ENETUNREACH: + case -ENOBUFS: +@@ -1181,7 +1205,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req) + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + case -ECONNRESET: + case -ECONNREFUSED: +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index f4217673eee70..d543c4556df20 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2698,7 +2698,8 @@ static void tipc_sk_retry_connect(struct sock *sk, struct sk_buff_head *list) + + /* Try again later if dest link is congested */ + if (tsk->cong_link_cnt) { +- sk_reset_timer(sk, &sk->sk_timer, msecs_to_jiffies(100)); ++ sk_reset_timer(sk, &sk->sk_timer, ++ jiffies + msecs_to_jiffies(100)); + return; + } + /* Prepare SYN for retransmit */ +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1436a36c1934a..af3be9a29d6db 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1479,7 +1479,7 @@ static int decrypt_internal(struct sock *sk, struct sk_buff *skb, + } + if (prot->version == TLS_1_3_VERSION) + memcpy(iv + iv_offset, tls_ctx->rx.iv, +- crypto_aead_ivsize(ctx->aead_recv)); ++ prot->iv_size + prot->salt_size); + else + memcpy(iv + iv_offset, tls_ctx->rx.iv, prot->salt_size); + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index d8d603aa48875..c94aa587e0c92 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1767,10 +1767,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + write_lock_bh(&x25_list_lock); + +- sk_for_each(s, &x25_list) +- if (x25_sk(s)->neighbour == nb) ++ sk_for_each(s, &x25_list) { ++ if (x25_sk(s)->neighbour == nb) { ++ write_unlock_bh(&x25_list_lock); ++ lock_sock(s); + x25_disconnect(s, ENETUNREACH, 0, 0); +- ++ release_sock(s); ++ write_lock_bh(&x25_list_lock); ++ } ++ } + write_unlock_bh(&x25_list_lock); + + /* Remove any related forwards */ +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 3932d3aaff270..4cfa79e04e3d1 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + +- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ if (skb->len > 1280) ++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ else ++ goto xmit; + } else { + if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) + goto xmit; +diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c +index dbd37460c573e..f46abb315010d 100644 +--- a/scripts/gcc-plugins/stackleak_plugin.c ++++ b/scripts/gcc-plugins/stackleak_plugin.c +@@ -262,6 +262,23 @@ static unsigned int stackleak_cleanup_execute(void) + return 0; + } + ++/* ++ * STRING_CST may or may not be NUL terminated: ++ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html ++ */ ++static inline bool string_equal(tree node, const char *string, int length) ++{ ++ if (TREE_STRING_LENGTH(node) < length) ++ return false; ++ if (TREE_STRING_LENGTH(node) > length + 1) ++ return false; ++ if (TREE_STRING_LENGTH(node) == length + 1 && ++ TREE_STRING_POINTER(node)[length] != '\0') ++ return false; ++ return !memcmp(TREE_STRING_POINTER(node), string, length); ++} ++#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str)) ++ + static bool stackleak_gate(void) + { + tree section; +@@ -271,13 +288,13 @@ static bool stackleak_gate(void) + if (section && TREE_VALUE(section)) { + section = TREE_VALUE(TREE_VALUE(section)); + +- if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) ++ if (STRING_EQUAL(section, ".init.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) ++ if (STRING_EQUAL(section, ".devinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) ++ if (STRING_EQUAL(section, ".cpuinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) ++ if (STRING_EQUAL(section, ".meminit.text")) + return false; + } + +diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c +index 931d8dfb4a7f4..63e5c646f7620 100644 +--- a/security/keys/keyctl_pkey.c ++++ b/security/keys/keyctl_pkey.c +@@ -135,15 +135,23 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + + switch (op) { + case KEYCTL_PKEY_ENCRYPT: ++ if (uparams.in_len > info.max_dec_size || ++ uparams.out_len > info.max_enc_size) ++ return -EINVAL; ++ break; + case KEYCTL_PKEY_DECRYPT: + if (uparams.in_len > info.max_enc_size || + uparams.out_len > info.max_dec_size) + return -EINVAL; + break; + case KEYCTL_PKEY_SIGN: ++ if (uparams.in_len > info.max_data_size || ++ uparams.out_len > info.max_sig_size) ++ return -EINVAL; ++ break; + case KEYCTL_PKEY_VERIFY: +- if (uparams.in_len > info.max_sig_size || +- uparams.out_len > info.max_data_size) ++ if (uparams.in_len > info.max_data_size || ++ uparams.in2_len > info.max_sig_size) + return -EINVAL; + break; + default: +@@ -151,7 +159,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par + } + + params->in_len = uparams.in_len; +- params->out_len = uparams.out_len; ++ params->out_len = uparams.out_len; /* Note: same as in2_len */ + return 0; + } + +diff --git a/security/security.c b/security/security.c +index c34ec4c7d98cc..f633717311a34 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -802,9 +802,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) + return call_int_hook(fs_context_dup, 0, fc, src_fc); + } + +-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param) ++int security_fs_context_parse_param(struct fs_context *fc, ++ struct fs_parameter *param) + { +- return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param); ++ struct security_hook_list *hp; ++ int trc; ++ int rc = -ENOPARAM; ++ ++ hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param, ++ list) { ++ trc = hp->hook.fs_context_parse_param(fc, param); ++ if (trc == 0) ++ rc = 0; ++ else if (trc != -ENOPARAM) ++ return trc; ++ } ++ return rc; + } + + int security_sb_alloc(struct super_block *sb) +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 56418cf72069d..d9f15c84aab7d 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2855,10 +2855,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc, + return opt; + + rc = selinux_add_opt(opt, param->string, &fc->security); +- if (!rc) { ++ if (!rc) + param->string = NULL; +- rc = 1; +- } ++ + return rc; + } + +diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c +index 7314196185d15..00e95f8bd7c73 100644 +--- a/security/selinux/xfrm.c ++++ b/security/selinux/xfrm.c +@@ -346,7 +346,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, + int rc; + struct xfrm_sec_ctx *ctx; + char *ctx_str = NULL; +- int str_len; ++ u32 str_len; + + if (!polsec) + return 0; +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 12c0fa85d9f82..0253cd2e2358a 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2501,7 +2501,7 @@ static int smk_ipv6_check(struct smack_known *subject, + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); + ad.a.u.net->family = PF_INET6; +- ad.a.u.net->dport = ntohs(address->sin6_port); ++ ad.a.u.net->dport = address->sin6_port; + if (act == SMK_RECEIVING) + ad.a.u.net->v6info.saddr = address->sin6_addr; + else +diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c +index 3445ae6fd4794..363b65be87ab7 100644 +--- a/security/tomoyo/load_policy.c ++++ b/security/tomoyo/load_policy.c +@@ -24,7 +24,7 @@ static const char *tomoyo_loader; + static int __init tomoyo_loader_setup(char *str) + { + tomoyo_loader = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_loader=", tomoyo_loader_setup); +@@ -64,7 +64,7 @@ static const char *tomoyo_trigger; + static int __init tomoyo_trigger_setup(char *str) + { + tomoyo_trigger = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_trigger=", tomoyo_trigger_setup); +diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c +index bbfbebf4affbc..df44dd5dc4b22 100644 +--- a/sound/firewire/fcp.c ++++ b/sound/firewire/fcp.c +@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, + t.response_match_bytes = response_match_bytes; + t.state = STATE_PENDING; + init_waitqueue_head(&t.wait); +- +- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) +- t.deferrable = true; ++ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); + + spin_lock_irq(&transactions_lock); + list_add_tail(&t.list, &transactions); +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index fa3c39cff5f85..9ee3a312c6793 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -544,7 +544,7 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + static int dev; + int err; + struct snd_card *card; +- struct pnp_dev *cdev; ++ struct pnp_dev *cdev, *iter; + char cid[PNP_ID_LEN]; + + if (pnp_device_is_isapnp(pdev)) +@@ -560,9 +560,11 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + strcpy(cid, pdev->id[0].id); + cid[5] = '1'; + cdev = NULL; +- list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) { +- if (!strcmp(cdev->id[0].id, cid)) ++ list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) { ++ if (!strcmp(iter->id[0].id, cid)) { ++ cdev = iter; + break; ++ } + } + err = snd_cs423x_card_new(&pdev->dev, dev, &card); + if (err < 0) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index d201043d661c1..05ca4196cb0fd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3557,8 +3557,8 @@ static void alc256_shutup(struct hda_codec *codec) + /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly + * when booting with headset plugged. So skip setting it for the codec alc257 + */ +- if (spec->codec_variant != ALC269_TYPE_ALC257 && +- spec->codec_variant != ALC269_TYPE_ALC256) ++ if (codec->core.vendor_id != 0x10ec0236 && ++ codec->core.vendor_id != 0x10ec0257) + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (!spec->no_shutup_pins) +@@ -6456,6 +6456,7 @@ enum { + ALC285_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, ++ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS, + ALC269VC_FIXUP_ACER_HEADSET_MIC, +@@ -7740,6 +7741,14 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x08}, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf}, ++ { } ++ }, ++ }, + [ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -8217,6 +8226,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), +@@ -8540,6 +8550,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, ++ {.