diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch deleted file mode 100644 index 1936cbdca1..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.142-143.patch +++ /dev/null @@ -1,2381 +0,0 @@ -diff --git a/Makefile b/Makefile -index ef3adc6ccb871..e99fabc4dfc8c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 142 -+SUBLEVEL = 143 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts -index a9f191d78b544..d0ea95830d454 100644 ---- a/arch/arm/boot/dts/am43x-epos-evm.dts -+++ b/arch/arm/boot/dts/am43x-epos-evm.dts -@@ -589,7 +589,7 @@ - status = "okay"; - pinctrl-names = "default"; - pinctrl-0 = <&i2c0_pins>; -- clock-frequency = <400000>; -+ clock-frequency = <100000>; - - tps65218: tps65218@24 { - reg = <0x24>; -diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi -index f78b4eabd68c2..e7178a6db6bef 100644 ---- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi -+++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi -@@ -755,14 +755,14 @@ - status = "disabled"; - }; - -- vica: intc@10140000 { -+ vica: interrupt-controller@10140000 { - compatible = "arm,versatile-vic"; - interrupt-controller; - #interrupt-cells = <1>; - reg = <0x10140000 0x20>; - }; - -- vicb: intc@10140020 { -+ vicb: interrupt-controller@10140020 { - compatible = "arm,versatile-vic"; - interrupt-controller; - #interrupt-cells = <1>; -diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h -index a9d1dd82d8208..03b3de491b5e6 100644 ---- a/arch/x86/include/asm/fpu/internal.h -+++ b/arch/x86/include/asm/fpu/internal.h -@@ -204,6 +204,14 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) - asm volatile("fxsaveq %[fx]" : [fx] "=m" (fpu->state.fxsave)); - } - -+static inline void fxsave(struct fxregs_state *fx) -+{ -+ if (IS_ENABLED(CONFIG_X86_32)) -+ asm volatile( "fxsave %[fx]" : [fx] "=m" (*fx)); -+ else -+ asm volatile("fxsaveq %[fx]" : [fx] "=m" (*fx)); -+} -+ - /* These macros all use (%edi)/(%rdi) as the single memory argument. */ - #define XSAVE ".byte " REX_PREFIX "0x0f,0xae,0x27" - #define XSAVEOPT ".byte " REX_PREFIX "0x0f,0xae,0x37" -@@ -272,28 +280,6 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) - : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ - : "memory") - --/* -- * This function is called only during boot time when x86 caps are not set -- * up and alternative can not be used yet. -- */ --static inline void copy_xregs_to_kernel_booting(struct xregs_state *xstate) --{ -- u64 mask = -1; -- u32 lmask = mask; -- u32 hmask = mask >> 32; -- int err; -- -- WARN_ON(system_state != SYSTEM_BOOTING); -- -- if (boot_cpu_has(X86_FEATURE_XSAVES)) -- XSTATE_OP(XSAVES, xstate, lmask, hmask, err); -- else -- XSTATE_OP(XSAVE, xstate, lmask, hmask, err); -- -- /* We should never fault when copying to a kernel buffer: */ -- WARN_ON_FPU(err); --} -- - /* - * This function is called only during boot time when x86 caps are not set - * up and alternative can not be used yet. -diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c -index 735d1f1bbabc7..046782df37a6d 100644 ---- a/arch/x86/kernel/fpu/xstate.c -+++ b/arch/x86/kernel/fpu/xstate.c -@@ -398,6 +398,24 @@ static void __init print_xstate_offset_size(void) - } - } - -+/* -+ * All supported features have either init state all zeros or are -+ * handled in setup_init_fpu() individually. This is an explicit -+ * feature list and does not use XFEATURE_MASK*SUPPORTED to catch -+ * newly added supported features at build time and make people -+ * actually look at the init state for the new feature. -+ */ -+#define XFEATURES_INIT_FPSTATE_HANDLED \ -+ (XFEATURE_MASK_FP | \ -+ XFEATURE_MASK_SSE | \ -+ XFEATURE_MASK_YMM | \ -+ XFEATURE_MASK_OPMASK | \ -+ XFEATURE_MASK_ZMM_Hi256 | \ -+ XFEATURE_MASK_Hi16_ZMM | \ -+ XFEATURE_MASK_PKRU | \ -+ XFEATURE_MASK_BNDREGS | \ -+ XFEATURE_MASK_BNDCSR) -+ - /* - * setup the xstate image representing the init state - */ -@@ -405,6 +423,8 @@ static void __init setup_init_fpu_buf(void) - { - static int on_boot_cpu __initdata = 1; - -+ BUILD_BUG_ON(XCNTXT_MASK != XFEATURES_INIT_FPSTATE_HANDLED); -+ - WARN_ON_FPU(!on_boot_cpu); - on_boot_cpu = 0; - -@@ -423,10 +443,22 @@ static void __init setup_init_fpu_buf(void) - copy_kernel_to_xregs_booting(&init_fpstate.xsave); - - /* -- * Dump the init state again. This is to identify the init state -- * of any feature which is not represented by all zero's. -+ * All components are now in init state. Read the state back so -+ * that init_fpstate contains all non-zero init state. This only -+ * works with XSAVE, but not with XSAVEOPT and XSAVES because -+ * those use the init optimization which skips writing data for -+ * components in init state. -+ * -+ * XSAVE could be used, but that would require to reshuffle the -+ * data when XSAVES is available because XSAVES uses xstate -+ * compaction. But doing so is a pointless exercise because most -+ * components have an all zeros init state except for the legacy -+ * ones (FP and SSE). Those can be saved with FXSAVE into the -+ * legacy area. Adding new features requires to ensure that init -+ * state is all zeroes or if not to add the necessary handling -+ * here. - */ -- copy_xregs_to_kernel_booting(&init_fpstate.xsave); -+ fxsave(&init_fpstate.fxsave); - } - - static int xfeature_uncompacted_offset(int xfeature_nr) -diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c -index e4782f562e7a9..2de7fd18f66a1 100644 ---- a/drivers/cpufreq/armada-37xx-cpufreq.c -+++ b/drivers/cpufreq/armada-37xx-cpufreq.c -@@ -102,7 +102,11 @@ struct armada_37xx_dvfs { - }; - - static struct armada_37xx_dvfs armada_37xx_dvfs[] = { -- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, -+ /* -+ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently -+ * unstable because we do not know how to configure it properly. -+ */ -+ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */ - {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} }, - {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} }, - {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} }, -diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c -index 4bbf4172b9bf9..e3f1d4ab8e4f3 100644 ---- a/drivers/dma/of-dma.c -+++ b/drivers/dma/of-dma.c -@@ -65,8 +65,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, - return NULL; - - ofdma_target = of_dma_find_controller(&dma_spec_target); -- if (!ofdma_target) -- return NULL; -+ if (!ofdma_target) { -+ ofdma->dma_router->route_free(ofdma->dma_router->dev, -+ route_data); -+ chan = ERR_PTR(-EPROBE_DEFER); -+ goto err; -+ } - - chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); - if (IS_ERR_OR_NULL(chan)) { -@@ -77,6 +81,7 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, - chan->route_data = route_data; - } - -+err: - /* - * Need to put the node back since the ofdma->of_dma_route_allocate - * has taken it for generating the new, translated dma_spec -diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c -index 8f7ceb698226c..1cc06900153e4 100644 ---- a/drivers/dma/sh/usb-dmac.c -+++ b/drivers/dma/sh/usb-dmac.c -@@ -855,8 +855,8 @@ static int usb_dmac_probe(struct platform_device *pdev) - - error: - of_dma_controller_free(pdev->dev.of_node); -- pm_runtime_put(&pdev->dev); - error_pm: -+ pm_runtime_put(&pdev->dev); - pm_runtime_disable(&pdev->dev); - return ret; - } -diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c -index 1b5f3e9f43d70..ce18bca45ff27 100644 ---- a/drivers/dma/xilinx/xilinx_dma.c -+++ b/drivers/dma/xilinx/xilinx_dma.c -@@ -333,6 +333,7 @@ struct xilinx_dma_tx_descriptor { - * @genlock: Support genlock mode - * @err: Channel has errors - * @idle: Check for channel idle -+ * @terminating: Check for channel being synchronized by user - * @tasklet: Cleanup work after irq - * @config: Device configuration info - * @flush_on_fsync: Flush on Frame sync -@@ -370,6 +371,7 @@ struct xilinx_dma_chan { - bool genlock; - bool err; - bool idle; -+ bool terminating; - struct tasklet_struct tasklet; - struct xilinx_vdma_config config; - bool flush_on_fsync; -@@ -844,6 +846,13 @@ static void xilinx_dma_chan_desc_cleanup(struct xilinx_dma_chan *chan) - /* Run any dependencies, then free the descriptor */ - dma_run_dependencies(&desc->async_tx); - xilinx_dma_free_tx_descriptor(chan, desc); -+ -+ /* -+ * While we ran a callback the user called a terminate function, -+ * which takes care of cleaning up any remaining descriptors -+ */ -+ if (chan->terminating) -+ break; - } - - spin_unlock_irqrestore(&chan->lock, flags); -@@ -1618,6 +1627,8 @@ static dma_cookie_t xilinx_dma_tx_submit(struct dma_async_tx_descriptor *tx) - if (desc->cyclic) - chan->cyclic = true; - -+ chan->terminating = false; -+ - spin_unlock_irqrestore(&chan->lock, flags); - - return cookie; -@@ -2074,6 +2085,7 @@ static int xilinx_dma_terminate_all(struct dma_chan *dchan) - } - - /* Remove and free all of the descriptors in the lists */ -+ chan->terminating = true; - xilinx_dma_free_descriptors(chan); - chan->idle = true; - -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c -index 8d5cfd5357c75..03e2073339539 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c -@@ -362,7 +362,7 @@ void optc2_lock_doublebuffer_enable(struct timing_generator *optc) - - REG_UPDATE_2(OTG_GLOBAL_CONTROL1, - MASTER_UPDATE_LOCK_DB_X, -- h_blank_start - 200 - 1, -+ (h_blank_start - 200 - 1) / optc1->opp_count, - MASTER_UPDATE_LOCK_DB_Y, - v_blank_start - 1); - } -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 9d7232e26ecf0..c5758fb696cc8 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -775,6 +775,9 @@ void iommu_group_remove_device(struct device *dev) - struct iommu_group *group = dev->iommu_group; - struct group_device *tmp_device, *device = NULL; - -+ if (!group) -+ return; -+ - dev_info(dev, "Removing from iommu group %d\n", group->id); - - /* Pre-notify listeners that a device is being removed. */ -diff --git a/drivers/ipack/carriers/tpci200.c b/drivers/ipack/carriers/tpci200.c -index b05d6125c787a..46665b1cef85a 100644 ---- a/drivers/ipack/carriers/tpci200.c -+++ b/drivers/ipack/carriers/tpci200.c -@@ -91,16 +91,13 @@ static void tpci200_unregister(struct tpci200_board *tpci200) - free_irq(tpci200->info->pdev->irq, (void *) tpci200); - - pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs); -- pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); - - pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR); - pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR); - pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR); - pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR); -- pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); - - pci_disable_device(tpci200->info->pdev); -- pci_dev_put(tpci200->info->pdev); - } - - static void tpci200_enable_irq(struct tpci200_board *tpci200, -@@ -259,7 +256,7 @@ static int tpci200_register(struct tpci200_board *tpci200) - "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 2 !", - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); -- goto out_disable_pci; -+ goto err_disable_device; - } - - /* Request IO ID INT space (Bar 3) */ -@@ -271,7 +268,7 @@ static int tpci200_register(struct tpci200_board *tpci200) - "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 3 !", - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); -- goto out_release_ip_space; -+ goto err_ip_interface_bar; - } - - /* Request MEM8 space (Bar 5) */ -@@ -282,7 +279,7 @@ static int tpci200_register(struct tpci200_board *tpci200) - "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 5!", - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); -- goto out_release_ioid_int_space; -+ goto err_io_id_int_spaces_bar; - } - - /* Request MEM16 space (Bar 4) */ -@@ -293,7 +290,7 @@ static int tpci200_register(struct tpci200_board *tpci200) - "(bn 0x%X, sn 0x%X) failed to allocate PCI resource for BAR 4!", - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); -- goto out_release_mem8_space; -+ goto err_mem8_space_bar; - } - - /* Map internal tpci200 driver user space */ -@@ -307,7 +304,7 @@ static int tpci200_register(struct tpci200_board *tpci200) - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); - res = -ENOMEM; -- goto out_release_mem8_space; -+ goto err_mem16_space_bar; - } - - /* Initialize lock that protects interface_regs */ -@@ -346,18 +343,22 @@ static int tpci200_register(struct tpci200_board *tpci200) - "(bn 0x%X, sn 0x%X) unable to register IRQ !", - tpci200->info->pdev->bus->number, - tpci200->info->pdev->devfn); -- goto out_release_ioid_int_space; -+ goto err_interface_regs; - } - - return 0; - --out_release_mem8_space: -+err_interface_regs: -+ pci_iounmap(tpci200->info->pdev, tpci200->info->interface_regs); -+err_mem16_space_bar: -+ pci_release_region(tpci200->info->pdev, TPCI200_MEM16_SPACE_BAR); -+err_mem8_space_bar: - pci_release_region(tpci200->info->pdev, TPCI200_MEM8_SPACE_BAR); --out_release_ioid_int_space: -+err_io_id_int_spaces_bar: - pci_release_region(tpci200->info->pdev, TPCI200_IO_ID_INT_SPACES_BAR); --out_release_ip_space: -+err_ip_interface_bar: - pci_release_region(tpci200->info->pdev, TPCI200_IP_INTERFACE_BAR); --out_disable_pci: -+err_disable_device: - pci_disable_device(tpci200->info->pdev); - return res; - } -@@ -529,7 +530,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - tpci200->info = kzalloc(sizeof(struct tpci200_infos), GFP_KERNEL); - if (!tpci200->info) { - ret = -ENOMEM; -- goto out_err_info; -+ goto err_tpci200; - } - - pci_dev_get(pdev); -@@ -540,7 +541,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - if (ret) { - dev_err(&pdev->dev, "Failed to allocate PCI Configuration Memory"); - ret = -EBUSY; -- goto out_err_pci_request; -+ goto err_tpci200_info; - } - tpci200->info->cfg_regs = ioremap_nocache( - pci_resource_start(pdev, TPCI200_CFG_MEM_BAR), -@@ -548,7 +549,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - if (!tpci200->info->cfg_regs) { - dev_err(&pdev->dev, "Failed to map PCI Configuration Memory"); - ret = -EFAULT; -- goto out_err_ioremap; -+ goto err_request_region; - } - - /* Disable byte swapping for 16 bit IP module access. This will ensure -@@ -571,7 +572,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - if (ret) { - dev_err(&pdev->dev, "error during tpci200 install\n"); - ret = -ENODEV; -- goto out_err_install; -+ goto err_cfg_regs; - } - - /* Register the carrier in the industry pack bus driver */ -@@ -583,7 +584,7 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - dev_err(&pdev->dev, - "error registering the carrier on ipack driver\n"); - ret = -EFAULT; -- goto out_err_bus_register; -+ goto err_tpci200_install; - } - - /* save the bus number given by ipack to logging purpose */ -@@ -594,19 +595,16 @@ static int tpci200_pci_probe(struct pci_dev *pdev, - tpci200_create_device(tpci200, i); - return 0; - --out_err_bus_register: -+err_tpci200_install: - tpci200_uninstall(tpci200); -- /* tpci200->info->cfg_regs is unmapped in tpci200_uninstall */ -- tpci200->info->cfg_regs = NULL; --out_err_install: -- if (tpci200->info->cfg_regs) -- iounmap(tpci200->info->cfg_regs); --out_err_ioremap: -+err_cfg_regs: -+ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); -+err_request_region: - pci_release_region(pdev, TPCI200_CFG_MEM_BAR); --out_err_pci_request: -- pci_dev_put(pdev); -+err_tpci200_info: - kfree(tpci200->info); --out_err_info: -+ pci_dev_put(pdev); -+err_tpci200: - kfree(tpci200); - return ret; - } -@@ -616,6 +614,12 @@ static void __tpci200_pci_remove(struct tpci200_board *tpci200) - ipack_bus_unregister(tpci200->info->ipack_bus); - tpci200_uninstall(tpci200); - -+ pci_iounmap(tpci200->info->pdev, tpci200->info->cfg_regs); -+ -+ pci_release_region(tpci200->info->pdev, TPCI200_CFG_MEM_BAR); -+ -+ pci_dev_put(tpci200->info->pdev); -+ - kfree(tpci200->info); - kfree(tpci200); - } -diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c -index 02458c9cb5dc0..25f16ff6dcc75 100644 ---- a/drivers/media/usb/zr364xx/zr364xx.c -+++ b/drivers/media/usb/zr364xx/zr364xx.c -@@ -1187,15 +1187,11 @@ out: - return err; - } - --static void zr364xx_release(struct v4l2_device *v4l2_dev) -+static void zr364xx_board_uninit(struct zr364xx_camera *cam) - { -- struct zr364xx_camera *cam = -- container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); - unsigned long i; - -- v4l2_device_unregister(&cam->v4l2_dev); -- -- videobuf_mmap_free(&cam->vb_vidq); -+ zr364xx_stop_readpipe(cam); - - /* release sys buffers */ - for (i = 0; i < FRAMES; i++) { -@@ -1206,9 +1202,19 @@ static void zr364xx_release(struct v4l2_device *v4l2_dev) - cam->buffer.frame[i].lpvbits = NULL; - } - -- v4l2_ctrl_handler_free(&cam->ctrl_handler); - /* release transfer