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, + {.id = ALC295_FIXUP_HP_OMEN, .name = "alc295-hp-omen"}, +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index ca603397651c0..1e0973322cd00 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + + /* Enable PMC peripheral clock for this SSC */ + pr_debug("atmel_ssc_dai: Starting clock\n"); +- clk_enable(ssc_p->ssc->clk); ++ ret = clk_enable(ssc_p->ssc->clk); ++ if (ret) ++ return ret; ++ + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + + /* Reset the SSC unless initialized to keep it in a clean state */ +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index b1bef2bf142dc..05277a88e20d8 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); + if (!cpu_np) { + dev_err(&pdev->dev, "dai and pcm info missing\n"); ++ of_node_put(codec_np); + return -EINVAL; + } + at91sam9g20ek_dai.cpus->of_node = cpu_np; +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 229cc89f8c5a5..466dc67799f4c 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -586,21 +586,26 @@ config SND_SOC_CS4349 + + config SND_SOC_CS47L15 + tristate ++ depends on MFD_CS47L15 + + config SND_SOC_CS47L24 + tristate + + config SND_SOC_CS47L35 + tristate ++ depends on MFD_CS47L35 + + config SND_SOC_CS47L85 + tristate ++ depends on MFD_CS47L85 + + config SND_SOC_CS47L90 + tristate ++ depends on MFD_CS47L90 + + config SND_SOC_CS47L92 + tristate ++ depends on MFD_CS47L92 + + # Cirrus Logic Quad-Channel ADC + config SND_SOC_CS53L30 +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 337bddb7c2a49..5a8eedea6be03 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -1195,8 +1195,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + } + + irq = platform_get_irq_byname(pdev, "mbhc_switch_int"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + pm8916_mbhc_switch_irq_handler, +@@ -1208,8 +1210,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + + if (priv->mbhc_btn_enabled) { + irq = platform_get_irq_byname(pdev, "mbhc_but_press_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_press_irq_handler, +@@ -1220,8 +1224,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + dev_err(dev, "cannot request mbhc button press irq\n"); + + irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_release_irq_handler, +@@ -1238,6 +1244,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &pm8916_wcd_analog, + pm8916_wcd_analog_dai, + ARRAY_SIZE(pm8916_wcd_analog_dai)); ++ ++err_disable_clk: ++ clk_disable_unprepare(priv->mclk); ++ return ret; + } + + static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev) +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index 09fccacadd6b1..d5269ab5f91c5 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + ret = clk_prepare_enable(priv->mclk); + if (ret < 0) { + dev_err(dev, "failed to enable mclk %d\n", ret); +- return ret; ++ goto err_clk; + } + + dev_set_drvdata(dev, priv); +@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, + msm8916_wcd_digital_dai, + ARRAY_SIZE(msm8916_wcd_digital_dai)); ++err_clk: ++ clk_disable_unprepare(priv->ahbclk); ++ return ret; + } + + static int msm8916_wcd_digital_remove(struct platform_device *pdev) +diff --git a/sound/soc/codecs/mt6358.c b/sound/soc/codecs/mt6358.c +index bb737fd678cc6..494ba0eeb4336 100644 +--- a/sound/soc/codecs/mt6358.c ++++ b/sound/soc/codecs/mt6358.c +@@ -103,6 +103,7 @@ int mt6358_set_mtkaif_protocol(struct snd_soc_component *cmpnt, + priv->mtkaif_protocol = mtkaif_protocol; + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_protocol); + + static void playback_gpio_set(struct mt6358_priv *priv) + { +@@ -269,6 +270,7 @@ int mt6358_mtkaif_calibration_enable(struct snd_soc_component *cmpnt) + 1 << RG_AUD_PAD_TOP_DAT_MISO_LOOPBACK_SFT); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_enable); + + int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) + { +@@ -292,6 +294,7 @@ int mt6358_mtkaif_calibration_disable(struct snd_soc_component *cmpnt) + capture_gpio_reset(priv); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_mtkaif_calibration_disable); + + int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, + int phase_1, int phase_2) +@@ -306,6 +309,7 @@ int mt6358_set_mtkaif_calibration_phase(struct snd_soc_component *cmpnt, + phase_2 << RG_AUD_PAD_TOP_PHASE_MODE2_SFT); + return 0; + } ++EXPORT_SYMBOL_GPL(mt6358_set_mtkaif_calibration_phase); + + /* dl pga gain */ + enum { +diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c +index 3610be1590fcc..19e2f622718d6 100644 +--- a/sound/soc/codecs/rt5663.c ++++ b/sound/soc/codecs/rt5663.c +@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + table_size = sizeof(struct impedance_mapping_table) * + rt5663->pdata.impedance_sensing_num; + rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); ++ if (!rt5663->imp_table) ++ return -ENOMEM; + ret = device_property_read_u32_array(dev, + "realtek,impedance_sensing_table", + (u32 *)rt5663->imp_table, table_size); +diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c +index fe99584c917f8..9cd91bb0a9022 100644 +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -1535,18 +1535,38 @@ static int wm8350_component_probe(struct snd_soc_component *component) + wm8350_clear_bits(wm8350, WM8350_JACK_DETECT, + WM8350_JDL_ENA | WM8350_JDR_ENA); + +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, + wm8350_hpl_jack_handler, 0, "Left jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, ++ if (ret != 0) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, + wm8350_hpr_jack_handler, 0, "Right jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, ++ if (ret != 0) ++ goto free_jck_det_l; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, + wm8350_mic_handler, 0, "Microphone short", priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, ++ if (ret != 0) ++ goto free_jck_det_r; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, + wm8350_mic_handler, 0, "Microphone detect", priv); ++ if (ret != 0) ++ goto free_micscd; + + return 0; ++ ++free_micscd: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv); ++free_jck_det_r: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv); ++free_jck_det_l: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv); ++err: ++ return ret; + } + + static void wm8350_component_remove(struct snd_soc_component *component) +diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c +index fad1eb6253d53..9e602c3456196 100644 +--- a/sound/soc/fsl/imx-es8328.c ++++ b/sound/soc/fsl/imx-es8328.c +@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev) + if (int_port > MUX_PORT_MAX || int_port == 0) { + dev_err(dev, "mux-int-port: hardware only has %d mux ports\n", + MUX_PORT_MAX); ++ ret = -EINVAL; + goto fail; + } + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 1e38ce8583262..cb1b525cbe9de 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream, + * basic clock which should be fast enough for the internal + * logic. + */ +- clk_enable(saif->clk); ++ ret = clk_enable(saif->clk); ++ if (ret) ++ return ret; ++ + ret = clk_set_rate(saif->clk, 24000000); + clk_disable(saif->clk); + if (ret) +diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c +index 9841e1da97826..8282fe6d00dd4 100644 +--- a/sound/soc/mxs/mxs-sgtl5000.c ++++ b/sound/soc/mxs/mxs-sgtl5000.c +@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev) + codec_np = of_parse_phandle(np, "audio-codec", 0); + if (!saif_np[0] || !saif_np[1] || !codec_np) { + dev_err(&pdev->dev, "phandle missing or invalid\n"); ++ of_node_put(codec_np); ++ of_node_put(saif_np[0]); ++ of_node_put(saif_np[1]); + return -EINVAL; + } + +diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c +index 3447dbdba1f17..6ac7df30a2890 100644 +--- a/sound/soc/sh/fsi.c ++++ b/sound/soc/sh/fsi.c +@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev, + return ret; + } + +- clk_enable(clock->xck); +- clk_enable(clock->ick); +- clk_enable(clock->div); ++ ret = clk_enable(clock->xck); ++ if (ret) ++ goto err; ++ ret = clk_enable(clock->ick); ++ if (ret) ++ goto disable_xck; ++ ret = clk_enable(clock->div); ++ if (ret) ++ goto disable_ick; + + clock->count++; + } + + return ret; ++ ++disable_ick: ++ clk_disable(clock->ick); ++disable_xck: ++ clk_disable(clock->xck); ++err: ++ return ret; + } + + static int fsi_clk_disable(struct device *dev, +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 9e54d8ae6d2cf..da6e40aef7b6e 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -871,6 +871,11 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + return -EINVAL; + } + ++ if (!codec_dai) { ++ dev_err(rtd->card->dev, "Missing codec\n"); ++ return -EINVAL; ++ } ++ + /* check client and interface hw capabilities */ + if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) && + snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_PLAYBACK)) +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index c0e03cc8ea822..093ab32ea2c3a 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3362,7 +3362,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args, + for_each_component(pos) { + component_of_node = soc_component_to_node(pos); + +- if (component_of_node != args->np) ++ if (component_of_node != args->np || !pos->num_dai) + continue; + + ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name); +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 5552c66ca6422..ca4b17bd95d14 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream, + + memset(&slave_config, 0, sizeof(slave_config)); + +- if (!pcm->config) +- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; +- else ++ if (pcm->config && pcm->config->prepare_slave_config) + prepare_slave_config = pcm->config->prepare_slave_config; ++ else ++ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; + + if (prepare_slave_config) { + ret = prepare_slave_config(substream, params, &slave_config); +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 21f859e56b700..870b002293535 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -587,7 +587,8 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr, + + if (le32_to_cpu(hdr->ops.info) == SND_SOC_TPLG_CTL_BYTES + && k->iface & SNDRV_CTL_ELEM_IFACE_MIXER +- && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ++ && (k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ ++ || k->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) + && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { + struct soc_bytes_ext *sbe; + struct snd_soc_tplg_bytes_control *be; +diff --git a/sound/soc/sof/intel/hda-loader.c b/sound/soc/sof/intel/hda-loader.c +index 356bb134ae93a..7573f3f9f0f21 100644 +--- a/sound/soc/sof/intel/hda-loader.c ++++ b/sound/soc/sof/intel/hda-loader.c +@@ -50,7 +50,7 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, + ret = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV_SG, &pci->dev, size, dmab); + if (ret < 0) { + dev_err(sdev->dev, "error: memory alloc failed: %x\n", ret); +- goto error; ++ goto out_put; + } + + hstream->period_bytes = 0;/* initialize period_bytes */ +@@ -60,16 +60,17 @@ static int cl_stream_prepare(struct snd_sof_dev *sdev, unsigned int format, + ret = hda_dsp_stream_hw_params(sdev, dsp_stream, dmab, NULL); + if (ret < 0) { + dev_err(sdev->dev, "error: hdac prepare failed: %x\n", ret); +- goto error; ++ goto out_free; + } + + hda_dsp_stream_spib_config(sdev, dsp_stream, HDA_DSP_SPIB_ENABLE, size); + + return hstream->stream_tag; + +-error: +- hda_dsp_stream_put(sdev, direction, hstream->stream_tag); ++out_free: + snd_dma_free_pages(dmab); ++out_put: ++ hda_dsp_stream_put(sdev, direction, hstream->stream_tag); + return ret; + } + +diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c +index d89b5c928c4d7..b2b2dcdb05d4c 100644 +--- a/sound/soc/ti/davinci-i2s.c ++++ b/sound/soc/ti/davinci-i2s.c +@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev) + dev->clk = clk_get(&pdev->dev, NULL); + if (IS_ERR(dev->clk)) + return -ENODEV; +- clk_enable(dev->clk); ++ ret = clk_enable(dev->clk); ++ if (ret) ++ goto err_put_clk; + + dev->dev = &pdev->dev; + dev_set_drvdata(&pdev->dev, dev); +@@ -730,6 +732,7 @@ err_unregister_component: + snd_soc_unregister_component(&pdev->dev); + err_release_clk: + clk_disable(dev->clk); ++err_put_clk: + clk_put(dev->clk); + return ret; + } +diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c +index 4de1ba9a418d9..6e5d315bab59b 100644 +--- a/sound/spi/at73c213.c ++++ b/sound/spi/at73c213.c +@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream) + runtime->hw = snd_at73c213_playback_hw; + chip->substream = substream; + +- clk_enable(chip->ssc->clk); ++ err = clk_enable(chip->ssc->clk); ++ if (err) ++ return err; + + return 0; + } +@@ -784,7 +786,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip) + goto out; + + /* Enable DAC master clock. */ +- clk_enable(chip->board->dac_clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ goto out; + + /* Initialize at73c213 on SPI bus. */ + retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04); +@@ -897,7 +901,9 @@ static int snd_at73c213_dev_init(struct snd_card *card, + chip->card = card; + chip->irq = -1; + +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ return retval; + + retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip); + if (retval) { +@@ -1016,7 +1022,9 @@ static int snd_at73c213_remove(struct spi_device *spi) + int retval; + + /* Stop playback. */ +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ goto out; + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS)); + clk_disable(chip->ssc->clk); + +@@ -1096,9 +1104,16 @@ static int snd_at73c213_resume(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); + struct snd_at73c213 *chip = card->private_data; ++ int retval; + +- clk_enable(chip->board->dac_clk); +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ return retval; ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) { ++ clk_disable(chip->board->dac_clk); ++ return retval; ++ } + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN)); + + return 0; +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 2a261b909dd8d..88392219d425e 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -204,9 +204,16 @@ strip-libs = $(filter-out -l%,$(1)) + PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null) + PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS)) + PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS)) +-PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null` ++PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null) + FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS) + ++ifeq ($(CC_NO_CLANG), 0) ++ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS)) ++ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro ++endif ++ + $(OUTPUT)test-libperl.bin: + $(BUILD) $(FLAGS_PERL_EMBED) + +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 63038eb23560b..0bfad86ec960a 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -1294,8 +1294,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index b2fc452504501..a1176a9e8430a 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -1366,6 +1366,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id, + if (s->name_resolved) + return *cached_name ? *cached_name : orig_name; + ++ if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) { ++ s->name_resolved = 1; ++ return orig_name; ++ } ++ + dup_cnt = btf_dump_name_dups(d, name_map, orig_name); + if (dup_cnt > 1) { + const size_t max_len = 256; +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 7578af2504549..b94d9afad3f79 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -706,6 +706,9 @@ else + LDFLAGS += $(PERL_EMBED_LDFLAGS) + EXTLIBS += $(PERL_EMBED_LIBADD) + CFLAGS += -DHAVE_LIBPERL_SUPPORT ++ ifeq ($(CC_NO_CLANG), 0) ++ CFLAGS += -Wno-compound-token-split-by-macro ++ endif + $(call detected,CONFIG_LIBPERL) + endif + endif +diff --git a/tools/perf/perf.c b/tools/perf/perf.c +index 27f94b0bb8747..505e2a2f1872b 100644 +--- a/tools/perf/perf.c ++++ b/tools/perf/perf.c +@@ -433,7 +433,7 @@ void pthread__unblock_sigwinch(void) + static int libperf_print(enum libperf_print_level level, + const char *fmt, va_list ap) + { +- return eprintf(level, verbose, fmt, ap); ++ return veprintf(level, verbose, fmt, ap); + } + + int main(int argc, const char **argv) +diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c +index 8ff2c98e90322..01e15b445cb58 100644 +--- a/tools/perf/util/session.c ++++ b/tools/perf/util/session.c +@@ -1960,6 +1960,7 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + bool needs_swap, union perf_event *error) + { + union perf_event *event; ++ u16 event_size; + + /* + * Ensure we have enough space remaining to read +@@ -1972,15 +1973,23 @@ prefetch_event(char *buf, u64 head, size_t mmap_size, + if (needs_swap) + perf_event_header__bswap(&event->header); + +- if (head + event->header.size <= mmap_size) ++ event_size = event->header.size; ++ if (head + event_size <= mmap_size) + return event; + + /* We're not fetching the event so swap back again */ + if (needs_swap) + perf_event_header__bswap(&event->header); + +- pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx:" +- " fuzzed or compressed perf.data?\n",__func__, head, event->header.size, mmap_size); ++ /* Check if the event fits into the next mmapped buf. */ ++ if (event_size <= mmap_size - head % page_size) { ++ /* Remap buf and fetch again. */ ++ return NULL; ++ } ++ ++ /* Invalid input. Event size should never exceed mmap_size. */ ++ pr_debug("%s: head=%#" PRIx64 " event->header.size=%#x, mmap_size=%#zx:" ++ " fuzzed or compressed perf.data?\n", __func__, head, event_size, mmap_size); + + return error; + } +diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh +index ec4e15948e406..5252b91f48a18 100755 +--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh ++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh +@@ -3,6 +3,7 @@ + + # Kselftest framework requirement - SKIP code is 4. + ksft_skip=4 ++ret=$ksft_skip + + msg="skip all tests:" + if [ $UID != 0 ]; then +@@ -25,7 +26,7 @@ do + fi + done + +-if [ -n $LIRCDEV ]; ++if [ -n "$LIRCDEV" ]; + then + TYPE=lirc_mode2 + ./test_lirc_mode2_user $LIRCDEV $INPUTDEV +@@ -36,3 +37,5 @@ then + echo -e ${GREEN}"PASS: $TYPE"${NC} + fi + fi ++ ++exit $ret +diff --git a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh +index b497bb85b667f..6c69c42b1d607 100755 +--- a/tools/testing/selftests/bpf/test_lwt_ip_encap.sh ++++ b/tools/testing/selftests/bpf/test_lwt_ip_encap.sh +@@ -120,6 +120,14 @@ setup() + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ++ # disable IPv6 DAD because it sometimes takes too long and fails tests ++ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.all.accept_dad=0 ++ ip netns exec ${NS1} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ ip netns exec ${NS2} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ ip netns exec ${NS3} sysctl -wq net.ipv6.conf.default.accept_dad=0 ++ + ip link add veth1 type veth peer name veth2 + ip link add veth3 type veth peer name veth4 + ip link add veth5 type veth peer name veth6 +@@ -289,7 +297,7 @@ test_ping() + ip netns exec ${NS1} ping -c 1 -W 1 -I veth1 ${IPv4_DST} 2>&1 > /dev/null + RET=$? + elif [ "${PROTO}" == "IPv6" ] ; then +- ip netns exec ${NS1} ping6 -c 1 -W 6 -I veth1 ${IPv6_DST} 2>&1 > /dev/null ++ ip netns exec ${NS1} ping6 -c 1 -W 1 -I veth1 ${IPv6_DST} 2>&1 > /dev/null + RET=$? + else + echo " test_ping: unknown PROTO: ${PROTO}" +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index 5e939ff1e3f95..819f3480a6f71 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -202,7 +202,7 @@ int cg_find_unified_root(char *root, size_t len) + + int cg_create(const char *cgroup) + { +- return mkdir(cgroup, 0644); ++ return mkdir(cgroup, 0755); + } + + int cg_wait_for_proc_count(const char *cgroup, int count) +diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c +index 79053a4f47838..599234c5e496c 100644 +--- a/tools/testing/selftests/cgroup/test_core.c ++++ b/tools/testing/selftests/cgroup/test_core.c +@@ -1,8 +1,13 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + ++#define _GNU_SOURCE + #include ++#include + #include ++#include + #include ++#include ++#include + #include + #include + +@@ -354,6 +359,166 @@ cleanup: + return ret; + } + ++/* ++ * cgroup migration permission check should be performed based on the ++ * credentials at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_euid_open(const char *root) ++{ ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ uid_t saved_uid; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ saved_uid = geteuid(); ++ if (seteuid(test_euid)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR); ++ ++ if (seteuid(saved_uid)) ++ goto cleanup; ++ ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ ++struct lesser_ns_open_thread_arg { ++ const char *path; ++ int fd; ++ int err; ++}; ++ ++static int lesser_ns_open_thread_fn(void *arg) ++{ ++ struct lesser_ns_open_thread_arg *targ = arg; ++ ++ targ->fd = open(targ->path, O_RDWR); ++ targ->err = errno; ++ return 0; ++} ++ ++/* ++ * cgroup migration permission check should be performed based on the cgroup ++ * namespace at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_ns_open(const char *root) ++{ ++ static char stack[65536]; ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ struct lesser_ns_open_thread_arg targ = { .fd = -1 }; ++ pid_t pid; ++ int status; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_b)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ targ.path = cg_test_b_procs; ++ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack), ++ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, ++ &targ); ++ if (pid < 0) ++ goto cleanup; ++ ++ if (waitpid(pid, &status, 0) < 0) ++ goto cleanup; ++ ++ if (!WIFEXITED(status)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = targ.fd; ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ + #define T(x) { x, #x } + struct corecg_test { + int (*fn)(const char *root); +@@ -366,6 +531,8 @@ struct corecg_test { + T(test_cgcore_parent_becomes_threaded), + T(test_cgcore_invalid_domain), + T(test_cgcore_populated), ++ T(test_cgcore_lesser_euid_open), ++ T(test_cgcore_lesser_ns_open), + }; + #undef T + +diff --git a/tools/testing/selftests/net/test_vxlan_under_vrf.sh b/tools/testing/selftests/net/test_vxlan_under_vrf.sh +index 09f9ed92cbe4c..a44b9aca74272 100755 +--- a/tools/testing/selftests/net/test_vxlan_under_vrf.sh ++++ b/tools/testing/selftests/net/test_vxlan_under_vrf.sh +@@ -118,11 +118,11 @@ echo "[ OK ]" + + # Move the underlay to a non-default VRF + ip -netns hv-1 link set veth0 vrf vrf-underlay +-ip -netns hv-1 link set veth0 down +-ip -netns hv-1 link set veth0 up ++ip -netns hv-1 link set vxlan0 down ++ip -netns hv-1 link set vxlan0 up + ip -netns hv-2 link set veth0 vrf vrf-underlay +-ip -netns hv-2 link set veth0 down +-ip -netns hv-2 link set veth0 up ++ip -netns hv-2 link set vxlan0 down ++ip -netns hv-2 link set vxlan0 up + + echo -n "Check VM connectivity through VXLAN (underlay in a VRF) " + ip netns exec vm-1 ping -c 1 -W 1 10.0.0.2 &> /dev/null || (echo "[FAIL]"; false) +diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh +index 3e2089c8cf549..8c669c0d662ee 100755 +--- a/tools/testing/selftests/x86/check_cc.sh ++++ b/tools/testing/selftests/x86/check_cc.sh +@@ -7,7 +7,7 @@ CC="$1" + TESTPROG="$2" + shift 2 + +-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then ++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then + echo 1 + else + echo 0 +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index f31976010622f..287444e52ccf8 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -115,6 +115,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir); + static int kvm_debugfs_num_entries; + static const struct file_operations *stat_fops_per_vm[]; + ++static struct file_operations kvm_chardev_ops; ++ + static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl, + unsigned