buffer */ - kfree(cam->pipe->transfer_buffer); -+} -+ -+static void zr364xx_release(struct v4l2_device *v4l2_dev) -+{ -+ struct zr364xx_camera *cam = -+ container_of(v4l2_dev, struct zr364xx_camera, v4l2_dev); -+ -+ videobuf_mmap_free(&cam->vb_vidq); -+ v4l2_ctrl_handler_free(&cam->ctrl_handler); -+ zr364xx_board_uninit(cam); -+ v4l2_device_unregister(&cam->v4l2_dev); - kfree(cam); - } - -@@ -1331,6 +1337,7 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) - { - struct zr364xx_pipeinfo *pipe = cam->pipe; - unsigned long i; -+ int err; - - DBG("board init: %p\n", cam); - memset(pipe, 0, sizeof(*pipe)); -@@ -1363,9 +1370,8 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) - - if (i == 0) { - printk(KERN_INFO KBUILD_MODNAME ": out of memory. Aborting\n"); -- kfree(cam->pipe->transfer_buffer); -- cam->pipe->transfer_buffer = NULL; -- return -ENOMEM; -+ err = -ENOMEM; -+ goto err_free; - } else - cam->buffer.dwFrames = i; - -@@ -1380,9 +1386,20 @@ static int zr364xx_board_init(struct zr364xx_camera *cam) - /*** end create system buffers ***/ - - /* start read pipe */ -- zr364xx_start_readpipe(cam); -+ err = zr364xx_start_readpipe(cam); -+ if (err) -+ goto err_free_frames; -+ - DBG(": board initialized\n"); - return 0; -+ -+err_free_frames: -+ for (i = 0; i < FRAMES; i++) -+ vfree(cam->buffer.frame[i].lpvbits); -+err_free: -+ kfree(cam->pipe->transfer_buffer); -+ cam->pipe->transfer_buffer = NULL; -+ return err; - } - - static int zr364xx_probe(struct usb_interface *intf, -@@ -1407,12 +1424,10 @@ static int zr364xx_probe(struct usb_interface *intf, - if (!cam) - return -ENOMEM; - -- cam->v4l2_dev.release = zr364xx_release; - err = v4l2_device_register(&intf->dev, &cam->v4l2_dev); - if (err < 0) { - dev_err(&udev->dev, "couldn't register v4l2_device\n"); -- kfree(cam); -- return err; -+ goto free_cam; - } - hdl = &cam->ctrl_handler; - v4l2_ctrl_handler_init(hdl, 1); -@@ -1421,7 +1436,7 @@ static int zr364xx_probe(struct usb_interface *intf, - if (hdl->error) { - err = hdl->error; - dev_err(&udev->dev, "couldn't register control\n"); -- goto fail; -+ goto free_hdlr_and_unreg_dev; - } - /* save the init method used by this camera */ - cam->method = id->driver_info; -@@ -1494,7 +1509,7 @@ static int zr364xx_probe(struct usb_interface *intf, - if (!cam->read_endpoint) { - err = -ENOMEM; - dev_err(&intf->dev, "Could not find bulk-in endpoint\n"); -- goto fail; -+ goto free_hdlr_and_unreg_dev; - } - - /* v4l */ -@@ -1505,10 +1520,11 @@ static int zr364xx_probe(struct usb_interface *intf, - - /* load zr364xx board specific */ - err = zr364xx_board_init(cam); -- if (!err) -- err = v4l2_ctrl_handler_setup(hdl); - if (err) -- goto fail; -+ goto free_hdlr_and_unreg_dev; -+ err = v4l2_ctrl_handler_setup(hdl); -+ if (err) -+ goto board_uninit; - - spin_lock_init(&cam->slock); - -@@ -1523,16 +1539,20 @@ static int zr364xx_probe(struct usb_interface *intf, - err = video_register_device(&cam->vdev, VFL_TYPE_GRABBER, -1); - if (err) { - dev_err(&udev->dev, "video_register_device failed\n"); -- goto fail; -+ goto board_uninit; - } -+ cam->v4l2_dev.release = zr364xx_release; - - dev_info(&udev->dev, DRIVER_DESC " controlling device %s\n", - video_device_node_name(&cam->vdev)); - return 0; - --fail: -+board_uninit: -+ zr364xx_board_uninit(cam); -+free_hdlr_and_unreg_dev: - v4l2_ctrl_handler_free(hdl); - v4l2_device_unregister(&cam->v4l2_dev); -+free_cam: - kfree(cam); - return err; - } -@@ -1579,10 +1599,19 @@ static int zr364xx_resume(struct usb_interface *intf) - if (!cam->was_streaming) - return 0; - -- zr364xx_start_readpipe(cam); -+ res = zr364xx_start_readpipe(cam); -+ if (res) -+ return res; -+ - res = zr364xx_prepare(cam); -- if (!res) -- zr364xx_start_acquire(cam); -+ if (res) -+ goto err_prepare; -+ -+ zr364xx_start_acquire(cam); -+ return 0; -+ -+err_prepare: -+ zr364xx_stop_readpipe(cam); - return res; - } - #endif -diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c -index 79c55c7b4afd9..6ace82028667b 100644 ---- a/drivers/mmc/host/dw_mmc.c -+++ b/drivers/mmc/host/dw_mmc.c -@@ -2017,8 +2017,8 @@ static void dw_mci_tasklet_func(unsigned long priv) - continue; - } - -- dw_mci_stop_dma(host); - send_stop_abort(host, data); -+ dw_mci_stop_dma(host); - state = STATE_SENDING_STOP; - break; - } -@@ -2042,10 +2042,10 @@ static void dw_mci_tasklet_func(unsigned long priv) - */ - if (test_and_clear_bit(EVENT_DATA_ERROR, - &host->pending_events)) { -- dw_mci_stop_dma(host); - if (!(host->data_status & (SDMMC_INT_DRTO | - SDMMC_INT_EBE))) - send_stop_abort(host, data); -+ dw_mci_stop_dma(host); - state = STATE_DATA_ERROR; - break; - } -@@ -2078,10 +2078,10 @@ static void dw_mci_tasklet_func(unsigned long priv) - */ - if (test_and_clear_bit(EVENT_DATA_ERROR, - &host->pending_events)) { -- dw_mci_stop_dma(host); - if (!(host->data_status & (SDMMC_INT_DRTO | - SDMMC_INT_EBE))) - send_stop_abort(host, data); -+ dw_mci_stop_dma(host); - state = STATE_DATA_ERROR; - break; - } -diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c -index c8b9ab40a1027..9c98ddef0097d 100644 ---- a/drivers/mtd/chips/cfi_cmdset_0002.c -+++ b/drivers/mtd/chips/cfi_cmdset_0002.c -@@ -119,7 +119,7 @@ static int cfi_use_status_reg(struct cfi_private *cfi) - struct cfi_pri_amdstd *extp = cfi->cmdset_priv; - u8 poll_mask = CFI_POLL_STATUS_REG | CFI_POLL_DQ; - -- return extp->MinorVersion >= '5' && -+ return extp && extp->MinorVersion >= '5' && - (extp->SoftwareFeatures & poll_mask) == CFI_POLL_STATUS_REG; - } - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 287ea792922a9..e67f07faca789 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -360,6 +360,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) - return md_dst->u.port_info.port_id; - } - -+static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, -+ struct bnxt_tx_ring_info *txr, -+ struct netdev_queue *txq) -+{ -+ netif_tx_stop_queue(txq); -+ -+ /* netif_tx_stop_queue() must be done before checking -+ * tx index in bnxt_tx_avail() below, because in -+ * bnxt_tx_int(), we update tx index before checking for -+ * netif_tx_queue_stopped(). -+ */ -+ smp_mb(); -+ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { -+ netif_tx_wake_queue(txq); -+ return false; -+ } -+ -+ return true; -+} -+ - static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) - { - struct bnxt *bp = netdev_priv(dev); -@@ -387,8 +407,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) - - free_size = bnxt_tx_avail(bp, txr); - if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { -- netif_tx_stop_queue(txq); -- return NETDEV_TX_BUSY; -+ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) -+ return NETDEV_TX_BUSY; - } - - length = skb->len; -@@ -597,16 +617,7 @@ tx_done: - if (netdev_xmit_more() && !tx_buf->is_push) - bnxt_db_write(bp, &txr->tx_db, prod); - -- netif_tx_stop_queue(txq); -- -- /* netif_tx_stop_queue() must be done before checking -- * tx index in bnxt_tx_avail() below, because in -- * bnxt_tx_int(), we update tx index before checking for -- * netif_tx_queue_stopped(). -- */ -- smp_mb(); -- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) -- netif_tx_wake_queue(txq); -+ bnxt_txr_netif_try_stop_queue(bp, txr, txq); - } - return NETDEV_TX_OK; - -@@ -690,14 +701,9 @@ next_tx_int: - smp_mb(); - - if (unlikely(netif_tx_queue_stopped(txq)) && -- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) { -- __netif_tx_lock(txq, smp_processor_id()); -- if (netif_tx_queue_stopped(txq) && -- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && -- txr->dev_state != BNXT_DEV_STATE_CLOSING) -- netif_tx_wake_queue(txq); -- __netif_tx_unlock(txq); -- } -+ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && -+ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) -+ netif_tx_wake_queue(txq); - } - - static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, -@@ -1718,6 +1724,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, - if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) - return -EBUSY; - -+ /* The valid test of the entry must be done first before -+ * reading any further. -+ */ -+ dma_rmb(); - prod = rxr->rx_prod; - - if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) { -@@ -1912,6 +1922,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp, - if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) - return -EBUSY; - -+ /* The valid test of the entry must be done first before -+ * reading any further. -+ */ -+ dma_rmb(); - cmp_type = RX_CMP_TYPE(rxcmp); - if (cmp_type == CMP_TYPE_RX_L2_CMP) { - rxcmp1->rx_cmp_cfa_code_errors_v2 |= -@@ -2308,6 +2322,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) - if (!TX_CMP_VALID(txcmp, raw_cons)) - break; - -+ /* The valid test of the entry must be done first before -+ * reading any further. -+ */ -+ dma_rmb(); - if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { - tmp_raw_cons = NEXT_RAW_CMP(raw_cons); - cp_cons = RING_CMP(tmp_raw_cons); -@@ -8340,10 +8358,9 @@ static void bnxt_disable_napi(struct bnxt *bp) - for (i = 0; i < bp->cp_nr_rings; i++) { - struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; - -+ napi_disable(&bp->bnapi[i]->napi); - if (bp->bnapi[i]->rx_ring) - cancel_work_sync(&cpr->dim.work); -- -- napi_disable(&bp->bnapi[i]->napi); - } - } - -@@ -8371,9 +8388,11 @@ void bnxt_tx_disable(struct bnxt *bp) - if (bp->tx_ring) { - for (i = 0; i < bp->tx_nr_rings; i++) { - txr = &bp->tx_ring[i]; -- txr->dev_state = BNXT_DEV_STATE_CLOSING; -+ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING); - } - } -+ /* Make sure napi polls see @dev_state change */ -+ synchronize_net(); - /* Drop carrier first to prevent TX timeout */ - netif_carrier_off(bp->dev); - /* Stop all TX queues */ -@@ -8387,8 +8406,10 @@ void bnxt_tx_enable(struct bnxt *bp) - - for (i = 0; i < bp->tx_nr_rings; i++) { - txr = &bp->tx_ring[i]; -- txr->dev_state = 0; -+ WRITE_ONCE(txr->dev_state, 0); - } -+ /* Make sure napi polls see @dev_state change */ -+ synchronize_net(); - netif_tx_wake_all_queues(bp->dev); - if (bp->link_info.link_up) - netif_carrier_on(bp->dev); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index 8e38c547b53f9..06987913837aa 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -3553,8 +3553,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev, - - /* is DCB enabled at all? */ - if (vsi->tc_config.numtc == 1) -- return i40e_swdcb_skb_tx_hash(netdev, skb, -- netdev->real_num_tx_queues); -+ return netdev_pick_tx(netdev, skb, sb_dev); - - prio = skb->priority; - hw = &vsi->back->hw; -diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h -index 6b9117a350fac..81ca6472937d2 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf.h -+++ b/drivers/net/ethernet/intel/iavf/iavf.h -@@ -134,6 +134,7 @@ struct iavf_q_vector { - struct iavf_mac_filter { - struct list_head list; - u8 macaddr[ETH_ALEN]; -+ bool is_new_mac; /* filter is new, wait for PF decision */ - bool remove; /* filter needs to be removed */ - bool add; /* filter needs to be added */ - }; -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index dc902e371c2cf..94a3f000e999b 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -761,6 +761,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, - - list_add_tail(&f->list, &adapter->mac_filter_list); - f->add = true; -+ f->is_new_mac = true; - adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; - } else { - f->remove = false; -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index 9655318803b71..4d471a6f2946f 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -564,6 +564,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter) - kfree(veal); - } - -+/** -+ * iavf_mac_add_ok -+ * @adapter: adapter structure -+ * -+ * Submit list of filters based on PF response. -+ **/ -+static void iavf_mac_add_ok(struct iavf_adapter *adapter) -+{ -+ struct iavf_mac_filter *f, *ftmp; -+ -+ spin_lock_bh(&adapter->mac_vlan_list_lock); -+ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { -+ f->is_new_mac = false; -+ } -+ spin_unlock_bh(&adapter->mac_vlan_list_lock); -+} -+ -+/** -+ * iavf_mac_add_reject -+ * @adapter: adapter structure -+ * -+ * Remove filters from list based on PF response. -+ **/ -+static void iavf_mac_add_reject(struct iavf_adapter *adapter) -+{ -+ struct net_device *netdev = adapter->netdev; -+ struct iavf_mac_filter *f, *ftmp; -+ -+ spin_lock_bh(&adapter->mac_vlan_list_lock); -+ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { -+ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr)) -+ f->remove = false; -+ -+ if (f->is_new_mac) { -+ list_del(&f->list); -+ kfree(f); -+ } -+ } -+ spin_unlock_bh(&adapter->mac_vlan_list_lock); -+} -+ - /** - * iavf_add_vlans - * @adapter: adapter structure -@@ -1316,6 +1357,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - case VIRTCHNL_OP_ADD_ETH_ADDR: - dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n", - iavf_stat_str(&adapter->hw, v_retval)); -+ iavf_mac_add_reject(adapter); - /* restore administratively set MAC address */ - ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); - break; -@@ -1385,10 +1427,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - } - } - switch (v_opcode) { -- case VIRTCHNL_OP_ADD_ETH_ADDR: { -+ case VIRTCHNL_OP_ADD_ETH_ADDR: -+ if (!v_retval) -+ iavf_mac_add_ok(adapter); - if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) - ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); -- } - break; - case VIRTCHNL_OP_GET_STATS: { - struct iavf_eth_stats *stats = -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -index 29b9c728a65e2..f2014c10f7c97 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -@@ -3158,8 +3158,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, - - indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); - ret = QLCRD32(adapter, indirect_addr, &err); -- if (err == -EIO) -+ if (err == -EIO) { -+ qlcnic_83xx_unlock_flash(adapter); - return err; -+ } - - word = ret; - *(u32 *)p_data = word; -diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c -index 71d6629e65c97..da13683d52d1a 100644 ---- a/drivers/net/hamradio/6pack.c -+++ b/drivers/net/hamradio/6pack.c -@@ -839,6 +839,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) - return; - } - -+ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { -+ pr_err("6pack: cooked buffer overrun, data loss\n"); -+ sp->rx_count = 0; -+ return; -+ } -+ - buf = sp->raw_buf; - sp->cooked_buf[sp->rx_count_cooked++] = - buf[0] | ((buf[1] << 2) & 0xc0); -diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c -index 6a1d3540210bd..ccb3ee704eb1c 100644 ---- a/drivers/net/phy/mdio-mux.c -+++ b/drivers/net/phy/mdio-mux.c -@@ -82,6 +82,17 @@ out: - - static int parent_count; - -+static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb) -+{ -+ struct mdio_mux_child_bus *cb = pb->children; -+ -+ while (cb) { -+ mdiobus_unregister(cb->mii_bus); -+ mdiobus_free(cb->mii_bus); -+ cb = cb->next; -+ } -+} -+ - int mdio_mux_init(struct device *dev, - struct device_node *mux_node, - int (*switch_fn)(int cur, int desired, void *data), -@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev, - cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL); - if (!cb) { - ret_val = -ENOMEM; -- continue; -+ goto err_loop; - } - cb->bus_number = v; - cb->parent = pb; -@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev, - cb->mii_bus = mdiobus_alloc(); - if (!cb->mii_bus) { - ret_val = -ENOMEM; -- devm_kfree(dev, cb); -- continue; -+ goto err_loop; - } - cb->mii_bus->priv = cb; - -@@ -165,11 +175,15 @@ int mdio_mux_init(struct device *dev, - cb->mii_bus->write = mdio_mux_write; - r = of_mdiobus_register(cb->mii_bus, child_bus_node); - if (r) { -+ mdiobus_free(cb->mii_bus); -+ if (r == -EPROBE_DEFER) { -+ ret_val = r; -+ goto err_loop; -+ } -+ devm_kfree(dev, cb); - dev_err(dev, - "Error: Failed to register MDIO bus for child %pOF\n", - child_bus_node); -- mdiobus_free(cb->mii_bus); -- devm_kfree(dev, cb); - } else { - cb->next = pb->children; - pb->children = cb; -@@ -182,6 +196,10 @@ int mdio_mux_init(struct device *dev, - - dev_err(dev, "Error: No acceptable child buses found\n"); - devm_kfree(dev, pb); -+ -+err_loop: -+ mdio_mux_uninit_children(pb); -+ of_node_put(child_bus_node); - err_pb_kz: - put_device(&parent_bus->dev); - err_parent_bus: -@@ -193,14 +211,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init); - void mdio_mux_uninit(void *mux_handle) - { - struct mdio_mux_parent_bus *pb = mux_handle; -- struct mdio_mux_child_bus *cb = pb->children; -- -- while (cb) { -- mdiobus_unregister(cb->mii_bus); -- mdiobus_free(cb->mii_bus); -- cb = cb->next; -- } - -+ mdio_mux_uninit_children(pb); - put_device(&pb->mii_bus->dev); - } - EXPORT_SYMBOL_GPL(mdio_mux_uninit); -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 71cc5b63d8ced..92d9d3407b79b 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -1159,7 +1159,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) - { - struct phy_device *phydev = dev->net->phydev; - struct ethtool_link_ksettings ecmd; -- int ladv, radv, ret; -+ int ladv, radv, ret, link; - u32 buf; - - /* clear LAN78xx interrupt status */ -@@ -1167,9 +1167,12 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) - if (unlikely(ret < 0)) - return -EIO; - -+ mutex_lock(&phydev->lock); - phy_read_status(phydev); -+ link = phydev->link; -+ mutex_unlock(&phydev->lock); - -- if (!phydev->link && dev->link_on) { -+ if (!link && dev->link_on) { - dev->link_on = false; - - /* reset MAC */ -@@ -1182,7 +1185,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) - return -EIO; - - del_timer(&dev->stat_monitor); -- } else if (phydev->link && !dev->link_on) { -+ } else if (link && !dev->link_on) { - dev->link_on = true; - - phy_ethtool_ksettings_get(phydev, &ecmd); -@@ -1471,9 +1474,14 @@ static int lan78xx_set_eee(struct net_device *net, struct ethtool_eee *edata) - - static u32 lan78xx_get_link(struct net_device *net) - { -+ u32 link; -+ -+ mutex_lock(&net->phydev->lock); - phy_read_status(net->phydev); -+ link = net->phydev->link; -+ mutex_unlock(&net->phydev->lock); - -- return net->phydev->link; -+ return link; - } - - static void lan78xx_get_drvinfo(struct net_device *net, -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 15453d6fcc232..37c2cecd1e503 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = { - VIRTIO_NET_F_GUEST_CSUM - }; - --#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ -+#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ - (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \ - (1ULL << VIRTIO_NET_F_GUEST_ECN) | \ - (1ULL << VIRTIO_NET_F_GUEST_UFO)) -@@ -195,6 +195,9 @@ struct virtnet_info { - /* # of XDP queue pairs currently used by the driver */ - u16 xdp_queue_pairs; - -+ /* xdp_queue_pairs may be 0, when xdp is already loaded. So add this. */ -+ bool xdp_enabled; -+ - /* I like... big packets and I cannot lie! */ - bool big_packets; - -@@ -485,12 +488,41 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi, - return 0; - } - --static struct send_queue *virtnet_xdp_sq(struct virtnet_info *vi) --{ -- unsigned int qp; -- -- qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id(); -- return &vi->sq[qp]; -+/* when vi->curr_queue_pairs > nr_cpu_ids, the txq/sq is only used for xdp tx on -+ * the current cpu, so it does not need to be locked. -+ * -+ * Here we use marco instead of inline functions because we have to deal with -+ * three issues at the same time: 1. the choice of sq. 2. judge and execute the -+ * lock/unlock of txq 3. make sparse happy. It is difficult for two inline -+ * functions to perfectly solve these three problems at the same time. -+ */ -+#define virtnet_xdp_get_sq(vi) ({ \ -+ struct netdev_queue *txq; \ -+ typeof(vi) v = (vi); \ -+ unsigned int qp; \ -+ \ -+ if (v->curr_queue_pairs > nr_cpu_ids) { \ -+ qp = v->curr_queue_pairs - v->xdp_queue_pairs; \ -+ qp += smp_processor_id(); \ -+ txq = netdev_get_tx_queue(v->dev, qp); \ -+ __netif_tx_acquire(txq); \ -+ } else { \ -+ qp = smp_processor_id() % v->curr_queue_pairs; \ -+ txq = netdev_get_tx_queue(v->dev, qp); \ -+ __netif_tx_lock(txq, raw_smp_processor_id()); \ -+ } \ -+ v->sq + qp; \ -+}) -+ -+#define virtnet_xdp_put_sq(vi, q) { \ -+ struct netdev_queue *txq; \ -+ typeof(vi) v = (vi); \ -+ \ -+ txq = netdev_get_tx_queue(v->dev, (q) - v->sq); \ -+ if (v->curr_queue_pairs > nr_cpu_ids) \ -+ __netif_tx_release(txq); \ -+ else \ -+ __netif_tx_unlock(txq); \ - } - - static int virtnet_xdp_xmit(struct net_device *dev, -@@ -516,7 +548,7 @@ static int virtnet_xdp_xmit(struct net_device *dev, - if (!xdp_prog) - return -ENXIO; - -- sq = virtnet_xdp_sq(vi); -+ sq = virtnet_xdp_get_sq(vi); - - if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) { - ret = -EINVAL; -@@ -564,12 +596,13 @@ out: - sq->stats.kicks += kicks; - u64_stats_update_end(&sq->stats.syncp); - -+ virtnet_xdp_put_sq(vi, sq); - return ret; - } - - static unsigned int virtnet_get_headroom(struct virtnet_info *vi) - { -- return vi->xdp_queue_pairs ? VIRTIO_XDP_HEADROOM : 0; -+ return vi->xdp_enabled ? VIRTIO_XDP_HEADROOM : 0; - } - - /* We copy the packet for XDP in the following cases: -@@ -1458,12 +1491,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget) - xdp_do_flush_map(); - - if (xdp_xmit & VIRTIO_XDP_TX) { -- sq = virtnet_xdp_sq(vi); -+ sq = virtnet_xdp_get_sq(vi); - if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { - u64_stats_update_begin(&sq->stats.syncp); - sq->stats.kicks++; - u64_stats_update_end(&sq->stats.syncp); - } -+ virtnet_xdp_put_sq(vi, sq); - } - - return received; -@@ -2459,7 +2493,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, - virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) || - virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) || - virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) { -- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first"); -+ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first"); - return -EOPNOTSUPP; - } - -@@ -2480,10 +2514,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, - - /* XDP requires extra queues for XDP_TX */ - if (curr_qp + xdp_qp > vi->max_queue_pairs) { -- NL_SET_ERR_MSG_MOD(extack, "Too few free TX rings available"); -- netdev_warn(dev, "request %i queues but max is %i\n", -+ netdev_warn(dev, "XDP request %i queues but max is %i. XDP_TX and XDP_REDIRECT will operate in a slower locked tx mode.\n", - curr_qp + xdp_qp, vi->max_queue_pairs); -- return -ENOMEM; -+ xdp_qp = 0; - } - - old_prog = rtnl_dereference(vi->rq[0].xdp_prog); -@@ -2520,11 +2553,14 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, - vi->xdp_queue_pairs = xdp_qp; - - if (prog) { -+ vi->xdp_enabled = true; - for (i = 0; i < vi->max_queue_pairs; i++) { - rcu_assign_pointer(vi->rq[i].xdp_prog, prog); - if (i == 0 && !old_prog) - virtnet_clear_guest_offloads(vi); - } -+ } else { -+ vi->xdp_enabled = false; - } - - for (i = 0; i < vi->max_queue_pairs; i++) { -@@ -2608,15 +2644,15 @@ static int virtnet_set_features(struct net_device *dev, - u64 offloads; - int err; - -- if ((dev->features ^ features) & NETIF_F_LRO) { -- if (vi->xdp_queue_pairs) -+ if ((dev->features ^ features) & NETIF_F_GRO_HW) { -+ if (vi->xdp_enabled) - return -EBUSY; - -- if (features & NETIF_F_LRO) -+ if (features & NETIF_F_GRO_HW) - offloads = vi->guest_offloads_capable; - else - offloads = vi->guest_offloads_capable & -- ~GUEST_OFFLOAD_LRO_MASK; -+ ~GUEST_OFFLOAD_GRO_HW_MASK; - - err = virtnet_set_guest_offloads(vi, offloads); - if (err) -@@ -3092,9 +3128,9 @@ static int virtnet_probe(struct virtio_device *vdev) - dev->features |= NETIF_F_RXCSUM; - if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || - virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)) -- dev->features |= NETIF_F_LRO; -+ dev->features |= NETIF_F_GRO_HW; - if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) -- dev->hw_features |= NETIF_F_LRO; -+ dev->hw_features |= NETIF_F_GRO_HW; - - dev->vlan_features = dev->features; - -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index f08ed52d51f3f..9b626c169554f 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -1036,6 +1036,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, - bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); - bool is_ndisc = ipv6_ndisc_frame(skb); - -+ nf_reset_ct(skb); -+ - /* loopback, multicast & non-ND link-local traffic; do not push through - * packet taps again. Reset pkt_type for upper layers to process skb. - * For strict packets with a source LLA, determine the dst using the -@@ -1092,6 +1094,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev, - skb->skb_iif = vrf_dev->ifindex; - IPCB(skb)->flags |= IPSKB_L3SLAVE; - -+ nf_reset_ct(skb); -+ - if (ipv4_is_multicast(ip_hdr(skb)->daddr)) - goto out; - -diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h -index 7a364eca46d64..f083fb9038c36 100644 ---- a/drivers/net/wireless/ath/ath.h -+++ b/drivers/net/wireless/ath/ath.h -@@ -197,12 +197,13 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common, - bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr); - - void ath_hw_setbssidmask(struct ath_common *common); --void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key); -+void ath_key_delete(struct ath_common *common, u8 hw_key_idx); - int ath_key_config(struct ath_common *common, - struct ieee80211_vif *vif, - struct ieee80211_sta *sta, - struct ieee80211_key_conf *key); - bool ath_hw_keyreset(struct ath_common *common, u16 entry); -+bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac); - void ath_hw_cycle_counters_update(struct ath_common *common); - int32_t ath_hw_get_listen_time(struct ath_common *common); - -diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -index 5e866a193ed04..d065600791c11 100644 ---- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c -+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -@@ -521,7 +521,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - } - break; - case DISABLE_KEY: -- ath_key_delete(common, key); -+ ath_key_delete(common, key->hw_key_idx); - break; - default: - ret = -EINVAL; -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c -index a82ad739ab806..16a7bae62b7d3 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c -@@ -1460,7 +1460,7 @@ static int ath9k_htc_set_key(struct ieee80211_hw *hw, - } - break; - case DISABLE_KEY: -- ath_key_delete(common, key); -+ ath_key_delete(common, key->hw_key_idx); - break; - default: - ret = -EINVAL; -diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h -index 2e4489700a859..2842ca205a0a9 100644 ---- a/drivers/net/wireless/ath/ath9k/hw.h -+++ b/drivers/net/wireless/ath/ath9k/hw.h -@@ -819,6 +819,7 @@ struct ath_hw { - struct ath9k_pacal_info pacal_info; - struct ar5416Stats stats; - struct ath9k_tx_queue_info txq[ATH9K_NUM_TX_QUEUES]; -+ DECLARE_BITMAP(pending_del_keymap, ATH_KEYMAX); - - enum ath9k_int imask; - u32 imrs2_reg; -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index d14e01da3c312..28ccdcb197de2 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -823,12 +823,80 @@ exit: - ieee80211_free_txskb(hw, skb); - } - -+static bool ath9k_txq_list_has_key(struct list_head *txq_list, u32 keyix) -+{ -+ struct ath_buf *bf; -+ struct ieee80211_tx_info *txinfo; -+ struct ath_frame_info *fi; -+ -+ list_for_each_entry(bf, txq_list, list) { -+ if (bf->bf_state.stale || !bf->bf_mpdu) -+ continue; -+ -+ txinfo = IEEE80211_SKB_CB(bf->bf_mpdu); -+ fi = (struct ath_frame_info *)&txinfo->rate_driver_data[0]; -+ if (fi->keyix == keyix) -+ return true; -+ } -+ -+ return false; -+} -+ -+static bool ath9k_txq_has_key(struct ath_softc *sc, u32 keyix) -+{ -+ struct ath_hw *ah = sc->sc_ah; -+ int i; -+ struct ath_txq *txq; -+ bool key_in_use = false; -+ -+ for (i = 0; !key_in_use && i < ATH9K_NUM_TX_QUEUES; i++) { -+ if (!ATH_TXQ_SETUP(sc, i)) -+ continue; -+ txq = &sc->tx.txq[i]; -+ if (!txq->axq_depth) -+ continue; -+ if (!ath9k_hw_numtxpending(ah, txq->axq_qnum)) -+ continue; -+ -+ ath_txq_lock(sc, txq); -+ key_in_use = ath9k_txq_list_has_key(&txq->axq_q, keyix); -+ if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) { -+ int idx = txq->txq_tailidx; -+ -+ while (!key_in_use && -+ !list_empty(&txq->txq_fifo[idx])) { -+ key_in_use = ath9k_txq_list_has_key( -+ &txq->txq_fifo[idx], keyix); -+ INCR(idx, ATH_TXFIFO_DEPTH); -+ } -+ } -+ ath_txq_unlock(sc, txq); -+ } -+ -+ return key_in_use; -+} -+ -+static void ath9k_pending_key_del(struct ath_softc *sc, u8 keyix) -+{ -+ struct ath_hw *ah = sc->sc_ah; -+ struct ath_common *common = ath9k_hw_common(ah); -+ -+ if (!test_bit(keyix, ah->pending_del_keymap) || -+ ath9k_txq_has_key(sc, keyix)) -+ return; -+ -+ /* No more TXQ frames point to this key cache entry, so delete it. */ -+ clear_bit(keyix, ah->pending_del_keymap); -+ ath_key_delete(common, keyix); -+} -+ - static void ath9k_stop(struct ieee80211_hw *hw) - { - struct ath_softc *sc = hw->priv; - struct ath_hw *ah = sc->sc_ah; - struct ath_common *common = ath9k_hw_common(ah); - bool prev_idle; -+ int i; - - ath9k_deinit_channel_context(sc); - -@@ -896,6 +964,14 @@ static void ath9k_stop(struct ieee80211_hw *hw) - - spin_unlock_bh(&sc->sc_pcu_lock); - -+ for (i = 0; i < ATH_KEYMAX; i++) -+ ath9k_pending_key_del(sc, i); -+ -+ /* Clear key cache entries explicitly to get rid of any potentially -+ * remaining keys. -+ */ -+ ath9k_cmn_init_crypto(sc->sc_ah); -+ - ath9k_ps_restore(sc); - - sc->ps_idle = prev_idle; -@@ -1541,12 +1617,11 @@ static void ath9k_del_ps_key(struct ath_softc *sc, - { - struct ath_common *common = ath9k_hw_common(sc->sc_ah); - struct ath_node *an = (struct ath_node *) sta->drv_priv; -- struct ieee80211_key_conf ps_key = { .hw_key_idx = an->ps_key }; - - if (!an->ps_key) - return; - -- ath_key_delete(common, &ps_key); -+ ath_key_delete(common, an->ps_key); - an->ps_key = 0; - an->key_idx[0] = 0; - } -@@ -1708,6 +1783,12 @@ static int ath9k_set_key(struct ieee80211_hw *hw, - if (sta) - an = (struct ath_node *)sta->drv_priv; - -+ /* Delete pending key cache entries if no more frames are pointing to -+ * them in TXQs. -+ */ -+ for (i = 0; i < ATH_KEYMAX; i++) -+ ath9k_pending_key_del(sc, i); -+ - switch (cmd) { - case SET_KEY: - if (sta) -@@ -1737,7 +1818,15 @@ static int ath9k_set_key(struct ieee80211_hw *hw, - } - break; - case DISABLE_KEY: -- ath_key_delete(common, key); -+ if (ath9k_txq_has_key(sc, key->hw_key_idx)) { -+ /* Delay key cache entry deletion until there are no -+ * remaining TXQ frames pointing to this entry. -+ */ -+ set_bit(key->hw_key_idx, sc->sc_ah->pending_del_keymap); -+ ath_hw_keysetmac(common, key->hw_key_idx, NULL); -+ } else { -+ ath_key_delete(common, key->hw_key_idx); -+ } - if (an) { - for (i = 0; i < ARRAY_SIZE(an->key_idx); i++) { - if (an->key_idx[i] != key->hw_key_idx) -diff --git a/drivers/net/wireless/ath/key.c b/drivers/net/wireless/ath/key.c -index 1816b4e7dc264..61b59a804e308 100644 ---- a/drivers/net/wireless/ath/key.c -+++ b/drivers/net/wireless/ath/key.c -@@ -84,8 +84,7 @@ bool ath_hw_keyreset(struct ath_common *common, u16 entry) - } - EXPORT_SYMBOL(ath_hw_keyreset); - --static bool ath_hw_keysetmac(struct ath_common *common, -- u16 entry, const u8 *mac) -+bool ath_hw_keysetmac(struct ath_common *common, u16 entry, const u8 *mac) - { - u32 macHi, macLo; - u32 unicast_flag = AR_KEYTABLE_VALID; -@@ -125,6 +124,7 @@ static bool ath_hw_keysetmac(struct ath_common *common, - - return true; - } -+EXPORT_SYMBOL(ath_hw_keysetmac); - - static bool ath_hw_set_keycache_entry(struct ath_common *common, u16 entry, - const struct ath_keyval *k, -@@ -581,29 +581,38 @@ EXPORT_SYMBOL(ath_key_config); - /* - * Delete Key. - */ --void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key) -+void ath_key_delete(struct ath_common *common, u8 hw_key_idx) - { -- ath_hw_keyreset(common, key->hw_key_idx); -- if (key->hw_key_idx < IEEE80211_WEP_NKID) -+ /* Leave CCMP and TKIP (main key) configured to avoid disabling -+ * encryption for potentially pending frames already in a TXQ with the -+ * keyix pointing to this key entry. Instead, only clear the MAC address -+ * to prevent RX processing from using this key cache entry. -+ */ -+ if (test_bit(hw_key_idx, common->ccmp_keymap) || -+ test_bit(hw_key_idx, common->tkip_keymap)) -+ ath_hw_keysetmac(common, hw_key_idx, NULL); -+ else -+ ath_hw_keyreset(common, hw_key_idx); -+ if (hw_key_idx < IEEE80211_WEP_NKID) - return; - -- clear_bit(key->hw_key_idx, common->keymap); -- clear_bit(key->hw_key_idx, common->ccmp_keymap); -- if (key->cipher != WLAN_CIPHER_SUITE_TKIP) -+ clear_bit(hw_key_idx, common->keymap); -+ clear_bit(hw_key_idx, common->ccmp_keymap); -+ if (!test_bit(hw_key_idx, common->tkip_keymap)) - return; - -- clear_bit(key->hw_key_idx + 64, common->keymap); -+ clear_bit(hw_key_idx + 64, common->keymap); - -- clear_bit(key->hw_key_idx, common->tkip_keymap); -- clear_bit(key->hw_key_idx + 64, common->tkip_keymap); -+ clear_bit(hw_key_idx, common->tkip_keymap); -+ clear_bit(hw_key_idx + 64, common->tkip_keymap); - - if (!(common->crypt_caps & ATH_CRYPT_CAP_MIC_COMBINED)) { -- ath_hw_keyreset(common, key->hw_key_idx + 32); -- clear_bit(key->hw_key_idx + 32, common->keymap); -- clear_bit(key->hw_key_idx + 64 + 32, common->keymap); -+ ath_hw_keyreset(common, hw_key_idx + 32); -+ clear_bit(hw_key_idx + 32, common->keymap); -+ clear_bit(hw_key_idx + 64 + 32, common->keymap); - -- clear_bit(key->hw_key_idx + 32, common->tkip_keymap); -- clear_bit(key->hw_key_idx + 64 + 32, common->tkip_keymap); -+ clear_bit(hw_key_idx + 32, common->tkip_keymap); -+ clear_bit(hw_key_idx + 64 + 32, common->tkip_keymap); - } - } - EXPORT_SYMBOL(ath_key_delete); -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 6c1b936a94fac..0241f0dcc093f 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -1905,6 +1905,7 @@ static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev) - } - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot); - DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot); -+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1639, quirk_ryzen_xhci_d3hot); - - #ifdef CONFIG_X86_IO_APIC - static int dmi_disable_ioapicreroute(const struct dmi_system_id *d) -diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig -index 0517272a268ed..9fb6f7643ea96 100644 ---- a/drivers/ptp/Kconfig -+++ b/drivers/ptp/Kconfig -@@ -92,7 +92,8 @@ config DP83640_PHY - config PTP_1588_CLOCK_PCH - tristate "Intel PCH EG20T as PTP clock" - depends on X86_32 || COMPILE_TEST -- depends on HAS_IOMEM && NET -+ depends on HAS_IOMEM && PCI -+ depends on NET - imply PTP_1588_CLOCK - help - This driver adds support for using the PCH EG20T as a PTP -diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c -index 5efc959493ecd..85a71bafaea76 100644 ---- a/drivers/scsi/device_handler/scsi_dh_rdac.c -+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c -@@ -453,8 +453,8 @@ static int initialize_controller(struct scsi_device *sdev, - if (!h->ctlr) - err = SCSI_DH_RES_TEMP_UNAVAIL; - else { -- list_add_rcu(&h->node, &h->ctlr->dh_list); - h->sdev = sdev; -+ list_add_rcu(&h->node, &h->ctlr->dh_list); - } - spin_unlock(&list_lock); - err = SCSI_DH_OK; -@@ -778,11 +778,11 @@ static void rdac_bus_detach( struct scsi_device *sdev ) - spin_lock(&list_lock); - if (h->ctlr) { - list_del_rcu(&h->node); -- h->sdev = NULL; - kref_put(&h->ctlr->kref, release_controller); - } - spin_unlock(&list_lock); - sdev->handler_data = NULL; -+ synchronize_rcu(); - kfree(h); - } - -diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c -index 59cca898f0882..fcfbf3343b64e 100644 ---- a/drivers/scsi/megaraid/megaraid_mm.c -+++ b/drivers/scsi/megaraid/megaraid_mm.c -@@ -246,7 +246,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) - mimd_t mimd; - uint32_t adapno; - int iterator; -- -+ bool is_found; - - if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { - *rval = -EFAULT; -@@ -262,12 +262,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) - - adapter = NULL; - iterator = 0; -+ is_found = false; - - list_for_each_entry(adapter, &adapters_list_g, list) { -- if (iterator++ == adapno) break; -+ if (iterator++ == adapno) { -+ is_found = true; -+ break; -+ } - } - -- if (!adapter) { -+ if (!is_found) { - *rval = -ENODEV; - return NULL; - } -@@ -733,6 +737,7 @@ ioctl_done(uioc_t *kioc) - uint32_t adapno; - int iterator; - mraid_mmadp_t* adapter; -+ bool is_found; - - /* - * When the kioc returns from driver, make sure it still doesn't -@@ -755,19 +760,23 @@ ioctl_done(uioc_t *kioc) - iterator = 0; - adapter = NULL; - adapno = kioc->adapno; -+ is_found = false; - - con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " - "ioctl that was timedout before\n")); - - list_for_each_entry(adapter, &adapters_list_g, list) { -- if (iterator++ == adapno) break; -+ if (iterator++ == adapno) { -+ is_found = true; -+ break; -+ } - } - - kioc->timedout = 0; - -- if (adapter) { -+ if (is_found) - mraid_mm_dealloc_kioc( adapter, kioc ); -- } -+ - } - else { - wake_up(&wait_q); -diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c -index 79232cef1af16..3fd109fd9335d 100644 ---- a/drivers/scsi/scsi_scan.c -+++ b/drivers/scsi/scsi_scan.c -@@ -454,7 +454,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, - error = shost->hostt->target_alloc(starget); - - if(error) { -- dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error); -+ if (error != -ENXIO) -+ dev_err(dev, "target allocation failed, error %d\n", error); - /* don't want scsi_target_reap to do the final - * put because it will be under the host lock */ - scsi_target_destroy(starget); -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 6d7362e7367ed..11592ec7b23ea 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -787,11 +787,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, - mutex_lock(&sdev->state_mutex); - ret = scsi_device_set_state(sdev, state); - /* -- * If the device state changes to SDEV_RUNNING, we need to run -- * the queue to avoid I/O hang. -+ * If the device state changes to SDEV_RUNNING, we need to -+ * rescan the device to revalidate it, and run the queue to -+ * avoid I/O hang. - */ -- if (ret == 0 && state == SDEV_RUNNING) -+ if (ret == 0 && state == SDEV_RUNNING) { -+ scsi_rescan_device(dev); - blk_mq_run_hw_queues(sdev->request_queue, true); -+ } - mutex_unlock(&sdev->state_mutex); - - return ret == 0 ? count : -EINVAL; -diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c -index d5879142dbef1..ddf0371ad52b2 100644 ---- a/drivers/slimbus/messaging.c -+++ b/drivers/slimbus/messaging.c -@@ -66,7 +66,7 @@ int slim_alloc_txn_tid(struct slim_controller *ctrl, struct slim_msg_txn *txn) - int ret = 0; - - spin_lock_irqsave(&ctrl->txn_lock, flags); -- ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 0, -+ ret = idr_alloc_cyclic(&ctrl->tid_idr, txn, 1, - SLIM_MAX_TIDS, GFP_ATOMIC); - if (ret < 0) { - spin_unlock_irqrestore(&ctrl->txn_lock, flags); -@@ -131,7 +131,8 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) - goto slim_xfer_err; - } - } -- -+ /* Initialize tid to invalid value */ -+ txn->tid = 0; - need_tid = slim_tid_txn(txn->mt, txn->mc); - - if (need_tid) { -@@ -163,7 +164,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) - txn->mt, txn->mc, txn->la, ret); - - slim_xfer_err: -- if (!clk_pause_msg && (!need_tid || ret == -ETIMEDOUT)) { -+ if (!clk_pause_msg && (txn->tid == 0 || ret == -ETIMEDOUT)) { - /* - * remove runtime-pm vote if this was TX only, or - * if there was error during this transaction -diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c -index b60541c3f72da..09ecd1fb24ae3 100644 ---- a/drivers/slimbus/qcom-ngd-ctrl.c -+++ b/drivers/slimbus/qcom-ngd-ctrl.c -@@ -1061,7 +1061,8 @@ static void qcom_slim_ngd_setup(struct qcom_slim_ngd_ctrl *ctrl) - { - u32 cfg = readl_relaxed(ctrl->ngd->base); - -- if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN) -+ if (ctrl->state == QCOM_SLIM_NGD_CTRL_DOWN || -+ ctrl->state == QCOM_SLIM_NGD_CTRL_ASLEEP) - qcom_slim_ngd_init_dma(ctrl); - - /* By default enable message queues */ -@@ -1112,6 +1113,7 @@ static int qcom_slim_ngd_power_up(struct qcom_slim_ngd_ctrl *ctrl) - dev_info(ctrl->dev, "Subsys restart: ADSP active framer\n"); - return 0; - } -+ qcom_slim_ngd_setup(ctrl); - return 0; - } - -@@ -1500,6 +1502,7 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev) - struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev); - int ret = 0; - -+ qcom_slim_ngd_exit_dma(ctrl); - if (!ctrl->qmi.handle) - return 0; - -diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c -index 041c68ea329f4..7ca908704777c 100644 ---- a/drivers/usb/core/message.c -+++ b/drivers/usb/core/message.c -@@ -647,6 +647,9 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type, - int i; - int result; - -+ if (size <= 0) /* No point in asking for no data */ -+ return -EINVAL; -+ - memset(buf, 0, size); /* Make sure we parse really received data */ - - for (i = 0; i < 3; ++i) { -@@ -695,6 +698,9 @@ static int usb_get_string(struct usb_device *dev, unsigned short langid, - int i; - int result; - -+ if (size <= 0) /* No point in asking for no data */ -+ return -EINVAL; -+ - for (i = 0; i < 3; ++i) { - /* retry on length 0 or stall; some devices are flakey */ - result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c -index a279ecacbf60a..97be299f0a8dc 100644 ---- a/drivers/vhost/vhost.c -+++ b/drivers/vhost/vhost.c -@@ -702,10 +702,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) - (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); - } - -+/* Make sure 64 bit math will not overflow. */ - static bool vhost_overflow(u64 uaddr, u64 size) - { -- /* Make sure 64 bit math will not overflow. */ -- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; -+ if (uaddr > ULONG_MAX || size > ULONG_MAX) -+ return true; -+ -+ if (!size) -+ return false; -+ -+ return uaddr > ULONG_MAX - size + 1; - } - - /* Caller should have vq mutex and device mutex. */ -diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c -index a977e32a88f2f..59a05f1b81054 100644 ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -342,6 +342,7 @@ int register_virtio_device(struct virtio_device *dev) - virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE); - - INIT_LIST_HEAD(&dev->vqs); -+ spin_lock_init(&dev->vqs_list_lock); - - /* - * device_add() causes the bus infrastructure to look for a matching -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index 97e8a195e18f5..f6011c9ed32f1 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed( - cpu_to_le16(vq->packed.event_flags_shadow); - } - -+ spin_lock(&vdev->vqs_list_lock); - list_add_tail(&vq->vq.list, &vdev->vqs); -+ spin_unlock(&vdev->vqs_list_lock); - return &vq->vq; - - err_desc_extra: -@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, - memset(vq->split.desc_state, 0, vring.num * - sizeof(struct vring_desc_state_split)); - -+ spin_lock(&vdev->vqs_list_lock); - list_add_tail(&vq->vq.list, &vdev->vqs); -+ spin_unlock(&vdev->vqs_list_lock); - return &vq->vq; - } - EXPORT_SYMBOL_GPL(__vring_new_virtqueue); -@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq) - } - if (!vq->packed_ring) - kfree(vq->split.desc_state); -+ spin_lock(&vq->vq.vdev->vqs_list_lock); - list_del(&_vq->list); -+ spin_unlock(&vq->vq.vdev->vqs_list_lock); - kfree(vq); - } - EXPORT_SYMBOL_GPL(vring_del_virtqueue); -@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev) - { - struct virtqueue *_vq; - -+ spin_lock(&dev->vqs_list_lock); - list_for_each_entry(_vq, &dev->vqs, list) { - struct vring_virtqueue *vq = to_vvq(_vq); - vq->broken = true; - } -+ spin_unlock(&dev->vqs_list_lock); - } - EXPORT_SYMBOL_GPL(virtio_break_device); - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index b044b1d910dec..54b607a3cc3f2 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -9702,8 +9702,14 @@ static int btrfs_rename_exchange(struct inode *old_dir, - bool root_log_pinned = false; - bool dest_log_pinned = false; - -- /* we only allow rename subvolume link between subvolumes */ -- if (old_ino != BTRFS_FIRST_FREE_OBJECTID && root != dest) -+ /* -+ * For non-subvolumes allow exchange only within one subvolume, in the -+ * same inode namespace. Two subvolumes (represented as directory) can -+ * be exchanged as they're a logical link and have a fixed inode number. -+ */ -+ if (root != dest && -+ (old_ino != BTRFS_FIRST_FREE_OBJECTID || -+ new_ino != BTRFS_FIRST_FREE_OBJECTID)) - return -EXDEV; - - /* close the race window with snapshot create/destroy ioctl */ -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index bf3eaa9030335..ae2cb15d95407 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -718,7 +718,7 @@ enum { - #define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF - - /* Max logical block we can support */ --#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF -+#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFE - - /* - * Structure of an inode on the disk -diff --git a/fs/namespace.c b/fs/namespace.c -index a092611d89e77..5782cd55dfdbb 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1647,8 +1647,12 @@ static inline bool may_mount(void) - } - - #ifdef CONFIG_MANDATORY_FILE_LOCKING --static inline bool may_mandlock(void) -+static bool may_mandlock(void) - { -+ pr_warn_once("======================================================\n" -+ "WARNING: the mand mount option is being deprecated and\n" -+ " will be removed in v5.15!\n" -+ "======================================================\n"); - return capable(CAP_SYS_ADMIN); - } - #else -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 7a08a576f7b29..ab5e92897270a 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -9,6 +9,9 @@ - #include - #include - #include -+#include -+#include -+#include - #include "overlayfs.h" - - static char ovl_whatisit(struct inode *inode, struct inode *realinode) -@@ -293,6 +296,48 @@ out_unlock: - return ret; - } - -+static ssize_t ovl_splice_read(struct file *in, loff_t *ppos, -+ struct pipe_inode_info *pipe, size_t len, -+ unsigned int flags) -+{ -+ ssize_t ret; -+ struct fd real; -+ const struct cred *old_cred; -+ -+ ret = ovl_real_fdget(in, &real); -+ if (ret) -+ return ret; -+ -+ old_cred = ovl_override_creds(file_inode(in)->i_sb); -+ ret = generic_file_splice_read(real.file, ppos, pipe, len, flags); -+ revert_creds(old_cred); -+ -+ ovl_file_accessed(in); -+ fdput(real); -+ return ret; -+} -+ -+static ssize_t -+ovl_splice_write(struct pipe_inode_info *pipe, struct file *out, -+ loff_t *ppos, size_t len, unsigned int flags) -+{ -+ struct fd real; -+ const struct cred *old_cred; -+ ssize_t ret; -+ -+ ret = ovl_real_fdget(out, &real); -+ if (ret) -+ return ret; -+ -+ old_cred = ovl_override_creds(file_inode(out)->i_sb); -+ ret = iter_file_splice_write(pipe, real.file, ppos, len, flags); -+ revert_creds(old_cred); -+ -+ ovl_file_accessed(out); -+ fdput(real); -+ return ret; -+} -+ - static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync) - { - struct fd real; -@@ -649,6 +694,8 @@ const struct file_operations ovl_file_operations = { - .fadvise = ovl_fadvise, - .unlocked_ioctl = ovl_ioctl, - .compat_ioctl = ovl_compat_ioctl, -+ .splice_read = ovl_splice_read, -+ .splice_write = ovl_splice_write, - - .copy_file_range = ovl_copy_file_range, - .remap_file_range = ovl_remap_file_range, -diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h -index fb5b2a41bd456..b6d0b68f55032 100644 ---- a/include/linux/memcontrol.h -+++ b/include/linux/memcontrol.h -@@ -356,17 +356,54 @@ static inline bool mem_cgroup_disabled(void) - return !cgroup_subsys_enabled(memory_cgrp_subsys); - } - --static inline unsigned long mem_cgroup_protection(struct mem_cgroup *memcg, -- bool in_low_reclaim) -+static inline void mem_cgroup_protection(struct mem_cgroup *root, -+ struct mem_cgroup *memcg, -+ unsigned long *min, -+ unsigned long *low) - { -+ *min = *low = 0; -+ - if (mem_cgroup_disabled()) -- return 0; -+ return; - -- if (in_low_reclaim) -- return READ_ONCE(memcg->memory.emin); -+ /* -+ * There is no reclaim protection applied to a targeted reclaim. -+ * We are special casing this specific case here because -+ * mem_cgroup_protected calculation is not robust enough to keep -+ * the protection invariant for calculated effective values for -+ * parallel reclaimers with different reclaim target. This is -+ * especially a problem for tail memcgs (as they have pages on LRU) -+ * which would want to have effective values 0 for targeted reclaim -+ * but a different value for external reclaim. -+ * -+ * Example -+ * Let's have global and A's reclaim in parallel: -+ * | -+ * A (low=2G, usage = 3G, max = 3G, children_low_usage = 1.5G) -+ * |\ -+ * | C (low = 1G, usage = 2.5G) -+ * B (low = 1G, usage = 0.5G) -+ * -+ * For the global reclaim -+ * A.elow = A.low -+ * B.elow = min(B.usage, B.low) because children_low_usage <= A.elow -+ * C.elow = min(C.usage, C.low) -+ * -+ * With the effective values resetting we have A reclaim -+ * A.elow = 0 -+ * B.elow = B.low -+ * C.elow = C.low -+ * -+ * If the global reclaim races with A's reclaim then -+ * B.elow = C.elow = 0 because children_low_usage > A.elow) -+ * is possible and reclaiming B would be violating the protection. -+ * -+ */ -+ if (root == memcg) -+ return; - -- return max(READ_ONCE(memcg->memory.emin), -- READ_ONCE(memcg->memory.elow)); -+ *min = READ_ONCE(memcg->memory.emin); -+ *low = READ_ONCE(memcg->memory.elow); - } - - enum mem_cgroup_protection mem_cgroup_protected(struct mem_cgroup *root, -@@ -847,10 +884,12 @@ static inline void memcg_memory_event_mm(struct mm_struct *mm, - { - } - --static inline unsigned long mem_cgroup_protection(struct mem_cgroup *memcg, -- bool in_low_reclaim) -+static inline void mem_cgroup_protection(struct mem_cgroup *root, -+ struct mem_cgroup *memcg, -+ unsigned long *min, -+ unsigned long *low) - { -- return 0; -+ *min = *low = 0; - } - - static inline enum mem_cgroup_protection mem_cgroup_protected( -diff --git a/include/linux/virtio.h