long arg); + #ifdef CONFIG_KVM_COMPAT +@@ -766,6 +768,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + + preempt_notifier_inc(); + ++ /* ++ * When the fd passed to this ioctl() is opened it pins the module, ++ * but try_module_get() also prevents getting a reference if the module ++ * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait"). ++ */ ++ if (!try_module_get(kvm_chardev_ops.owner)) { ++ r = -ENODEV; ++ goto out_err; ++ } ++ + return kvm; + + out_err: +@@ -844,6 +856,7 @@ static void kvm_destroy_vm(struct kvm *kvm) + preempt_notifier_dec(); + hardware_disable_all(); + mmdrop(mm); ++ module_put(kvm_chardev_ops.owner); + } + + void kvm_get_kvm(struct kvm *kvm) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch new file mode 100644 index 0000000000..81f2d3b042 --- /dev/null +++ b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.189-190.patch @@ -0,0 +1,1735 @@ +diff --git a/Makefile b/Makefile +index cbb71900d3dcf..fd239ec16278b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 4 +-SUBLEVEL = 189 ++SUBLEVEL = 190 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c +index 5b3549f1236c5..b2ede9bf82dff 100644 +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -1101,11 +1101,13 @@ static int __init da850_evm_config_emac(void) + int ret; + u32 val; + struct davinci_soc_info *soc_info = &davinci_soc_info; +- u8 rmii_en = soc_info->emac_pdata->rmii_en; ++ u8 rmii_en; + + if (!machine_is_davinci_da850_evm()) + return 0; + ++ rmii_en = soc_info->emac_pdata->rmii_en; ++ + cfg_chip3_base = DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); + + val = __raw_readl(cfg_chip3_base); +diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c +index 73039949b5ce2..5f8e4c2df53cc 100644 +--- a/arch/arm64/kernel/alternative.c ++++ b/arch/arm64/kernel/alternative.c +@@ -41,7 +41,7 @@ bool alternative_is_applied(u16 cpufeature) + /* + * Check if the target PC is within an alternative block. + */ +-static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) ++static __always_inline bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) + { + unsigned long replptr = (unsigned long)ALT_REPL_PTR(alt); + return !(pc >= replptr && pc <= (replptr + alt->alt_len)); +@@ -49,7 +49,7 @@ static bool branch_insn_requires_update(struct alt_instr *alt, unsigned long pc) + + #define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1)) + +-static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr) ++static __always_inline u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnptr) + { + u32 insn; + +@@ -94,7 +94,7 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnp + return insn; + } + +-static void patch_alternative(struct alt_instr *alt, ++static noinstr void patch_alternative(struct alt_instr *alt, + __le32 *origptr, __le32 *updptr, int nr_inst) + { + __le32 *replptr; +diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h +index 6ba5adb96a3be..0d8f9246ce153 100644 +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -132,7 +132,11 @@ static inline bool pfn_valid(unsigned long pfn) + #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr)) + #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT) + +-#define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) ++#define virt_addr_valid(vaddr) ({ \ ++ unsigned long _addr = (unsigned long)vaddr; \ ++ _addr >= PAGE_OFFSET && _addr < (unsigned long)high_memory && \ ++ pfn_valid(virt_to_pfn(_addr)); \ ++}) + + /* + * On Book-E parts we need __va to parse the device tree and we can't +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index dca1590f295d0..af8a1bac93458 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4580,6 +4580,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung SSD 840 EVO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_NO_DMA_LOG | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 13c6eee481da7..d71c7b9b96650 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -275,8 +275,8 @@ static acpi_status acpi_gpiochip_alloc_event(struct acpi_resource *ares, + pin = agpio->pin_table[0]; + + if (pin <= 255) { +- char ev_name[5]; +- sprintf(ev_name, "_%c%02hhX", ++ char ev_name[8]; ++ sprintf(ev_name, "_%c%02X", + agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L', + pin); + if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) +diff --git a/drivers/gpu/drm/amd/amdgpu/ObjectID.h b/drivers/gpu/drm/amd/amdgpu/ObjectID.h +index 5b393622f5920..a0f0a17e224fe 100644 +--- a/drivers/gpu/drm/amd/amdgpu/ObjectID.h ++++ b/drivers/gpu/drm/amd/amdgpu/ObjectID.h +@@ -119,6 +119,7 @@ + #define CONNECTOR_OBJECT_ID_eDP 0x14 + #define CONNECTOR_OBJECT_ID_MXM 0x15 + #define CONNECTOR_OBJECT_ID_LVDS_eDP 0x16 ++#define CONNECTOR_OBJECT_ID_USBC 0x17 + + /* deleted */ + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index e8e1720104160..ffd7547135225 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -633,7 +633,7 @@ MODULE_PARM_DESC(sched_policy, + * Maximum number of processes that HWS can schedule concurrently. The maximum is the + * number of VMIDs assigned to the HWS, which is also the default. + */ +-int hws_max_conc_proc = 8; ++int hws_max_conc_proc = -1; + module_param(hws_max_conc_proc, int, 0444); + MODULE_PARM_DESC(hws_max_conc_proc, + "Max # processes HWS can execute concurrently when sched_policy=0 (0 = no concurrency, #VMIDs for KFD = Maximum(default))"); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index ad9483b9eea32..60ee1a8321129 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -609,15 +609,10 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, + - kfd->vm_info.first_vmid_kfd + 1; + + /* Verify module parameters regarding mapped process number*/ +- if ((hws_max_conc_proc < 0) +- || (hws_max_conc_proc > kfd->vm_info.vmid_num_kfd)) { +- dev_err(kfd_device, +- "hws_max_conc_proc %d must be between 0 and %d, use %d instead\n", +- hws_max_conc_proc, kfd->vm_info.vmid_num_kfd, +- kfd->vm_info.vmid_num_kfd); ++ if (hws_max_conc_proc >= 0) ++ kfd->max_proc_per_quantum = min((u32)hws_max_conc_proc, kfd->vm_info.vmid_num_kfd); ++ else + kfd->max_proc_per_quantum = kfd->vm_info.vmid_num_kfd; +- } else +- kfd->max_proc_per_quantum = hws_max_conc_proc; + + /* Allocate global GWS that is shared by all KFD processes */ + if (hws_gws_support && amdgpu_amdkfd_alloc_gws(kfd->kgd, +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +index d674d4b3340fa..adbb2fec2e0f2 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c +@@ -532,6 +532,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events) + event_waiters = kmalloc_array(num_events, + sizeof(struct kfd_event_waiter), + GFP_KERNEL); ++ if (!event_waiters) ++ return NULL; + + for (i = 0; (event_waiters) && (i < num_events) ; i++) { + init_wait(&event_waiters[i].wait); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index c5231c50c4126..de33864af70b8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1210,7 +1210,8 @@ static int dm_resume(void *handle) + * this is the case when traversing through already created + * MST connectors, should be skipped + */ +- if (aconnector->mst_port) ++ if (aconnector->dc_link && ++ aconnector->dc_link->type == dc_connection_mst_branch) + continue; + + mutex_lock(&aconnector->hpd_lock); +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 95a5310e9e661..de246e183d6ba 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1546,8 +1546,8 @@ bool dc_is_stream_unchanged( + if (old_stream->ignore_msa_timing_param != stream->ignore_msa_timing_param) + return false; + +- // Only Have Audio left to check whether it is same or not. This is a corner case for Tiled sinks +- if (old_stream->audio_info.mode_count != stream->audio_info.mode_count) ++ /*compare audio info*/ ++ if (memcmp(&old_stream->audio_info, &stream->audio_info, sizeof(stream->audio_info)) != 0) + return false; + + return true; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index bc5ebea1abede..fa3acf60e7bd2 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2202,14 +2202,18 @@ static void dcn10_update_mpcc(struct dc *dc, struct pipe_ctx *pipe_ctx) + &blnd_cfg.black_color); + } + +- if (per_pixel_alpha) +- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; +- else +- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; +- + blnd_cfg.overlap_only = false; + blnd_cfg.global_gain = 0xff; + ++ if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_GLOBAL_GAIN; ++ blnd_cfg.global_gain = pipe_ctx->plane_state->global_alpha_value; ++ } else if (per_pixel_alpha) { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; ++ } else { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; ++ } ++ + if (pipe_ctx->plane_state->global_alpha) + blnd_cfg.global_alpha = pipe_ctx->plane_state->global_alpha_value; + else +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +index 03a2e1d7f0673..f7965a5d24442 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +@@ -1740,14 +1740,18 @@ static void dcn20_update_mpcc(struct dc *dc, struct pipe_ctx *pipe_ctx) + pipe_ctx, &blnd_cfg.black_color); + } + +- if (per_pixel_alpha) +- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; +- else +- blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; +- + blnd_cfg.overlap_only = false; + blnd_cfg.global_gain = 0xff; + ++ if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_GLOBAL_GAIN; ++ blnd_cfg.global_gain = pipe_ctx->plane_state->global_alpha_value; ++ } else if (per_pixel_alpha) { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; ++ } else { ++ blnd_cfg.alpha_mode = MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; ++ } ++ + if (pipe_ctx->plane_state->global_alpha) + blnd_cfg.global_alpha = pipe_ctx->plane_state->global_alpha_value; + else +diff --git a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c +index d885d642ed7fc..537736713598b 100644 +--- a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c ++++ b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c +@@ -85,7 +85,8 @@ + //PB7 = MD0 + #define MASK_VTEM_MD0__VRR_EN 0x01 + #define MASK_VTEM_MD0__M_CONST 0x02 +-#define MASK_VTEM_MD0__RESERVED2 0x0C ++#define MASK_VTEM_MD0__QMS_EN 0x04 ++#define MASK_VTEM_MD0__RESERVED2 0x08 + #define MASK_VTEM_MD0__FVA_FACTOR_M1 0xF0 + + //MD1 +@@ -94,7 +95,7 @@ + //MD2 + #define MASK_VTEM_MD2__BASE_REFRESH_RATE_98 0x03 + #define MASK_VTEM_MD2__RB 0x04 +-#define MASK_VTEM_MD2__RESERVED3 0xF8 ++#define MASK_VTEM_MD2__NEXT_TFR 0xF8 + + //MD3 + #define MASK_VTEM_MD3__BASE_REFRESH_RATE_07 0xFF +diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c +index 73127948f54d9..f3ff2cdc288ba 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c +@@ -625,7 +625,7 @@ struct drm_connector *msm_dsi_manager_connector_init(u8 id) + return connector; + + fail: +- connector->funcs->destroy(msm_dsi->connector); ++ connector->funcs->destroy(connector); + return ERR_PTR(ret); + } + +diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c +index b4a31d506fccf..74eca68891add 100644 +--- a/drivers/gpu/ipu-v3/ipu-di.c ++++ b/drivers/gpu/ipu-v3/ipu-di.c +@@ -451,8 +451,9 @@ static void ipu_di_config_clock(struct ipu_di *di, + + error = rate / (sig->mode.pixelclock / 1000); + +- dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %d.%u%%\n", +- rate, div, (signed)(error - 1000) / 10, error % 10); ++ dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %c%d.%d%%\n", ++ rate, div, error < 1000 ? '-' : '+', ++ abs(error - 1000) / 10, abs(error - 1000) % 10); + + /* Allow a 1% error */ + if (error < 1010 && error >= 990) { +diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c +index 9a03b163cbbda..59f1e64908b1d 100644 +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -378,7 +378,16 @@ int hv_ringbuffer_read(struct vmbus_channel *channel, + static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi) + { + u32 priv_read_loc = rbi->priv_read_index; +- u32 write_loc = READ_ONCE(rbi->ring_buffer->write_index); ++ u32 write_loc; ++ ++ /* ++ * The Hyper-V host writes the packet data, then uses ++ * store_release() to update the write_index. Use load_acquire() ++ * here to prevent loads of the packet data from being re-ordered ++ * before the read of the write_index and potentially getting ++ * stale data. ++ */ ++ write_loc = virt_load_acquire(&rbi->ring_buffer->write_index); + + if (write_loc >= priv_read_loc) + return write_loc - priv_read_loc; +diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c +index 20f2772c0e79b..2c909522f0f38 100644 +--- a/drivers/i2c/busses/i2c-pasemi.c ++++ b/drivers/i2c/busses/i2c-pasemi.c +@@ -137,6 +137,12 @@ static int pasemi_i2c_xfer_msg(struct i2c_adapter *adapter, + + TXFIFO_WR(smbus, msg->buf[msg->len-1] | + (stop ? MTXFIFO_STOP : 0)); ++ ++ if (stop) { ++ err = pasemi_smb_waitready(smbus); ++ if (err) ++ goto reset_out; ++ } + } + + return 0; +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 9f4d657dd36c8..28a9eeae83b66 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -4054,6 +4054,7 @@ try_smaller_buffer: + } + + if (ic->internal_hash) { ++ size_t recalc_tags_size; + ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1); + if (!ic->recalc_wq ) { + ti->error = "Cannot allocate workqueue"; +@@ -4067,8 +4068,10 @@ try_smaller_buffer: + r = -ENOMEM; + goto bad; + } +- ic->recalc_tags = kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sectors_per_block, +- ic->tag_size, GFP_KERNEL); ++ recalc_tags_size = (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) * ic->tag_size; ++ if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) ++ recalc_tags_size += crypto_shash_digestsize(ic->internal_hash) - ic->tag_size; ++ ic->recalc_tags = kvmalloc(recalc_tags_size, GFP_KERNEL); + if (!ic->recalc_tags) { + ti->error = "Cannot allocate tags for recalculating"; + r = -ENOMEM; +diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c +index 89646896a1833..6f9cf6270a437 100644 +--- a/drivers/memory/atmel-ebi.c ++++ b/drivers/memory/atmel-ebi.c +@@ -545,20 +545,27 @@ static int atmel_ebi_probe(struct platform_device *pdev) + smc_np = of_parse_phandle(dev->of_node, "atmel,smc", 0); + + ebi->smc.regmap = syscon_node_to_regmap(smc_np); +- if (IS_ERR(ebi->smc.regmap)) +- return PTR_ERR(ebi->smc.regmap); ++ if (IS_ERR(ebi->smc.regmap)) { ++ ret = PTR_ERR(ebi->smc.regmap); ++ goto put_node; ++ } + + ebi->smc.layout = atmel_hsmc_get_reg_layout(smc_np); +- if (IS_ERR(ebi->smc.layout)) +- return PTR_ERR(ebi->smc.layout); ++ if (IS_ERR(ebi->smc.layout)) { ++ ret = PTR_ERR(ebi->smc.layout); ++ goto put_node; ++ } + + ebi->smc.clk = of_clk_get(smc_np, 0); + if (IS_ERR(ebi->smc.clk)) { +- if (PTR_ERR(ebi->smc.clk) != -ENOENT) +- return PTR_ERR(ebi->smc.clk); ++ if (PTR_ERR(ebi->smc.clk) != -ENOENT) { ++ ret = PTR_ERR(ebi->smc.clk); ++ goto put_node; ++ } + + ebi->smc.clk = NULL; + } ++ of_node_put(smc_np); + ret = clk_prepare_enable(ebi->smc.clk); + if (ret) + return ret; +@@ -609,6 +616,10 @@ static int atmel_ebi_probe(struct platform_device *pdev) + } + + return of_platform_populate(np, NULL, NULL, dev); ++ ++put_node: ++ of_node_put(smc_np); ++ return ret; + } + + static __maybe_unused int atmel_ebi_resume(struct device *dev) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +index 95f408d0e103c..7cc4c30af1a71 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c +@@ -649,6 +649,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, + return 0; + + errout: ++ mutex_destroy(&mlxsw_i2c->cmd.lock); + i2c_set_clientdata(client, NULL); + + return err; +diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/micrel/Kconfig +index b9c4d48e28e42..120ed4633a096 100644 +--- a/drivers/net/ethernet/micrel/Kconfig ++++ b/drivers/net/ethernet/micrel/Kconfig +@@ -37,6 +37,7 @@ config KS8851 + config KS8851_MLL + tristate "Micrel KS8851 MLL" + depends on HAS_IOMEM ++ depends on PTP_1588_CLOCK_OPTIONAL + select MII + ---help--- + This platform driver is for Micrel KS8851 Address/data bus +diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +index cd478d2cd871a..00f6d347eaf75 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +@@ -57,10 +57,6 @@ + #define TSE_PCS_USE_SGMII_ENA BIT(0) + #define TSE_PCS_IF_USE_SGMII 0x03 + +-#define SGMII_ADAPTER_CTRL_REG 0x00 +-#define SGMII_ADAPTER_DISABLE 0x0001 +-#define SGMII_ADAPTER_ENABLE 0x0000 +- + #define AUTONEGO_LINK_TIMER 20 + + static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs) +@@ -202,12 +198,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct phy_device *phy_dev, + unsigned int speed) + { + void __iomem *tse_pcs_base = pcs->tse_pcs_base; +- void __iomem *sgmii_adapter_base = pcs->sgmii_adapter_base; + u32 val; + +- writew(SGMII_ADAPTER_ENABLE, +- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); +- + pcs->autoneg = phy_dev->autoneg; + + if (phy_dev->autoneg == AUTONEG_ENABLE) { +diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h +index 442812c0a4bdc..694ac25ef426b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h ++++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h +@@ -10,6 +10,10 @@ + #include + #include + ++#define SGMII_ADAPTER_CTRL_REG 0x00 ++#define SGMII_ADAPTER_ENABLE 0x0000 ++#define SGMII_ADAPTER_DISABLE 0x0001 ++ + struct tse_pcs { + struct device *dev; + void __iomem *tse_pcs_base; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +index 70d41783329dd..72e47621d27c7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +@@ -18,9 +18,6 @@ + + #include "altr_tse_pcs.h" + +-#define SGMII_ADAPTER_CTRL_REG 0x00 +-#define SGMII_ADAPTER_DISABLE 0x0001 +- + #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0 + #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1 + #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2 +@@ -62,16 +59,14 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) + { + struct socfpga_dwmac *dwmac = (struct socfpga_dwmac *)priv; + void __iomem *splitter_base = dwmac->splitter_base; +- void __iomem *tse_pcs_base = dwmac->pcs.tse_pcs_base; + void __iomem *sgmii_adapter_base = dwmac->pcs.sgmii_adapter_base; + struct device *dev = dwmac->dev; + struct net_device *ndev = dev_get_drvdata(dev); + struct phy_device *phy_dev = ndev->phydev; + u32 val; + +- if ((tse_pcs_base) && (sgmii_adapter_base)) +- writew(SGMII_ADAPTER_DISABLE, +- sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); ++ writew(SGMII_ADAPTER_DISABLE, ++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + + if (splitter_base) { + val = readl(splitter_base + EMAC_SPLITTER_CTRL_REG); +@@ -93,7 +88,9 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsigned int speed) + writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); + } + +- if (tse_pcs_base && sgmii_adapter_base) ++ writew(SGMII_ADAPTER_ENABLE, ++ sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); ++ if (phy_dev) + tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); + } + +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c +index 8e56a41dd7585..096617982998f 100644 +--- a/drivers/net/slip/slip.c ++++ b/drivers/net/slip/slip.c +@@ -471,7 +471,7 @@ static void sl_tx_timeout(struct net_device *dev) + spin_lock(&sl->lock); + + if (netif_queue_stopped(dev)) { +- if (!netif_running(dev)) ++ if (!netif_running(dev) || !sl->tty) + goto out; + + /* May be we must check transmitter timeout here ? +diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c +index 7e44110746dd0..68912e266826b 100644 +--- a/drivers/net/usb/aqc111.c ++++ b/drivers/net/usb/aqc111.c +@@ -1102,10 +1102,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + if (start_of_descs != desc_offset) + goto err; + +- /* self check desc_offset from header*/ +- if (desc_offset >= skb_len) ++ /* self check desc_offset from header and make sure that the ++ * bounds of the metadata array are inside the SKB ++ */ ++ if (pkt_count * 2 + desc_offset >= skb_len) + goto err; + ++ /* Packets must not overlap the metadata array */ ++ skb_trim(skb, desc_offset); ++ + if (pkt_count == 0) + goto err; + +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index 10a876f8831c7..683425e3a353c 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -245,7 +245,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) + + rcu_read_lock(); + rcv = rcu_dereference(priv->peer); +- if (unlikely(!rcv)) { ++ if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { + kfree_skb(skb); + goto drop; + } +diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c +index ec13bd8d5487d..eb5751a45f266 100644 +--- a/drivers/net/wireless/ath/ath9k/main.c ++++ b/drivers/net/wireless/ath/ath9k/main.c +@@ -836,7 +836,7 @@ static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) + continue; + + txinfo = IEEE80211_SKB_CB(bf->bf_mpdu); +- fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0]; ++ fi = (struct ath_frame_info *)&txinfo->status.status_driver_data[0]; + if (fi->keyix == keyix) + return true; + } +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 14e6871a14054..fdb2152345eba 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -141,8 +141,8 @@ static struct ath_frame_info *get_frame_info(struct sk_buff *skb) + { + struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb); + BUILD_BUG_ON(sizeof(struct ath_frame_info) > +- sizeof(tx_info->rate_driver_data)); +- return (struct ath_frame_info *) &tx_info->rate_driver_data[0]; ++ sizeof(tx_info->status.status_driver_data)); ++ return (struct ath_frame_info *) &tx_info->status.status_driver_data[0]; + } + + static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno) +@@ -2498,6 +2498,16 @@ skip_tx_complete: + spin_unlock_irqrestore(&sc->tx.txbuflock, flags); + } + ++static void ath_clear_tx_status(struct ieee80211_tx_info *tx_info) ++{ ++ void *ptr = &tx_info->status; ++ ++ memset(ptr + sizeof(tx_info->status.rates), 0, ++ sizeof(tx_info->status) - ++ sizeof(tx_info->status.rates) - ++ sizeof(tx_info->status.status_driver_data)); ++} ++ + static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, + struct ath_tx_status *ts, int nframes, int nbad, + int txok) +@@ -2509,6 +2519,8 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, + struct ath_hw *ah = sc->sc_ah; + u8 i, tx_rateindex; + ++ ath_clear_tx_status(tx_info); ++ + if (txok) + tx_info->status.ack_signal = ts->ts_rssi; + +@@ -2523,6 +2535,13 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, + tx_info->status.ampdu_len = nframes; + tx_info->status.ampdu_ack_len = nframes - nbad; + ++ tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1; ++ ++ for (i = tx_rateindex + 1; i < hw->max_rates; i++) { ++ tx_info->status.rates[i].count = 0; ++ tx_info->status.rates[i].idx = -1; ++ } ++ + if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 && + (tx_info->flags & IEEE80211_TX_CTL_NO_ACK) == 0) { + /* +@@ -2544,16 +2563,6 @@ static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, + tx_info->status.rates[tx_rateindex].count = + hw->max_rate_tries; + } +- +- for (i = tx_rateindex + 1; i < hw->max_rates; i++) { +- tx_info->status.rates[i].count = 0; +- tx_info->status.rates[i].idx = -1; +- } +- +- tx_info->status.rates[tx_rateindex].count = ts->ts_longretry + 1; +- +- /* we report airtime in ath_tx_count_airtime(), don't report twice */ +- tx_info->status.tx_time = 0; + } + + static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq) +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index 726ed8f59868c..912a220a9db92 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -29,7 +29,7 @@ + #define CNTL_OVER_MASK 0xFFFFFFFE + + #define CNTL_CSV_SHIFT 24 +-#define CNTL_CSV_MASK (0xFF << CNTL_CSV_SHIFT) ++#define CNTL_CSV_MASK (0xFFU << CNTL_CSV_SHIFT) + + #define EVENT_CYCLES_ID 0 + #define EVENT_CYCLES_COUNTER 0 +diff --git a/drivers/regulator/wm8994-regulator.c b/drivers/regulator/wm8994-regulator.c +index cadea0344486f..40befdd9dfa92 100644 +--- a/drivers/regulator/wm8994-regulator.c ++++ b/drivers/regulator/wm8994-regulator.c +@@ -71,6 +71,35 @@ static const struct regulator_ops wm8994_ldo2_ops = { + }; + + static const struct regulator_desc wm8994_ldo_desc[] = { ++ { ++ .name = "LDO1", ++ .id = 1, ++ .type = REGULATOR_VOLTAGE, ++ .n_voltages = WM8994_LDO1_MAX_SELECTOR + 1, ++ .vsel_reg = WM8994_LDO_1, ++ .vsel_mask = WM8994_LDO1_VSEL_MASK, ++ .ops = &wm8994_ldo1_ops, ++ .min_uV = 2400000, ++ .uV_step = 100000, ++ .enable_time = 3000, ++ .off_on_delay = 36000, ++ .owner = THIS_MODULE, ++ }, ++ { ++ .name = "LDO2", ++ .id = 2, ++ .type = REGULATOR_VOLTAGE, ++ .n_voltages = WM8994_LDO2_MAX_SELECTOR + 1, ++ .vsel_reg = WM8994_LDO_2, ++ .vsel_mask = WM8994_LDO2_VSEL_MASK, ++ .ops = &wm8994_ldo2_ops, ++ .enable_time = 3000, ++ .off_on_delay = 36000, ++ .owner = THIS_MODULE, ++ }, ++}; ++ ++static const struct regulator_desc wm8958_ldo_desc[] = { + { + .name = "LDO1", + .id = 1, +@@ -172,9 +201,16 @@ static int wm8994_ldo_probe(struct platform_device *pdev) + * regulator core and we need not worry about it on the + * error path. + */ +- ldo->regulator = devm_regulator_register(&pdev->dev, +- &wm8994_ldo_desc[id], +- &config); ++ if (ldo->wm8994->type == WM8994) { ++ ldo->regulator = devm_regulator_register(&pdev->dev, ++ &wm8994_ldo_desc[id], ++ &config); ++ } else { ++ ldo->regulator = devm_regulator_register(&pdev->dev, ++ &wm8958_ldo_desc[id], ++ &config); ++ } ++ + if (IS_ERR(ldo->regulator)) { + ret = PTR_ERR(ldo->regulator); + dev_err(wm8994->dev, "Failed to register LDO%d: %d\n", +diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +index a929fe76102b0..d5b2917aea44f 100644 +--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c ++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +@@ -35,7 +35,7 @@ + + #define IBMVSCSIS_VERSION "v0.2" + +-#define INITIAL_SRP_LIMIT 800 ++#define INITIAL_SRP_LIMIT 1024 + #define DEFAULT_MAX_SECTORS 256 + #define MAX_TXU 1024 * 1024 + +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index 3d43ac9772f7e..aa62cc8ffd0af 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -2551,6 +2551,9 @@ struct megasas_instance_template { + #define MEGASAS_IS_LOGICAL(sdev) \ + ((sdev->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1) + ++#define MEGASAS_IS_LUN_VALID(sdev) \ ++ (((sdev)->lun == 0) ? 1 : 0) ++ + #define MEGASAS_DEV_INDEX(scp) \ + (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \ + scp->device->id) +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 6700d43b12ff5..a261ce511e9ed 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -2102,6 +2102,9 @@ static int megasas_slave_alloc(struct scsi_device *sdev) + goto scan_target; + } + return -ENXIO; ++ } else if (!MEGASAS_IS_LUN_VALID(sdev)) { ++ sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); ++ return -ENXIO; + } + + scan_target: +@@ -2132,6 +2135,10 @@ static void megasas_slave_destroy(struct scsi_device *sdev) + instance = megasas_lookup_instance(sdev->host->host_no); + + if (MEGASAS_IS_LOGICAL(sdev)) { ++ if (!MEGASAS_IS_LUN_VALID(sdev)) { ++ sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); ++ return; ++ } + ld_tgt_id = MEGASAS_TARGET_ID(sdev); + instance->ld_tgtid_status[ld_tgt_id] = LD_TARGET_ID_DELETED; + if (megasas_dbg_lvl & LD_PD_DEBUG) +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index c16d7fb0fdcbb..0c5e2c6105867 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -646,6 +646,7 @@ static struct pci_device_id mvs_pci_table[] = { + { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 }, + { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 }, + { PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 }, ++ { PCI_VDEVICE(TTI, 0x2640), chip_6440 }, + { PCI_VDEVICE(TTI, 0x2710), chip_9480 }, + { PCI_VDEVICE(TTI, 0x2720), chip_9480 }, + { PCI_VDEVICE(TTI, 0x2721), chip_9480 }, +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 71144e33272a3..077c56cbed4e1 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -1488,6 +1488,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi) + mutex_lock(&udev->cmdr_lock); + page = tcmu_get_block_page(udev, dbi); + if (likely(page)) { ++ get_page(page); + mutex_unlock(&udev->cmdr_lock); + return page; + } +@@ -1526,6 +1527,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) + /* For the vmalloc()ed cmd area pages */ + addr = (void *)(unsigned long)info->mem[mi].addr + offset; + page = vmalloc_to_page(addr); ++ get_page(page); + } else { + uint32_t dbi; + +@@ -1536,7 +1538,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) + return VM_FAULT_SIGBUS; + } + +- get_page(page); + vmf->page = page; + return 0; + } +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index e98d6ea35ea80..bcf19dfb0af35 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2388,7 +2388,6 @@ int btrfs_start_dirty_block_groups(struct btrfs_trans_handle *trans) + struct btrfs_path *path = NULL; + LIST_HEAD(dirty); + struct list_head *io = &cur_trans->io_bgs; +- int num_started = 0; + int loops = 0; + + spin_lock(&cur_trans->dirty_bgs_lock); +@@ -2455,7 +2454,6 @@ again: + cache->io_ctl.inode = NULL; + ret = btrfs_write_out_cache(trans, cache, path); + if (ret == 0 && cache->io_ctl.inode) { +- num_started++; + should_put = 0; + + /* +@@ -2556,7 +2554,6 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans) + int should_put; + struct btrfs_path *path; + struct list_head *io = &cur_trans->io_bgs; +- int num_started = 0; + + path = btrfs_alloc_path(); + if (!path) +@@ -2614,7 +2611,6 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans) + cache->io_ctl.inode = NULL; + ret = btrfs_write_out_cache(trans, cache, path); + if (ret == 0 && cache->io_ctl.inode) { +- num_started++; + should_put = 0; + list_add_tail(&cache->io_list, io); + } else { +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 344d18de1f08c..8898682c91038 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -4320,10 +4320,12 @@ static int balance_kthread(void *data) + struct btrfs_fs_info *fs_info = data; + int ret = 0; + ++ sb_start_write(fs_info->sb); + mutex_lock(&fs_info->balance_mutex); + if (fs_info->balance_ctl) + ret = btrfs_balance(fs_info, fs_info->balance_ctl, NULL); + mutex_unlock(&fs_info->balance_mutex); ++ sb_end_write(fs_info->sb); + + return ret; + } +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index b736acd3917bb..a24bcbbb50337 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -97,6 +97,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, unsigned int *_link_len, + if (rc != 1) + return -EINVAL; + ++ if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN) ++ return -EINVAL; ++ + rc = symlink_hash(link_len, link_str, md5_hash); + if (rc) { + cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc); +diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h +index 46294ef620ff9..268674c1d5685 100644 +--- a/include/asm-generic/tlb.h ++++ b/include/asm-generic/tlb.h +@@ -547,10 +547,14 @@ static inline void tlb_flush_p4d_range(struct mmu_gather *tlb, + #define tlb_remove_huge_tlb_entry(h, tlb, ptep, address) \ + do { \ + unsigned long _sz = huge_page_size(h); \ +- if (_sz == PMD_SIZE) \ +- tlb_flush_pmd_range(tlb, address, _sz); \ +- else if (_sz == PUD_SIZE) \ ++ if (_sz >= P4D_SIZE) \ ++ tlb_flush_p4d_range(tlb, address, _sz); \ ++ else if (_sz >= PUD_SIZE) \ + tlb_flush_pud_range(tlb, address, _sz); \ ++ else if (_sz >= PMD_SIZE) \ ++ tlb_flush_pmd_range(tlb, address, _sz); \ ++ else \ ++ tlb_flush_pte_range(tlb, address, _sz); \ + __tlb_remove_tlb_entry(tlb, ptep, address); \ + } while (0) + +diff --git a/include/net/ax25.h b/include/net/ax25.h +index 8b7eb46ad72d8..aadff553e4b73 100644 +--- a/include/net/ax25.h ++++ b/include/net/ax25.h +@@ -236,6 +236,7 @@ typedef struct ax25_dev { + #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER) + ax25_dama_info dama; + #endif ++ refcount_t refcount; + } ax25_dev; + + typedef struct ax25_cb { +@@ -290,6 +291,17 @@ static __inline__ void ax25_cb_put(ax25_cb *ax25) + } + } + ++static inline void ax25_dev_hold(ax25_dev *ax25_dev) ++{ ++ refcount_inc(&ax25_dev->refcount); ++} ++ ++static inline void ax25_dev_put(ax25_dev *ax25_dev) ++{ ++ if (refcount_dec_and_test(&ax25_dev->refcount)) { ++ kfree(ax25_dev); ++ } ++} + static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_device *dev) + { + skb->dev = dev; +diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h +index 78f6437cbc3a8..02171416c68eb 100644 +--- a/include/net/flow_dissector.h ++++ b/include/net/flow_dissector.h +@@ -51,6 +51,8 @@ struct flow_dissector_key_vlan { + vlan_dei:1, + vlan_priority:3; + __be16 vlan_tpid; ++ __be16 vlan_eth_type; ++ u16 padding; + }; + + struct flow_dissector_key_mpls { +diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c +index 0a093a675b632..f04cfc2e9e01a 100644 +--- a/kernel/dma/direct.c ++++ b/kernel/dma/direct.c +@@ -306,7 +306,8 @@ void dma_direct_unmap_page(struct device *dev, dma_addr_t addr, + dma_direct_sync_single_for_cpu(dev, addr, size, dir); + + if (unlikely(is_swiotlb_buffer(phys))) +- swiotlb_tbl_unmap_single(dev, phys, size, size, dir, attrs); ++ swiotlb_tbl_unmap_single(dev, phys, size, size, dir, ++ attrs | DMA_ATTR_SKIP_CPU_SYNC); + } + EXPORT_SYMBOL(dma_direct_unmap_page); + +diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c +index 4d89ad4fae3bb..5fb78addff51b 100644 +--- a/kernel/irq/affinity.c ++++ b/kernel/irq/affinity.c +@@ -269,8 +269,9 @@ static int __irq_build_affinity_masks(unsigned int startvec, + */ + if (numvecs <= nodes) { + for_each_node_mask(n, nodemsk) { +- cpumask_or(&masks[curvec].mask, &masks[curvec].mask, +- node_to_cpumask[n]); ++ /* Ensure that only CPUs which are in both masks are set */ ++ cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); ++ cpumask_or(&masks[curvec].mask, &masks[curvec].mask, nmsk); + if (++curvec == last_affv) + curvec = firstvec; + } +diff --git a/kernel/smp.c b/kernel/smp.c +index 3a390932f8b25..be65b76cb8036 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -222,7 +222,7 @@ static void flush_smp_call_function_queue(bool warn_cpu_offline) + + /* There shouldn't be any pending callbacks on an