b/include/linux/virtio.h -index 15f906e4a748f..7c075463c7f2b 100644 ---- a/include/linux/virtio.h -+++ b/include/linux/virtio.h -@@ -111,6 +111,7 @@ struct virtio_device { - bool config_enabled; - bool config_change_pending; - spinlock_t config_lock; -+ spinlock_t vqs_list_lock; /* Protects VQs list access */ - struct device dev; - struct virtio_device_id id; - const struct virtio_config_ops *config; -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 52c2b11a0b471..0b5a446ee59c9 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -8586,6 +8586,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env) - if (aux_data[i].seen) - continue; - memcpy(insn + i, &trap, sizeof(trap)); -+ aux_data[i].zext_dst = false; - } - } - -diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c -index e40712abe089e..f63766366e238 100644 ---- a/kernel/trace/trace_events_hist.c -+++ b/kernel/trace/trace_events_hist.c -@@ -4291,6 +4291,8 @@ trace_action_create_field_var(struct hist_trigger_data *hist_data, - event = data->match_data.event; - } - -+ if (!event) -+ goto free; - /* - * At this point, we're looking at a field on another - * event. Because we can't modify a hist trigger on -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 2701497edda5c..6d7fe3589e4a0 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -6446,6 +6446,14 @@ enum mem_cgroup_protection mem_cgroup_protected(struct mem_cgroup *root, - - if (!root) - root = root_mem_cgroup; -+ -+ /* -+ * Effective values of the reclaim targets are ignored so they -+ * can be stale. Have a look at mem_cgroup_protection for more -+ * details. -+ * TODO: calculation should be more robust so that we do not need -+ * that special casing. -+ */ - if (memcg == root) - return MEMCG_PROT_NONE; - -diff --git a/mm/vmscan.c b/mm/vmscan.c -index 10feb872d9a4f..fad9be4703ece 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -89,9 +89,12 @@ struct scan_control { - unsigned int may_swap:1; - - /* -- * Cgroups are not reclaimed below their configured memory.low, -- * unless we threaten to OOM. If any cgroups are skipped due to -- * memory.low and nothing was reclaimed, go back for memory.low. -+ * Cgroup memory below memory.low is protected as long as we -+ * don't threaten to OOM. If any cgroup is reclaimed at -+ * reduced force or passed over entirely due to its memory.low -+ * setting (memcg_low_skipped), and nothing is reclaimed as a -+ * result, then go back for one more cycle that reclaims the protected -+ * memory (memcg_low_reclaim) to avert OOM. - */ - unsigned int memcg_low_reclaim:1; - unsigned int memcg_low_skipped:1; -@@ -2458,14 +2461,14 @@ out: - for_each_evictable_lru(lru) { - int file = is_file_lru(lru); - unsigned long lruvec_size; -+ unsigned long low, min; - unsigned long scan; -- unsigned long protection; - - lruvec_size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); -- protection = mem_cgroup_protection(memcg, -- sc->memcg_low_reclaim); -+ mem_cgroup_protection(sc->target_mem_cgroup, memcg, -+ &min, &low); - -- if (protection) { -+ if (min || low) { - /* - * Scale a cgroup's reclaim pressure by proportioning - * its current usage to its memory.low or memory.min -@@ -2496,6 +2499,15 @@ out: - * hard protection. - */ - unsigned long cgroup_size = mem_cgroup_size(memcg); -+ unsigned long protection; -+ -+ /* memory.low scaling, make sure we retry before OOM */ -+ if (!sc->memcg_low_reclaim && low > min) { -+ protection = low; -+ sc->memcg_low_skipped = 1; -+ } else { -+ protection = min; -+ } - - /* Avoid TOCTOU with earlier protection check */ - cgroup_size = max(cgroup_size, protection); -diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c -index bef84b95e2c47..ac98e3b37ab47 100644 ---- a/net/bluetooth/hidp/core.c -+++ b/net/bluetooth/hidp/core.c -@@ -1290,7 +1290,7 @@ static int hidp_session_thread(void *arg) - - /* cleanup runtime environment */ - remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); -- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait); -+ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); - wake_up_interruptible(&session->report_queue); - hidp_del_timer(session); - -diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h -index 9c3b27c257bbf..cb818617699c3 100644 ---- a/net/dccp/dccp.h -+++ b/net/dccp/dccp.h -@@ -41,9 +41,9 @@ extern bool dccp_debug; - #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) - #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) - #else --#define dccp_pr_debug(format, a...) --#define dccp_pr_debug_cat(format, a...) --#define dccp_debug(format, a...) -+#define dccp_pr_debug(format, a...) do {} while (0) -+#define dccp_pr_debug_cat(format, a...) do {} while (0) -+#define dccp_debug(format, a...) do {} while (0) - #endif - - extern struct inet_hashinfo dccp_hashinfo; -diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c -index 00f4323cfeb87..faa0844c01fb8 100644 ---- a/net/netfilter/nft_exthdr.c -+++ b/net/netfilter/nft_exthdr.c -@@ -231,7 +231,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, - unsigned int i, optl, tcphdr_len, offset; - struct tcphdr *tcph; - u8 *opt; -- u32 src; - - tcph = nft_tcp_header_pointer(pkt, sizeof(buff), buff, &tcphdr_len); - if (!tcph) -@@ -240,7 +239,6 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, - opt = (u8 *)tcph; - for (i = sizeof(*tcph); i < tcphdr_len - 1; i += optl) { - union { -- u8 octet; - __be16 v16; - __be32 v32; - } old, new; -@@ -262,13 +260,13 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, - if (!tcph) - return; - -- src = regs->data[priv->sreg]; - offset = i + priv->offset; - - switch (priv->len) { - case 2: - old.v16 = get_unaligned((u16 *)(opt + offset)); -- new.v16 = src; -+ new.v16 = (__force __be16)nft_reg_load16( -+ ®s->data[priv->sreg]); - - switch (priv->type) { - case TCPOPT_MSS: -@@ -286,7 +284,7 @@ static void nft_exthdr_tcp_set_eval(const struct nft_expr *expr, - old.v16, new.v16, false); - break; - case 4: -- new.v32 = src; -+ new.v32 = regs->data[priv->sreg]; - old.v32 = get_unaligned((u32 *)(opt + offset)); - - if (old.v32 == new.v32) -diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c -index 3fc38d16c4568..19af0efeb8dc1 100644 ---- a/net/openvswitch/vport.c -+++ b/net/openvswitch/vport.c -@@ -499,6 +499,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto) - } - - skb->dev = vport->dev; -+ skb->tstamp = 0; - vport->ops->send(skb); - return; - -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index 7ac3f04ca8c00..e92fcb150e57c 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -3458,7 +3458,7 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, - struct hda_gen_spec *spec = codec->spec; - const struct hda_input_mux *imux; - struct nid_path *path; -- int i, adc_idx, err = 0; -+ int i, adc_idx, ret, err = 0; - - imux = &spec->input_mux; - adc_idx = kcontrol->id.index; -@@ -3468,9 +3468,13 @@ static int cap_put_caller(struct snd_kcontrol *kcontrol, - if (!path || !path->ctls[type]) - continue; - kcontrol->private_value = path->ctls[type]; -- err = func(kcontrol, ucontrol); -- if (err < 0) -+ ret = func(kcontrol, ucontrol); -+ if (ret < 0) { -+ err = ret; - break; -+ } -+ if (ret > 0) -+ err = 1; - } - mutex_unlock(&codec->control_mutex); - if (err >= 0 && spec->cap_sync_hook) -diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -index 216e88624c5f3..7d59846808b52 100644 ---- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c -+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c -@@ -127,7 +127,7 @@ static void sst_fill_alloc_params(struct snd_pcm_substream *substream, - snd_pcm_uframes_t period_size; - ssize_t periodbytes; - ssize_t buffer_bytes = snd_pcm_lib_buffer_bytes(substream); -- u32 buffer_addr = substream->runtime->dma_addr; -+ u32 buffer_addr = virt_to_phys(substream->runtime->dma_area); - - channels = substream->runtime->channels; - period_size = substream->runtime->period_size; diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch deleted file mode 100644 index 9bcf3a4e79..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.143-144.patch +++ /dev/null @@ -1,1738 +0,0 @@ -diff --git a/Makefile b/Makefile -index e99fabc4dfc8c..3c3804197b511 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 143 -+SUBLEVEL = 144 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/kernel/vmlinux.lds.S b/arch/arc/kernel/vmlinux.lds.S -index 6c693a9d29b6d..0391b8293ad85 100644 ---- a/arch/arc/kernel/vmlinux.lds.S -+++ b/arch/arc/kernel/vmlinux.lds.S -@@ -88,6 +88,8 @@ SECTIONS - CPUIDLE_TEXT - LOCK_TEXT - KPROBES_TEXT -+ IRQENTRY_TEXT -+ SOFTIRQENTRY_TEXT - *(.fixup) - *(.gnu.warning) - } -diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts -index a5f9a6ab512c4..9b989cc30edc8 100644 ---- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts -+++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts -@@ -30,3 +30,7 @@ - }; - }; - }; -+ -+&msmgpio { -+ gpio-reserved-ranges = <85 4>; -+}; -diff --git a/arch/parisc/include/asm/string.h b/arch/parisc/include/asm/string.h -index 4a0c9dbd62fd0..f6e1132f4e352 100644 ---- a/arch/parisc/include/asm/string.h -+++ b/arch/parisc/include/asm/string.h -@@ -8,19 +8,4 @@ extern void * memset(void *, int, size_t); - #define __HAVE_ARCH_MEMCPY - void * memcpy(void * dest,const void *src,size_t count); - --#define __HAVE_ARCH_STRLEN --extern size_t strlen(const char *s); -- --#define __HAVE_ARCH_STRCPY --extern char *strcpy(char *dest, const char *src); -- --#define __HAVE_ARCH_STRNCPY --extern char *strncpy(char *dest, const char *src, size_t count); -- --#define __HAVE_ARCH_STRCAT --extern char *strcat(char *dest, const char *src); -- --#define __HAVE_ARCH_MEMSET --extern void *memset(void *, int, size_t); -- - #endif -diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c -index 8ed409ecec933..e8a6a751dfd8e 100644 ---- a/arch/parisc/kernel/parisc_ksyms.c -+++ b/arch/parisc/kernel/parisc_ksyms.c -@@ -17,10 +17,6 @@ - - #include - EXPORT_SYMBOL(memset); --EXPORT_SYMBOL(strlen); --EXPORT_SYMBOL(strcpy); --EXPORT_SYMBOL(strncpy); --EXPORT_SYMBOL(strcat); - - #include - EXPORT_SYMBOL(__xchg8); -diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile -index 2d7a9974dbaef..7b197667faf6c 100644 ---- a/arch/parisc/lib/Makefile -+++ b/arch/parisc/lib/Makefile -@@ -3,7 +3,7 @@ - # Makefile for parisc-specific library files - # - --lib-y := lusercopy.o bitops.o checksum.o io.o memcpy.o \ -- ucmpdi2.o delay.o string.o -+lib-y := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \ -+ ucmpdi2.o delay.o - - obj-y := iomap.o -diff --git a/arch/parisc/lib/memset.c b/arch/parisc/lib/memset.c -new file mode 100644 -index 0000000000000..133e4809859a3 ---- /dev/null -+++ b/arch/parisc/lib/memset.c -@@ -0,0 +1,72 @@ -+/* SPDX-License-Identifier: GPL-2.0-or-later */ -+#include -+#include -+ -+#define OPSIZ (BITS_PER_LONG/8) -+typedef unsigned long op_t; -+ -+void * -+memset (void *dstpp, int sc, size_t len) -+{ -+ unsigned int c = sc; -+ long int dstp = (long int) dstpp; -+ -+ if (len >= 8) -+ { -+ size_t xlen; -+ op_t cccc; -+ -+ cccc = (unsigned char) c; -+ cccc |= cccc << 8; -+ cccc |= cccc << 16; -+ if (OPSIZ > 4) -+ /* Do the shift in two steps to avoid warning if long has 32 bits. */ -+ cccc |= (cccc << 16) << 16; -+ -+ /* There are at least some bytes to set. -+ No need to test for LEN == 0 in this alignment loop. */ -+ while (dstp % OPSIZ != 0) -+ { -+ ((unsigned char *) dstp)[0] = c; -+ dstp += 1; -+ len -= 1; -+ } -+ -+ /* Write 8 `op_t' per iteration until less than 8 `op_t' remain. */ -+ xlen = len / (OPSIZ * 8); -+ while (xlen > 0) -+ { -+ ((op_t *) dstp)[0] = cccc; -+ ((op_t *) dstp)[1] = cccc; -+ ((op_t *) dstp)[2] = cccc; -+ ((op_t *) dstp)[3] = cccc; -+ ((op_t *) dstp)[4] = cccc; -+ ((op_t *) dstp)[5] = cccc; -+ ((op_t *) dstp)[6] = cccc; -+ ((op_t *) dstp)[7] = cccc; -+ dstp += 8 * OPSIZ; -+ xlen -= 1; -+ } -+ len %= OPSIZ * 8; -+ -+ /* Write 1 `op_t' per iteration until less than OPSIZ bytes remain. */ -+ xlen = len / OPSIZ; -+ while (xlen > 0) -+ { -+ ((op_t *) dstp)[0] = cccc; -+ dstp += OPSIZ; -+ xlen -= 1; -+ } -+ len %= OPSIZ; -+ } -+ -+ /* Write the last few bytes. */ -+ while (len > 0) -+ { -+ ((unsigned char *) dstp)[0] = c; -+ dstp += 1; -+ len -= 1; -+ } -+ -+ return dstpp; -+} -diff --git a/arch/parisc/lib/string.S b/arch/parisc/lib/string.S -deleted file mode 100644 -index 4a64264427a63..0000000000000 ---- a/arch/parisc/lib/string.S -+++ /dev/null -@@ -1,136 +0,0 @@ --// SPDX-License-Identifier: GPL-2.0 --/* -- * PA-RISC assembly string functions -- * -- * Copyright (C) 2019 Helge Deller -- */ -- --#include --#include -- -- .section .text.hot -- .level PA_ASM_LEVEL -- -- t0 = r20 -- t1 = r21 -- t2 = r22 -- --ENTRY_CFI(strlen, frame=0,no_calls) -- or,COND(<>) arg0,r0,ret0 -- b,l,n .Lstrlen_null_ptr,r0 -- depwi 0,31,2,ret0 -- cmpb,COND(<>) arg0,ret0,.Lstrlen_not_aligned -- ldw,ma 4(ret0),t0 -- cmpib,tr 0,r0,.Lstrlen_loop -- uxor,nbz r0,t0,r0 --.Lstrlen_not_aligned: -- uaddcm arg0,ret0,t1 -- shladd t1,3,r0,t1 -- mtsar t1 -- depwi -1,%sar,32,t0 -- uxor,nbz r0,t0,r0 --.Lstrlen_loop: -- b,l,n .Lstrlen_end_loop,r0 -- ldw,ma 4(ret0),t0 -- cmpib,tr 0,r0,.Lstrlen_loop -- uxor,nbz r0,t0,r0 --.Lstrlen_end_loop: -- extrw,u,<> t0,7,8,r0 -- addib,tr,n -3,ret0,.Lstrlen_out -- extrw,u,<> t0,15,8,r0 -- addib,tr,n -2,ret0,.Lstrlen_out -- extrw,u,<> t0,23,8,r0 -- addi -1,ret0,ret0 --.Lstrlen_out: -- bv r0(rp) -- uaddcm ret0,arg0,ret0 --.Lstrlen_null_ptr: -- bv,n r0(rp) --ENDPROC_CFI(strlen) -- -- --ENTRY_CFI(strcpy, frame=0,no_calls) -- ldb 0(arg1),t0 -- stb t0,0(arg0) -- ldo 0(arg0),ret0 -- ldo 1(arg1),t1 -- cmpb,= r0,t0,2f -- ldo 1(arg0),t2 --1: ldb 0(t1),arg1 -- stb arg1,0(t2) -- ldo 1(t1),t1 -- cmpb,<> r0,arg1,1b -- ldo 1(t2),t2 --2: bv,n r0(rp) --ENDPROC_CFI(strcpy) -- -- --ENTRY_CFI(strncpy, frame=0,no_calls) -- ldb 0(arg1),t0 -- stb t0,0(arg0) -- ldo 1(arg1),t1 -- ldo 0(arg0),ret0 -- cmpb,= r0,t0,2f -- ldo 1(arg0),arg1 --1: ldo -1(arg2),arg2 -- cmpb,COND(=),n r0,arg2,2f -- ldb 0(t1),arg0 -- stb arg0,0(arg1) -- ldo 1(t1),t1 -- cmpb,<> r0,arg0,1b -- ldo 1(arg1),arg1 --2: bv,n r0(rp) --ENDPROC_CFI(strncpy) -- -- --ENTRY_CFI(strcat, frame=0,no_calls) -- ldb 0(arg0),t0 -- cmpb,= t0,r0,2f -- ldo 0(arg0),ret0 -- ldo 1(arg0),arg0 --1: ldb 0(arg0),t1 -- cmpb,<>,n r0,t1,1b -- ldo 1(arg0),arg0 --2: ldb 0(arg1),t2 -- stb t2,0(arg0) -- ldo 1(arg0),arg0 -- ldb 0(arg1),t0 -- cmpb,<> r0,t0,2b -- ldo 1(arg1),arg1 -- bv,n r0(rp) --ENDPROC_CFI(strcat) -- -- --ENTRY_CFI(memset, frame=0,no_calls) -- copy arg0,ret0 -- cmpb,COND(=) r0,arg0,4f -- copy arg0,t2 -- cmpb,COND(=) r0,arg2,4f -- ldo -1(arg2),arg3 -- subi -1,arg3,t0 -- subi 0,t0,t1 -- cmpiclr,COND(>=) 0,t1,arg2 -- ldo -1(t1),arg2 -- extru arg2,31,2,arg0 --2: stb arg1,0(t2) -- ldo 1(t2),t2 -- addib,>= -1,arg0,2b -- ldo -1(arg3),arg3 -- cmpiclr,COND(<=) 4,arg2,r0 -- b,l,n 4f,r0 --#ifdef CONFIG_64BIT -- depd,* r0,63,2,arg2 --#else -- depw r0,31,2,arg2 --#endif -- ldo 1(t2),t2 --3: stb arg1,-1(t2) -- stb arg1,0(t2) -- stb arg1,1(t2) -- stb arg1,2(t2) -- addib,COND(>) -4,arg2,3b -- ldo 4(t2),t2 --4: bv,n r0(rp) --ENDPROC_CFI(memset) -- -- .end -diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c -index 40751af62dd3d..9096a1693942d 100644 ---- a/arch/x86/events/intel/uncore_snbep.c -+++ b/arch/x86/events/intel/uncore_snbep.c -@@ -4382,7 +4382,7 @@ static void snr_uncore_mmio_init_box(struct intel_uncore_box *box) - return; - - pci_read_config_dword(pdev, SNR_IMC_MMIO_BASE_OFFSET, &pci_dword); -- addr = (pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23; -+ addr = ((resource_size_t)pci_dword & SNR_IMC_MMIO_BASE_MASK) << 23; - - pci_read_config_dword(pdev, SNR_IMC_MMIO_MEM0_OFFSET, &pci_dword); - addr |= (pci_dword & SNR_IMC_MMIO_MEM0_MASK) << 12; -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 260c64c205b8c..d3877dd713aef 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -4666,7 +4666,15 @@ static void reset_rsvds_bits_mask_ept(struct kvm_vcpu *vcpu, - void - reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu *context) - { -- bool uses_nx = context->nx || -+ /* -+ * KVM uses NX when TDP is disabled to handle a variety of scenarios, -+ * notably for huge SPTEs if iTLB multi-hit mitigation is enabled and -+ * to generate correct permissions for CR0.WP=0/CR4.SMEP=1/EFER.NX=0. -+ * The iTLB multi-hit workaround can be toggled at any time, so assume -+ * NX can be used by any non-nested shadow MMU to avoid having to reset -+ * MMU contexts. Note, KVM forces EFER.NX=1 when TDP is disabled. -+ */ -+ bool uses_nx = context->nx || !tdp_enabled || - context->mmu_role.base.smep_andnot_wp; - struct rsvd_bits_validate *shadow_zero_check; - int i; -diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c -index 40ea1a425c431..ac97a1e2e5ddc 100644 ---- a/drivers/block/floppy.c -+++ b/drivers/block/floppy.c -@@ -4063,22 +4063,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) - if (UFDCS->rawcmd == 1) - UFDCS->rawcmd = 2; - -- if (mode & (FMODE_READ|FMODE_WRITE)) { -- UDRS->last_checked = 0; -- clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -- check_disk_change(bdev); -- if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -- goto out; -- if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -+ if (!