offline CPU. */ + if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) && +- !warned && !llist_empty(head))) { ++ !warned && entry != NULL)) { + warned = true; + WARN(1, "IPI on offline CPU %d\n", smp_processor_id()); + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 4419486d7413c..5eb04bb598026 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -131,7 +131,7 @@ static void tick_sched_do_timer(struct tick_sched *ts, ktime_t now) + */ + if (unlikely(tick_do_timer_cpu == TICK_DO_TIMER_NONE)) { + #ifdef CONFIG_NO_HZ_FULL +- WARN_ON(tick_nohz_full_running); ++ WARN_ON_ONCE(tick_nohz_full_running); + #endif + tick_do_timer_cpu = cpu; + } +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index d8cde7292bf92..3761c79137b17 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -1123,7 +1123,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); + void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_count, + gfp_t gfp) + { +- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) ++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + kmemleak_alloc(__va(phys), size, min_count, gfp); + } + EXPORT_SYMBOL(kmemleak_alloc_phys); +@@ -1137,7 +1137,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); + */ + void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) + { +- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) ++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + kmemleak_free_part(__va(phys), size); + } + EXPORT_SYMBOL(kmemleak_free_part_phys); +@@ -1149,7 +1149,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); + */ + void __ref kmemleak_not_leak_phys(phys_addr_t phys) + { +- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) ++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + kmemleak_not_leak(__va(phys)); + } + EXPORT_SYMBOL(kmemleak_not_leak_phys); +@@ -1161,7 +1161,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); + */ + void __ref kmemleak_ignore_phys(phys_addr_t phys) + { +- if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) ++ if (PHYS_PFN(phys) >= min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + kmemleak_ignore(__va(phys)); + } + EXPORT_SYMBOL(kmemleak_ignore_phys); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 5038611563dfb..7048ea59d58bd 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -5481,7 +5481,7 @@ static int build_zonerefs_node(pg_data_t *pgdat, struct zoneref *zonerefs) + do { + zone_type--; + zone = pgdat->node_zones + zone_type; +- if (managed_zone(zone)) { ++ if (populated_zone(zone)) { + zoneref_set_zone(zone, &zonerefs[nr_zones++]); + check_highest_zone(zone_type); + } +diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c +index 093b73c454d28..aff991ca0e4a4 100644 +--- a/net/ax25/af_ax25.c ++++ b/net/ax25/af_ax25.c +@@ -89,17 +89,21 @@ again: + sk = s->sk; + if (!sk) { + spin_unlock_bh(&ax25_list_lock); +- s->ax25_dev = NULL; + ax25_disconnect(s, ENETUNREACH); ++ s->ax25_dev = NULL; + spin_lock_bh(&ax25_list_lock); + goto again; + } + sock_hold(sk); + spin_unlock_bh(&ax25_list_lock); + lock_sock(sk); ++ ax25_disconnect(s, ENETUNREACH); + s->ax25_dev = NULL; ++ if (sk->sk_socket) { ++ dev_put(ax25_dev->dev); ++ ax25_dev_put(ax25_dev); ++ } + release_sock(sk); +- ax25_disconnect(s, ENETUNREACH); + spin_lock_bh(&ax25_list_lock); + sock_put(sk); + /* The entry could have been deleted from the +@@ -365,21 +369,25 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) + if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl))) + return -EFAULT; + +- if ((ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr)) == NULL) +- return -ENODEV; +- + if (ax25_ctl.digi_count > AX25_MAX_DIGIS) + return -EINVAL; + + if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL) + return -EINVAL; + ++ ax25_dev = ax25_addr_ax25dev(&ax25_ctl.port_addr); ++ if (!ax25_dev) ++ return -ENODEV; ++ + digi.ndigi = ax25_ctl.digi_count; + for (k = 0; k < digi.ndigi; k++) + digi.calls[k] = ax25_ctl.digi_addr[k]; + +- if ((ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev)) == NULL) ++ ax25 = ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, ax25_dev->dev); ++ if (!ax25) { ++ ax25_dev_put(ax25_dev); + return -ENOTCONN; ++ } + + switch (ax25_ctl.cmd) { + case AX25_KILL: +@@ -446,6 +454,7 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg) + } + + out_put: ++ ax25_dev_put(ax25_dev); + ax25_cb_put(ax25); + return ret; + +@@ -971,14 +980,16 @@ static int ax25_release(struct socket *sock) + { + struct sock *sk = sock->sk; + ax25_cb *ax25; ++ ax25_dev *ax25_dev; + + if (sk == NULL) + return 0; + + sock_hold(sk); +- sock_orphan(sk); + lock_sock(sk); ++ sock_orphan(sk); + ax25 = sk_to_ax25(sk); ++ ax25_dev = ax25->ax25_dev; + + if (sk->sk_type == SOCK_SEQPACKET) { + switch (ax25->state) { +@@ -1040,6 +1051,15 @@ static int ax25_release(struct socket *sock) + sk->sk_state_change(sk); + ax25_destroy_socket(ax25); + } ++ if (ax25_dev) { ++ del_timer_sync(&ax25->timer); ++ del_timer_sync(&ax25->t1timer); ++ del_timer_sync(&ax25->t2timer); ++ del_timer_sync(&ax25->t3timer); ++ del_timer_sync(&ax25->idletimer); ++ dev_put(ax25_dev->dev); ++ ax25_dev_put(ax25_dev); ++ } + + sock->sk = NULL; + release_sock(sk); +@@ -1116,8 +1136,10 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + } + } + +- if (ax25_dev != NULL) ++ if (ax25_dev) { + ax25_fillin_cb(ax25, ax25_dev); ++ dev_hold(ax25_dev->dev); ++ } + + done: + ax25_cb_add(ax25); +diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c +index 4ac2e0847652a..d2e0cc67d91a7 100644 +--- a/net/ax25/ax25_dev.c ++++ b/net/ax25/ax25_dev.c +@@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address *addr) + for (ax25_dev = ax25_dev_list; ax25_dev != NULL; ax25_dev = ax25_dev->next) + if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) == 0) { + res = ax25_dev; ++ ax25_dev_hold(ax25_dev); + } + spin_unlock_bh(&ax25_dev_lock); + +@@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_device *dev) + return; + } + ++ refcount_set(&ax25_dev->refcount, 1); + dev->ax25_ptr = ax25_dev; + ax25_dev->dev = dev; + dev_hold(dev); +@@ -84,6 +86,7 @@ void ax25_dev_device_up(struct net_device *dev) + ax25_dev->next = ax25_dev_list; + ax25_dev_list = ax25_dev; + spin_unlock_bh(&ax25_dev_lock); ++ ax25_dev_hold(ax25_dev); + + ax25_register_dev_sysctl(ax25_dev); + } +@@ -113,9 +116,10 @@ void ax25_dev_device_down(struct net_device *dev) + if ((s = ax25_dev_list) == ax25_dev) { + ax25_dev_list = s->next; + spin_unlock_bh(&ax25_dev_lock); ++ ax25_dev_put(ax25_dev); + dev->ax25_ptr = NULL; + dev_put(dev); +- kfree(ax25_dev); ++ ax25_dev_put(ax25_dev); + return; + } + +@@ -123,9 +127,10 @@ void ax25_dev_device_down(struct net_device *dev) + if (s->next == ax25_dev) { + s->next = ax25_dev->next; + spin_unlock_bh(&ax25_dev_lock); ++ ax25_dev_put(ax25_dev); + dev->ax25_ptr = NULL; + dev_put(dev); +- kfree(ax25_dev); ++ ax25_dev_put(ax25_dev); + return; + } + +@@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_device *dev) + } + spin_unlock_bh(&ax25_dev_lock); + dev->ax25_ptr = NULL; ++ ax25_dev_put(ax25_dev); + } + + int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) +@@ -144,20 +150,32 @@ int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) + + switch (cmd) { + case SIOCAX25ADDFWD: +- if ((fwd_dev = ax25_addr_ax25dev(&fwd->port_to)) == NULL) ++ fwd_dev = ax25_addr_ax25dev(&fwd->port_to); ++ if (!fwd_dev) { ++ ax25_dev_put(ax25_dev); + return -EINVAL; +- if (ax25_dev->forward != NULL) ++ } ++ if (ax25_dev->forward) { ++ ax25_dev_put(fwd_dev); ++ ax25_dev_put(ax25_dev); + return -EINVAL; ++ } + ax25_dev->forward = fwd_dev->dev; ++ ax25_dev_put(fwd_dev); ++ ax25_dev_put(ax25_dev); + break; + + case SIOCAX25DELFWD: +- if (ax25_dev->forward == NULL) ++ if (!ax25_dev->forward) { ++ ax25_dev_put(ax25_dev); + return -EINVAL; ++ } + ax25_dev->forward = NULL; ++ ax25_dev_put(ax25_dev); + break; + + default: ++ ax25_dev_put(ax25_dev); + return -EINVAL; + } + +diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c +index b40e0bce67ead..dc2168d2a32a9 100644 +--- a/net/ax25/ax25_route.c ++++ b/net/ax25/ax25_route.c +@@ -75,11 +75,13 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + ax25_dev *ax25_dev; + int i; + +- if ((ax25_dev = ax25_addr_ax25dev(&route->port_addr)) == NULL) +- return -EINVAL; + if (route->digi_count > AX25_MAX_DIGIS) + return -EINVAL; + ++ ax25_dev = ax25_addr_ax25dev(&route->port_addr); ++ if (!ax25_dev) ++ return -EINVAL; ++ + write_lock_bh(&ax25_route_lock); + + ax25_rt = ax25_route_list; +@@ -91,6 +93,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + if (route->digi_count != 0) { + if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) { + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + return -ENOMEM; + } + ax25_rt->digipeat->lastrepeat = -1; +@@ -101,6 +104,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + } + } + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + return 0; + } + ax25_rt = ax25_rt->next; +@@ -108,6 +112,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + + if ((ax25_rt = kmalloc(sizeof(ax25_route), GFP_ATOMIC)) == NULL) { + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + return -ENOMEM; + } + +@@ -120,6 +125,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + if ((ax25_rt->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) { + write_unlock_bh(&ax25_route_lock); + kfree(ax25_rt); ++ ax25_dev_put(ax25_dev); + return -ENOMEM; + } + ax25_rt->digipeat->lastrepeat = -1; +@@ -132,6 +138,7 @@ static int __must_check ax25_rt_add(struct ax25_routes_struct *route) + ax25_rt->next = ax25_route_list; + ax25_route_list = ax25_rt; + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + + return 0; + } +@@ -173,6 +180,7 @@ static int ax25_rt_del(struct ax25_routes_struct *route) + } + } + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + + return 0; + } +@@ -215,6 +223,7 @@ static int ax25_rt_opt(struct ax25_route_opt_struct *rt_option) + + out: + write_unlock_bh(&ax25_route_lock); ++ ax25_dev_put(ax25_dev); + return err; + } + +diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c +index 15ab812c4fe4b..3a476e4f6cd0b 100644 +--- a/net/ax25/ax25_subr.c ++++ b/net/ax25/ax25_subr.c +@@ -261,12 +261,20 @@ void ax25_disconnect(ax25_cb *ax25, int reason) + { + ax25_clear_queues(ax25); + +- if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) +- ax25_stop_heartbeat(ax25); +- ax25_stop_t1timer(ax25); +- ax25_stop_t2timer(ax25); +- ax25_stop_t3timer(ax25); +- ax25_stop_idletimer(ax25); ++ if (reason == ENETUNREACH) { ++ del_timer_sync(&ax25->timer); ++ del_timer_sync(&ax25->t1timer); ++ del_timer_sync(&ax25->t2timer); ++ del_timer_sync(&ax25->t3timer); ++ del_timer_sync(&ax25->idletimer); ++ } else { ++ if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) ++ ax25_stop_heartbeat(ax25); ++ ax25_stop_t1timer(ax25); ++ ax25_stop_t2timer(ax25); ++ ax25_stop_t3timer(ax25); ++ ax25_stop_idletimer(ax25); ++ } + + ax25->state = AX25_STATE_0; + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index b740a74f06f22..4dac27c986231 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1149,6 +1149,7 @@ proto_again: + VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT; + } + key_vlan->vlan_tpid = saved_vlan_tpid; ++ key_vlan->vlan_eth_type = proto; + } + + fdret = FLOW_DISSECT_RET_PROTO_AGAIN; +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 3606796009572..5585e3a94f3ca 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -506,7 +506,7 @@ int ip6_forward(struct sk_buff *skb) + goto drop; + + if (!net->ipv6.devconf_all->disable_policy && +- !idev->cnf.disable_policy && ++ (!idev || !idev->cnf.disable_policy) && + !