(mode & FMODE_NDELAY)) { -+ if (mode & (FMODE_READ|FMODE_WRITE)) { -+ UDRS->last_checked = 0; -+ clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags); -+ check_disk_change(bdev); -+ if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags)) -+ goto out; -+ if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags)) -+ goto out; -+ } -+ res = -EROFS; -+ if ((mode & FMODE_WRITE) && -+ !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) - goto out; - } -- -- res = -EROFS; -- -- if ((mode & FMODE_WRITE) && -- !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags)) -- goto out; -- - mutex_unlock(&open_lock); - mutex_unlock(&floppy_mutex); - return 0; -diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c -index 2cf053fb8d54b..1c691bdb89141 100644 ---- a/drivers/gpu/drm/drm_ioc32.c -+++ b/drivers/gpu/drm/drm_ioc32.c -@@ -863,8 +863,6 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, - req.request.sequence = req32.request.sequence; - req.request.signal = req32.request.signal; - err = drm_ioctl_kernel(file, drm_wait_vblank_ioctl, &req, DRM_UNLOCKED); -- if (err) -- return err; - - req32.reply.type = req.reply.type; - req32.reply.sequence = req.reply.sequence; -@@ -873,7 +871,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd, - if (copy_to_user(argp, &req32, sizeof(req32))) - return -EFAULT; - -- return 0; -+ return err; - } - - #if defined(CONFIG_X86) -diff --git a/drivers/gpu/drm/i915/gt/intel_timeline.c b/drivers/gpu/drm/i915/gt/intel_timeline.c -index 9cb01d9828f1d..c970e3deb0085 100644 ---- a/drivers/gpu/drm/i915/gt/intel_timeline.c -+++ b/drivers/gpu/drm/i915/gt/intel_timeline.c -@@ -289,6 +289,14 @@ void intel_timeline_fini(struct intel_timeline *timeline) - i915_gem_object_unpin_map(timeline->hwsp_ggtt->obj); - - i915_vma_put(timeline->hwsp_ggtt); -+ -+ /* -+ * A small race exists between intel_gt_retire_requests_timeout and -+ * intel_timeline_exit which could result in the syncmap not getting -+ * free'd. Rather than work to hard to seal this race, simply cleanup -+ * the syncmap on fini. -+ */ -+ i915_syncmap_free(&timeline->sync); - } - - struct intel_timeline * -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c -index 818d21bd28d31..1d2837c5a8f29 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c -@@ -419,7 +419,7 @@ nvkm_dp_train(struct nvkm_dp *dp, u32 dataKBps) - return ret; - } - --static void -+void - nvkm_dp_disable(struct nvkm_outp *outp, struct nvkm_ior *ior) - { - struct nvkm_dp *dp = nvkm_dp(outp); -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h -index 428b3f488f033..e484d0c3b0d42 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.h -@@ -32,6 +32,7 @@ struct nvkm_dp { - - int nvkm_dp_new(struct nvkm_disp *, int index, struct dcb_output *, - struct nvkm_outp **); -+void nvkm_dp_disable(struct nvkm_outp *, struct nvkm_ior *); - - /* DPCD Receiver Capabilities */ - #define DPCD_RC00_DPCD_REV 0x00000 -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c -index c62030c96fba0..4b1c72fd8f039 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/outp.c -@@ -22,6 +22,7 @@ - * Authors: Ben Skeggs - */ - #include "outp.h" -+#include "dp.h" - #include "ior.h" - - #include -@@ -216,6 +217,14 @@ nvkm_outp_init_route(struct nvkm_outp *outp) - if (!ior->arm.head || ior->arm.proto != proto) { - OUTP_DBG(outp, "no heads (%x %d %d)", ior->arm.head, - ior->arm.proto, proto); -+ -+ /* The EFI GOP driver on Ampere can leave unused DP links routed, -+ * which we don't expect. The DisableLT IED script *should* get -+ * us back to where we need to be. -+ */ -+ if (ior->func->route.get && !ior->arm.head && outp->info.type == DCB_OUTPUT_DP) -+ nvkm_dp_disable(outp, ior); -+ - return; - } - -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index 58c021648b7c8..a96f9142fe08e 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -1404,6 +1404,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, - if (nq) - nq->budget++; - atomic_inc(&rdev->srq_count); -+ spin_lock_init(&srq->lock); - - return 0; - -diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c -index 83858f7e83d0f..75dfe9d1564c1 100644 ---- a/drivers/infiniband/hw/efa/efa_main.c -+++ b/drivers/infiniband/hw/efa/efa_main.c -@@ -340,6 +340,7 @@ static int efa_enable_msix(struct efa_dev *dev) - } - - if (irq_num != msix_vecs) { -+ efa_disable_msix(dev); - dev_err(&dev->pdev->dev, - "Allocated %d MSI-X (out of %d requested)\n", - irq_num, msix_vecs); -diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c -index c61b6022575e1..248be21acdbed 100644 ---- a/drivers/infiniband/hw/hfi1/sdma.c -+++ b/drivers/infiniband/hw/hfi1/sdma.c -@@ -3056,6 +3056,7 @@ static void __sdma_process_event(struct sdma_engine *sde, - static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) - { - int i; -+ struct sdma_desc *descp; - - /* Handle last descriptor */ - if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { -@@ -3076,12 +3077,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) - if (unlikely(tx->num_desc == MAX_DESC)) - goto enomem; - -- tx->descp = kmalloc_array( -- MAX_DESC, -- sizeof(struct sdma_desc), -- GFP_ATOMIC); -- if (!tx->descp) -+ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); -+ if (!descp) - goto enomem; -+ tx->descp = descp; - - /* reserve last descriptor for coalescing */ - tx->desc_limit = MAX_DESC - 1; -diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c -index 8bed81cf03adc..8ab963055238a 100644 ---- a/drivers/mmc/host/sdhci-msm.c -+++ b/drivers/mmc/host/sdhci-msm.c -@@ -1589,6 +1589,23 @@ out: - __sdhci_msm_set_clock(host, clock); - } - -+static void sdhci_msm_set_timeout(struct sdhci_host *host, struct mmc_command *cmd) -+{ -+ u32 count, start = 15; -+ -+ __sdhci_set_timeout(host, cmd); -+ count = sdhci_readb(host, SDHCI_TIMEOUT_CONTROL); -+ /* -+ * Update software timeout value if its value is less than hardware data -+ * timeout value. Qcom SoC hardware data timeout value was calculated -+ * using 4 * MCLK * 2^(count + 13). where MCLK = 1 / host->clock. -+ */ -+ if (cmd && cmd->data && host->clock > 400000 && -+ host->clock <= 50000000 && -+ ((1 << (count + start)) > (10 * host->clock))) -+ host->data_timeout = 22LL * NSEC_PER_SEC; -+} -+ - /* - * Platform specific register write functions. This is so that, if any - * register write needs to be followed up by platform specific actions, -@@ -1753,6 +1770,7 @@ static const struct sdhci_ops sdhci_msm_ops = { - .set_uhs_signaling = sdhci_msm_set_uhs_signaling, - .write_w = sdhci_msm_writew, - .write_b = sdhci_msm_writeb, -+ .set_timeout = sdhci_msm_set_timeout, - }; - - static const struct sdhci_pltfm_data sdhci_msm_pdata = { -diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c -index 485e20e0dec2c..8847942a8d97e 100644 ---- a/drivers/net/can/usb/esd_usb2.c -+++ b/drivers/net/can/usb/esd_usb2.c -@@ -224,8 +224,8 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, - if (id == ESD_EV_CAN_ERROR_EXT) { - u8 state = msg->msg.rx.data[0]; - u8 ecc = msg->msg.rx.data[1]; -- u8 txerr = msg->msg.rx.data[2]; -- u8 rxerr = msg->msg.rx.data[3]; -+ u8 rxerr = msg->msg.rx.data[2]; -+ u8 txerr = msg->msg.rx.data[3]; - - skb = alloc_can_err_skb(priv->netdev, &cf); - if (skb == NULL) { -diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c -index e1a3c33fdad90..2d8382eb9add3 100644 ---- a/drivers/net/dsa/mt7530.c -+++ b/drivers/net/dsa/mt7530.c -@@ -842,11 +842,8 @@ mt7530_port_bridge_leave(struct dsa_switch *ds, int port, - /* Remove this port from the port matrix of the other ports - * in the same bridge. If the port is disabled, port matrix - * is kept and not being setup until the port becomes enabled. -- * And the other port's port matrix cannot be broken when the -- * other port is still a VLAN-aware port. - */ -- if (dsa_is_user_port(ds, i) && i != port && -- !dsa_port_is_vlan_filtering(&ds->ports[i])) { -+ if (dsa_is_user_port(ds, i) && i != port) { - if (dsa_to_port(ds, i)->bridge_dev != bridge) - continue; - if (priv->ports[i].enable) -diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c -index 02b4f3af02b54..848be6bf2fd1f 100644 ---- a/drivers/net/ethernet/apm/xgene-v2/main.c -+++ b/drivers/net/ethernet/apm/xgene-v2/main.c -@@ -677,11 +677,13 @@ static int xge_probe(struct platform_device *pdev) - ret = register_netdev(ndev); - if (ret) { - netdev_err(ndev, "Failed to register netdev\n"); -- goto err; -+ goto err_mdio_remove; - } - - return 0; - -+err_mdio_remove: -+ xge_mdio_remove(ndev); - err: - free_netdev(ndev); - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -index e34e0854635c3..d64cded30eeb4 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h -@@ -257,6 +257,9 @@ enum hclge_opcode_type { - /* Led command */ - HCLGE_OPC_LED_STATUS_CFG = 0xB000, - -+ /* clear hardware resource command */ -+ HCLGE_OPC_CLEAR_HW_RESOURCE = 0x700B, -+ - /* NCL config command */ - HCLGE_OPC_QUERY_NCL_CONFIG = 0x7011, - /* M7 stats command */ -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -index a1790af73096d..d16488bab86f5 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c -@@ -281,21 +281,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) - u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC]; - struct hclge_vport *vport = hclge_get_vport(h); - struct hclge_dev *hdev = vport->back; -- u8 i, j, pfc_map, *prio_tc; - int ret; -+ u8 i; - - memset(pfc, 0, sizeof(*pfc)); - pfc->pfc_cap = hdev->pfc_max; -- prio_tc = hdev->tm_info.prio_tc; -- pfc_map = hdev->tm_info.hw_pfc_map; -- -- /* Pfc setting is based on TC */ -- for (i = 0; i < hdev->tm_info.num_tc; i++) { -- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) { -- if ((prio_tc[j] == i) && (pfc_map & BIT(i))) -- pfc->pfc_en |= BIT(j); -- } -- } -+ pfc->pfc_en = hdev->tm_info.pfc_en; - - ret = hclge_pfc_tx_stats_get(hdev, requests); - if (ret) -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 93f3865b679bf..aa402e2671212 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -8006,7 +8006,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev) - static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id, - bool writen_to_tbl) - { -- struct hclge_vport_vlan_cfg *vlan; -+ struct hclge_vport_vlan_cfg *vlan, *tmp; -+ -+ list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) -+ if (vlan->vlan_id == vlan_id) -+ return; - - vlan = kzalloc(sizeof(*vlan), GFP_KERNEL); - if (!vlan) -@@ -9165,6 +9169,28 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev) - } - } - -+static int hclge_clear_hw_resource(struct hclge_dev *hdev) -+{ -+ struct hclge_desc desc; -+ int ret; -+ -+ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CLEAR_HW_RESOURCE, false); -+ -+ ret = hclge_cmd_send(&hdev->hw, &desc, 1); -+ /* This new command is only supported by new firmware, it will -+ * fail with older firmware. Error value -EOPNOSUPP can only be -+ * returned by older firmware running this command, to keep code -+ * backward compatible we will override this value and return -+ * success. -+ */ -+ if (ret && ret != -EOPNOTSUPP) { -+ dev_err(&hdev->pdev->dev, -+ "failed to clear hw resource, ret = %d\n", ret); -+ return ret; -+ } -+ return 0; -+} -+ - static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) - { - struct pci_dev *pdev = ae_dev->pdev; -@@ -9206,6 +9232,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) - if (ret) - goto err_cmd_uninit; - -+ ret = hclge_clear_hw_resource(hdev); -+ if (ret) -+ goto err_cmd_uninit; -+ - ret = hclge_get_cap(hdev); - if (ret) { - dev_err(&pdev->dev, "get hw capability error, ret = %d.\n", -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index a1fab77b2096a..58ff747a42ae6 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) - { - u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | - link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; -+ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ -+ u16 lat_enc_d = 0; /* latency decoded */ - u16 lat_enc = 0; /* latency encoded */ - - if (link) { -@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) - E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); - max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); - -- if (lat_enc > max_ltr_enc) -+ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * -+ (1U << (E1000_LTRV_SCALE_FACTOR * -+ ((lat_enc & E1000_LTRV_SCALE_MASK) -+ >> E1000_LTRV_SCALE_SHIFT))); -+ -+ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * -+ (1U << (E1000_LTRV_SCALE_FACTOR * -+ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) -+ >> E1000_LTRV_SCALE_SHIFT))); -+ -+ if (lat_enc_d > max_ltr_enc_d) - lat_enc = max_ltr_enc; - } - -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h -index 1502895eb45dd..e757896287eba 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.h -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h -@@ -274,8 +274,11 @@ - - /* Latency Tolerance Reporting */ - #define E1000_LTRV 0x000F8 -+#define E1000_LTRV_VALUE_MASK 0x000003FF - #define E1000_LTRV_SCALE_MAX 5 - #define E1000_LTRV_SCALE_FACTOR 5 -+#define E1000_LTRV_SCALE_SHIFT 10 -+#define E1000_LTRV_SCALE_MASK 0x00001C00 - #define E1000_LTRV_REQ_SHIFT 15 - #define E1000_LTRV_NOSNOOP_SHIFT 16 - #define E1000_LTRV_SEND (1 << 30) -diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c -index 7b0543056b101..64aa5510e61a6 100644 ---- a/drivers/net/ethernet/marvell/mvneta.c -+++ b/drivers/net/ethernet/marvell/mvneta.c -@@ -101,7 +101,7 @@ - #define MVNETA_DESC_SWAP BIT(6) - #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) - #define MVNETA_PORT_STATUS 0x2444 --#define MVNETA_TX_IN_PRGRS BIT(1) -+#define MVNETA_TX_IN_PRGRS BIT(0) - #define MVNETA_TX_FIFO_EMPTY BIT(8) - #define MVNETA_RX_MIN_FRAME_SIZE 0x247c - /* Only exists on Armada XP and Armada 370 */ -diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c -index 19a1a58d60f89..c449ecc0add23 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c -@@ -353,6 +353,9 @@ static int qed_ll2_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) - unsigned long flags; - int rc = -EINVAL; - -+ if (!p_ll2_conn) -+ return rc; -+ - spin_lock_irqsave(&p_tx->lock, flags); - if (p_tx->b_completing_packet) { - rc = -EBUSY; -@@ -526,7 +529,16 @@ static int qed_ll2_rxq_completion(struct qed_hwfn *p_hwfn, void *cookie) - unsigned long flags = 0; - int rc = 0; - -+ if (!p_ll2_conn) -+ return rc; -+ - spin_lock_irqsave(&p_rx->lock, flags); -+ -+ if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) { -+ spin_unlock_irqrestore(&p_rx->lock, flags); -+ return 0; -+ } -+ - cq_new_idx = le16_to_cpu(*p_rx->p_fw_cons); - cq_old_idx = qed_chain_get_cons_idx(&p_rx->rcq_chain); - -@@ -847,6 +859,9 @@ static int qed_ll2_lb_rxq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) - struct qed_ll2_info *p_ll2_conn = (struct qed_ll2_info *)p_cookie; - int rc; - -+ if (!p_ll2_conn) -+ return 0; -+ - if (!QED_LL2_RX_REGISTERED(p_ll2_conn)) - return 0; - -@@ -870,6 +885,9 @@ static int qed_ll2_lb_txq_completion(struct qed_hwfn *p_hwfn, void *p_cookie) - u16 new_idx = 0, num_bds = 0; - int rc; - -+ if (!p_ll2_conn) -+ return 0; -+ - if (!QED_LL2_TX_REGISTERED(p_ll2_conn)) - return 0; - -@@ -1642,6 +1660,8 @@ int qed_ll2_post_rx_buffer(void *cxt, - if (!p_ll2_conn) - return -EINVAL; - p_rx = &p_ll2_conn->rx_queue; -+ if (!p_rx->set_prod_addr) -+ return -EIO; - - spin_lock_irqsave(&p_rx->lock, flags); - if (!list_empty(&p_rx->free_descq)) -diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c -index 38b1f402f7ed2..b291971bcf926 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c -@@ -1245,8 +1245,7 @@ qed_rdma_create_qp(void *rdma_cxt, - - if (!rdma_cxt || !in_params || !out_params || - !p_hwfn->p_rdma_info->active) { -- DP_ERR(p_hwfn->cdev, -- "qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n", -+ pr_err("qed roce create qp failed due to NULL entry (rdma_cxt=%p, in=%p, out=%p, roce_info=?