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { + __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); + goto drop; +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index b8ecb002e6238..b2e922fcc70da 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -548,6 +548,10 @@ static int nci_close_device(struct nci_dev *ndev) + mutex_lock(&ndev->req_lock); + + if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { ++ /* Need to flush the cmd wq in case ++ * there is a queued/running cmd_work ++ */ ++ flush_workqueue(ndev->cmd_wq); + del_timer_sync(&ndev->cmd_timer); + del_timer_sync(&ndev->data_timer); + mutex_unlock(&ndev->req_lock); +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 80205b138d113..919c7fa5f02d6 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -1639,10 +1639,10 @@ static int tcf_chain_tp_insert(struct tcf_chain *chain, + if (chain->flushing) + return -EAGAIN; + ++ RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); + if (*chain_info->pprev == chain->filter_chain) + tcf_chain0_head_change(chain, tp); + tcf_proto_get(tp); +- RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); + rcu_assign_pointer(*chain_info->pprev, tp); + + return 0; +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 26979b4853bdb..007fbc1993522 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -784,6 +784,7 @@ static int fl_set_key_mpls(struct nlattr **tb, + static void fl_set_key_vlan(struct nlattr **tb, + __be16 ethertype, + int vlan_id_key, int vlan_prio_key, ++ int vlan_next_eth_type_key, + struct flow_dissector_key_vlan *key_val, + struct flow_dissector_key_vlan *key_mask) + { +@@ -802,6 +803,11 @@ static void fl_set_key_vlan(struct nlattr **tb, + } + key_val->vlan_tpid = ethertype; + key_mask->vlan_tpid = cpu_to_be16(~0); ++ if (tb[vlan_next_eth_type_key]) { ++ key_val->vlan_eth_type = ++ nla_get_be16(tb[vlan_next_eth_type_key]); ++ key_mask->vlan_eth_type = cpu_to_be16(~0); ++ } + } + + static void fl_set_key_flag(u32 flower_key, u32 flower_mask, +@@ -1076,8 +1082,9 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + + if (eth_type_vlan(ethertype)) { + fl_set_key_vlan(tb, ethertype, TCA_FLOWER_KEY_VLAN_ID, +- TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan, +- &mask->vlan); ++ TCA_FLOWER_KEY_VLAN_PRIO, ++ TCA_FLOWER_KEY_VLAN_ETH_TYPE, ++ &key->vlan, &mask->vlan); + + if (tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]) { + ethertype = nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]); +@@ -1085,6 +1092,7 @@ static int fl_set_key(struct net *net, struct nlattr **tb, + fl_set_key_vlan(tb, ethertype, + TCA_FLOWER_KEY_CVLAN_ID, + TCA_FLOWER_KEY_CVLAN_PRIO, ++ TCA_FLOWER_KEY_CVLAN_ETH_TYPE, + &key->cvlan, &mask->cvlan); + fl_set_key_val(tb, &key->basic.n_proto, + TCA_FLOWER_KEY_CVLAN_ETH_TYPE, +@@ -2272,13 +2280,13 @@ static int fl_dump_key(struct sk_buff *skb, struct net *net, + goto nla_put_failure; + + if (mask->basic.n_proto) { +- if (mask->cvlan.vlan_tpid) { ++ if (mask->cvlan.vlan_eth_type) { + if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE, + key->basic.n_proto)) + goto nla_put_failure; +- } else if (mask->vlan.vlan_tpid) { ++ } else if (mask->vlan.vlan_eth_type) { + if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE, +- key->basic.n_proto)) ++ key->vlan.vlan_eth_type)) + goto nla_put_failure; + } + } +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index b268e61304515..4c26f7fb32b34 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -427,7 +427,8 @@ static int taprio_enqueue(struct sk_buff *skb, struct Qdisc *sch, + if (unlikely(!child)) + return qdisc_drop(skb, sch, to_free); + +- if (skb->sk && sock_flag(skb->sk, SOCK_TXTIME)) { ++ /* sk_flags are only safe to use on full sockets. */ ++ if (skb->sk && sk_fullsock(skb->sk) && sock_flag(skb->sk, SOCK_TXTIME)) { + if (!is_valid_interval(skb, sch)) + return qdisc_drop(skb, sch, to_free); + } else if (TXTIME_ASSIST_IS_ENABLED(q->flags)) { +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 565aa77fe5cbe..c76b40322ac7d 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5682,7 +5682,7 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) + * Set the daddr and initialize id to something more random and also + * copy over any ip options. + */ +- sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk); ++ sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sock->sk); + sp->pf->copy_ip_options(sk, sock->sk); + + /* Populate the fields of the newsk from the oldsk and migrate the +diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c +index 571e6d84da3ba..660608202f284 100644 +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -295,8 +295,9 @@ static struct smc_ib_device *smc_pnet_find_ib(char *ib_name) + list_for_each_entry(ibdev, &smc_ib_devices.list, list) { + if (!strncmp(ibdev->ibdev->name, ib_name, + sizeof(ibdev->ibdev->name)) || +- !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, +- IB_DEVICE_NAME_MAX - 1)) { ++ (ibdev->ibdev->dev.parent && ++ !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, ++ IB_DEVICE_NAME_MAX - 1))) { + goto out; + } + } +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index 6cefaad3b7f84..6bb9437af28bf 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -1457,11 +1457,13 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy, + /* this is a nontransmitting bss, we need to add it to + * transmitting bss' list if it is not there + */ ++ spin_lock_bh(&rdev->bss_lock); + if (cfg80211_add_nontrans_list(non_tx_data->tx_bss, + &res->pub)) { + if (__cfg80211_unlink_bss(rdev, res)) + rdev->bss_generation++; + } ++ spin_unlock_bh(&rdev->bss_lock); + } + + trace_cfg80211_return_bss(&res->pub); +diff --git a/scripts/gcc-plugins/latent_entropy_plugin.c b/scripts/gcc-plugins/latent_entropy_plugin.c +index cbe1d6c4b1a51..c84bef1d28955 100644 +--- a/scripts/gcc-plugins/latent_entropy_plugin.c ++++ b/scripts/gcc-plugins/latent_entropy_plugin.c +@@ -86,25 +86,31 @@ static struct plugin_info latent_entropy_plugin_info = { + .help = "disable\tturn off latent entropy instrumentation\n", + }; + +-static unsigned HOST_WIDE_INT seed; +-/* +- * get_random_seed() (this is a GCC function) generates the seed. +- * This is a simple random generator without any cryptographic security because +- * the entropy doesn't come from here. +- */ ++static unsigned HOST_WIDE_INT deterministic_seed; ++static unsigned HOST_WIDE_INT rnd_buf[32]; ++static size_t rnd_idx = ARRAY_SIZE(rnd_buf); ++static int urandom_fd = -1; ++ + static unsigned HOST_WIDE_INT get_random_const(void) + { +- unsigned int i; +- unsigned HOST_WIDE_INT ret = 0; +- +- for (i = 0; i < 8 * sizeof(ret); i++) { +- ret = (ret << 1) | (seed & 1); +- seed >>= 1; +- if (ret & 1) +- seed ^= 0xD800000000000000ULL; ++ if (deterministic_seed) { ++ unsigned HOST_WIDE_INT w = deterministic_seed; ++ w ^= w << 13; ++ w ^= w >> 7; ++ w ^= w << 17; ++ deterministic_seed = w; ++ return deterministic_seed; + } + +- return ret; ++ if (urandom_fd < 0) { ++ urandom_fd = open("/dev/urandom", O_RDONLY); ++ gcc_assert(urandom_fd >= 0); ++ } ++ if (rnd_idx >= ARRAY_SIZE(rnd_buf)) { ++ gcc_assert(read(urandom_fd, rnd_buf, sizeof(rnd_buf)) == sizeof(rnd_buf)); ++ rnd_idx = 0; ++ } ++ return rnd_buf[rnd_idx++]; + } + + static tree tree_get_random_const(tree type) +@@ -549,8 +555,6 @@ static void latent_entropy_start_unit(void *gcc_data __unused, + tree type, id; + int quals; + +- seed = get_random_seed(false); +- + if (in_lto_p) + return; + +@@ -585,6 +589,12 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, + const struct plugin_argument * const argv = plugin_info->argv; + int i; + ++ /* ++ * Call get_random_seed() with noinit=true, so that this returns ++ * 0 in the case where no seed has been passed via -frandom-seed. ++ */ ++ deterministic_seed = get_random_seed(true); ++ + static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = { + { + .base = &latent_entropy_decl, +diff --git a/sound/core/pcm_misc.c b/sound/core/pcm_misc.c +index c4eb561d20086..0956be39b0355 100644 +--- a/sound/core/pcm_misc.c ++++ b/sound/core/pcm_misc.c +@@ -423,7 +423,7 @@ int snd_pcm_format_set_silence(snd_pcm_format_t format, void *data, unsigned int + return 0; + width = pcm_formats[(INT)format].phys; /* physical width */ + pat = pcm_formats[(INT)format].silence; +- if (! width) ++ if (!width || !pat) + return -EINVAL; + /* signed or 1 byte data */ + if (pcm_formats[(INT)format].signd == 1 || width <= 8) { +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 05ca4196cb0fd..851ea79da31cd 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2568,6 +2568,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { + SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_PINS), ++ SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS), + SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS), +diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing/selftests/mqueue/mq_perf_tests.c +index b019e0b8221c7..84fda3b490735 100644 +--- a/tools/testing/selftests/mqueue/mq_perf_tests.c ++++ b/tools/testing/selftests/mqueue/mq_perf_tests.c +@@ -180,6 +180,9 @@ void shutdown(int exit_val, char *err_cause, int line_no) + if (in_shutdown++) + return; + ++ /* Free the cpu_set allocated using CPU_ALLOC in main function */ ++ CPU_FREE(cpu_set); ++ + for (i = 0; i < num_cpus_to_pin; i++) + if (cpu_threads[i]) { + pthread_kill(cpu_threads[i], SIGUSR1); +@@ -551,6 +554,12 @@ int main(int argc, char *argv[]) + perror("sysconf(_SC_NPROCESSORS_ONLN)"); + exit(1); + } ++ ++ if (getuid() != 0) ++ ksft_exit_skip("Not running as root, but almost all tests " ++ "require root in order to modify\nsystem settings. " ++ "Exiting.\n"); ++ + cpus_online = min(MAX_CPUS, sysconf(_SC_NPROCESSORS_ONLN)); + cpu_set = CPU_ALLOC(cpus_online); + if (cpu_set == NULL) { +@@ -589,7 +598,7 @@ int main(int argc, char *argv[]) + cpu_set)) { + fprintf(stderr, "Any given CPU may " + "only be given once.\n"); +- exit(1); ++ goto err_code; + } else + CPU_SET_S(cpus_to_pin[cpu], + cpu_set_size, cpu_set); +@@ -607,7 +616,7 @@ int main(int argc, char *argv[]) + queue_path = malloc(strlen(option) + 2); + if (!queue_path) { + perror("malloc()"); +- exit(1); ++ goto err_code; + } + queue_path[0] = '/'; + queue_path[1] = 0; +@@ -622,17 +631,12 @@ int main(int argc, char *argv[]) + fprintf(stderr, "Must pass at least one CPU to continuous " + "mode.\n"); + poptPrintUsage(popt_context, stderr, 0); +- exit(1); ++ goto err_code; + } else if (!continuous_mode) { + num_cpus_to_pin = 1; + cpus_to_pin[0] = cpus_online - 1; + } + +- if (getuid() != 0) +- ksft_exit_skip("Not running as root, but almost all tests " +- "require root in order to modify\nsystem settings. " +- "Exiting.\n"); +- + max_msgs = fopen(MAX_MSGS, "r+"); + max_msgsize = fopen(MAX_MSGSIZE, "r+"); + if (!max_msgs) +@@ -740,4 +744,9 @@ int main(int argc, char *argv[]) + sleep(1); + } + shutdown(0, "", 0); ++ ++err_code: ++ CPU_FREE(cpu_set); ++ exit(1); ++ + }