\n", - rdma_cxt, in_params, out_params); - return NULL; - } -diff --git a/drivers/opp/of.c b/drivers/opp/of.c -index 249738e1e0b7a..603c688fe23dc 100644 ---- a/drivers/opp/of.c -+++ b/drivers/opp/of.c -@@ -682,8 +682,9 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table) - } - } - -- /* There should be one of more OPP defined */ -- if (WARN_ON(!count)) { -+ /* There should be one or more OPPs defined */ -+ if (!count) { -+ dev_err(dev, "%s: no supported OPPs", __func__); - ret = -ENOENT; - goto remove_static_opp; - } -diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c -index 11592ec7b23ea..6aeb79e744e0b 100644 ---- a/drivers/scsi/scsi_sysfs.c -+++ b/drivers/scsi/scsi_sysfs.c -@@ -788,12 +788,15 @@ store_state_field(struct device *dev, struct device_attribute *attr, - ret = scsi_device_set_state(sdev, state); - /* - * If the device state changes to SDEV_RUNNING, we need to -- * rescan the device to revalidate it, and run the queue to -- * avoid I/O hang. -+ * run the queue to avoid I/O hang, and rescan the device -+ * to revalidate it. Running the queue first is necessary -+ * because another thread may be waiting inside -+ * blk_mq_freeze_queue_wait() and because that call may be -+ * waiting for pending I/O to finish. - */ - if (ret == 0 && state == SDEV_RUNNING) { -- scsi_rescan_device(dev); - blk_mq_run_hw_queues(sdev->request_queue, true); -+ scsi_rescan_device(dev); - } - mutex_unlock(&sdev->state_mutex); - -diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c -index b5d2ad900ec09..167c72726c5a0 100644 ---- a/drivers/tty/vt/vt_ioctl.c -+++ b/drivers/tty/vt/vt_ioctl.c -@@ -484,16 +484,19 @@ int vt_ioctl(struct tty_struct *tty, - ret = -EINVAL; - goto out; - } -- /* FIXME: this needs the console lock extending */ -- if (vc->vc_mode == (unsigned char) arg) -+ console_lock(); -+ if (vc->vc_mode == (unsigned char) arg) { -+ console_unlock(); - break; -+ } - vc->vc_mode = (unsigned char) arg; -- if (console != fg_console) -+ if (console != fg_console) { -+ console_unlock(); - break; -+ } - /* - * explicitly blank/unblank the screen if switching modes - */ -- console_lock(); - if (arg == KD_TEXT) - do_unblank_screen(1); - else -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 8a3752fcf7b46..39a9ad12cbbc8 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -894,19 +894,19 @@ static struct dwc3_trb *dwc3_ep_prev_trb(struct dwc3_ep *dep, u8 index) - - static u32 dwc3_calc_trbs_left(struct dwc3_ep *dep) - { -- struct dwc3_trb *tmp; - u8 trbs_left; - - /* -- * If enqueue & dequeue are equal than it is either full or empty. -- * -- * One way to know for sure is if the TRB right before us has HWO bit -- * set or not. If it has, then we're definitely full and can't fit any -- * more transfers in our ring. -+ * If the enqueue & dequeue are equal then the TRB ring is either full -+ * or empty. It's considered full when there are DWC3_TRB_NUM-1 of TRBs -+ * pending to be processed by the driver. - */ - if (dep->trb_enqueue == dep->trb_dequeue) { -- tmp = dwc3_ep_prev_trb(dep, dep->trb_enqueue); -- if (tmp->ctrl & DWC3_TRB_CTRL_HWO) -+ /* -+ * If there is any request remained in the started_list at -+ * this point, that means there is no TRB available. -+ */ -+ if (!list_empty(&dep->started_list)) - return 0; - - return DWC3_TRB_NUM - 1; -@@ -2012,10 +2012,8 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on) - - ret = wait_for_completion_timeout(&dwc->ep0_in_setup, - msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT)); -- if (ret == 0) { -- dev_err(dwc->dev, "timed out waiting for SETUP phase\n"); -- return -ETIMEDOUT; -- } -+ if (ret == 0) -+ dev_warn(dwc->dev, "timed out waiting for SETUP phase\n"); - } - - /* -@@ -2217,6 +2215,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) - /* begin to receive SETUP packets */ - dwc->ep0state = EP0_SETUP_PHASE; - dwc->link_state = DWC3_LINK_STATE_SS_DIS; -+ dwc->delayed_status = false; - dwc3_ep0_out_start(dwc); - - dwc3_gadget_enable_irq(dwc); -diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c -index 223029fa84459..4e01ba0ab8ecb 100644 ---- a/drivers/usb/gadget/function/u_audio.c -+++ b/drivers/usb/gadget/function/u_audio.c -@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) - if (!prm->ep_enabled) - return; - -- prm->ep_enabled = false; -- - audio_dev = uac->audio_dev; - params = &audio_dev->params; - -@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) - } - } - -+ prm->ep_enabled = false; -+ - if (usb_ep_disable(ep)) - dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); - } - -- - int u_audio_start_capture(struct g_audio *audio_dev) - { - struct snd_uac_chip *uac = audio_dev->uac; -diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c -index e9c39a41faae9..a82ba9cc0c724 100644 ---- a/drivers/usb/serial/ch341.c -+++ b/drivers/usb/serial/ch341.c -@@ -678,7 +678,6 @@ static struct usb_serial_driver ch341_device = { - .owner = THIS_MODULE, - .name = "ch341-uart", - }, -- .bulk_in_size = 512, - .id_table = id_table, - .num_ports = 1, - .open = ch341_open, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 793530f241ceb..d42ca13569965 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2074,6 +2074,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = RSVD(4) | RSVD(5) }, - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ - .driver_info = RSVD(6) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ - { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */ - { USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) }, /* LongSung M5710 */ - { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ -diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c -index 026a37ee41777..4653de001e261 100644 ---- a/drivers/vhost/vringh.c -+++ b/drivers/vhost/vringh.c -@@ -331,7 +331,7 @@ __vringh_iov(struct vringh *vrh, u16 i, - iov = wiov; - else { - iov = riov; -- if (unlikely(wiov && wiov->i)) { -+ if (unlikely(wiov && wiov->used)) { - vringh_bad("Readable desc %p after writable", - &descs[i]); - err = -EINVAL; -diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c -index 222d630c41fc9..b35bb2d57f62c 100644 ---- a/drivers/virtio/virtio_pci_common.c -+++ b/drivers/virtio/virtio_pci_common.c -@@ -576,6 +576,13 @@ static void virtio_pci_remove(struct pci_dev *pci_dev) - struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev); - struct device *dev = get_device(&vp_dev->vdev.dev); - -+ /* -+ * Device is marked broken on surprise removal so that virtio upper -+ * layers can abort any ongoing operation. -+ */ -+ if (!pci_device_is_present(pci_dev)) -+ virtio_break_device(&vp_dev->vdev); -+ - pci_disable_sriov(pci_dev); - - unregister_virtio_device(&vp_dev->vdev); -diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c -index f6011c9ed32f1..e442d400dbb2e 100644 ---- a/drivers/virtio/virtio_ring.c -+++ b/drivers/virtio/virtio_ring.c -@@ -2268,7 +2268,7 @@ bool virtqueue_is_broken(struct virtqueue *_vq) - { - struct vring_virtqueue *vq = to_vvq(_vq); - -- return vq->broken; -+ return READ_ONCE(vq->broken); - } - EXPORT_SYMBOL_GPL(virtqueue_is_broken); - -@@ -2283,7 +2283,9 @@ void virtio_break_device(struct virtio_device *dev) - spin_lock(&dev->vqs_list_lock); - list_for_each_entry(_vq, &dev->vqs, list) { - struct vring_virtqueue *vq = to_vvq(_vq); -- vq->broken = true; -+ -+ /* Pairs with READ_ONCE() in virtqueue_is_broken(). */ -+ WRITE_ONCE(vq->broken, true); - } - spin_unlock(&dev->vqs_list_lock); - } -diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h -index f853835c409c1..f3ff57b931580 100644 ---- a/fs/btrfs/btrfs_inode.h -+++ b/fs/btrfs/btrfs_inode.h -@@ -268,6 +268,21 @@ static inline void btrfs_mod_outstanding_extents(struct btrfs_inode *inode, - mod); - } - -+/* -+ * Called every time after doing a buffered, direct IO or memory mapped write. -+ * -+ * This is to ensure that if we write to a file that was previously fsynced in -+ * the current transaction, then try to fsync it again in the same transaction, -+ * we will know that there were changes in the file and that it needs to be -+ * logged. -+ */ -+static inline void btrfs_set_inode_last_sub_trans(struct btrfs_inode *inode) -+{ -+ spin_lock(&inode->lock); -+ inode->last_sub_trans = inode->root->log_transid; -+ spin_unlock(&inode->lock); -+} -+ - static inline int btrfs_inode_in_log(struct btrfs_inode *inode, u64 generation) - { - int ret = 0; -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 400b0717b9d44..1279359ed172a 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -2004,14 +2004,8 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb, - - inode_unlock(inode); - -- /* -- * We also have to set last_sub_trans to the current log transid, -- * otherwise subsequent syncs to a file that's been synced in this -- * transaction will appear to have already occurred. -- */ -- spin_lock(&BTRFS_I(inode)->lock); -- BTRFS_I(inode)->last_sub_trans = root->log_transid; -- spin_unlock(&BTRFS_I(inode)->lock); -+ btrfs_set_inode_last_sub_trans(BTRFS_I(inode)); -+ - if (num_written > 0) - num_written = generic_write_sync(iocb, num_written); - -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 54b607a3cc3f2..29552d4f6845b 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -9250,9 +9250,7 @@ again: - set_page_dirty(page); - SetPageUptodate(page); - -- BTRFS_I(inode)->last_trans = fs_info->generation; -- BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid; -- BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->root->last_log_commit; -+ btrfs_set_inode_last_sub_trans(BTRFS_I(inode)); - - unlock_extent_cached(io_tree, page_start, page_end, &cached_state); - -diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h -index d8a7d460e436a..cbede328bda5b 100644 ---- a/fs/btrfs/transaction.h -+++ b/fs/btrfs/transaction.h -@@ -160,7 +160,7 @@ static inline void btrfs_set_inode_last_trans(struct btrfs_trans_handle *trans, - spin_lock(&BTRFS_I(inode)->lock); - BTRFS_I(inode)->last_trans = trans->transaction->transid; - BTRFS_I(inode)->last_sub_trans = BTRFS_I(inode)->root->log_transid; -- BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->root->last_log_commit; -+ BTRFS_I(inode)->last_log_commit = BTRFS_I(inode)->last_sub_trans - 1; - spin_unlock(&BTRFS_I(inode)->lock); - } - -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 3e3529c600cb7..e882c790292f9 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -2168,7 +2168,7 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info, const char *device_path, - - if (IS_ERR(device)) { - if (PTR_ERR(device) == -ENOENT && -- strcmp(device_path, "missing") == 0) -+ device_path && strcmp(device_path, "missing") == 0) - ret = BTRFS_ERROR_DEV_MISSING_NOT_FOUND; - else - ret = PTR_ERR(device); -diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c -index 11dd8177770df..19574ef174709 100644 ---- a/fs/overlayfs/export.c -+++ b/fs/overlayfs/export.c -@@ -395,6 +395,7 @@ static struct dentry *ovl_lookup_real_one(struct dentry *connected, - */ - take_dentry_name_snapshot(&name, real); - this = lookup_one_len(name.name.name, connected, name.name.len); -+ release_dentry_name_snapshot(&name); - err = PTR_ERR(this); - if (IS_ERR(this)) { - goto fail; -@@ -409,7 +410,6 @@ static struct dentry *ovl_lookup_real_one(struct dentry *connected, - } - - out: -- release_dentry_name_snapshot(&name); - dput(parent); - inode_unlock(dir); - return this; -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 90d2f62a96723..5a187e9b72212 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -549,8 +549,17 @@ static int proc_oom_score(struct seq_file *m, struct pid_namespace *ns, - { - unsigned long totalpages = totalram_pages() + total_swap_pages; - unsigned long points = 0; -+ long badness; -+ -+ badness = oom_badness(task, totalpages); -+ /* -+ * Special case OOM_SCORE_ADJ_MIN for all others scale the -+ * badness value into [0, 2000] range which we have been -+ * exporting for a long time so userspace might depend on it. -+ */ -+ if (badness != LONG_MIN) -+ points = (1000 + badness * 1000 / (long)totalpages) * 2 / 3; - -- points = oom_badness(task, totalpages) * 1000 / totalpages; - seq_printf(m, "%lu\n", points); - - return 0; -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 11a52f2fa35de..ddc66ab8a1def 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3684,6 +3684,10 @@ int netdev_rx_handler_register(struct net_device *dev, - void netdev_rx_handler_unregister(struct net_device *dev); - - bool dev_valid_name(const char *name); -+static inline bool is_socket_ioctl_cmd(unsigned int cmd) -+{ -+ return _IOC_TYPE(cmd) == SOCK_IOC_TYPE; -+} - int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, - bool *need_copyout); - int dev_ifconf(struct net *net, struct ifconf *, int); -diff --git a/include/linux/once.h b/include/linux/once.h -index 9225ee6d96c75..ae6f4eb41cbe7 100644 ---- a/include/linux/once.h -+++ b/include/linux/once.h -@@ -7,7 +7,7 @@ - - bool __do_once_start(bool *done, unsigned long *flags); - void __do_once_done(bool *done, struct static_key_true *once_key, -- unsigned long *flags); -+ unsigned long *flags, struct module *mod); - - /* Call a function exactly once. The idea of DO_ONCE() is to perform - * a function call such as initialization of random seeds, etc, only -@@ -46,7 +46,7 @@ void __do_once_done(bool *done, struct static_key_true *once_key, - if (unlikely(___ret)) { \ - func(__VA_ARGS__); \ - __do_once_done(&___done, &___once_key, \ -- &___flags); \ -+ &___flags, THIS_MODULE); \ - } \ - } \ - ___ret; \ -diff --git a/include/linux/oom.h b/include/linux/oom.h -index b9df34326772c..2db9a14325112 100644 ---- a/include/linux/oom.h -+++ b/include/linux/oom.h -@@ -48,7 +48,7 @@ struct oom_control { - /* Used by oom implementation, do not set */ - unsigned long totalpages; - struct task_struct *chosen; -- unsigned long chosen_points; -+ long chosen_points; - - /* Used to print the constraint info. */ - enum oom_constraint constraint; -@@ -108,7 +108,7 @@ static inline vm_fault_t check_stable_address_space(struct mm_struct *mm) - - bool __oom_reap_task_mm(struct mm_struct *mm); - --extern unsigned long oom_badness(struct task_struct *p, -+long oom_badness(struct task_struct *p, - unsigned long totalpages); - - extern bool out_of_memory(struct oom_control *oc); -diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c -index e49c912f862d0..9dec6314cd28a 100644 ---- a/kernel/audit_tree.c -+++ b/kernel/audit_tree.c -@@ -595,7 +595,6 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged) - spin_lock(&hash_lock); - } - spin_unlock(&hash_lock); -- put_tree(victim); - } - - /* -@@ -604,6 +603,7 @@ static void prune_tree_chunks(struct audit_tree *victim, bool tagged) - static void prune_one(struct audit_tree *victim) - { - prune_tree_chunks(victim, false); -+ put_tree(victim); - } - - /* trim the uncommitted chunks from tree */ -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 0b5a446ee59c9..4deaf15b7618b 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -2778,6 +2778,41 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size) - reg->smax_value = reg->umax_value; - } - -+static bool bpf_map_is_rdonly(const struct bpf_map *map) -+{ -+ return (map->map_flags & BPF_F_RDONLY_PROG) && map->frozen; -+} -+ -+static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val) -+{ -+ void *ptr; -+ u64 addr; -+ int err; -+ -+ err = map->ops->map_direct_value_addr(map, &addr, off); -+ if (err) -+ return err; -+ ptr = (void *)(long)addr + off; -+ -+ switch (size) { -+ case sizeof(u8): -+ *val = (u64)*(u8 *)ptr; -+ break; -+ case sizeof(u16): -+ *val = (u64)*(u16 *)ptr; -+ break; -+ case sizeof(u32): -+ *val = (u64)*(u32 *)ptr; -+ break; -+ case sizeof(u64): -+ *val = *(u64 *)ptr; -+ break; -+ default: -+ return -EINVAL; -+ } -+ return 0; -+} -+ - /* check whether memory at (regno + off) is accessible for t = (read | write) - * if t==write, value_regno is a register which value is stored into memory - * if t==read, value_regno is a register which will receive the value from memory -@@ -2815,9 +2850,27 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn - if (err) - return err; - err = check_map_access(env, regno, off, size, false); -- if (!err && t == BPF_READ && value_regno >= 0) -- mark_reg_unknown(env, regs, value_regno); -+ if (!err && t == BPF_READ && value_regno >= 0) { -+ struct bpf_map *map = reg->map_ptr; -+ -+ /* if map is read-only, track its contents as scalars */ -+ if (tnum_is_const(reg->var_off) && -+ bpf_map_is_rdonly(map) && -+ map->ops->map_direct_value_addr) { -+ int map_off = off + reg->var_off.value; -+ u64 val = 0; - -+ err = bpf_map_direct_read(map, map_off, size, -+ &val); -+ if (err) -+ return err; -+ -+ regs[value_regno].type = SCALAR_VALUE; -+ __mark_reg_known(®s[value_regno], val); -+ } else { -+ mark_reg_unknown(env, regs, value_regno); -+ } -+ } - } else if (reg->type == PTR_TO_CTX) { - enum bpf_reg_type reg_type = SCALAR_VALUE; - -diff --git a/lib/once.c b/lib/once.c -index 8b7d6235217ee..59149bf3bfb4a 100644 ---- a/lib/once.c -+++ b/lib/once.c -@@ -3,10 +3,12 @@ - #include - #include - #include -+#include - - struct once_work { - struct work_struct work; - struct static_key_true *key; -+ struct module *module; - }; - - static void once_deferred(struct work_struct *w) -@@ -16,10 +18,11 @@ static void once_deferred(struct work_struct *w) - work = container_of(w, struct once_work, work); - BUG_ON(!static_key_enabled(work->key)); - static_branch_disable(work->key); -+ module_put(work->module); - kfree(work); - } - --static void once_disable_jump(struct static_key_true *key) -+static void once_disable_jump(struct static_key_true *key, struct module *mod) - { - struct once_work *w; - -@@ -29,6 +32,8 @@ static void once_disable_jump(struct static_key_true *key) - - INIT_WORK(&w->work, once_deferred); - w->key = key; -+ w->module = mod; -+ __module_get(mod); - schedule_work(&w->work); - } - -@@ -53,11 +58,11 @@ bool __do_once_start(bool *done, unsigned long *flags) - EXPORT_SYMBOL(__do_once_start); - - void __do_once_done(bool *done, struct static_key_true *once_key, -- unsigned long *flags) -+ unsigned long *flags, struct module *mod) - __releases(once_lock) - { - *done = true; - spin_unlock_irqrestore(&once_lock, *flags); -- once_disable_jump(once_key); -+ once_disable_jump(once_key, mod); - } - EXPORT_SYMBOL(__do_once_done); -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index 212e718743018..f1b810ddf2327 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -197,17 +197,17 @@ static bool is_dump_unreclaim_slabs(void) - * predictable as possible. The goal is to return the highest value for the - * task consuming the most memory to avoid subsequent oom failures. - */ --unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) -+long oom_badness(struct task_struct *p, unsigned long totalpages) - { - long points; - long adj; - - if (oom_unkillable_task(p)) -- return 0; -+ return LONG_MIN; - - p = find_lock_task_mm(p); - if (!p) -- return 0; -+ return LONG_MIN; - - /* - * Do not even consider tasks which are explicitly marked oom -@@ -219,7 +219,7 @@ unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) - test_bit(MMF_OOM_SKIP, &p->mm->flags) || - in_vfork(p)) { - task_unlock(p); -- return 0; -+ return LONG_MIN; - } - - /* -@@ -234,11 +234,7 @@ unsigned long oom_badness(struct task_struct *p, unsigned long totalpages) - adj *= totalpages / 1000; - points += adj; - -- /* -- * Never return 0 for an eligible task regardless of the root bonus and -- * oom_score_adj (oom_score_adj can't be OOM_SCORE_ADJ_MIN here). -- */ -- return points > 0 ? points : 1; -+ return points; - } - - static const char * const oom_constraint_text[] = { -@@ -311,7 +307,7 @@ static enum oom_constraint constrained_alloc(struct oom_control *oc) - static int oom_evaluate_task(struct task_struct *task, void *arg) - { - struct oom_control *oc = arg; -- unsigned long points; -+ long points; - - if (oom_unkillable_task(task)) - goto next; -@@ -337,12 +333,12 @@ static int oom_evaluate_task(struct task_struct *task, void *arg) - * killed first if it triggers an oom, then select it. - */ - if (oom_task_origin(task)) { -- points = ULONG_MAX; -+ points = LONG_MAX; - goto select; - } - - points = oom_badness(task, oc->totalpages); -- if (!points || points < oc->chosen_points) -+ if (points == LONG_MIN || points < oc->chosen_points) - goto next; - - select: -@@ -366,6 +362,8 @@ abort: - */ - static void select_bad_process(struct oom_control *oc) - { -+ oc->chosen_points = LONG_MIN; -+ - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 0bad5db23129a..6fbc9cb09dc0e 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -2414,6 +2414,7 @@ static int do_setlink(const struct sk_buff *skb, - return err; - - if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_TARGET_NETNSID]) { -+ const char *pat = ifname && ifname[0] ? ifname : NULL; - struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev), - tb, CAP_NET_ADMIN); - if (IS_ERR(net)) { -@@ -2421,7 +2422,7 @@ static int do_setlink(const struct sk_buff *skb, - goto errout; - } - -- err = dev_change_net_namespace(dev, net, ifname); -+ err = dev_change_net_namespace(dev, net, pat); - put_net(net); - if (err) - goto errout; -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index fedad3a3e61b8..fd8298b8b1c52 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -446,6 +446,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, - - static int gre_handle_offloads(struct sk_buff *skb, bool csum) - { -+ if (csum && skb_checksum_start(skb) < skb->data) -+ return -EINVAL; - return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); - } - -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 4a988ce4264cb..4bcc36e4b2ef0 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -66,22 +66,17 @@ EXPORT_SYMBOL_GPL(nf_conntrack_hash); - - struct conntrack_gc_work { - struct delayed_work dwork; -- u32 last_bucket; -+ u32 next_bucket; - bool exiting; - bool early_drop; -- long next_gc_run; - }; - - static __read_mostly struct kmem_cache *nf_conntrack_cachep; - static DEFINE_SPINLOCK(nf_conntrack_locks_all_lock); - static __read_mostly bool nf_conntrack_locks_all; - --/* every gc cycle scans at most 1/GC_MAX_BUCKETS_DIV part of table */ --#define GC_MAX_BUCKETS_DIV 128u --/* upper bound of full table scan */ --#define GC_MAX_SCAN_JIFFIES (16u * HZ) --/* desired ratio of entries found to be expired */ --#define GC_EVICT_RATIO 50u -+#define GC_SCAN_INTERVAL (120u * HZ) -+#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10) - - static struct conntrack_gc_work conntrack_gc_work; - -@@ -1226,17 +1221,13 @@ static void nf_ct_offload_timeout(struct nf_conn *ct) - - static void gc_worker(struct work_struct *work) - { -- unsigned int min_interval = max(HZ / GC_MAX_BUCKETS_DIV, 1u); -- unsigned int i, goal, buckets = 0, expired_count = 0; -- unsigned int nf_conntrack_max95 = 0; -+ unsigned long end_time = jiffies + GC_SCAN_MAX_DURATION; -+ unsigned int i, hashsz, nf_conntrack_max95 = 0; -+ unsigned long next_run = GC_SCAN_INTERVAL; - struct conntrack_gc_work *gc_work; -- unsigned int ratio, scanned = 0; -- unsigned long next_run; -- - gc_work = container_of(work, struct conntrack_gc_work, dwork.work); - -- goal = nf_conntrack_htable_size / GC_MAX_BUCKETS_DIV; -- i = gc_work->last_bucket; -+ i = gc_work->next_bucket; - if (gc_work->early_drop) - nf_conntrack_max95 = nf_conntrack_max / 100u * 95u; - -@@ -1244,22 +1235,21 @@ static void gc_worker(struct work_struct *work) - struct nf_conntrack_tuple_hash *h; - struct hlist_nulls_head *ct_hash; - struct hlist_nulls_node *n; -- unsigned int hashsz; - struct nf_conn *tmp; - -- i++; - rcu_read_lock(); - - nf_conntrack_get_ht(&ct_hash, &hashsz); -- if (i >= hashsz) -- i = 0; -+ if (i >= hashsz) { -+ rcu_read_unlock(); -+ break; -+ } - - hlist_nulls_for_each_entry_rcu(h, n, &ct_hash[i], hnnode) { - struct net *net; - - tmp = nf_ct_tuplehash_to_ctrack(h); - -- scanned++; - if (test_bit(IPS_OFFLOAD_BIT, &tmp->status)) { - nf_ct_offload_timeout(tmp); - continue; -@@ -1267,7 +1257,6 @@ static void gc_worker(struct work_struct *work) - - if (nf_ct_is_expired(tmp)) { - nf_ct_gc_expired(tmp); -- expired_count++; - continue; - } - -@@ -1299,7 +1288,14 @@ static void gc_worker(struct work_struct *work) - */ - rcu_read_unlock(); - cond_resched(); -- } while (++buckets < goal); -+ i++; -+ -+ if (time_after(jiffies, end_time) && i < hashsz) { -+ gc_work->next_bucket = i; -+ next_run = 0; -+ break; -+ } -+ } while (i < hashsz); - - if (gc_work->exiting) - return; -@@ -1310,40 +1306,17 @@ static void gc_worker(struct work_struct *work) - * - * This worker is only here to reap expired entries when system went - * idle after a busy period. -- * -- * The heuristics below are supposed to balance conflicting goals: -- * -- * 1. Minimize time until we notice a stale entry -- * 2. Maximize scan intervals to not waste cycles -- * -- * Normally, expire ratio will be close to 0. -- * -- * As soon as a sizeable fraction of the entries have expired -- * increase scan frequency. - */ -- ratio = scanned ? expired_count * 100 / scanned : 0; -- if (ratio > GC_EVICT_RATIO) { -- gc_work->next_gc_run = min_interval; -- } else { -- unsigned int max = GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV; -- -- BUILD_BUG_ON((GC_MAX_SCAN_JIFFIES / GC_MAX_BUCKETS_DIV) == 0); -- -- gc_work->next_gc_run += min_interval; -- if (gc_work->next_gc_run > max) -- gc_work->next_gc_run = max; -+ if (next_run) { -+ gc_work->early_drop = false; -+ gc_work->next_bucket = 0; - } -- -- next_run = gc_work->next_gc_run; -- gc_work->last_bucket = i; -- gc_work->early_drop = false; - queue_delayed_work(system_power_efficient_wq, &gc_work->dwork, next_run); - } - - static void conntrack_gc_work_init(struct conntrack_gc_work *gc_work) - { - INIT_DEFERRABLE_WORK(&gc_work->dwork, gc_worker); -- gc_work->next_gc_run = HZ; - gc_work->exiting = false; - } - -diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c -index faea2ce125110..b97a786d048cc 100644 ---- a/net/qrtr/qrtr.c -+++ b/net/qrtr/qrtr.c -@@ -314,7 +314,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) - goto err; - } - -- if (len != ALIGN(size, 4) + hdrlen) -+ if (!size || len != ALIGN(size, 4) + hdrlen) - goto err; - - if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA) -diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c -index 06ecf9d2d4bf1..ef6acd7211180 100644 ---- a/net/rds/ib_frmr.c -+++ b/net/rds/ib_frmr.c -@@ -131,9 +131,9 @@ static int rds_ib_post_reg_frmr(struct rds_ib_mr *ibmr) - cpu_relax(); - } - -- ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_len, -+ ret = ib_map_mr_sg_zbva(frmr->mr, ibmr->sg, ibmr->sg_dma_len, - &off, PAGE_SIZE); -- if (unlikely(ret != ibmr->sg_len)) -+ if (unlikely(ret != ibmr->sg_dma_len)) - return ret < 0 ? ret : -EINVAL; - - if (cmpxchg(&frmr->fr_state, -diff --git a/net/socket.c b/net/socket.c -index b14917dd811ad..94358566c9d10 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -1053,7 +1053,7 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, - rtnl_unlock(); - if (!err && copy_to_user(argp, &ifc, sizeof(struct ifconf))) - err = -EFAULT; -- } else { -+ } else if (is_socket_ioctl_cmd(cmd)) { - struct ifreq ifr; - bool need_copyout; - if (copy_from_user(&ifr, argp, sizeof(struct ifreq))) -@@ -1062,6 +1062,8 @@ static long sock_do_ioctl(struct net *net, struct socket *sock, - if (!err && need_copyout) - if (copy_to_user(argp, &ifr, sizeof(struct ifreq))) - return -EFAULT; -+ } else { -+ err = -ENOTTY; - } - return err; - } -@@ -3228,6 +3230,8 @@ static int compat_ifr_data_ioctl(struct net *net, unsigned int cmd, - struct ifreq ifreq; - u32 data32; - -+ if (!is_socket_ioctl_cmd(cmd)) -+ return -ENOTTY; - if (copy_from_user(ifreq.ifr_name, u_ifreq32->ifr_name, IFNAMSIZ)) - return -EFAULT; - if (get_user(data32, &u_ifreq32->ifr_data)) diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.144-145.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.144-145.patch deleted file mode 100644 index 0413ae41ef..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.144-145.patch +++ /dev/null @@ -1,1373 +0,0 @@ -diff --git a/Makefile b/Makefile -index 3c3804197b511..c32a36c8ffc90 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 144 -+SUBLEVEL = 145 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig -index 8383155c8c824..a9d0b5310165f 100644 ---- a/arch/arc/Kconfig -+++ b/arch/arc/Kconfig -@@ -29,6 +29,7 @@ config ARC - select GENERIC_SMP_IDLE_THREAD - select HAVE_ARCH_KGDB - select HAVE_ARCH_TRACEHOOK -+ select HAVE_COPY_THREAD_TLS - select HAVE_DEBUG_STACKOVERFLOW - select HAVE_FUTEX_CMPXCHG if FUTEX - select HAVE_IOREMAP_PROT -diff --git a/arch/arc/include/asm/syscalls.h b/arch/arc/include/asm/syscalls.h -index 7ddba13e9b599..c3f4714a4f5cd 100644 ---- a/arch/arc/include/asm/syscalls.h -+++ b/arch/arc/include/asm/syscalls.h -@@ -11,6 +11,7 @@ - #include - - int sys_clone_wrapper(int, int, int, int, int); -+int sys_clone3_wrapper(void *, size_t); - int sys_cacheflush(uint32_t, uint32_t uint32_t); - int sys_arc_settls(void *); - int sys_arc_gettls(void); -diff --git a/arch/arc/include/uapi/asm/unistd.h b/arch/arc/include/uapi/asm/unistd.h -index 5eafa11151623..fa2713ae6bea5 100644 ---- a/arch/arc/include/uapi/asm/unistd.h -+++ b/arch/arc/include/uapi/asm/unistd.h -@@ -21,6 +21,7 @@ - #define __ARCH_WANT_SET_GET_RLIMIT - #define __ARCH_WANT_SYS_EXECVE - #define __ARCH_WANT_SYS_CLONE -+#define __ARCH_WANT_SYS_CLONE3 - #define __ARCH_WANT_SYS_VFORK - #define __ARCH_WANT_SYS_FORK - #define __ARCH_WANT_TIME32_SYSCALLS -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index b37ca852a9f7e..cef1d3f2656f6 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -35,6 +35,18 @@ ENTRY(sys_clone_wrapper) - b .Lret_from_system_call - END(sys_clone_wrapper) - -+ENTRY(sys_clone3_wrapper) -+ SAVE_CALLEE_SAVED_USER -+ bl @sys_clone3 -+ DISCARD_CALLEE_SAVED_USER -+ -+ GET_CURR_THR_INFO_FLAGS r10 -+ btst r10, TIF_SYSCALL_TRACE -+ bnz tracesys_exit -+ -+ b .Lret_from_system_call -+END(sys_clone3_wrapper) -+ - ENTRY(ret_from_fork) - ; when the forked child comes here from the __switch_to function - ; r0 has the last task pointer. -diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c -index e1889ce3faf96..bfd4cbe74aa36 100644 ---- a/arch/arc/kernel/process.c -+++ b/arch/arc/kernel/process.c -@@ -171,9 +171,8 @@ asmlinkage void ret_from_fork(void); - * | user_r25 | - * ------------------ <===== END of PAGE - */ --int copy_thread(unsigned long clone_flags, -- unsigned long usp, unsigned long kthread_arg, -- struct task_struct *p) -+int copy_thread_tls(unsigned long clone_flags, unsigned long usp, -+ unsigned long kthread_arg, struct task_struct *p, unsigned long tls) - { - struct pt_regs *c_regs; /* child's pt_regs */ - unsigned long *childksp; /* to unwind out of __switch_to() */ -@@ -231,7 +230,7 @@ int copy_thread(unsigned long clone_flags, - * set task's userland tls data ptr from 4th arg - * clone C-lib call is difft from clone sys-call - */ -- task_thread_info(p)->thr_ptr = regs->r3; -+ task_thread_info(p)->thr_ptr = tls; - } else { - /* Normal fork case: set parent's TLS ptr in child */ - task_thread_info(p)->thr_ptr = -diff --git a/arch/arc/kernel/sys.c b/arch/arc/kernel/sys.c -index fddecc76efb7c..1069446bdc589 100644 ---- a/arch/arc/kernel/sys.c -+++ b/arch/arc/kernel/sys.c -@@ -7,6 +7,7 @@ - #include - - #define sys_clone sys_clone_wrapper -+#define sys_clone3 sys_clone3_wrapper - - #undef __SYSCALL - #define __SYSCALL(nr, call) [nr] = (call), -diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile -index 8cad59465af39..8b679e2ca3c3d 100644 ---- a/arch/arm/kernel/Makefile -+++ b/arch/arm/kernel/Makefile -@@ -17,10 +17,14 @@ CFLAGS_REMOVE_return_address.o = -pg - # Object file lists. - - obj-y := elf.o entry-common.o irq.o opcodes.o \ -- process.o ptrace.o reboot.o return_address.o \ -+ process.o ptrace.o reboot.o \ - setup.o signal.o sigreturn_codes.o \ - stacktrace.o sys_arm.o time.o traps.o - -+ifneq ($(CONFIG_ARM_UNWIND),y) -+obj-$(CONFIG_FRAME_POINTER) += return_address.o -+endif -+ - obj-$(CONFIG_ATAGS) += atags_parse.o - obj-$(CONFIG_ATAGS_PROC) += atags_proc.o - obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o -diff --git a/arch/arm/kernel/return_address.c b/arch/arm/kernel/return_address.c -index b0d2f1fe891d1..7b42ac010fdfd 100644 ---- a/arch/arm/kernel/return_address.c -+++ b/arch/arm/kernel/return_address.c -@@ -7,8 +7,6 @@ - */ - #include - #include -- --#if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) - #include - - #include -@@ -53,6 +51,4 @@ void *return_address(unsigned int level) - return NULL; - } - --#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */ -- - EXPORT_SYMBOL_GPL(return_address); -diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S -index 92608f34d3123..1d83966f5ef64 100644 ---- a/arch/powerpc/boot/crt0.S -+++ b/arch/powerpc/boot/crt0.S -@@ -44,9 +44,6 @@ p_end: .long _end - p_pstack: .long _platform_stack_top - #endif - -- .globl _zimage_start -- /* Clang appears to require the .weak directive to be after the symbol -- * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ - .weak _zimage_start - _zimage_start: - .globl _zimage_start_lib -diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c -index 39169885adfa8..ff07040287c40 100644 ---- a/arch/x86/events/amd/ibs.c -+++ b/arch/x86/events/amd/ibs.c -@@ -90,6 +90,7 @@ struct perf_ibs { - unsigned long offset_mask[1]; - int offset_max; - unsigned int fetch_count_reset_broken : 1; -+ unsigned int fetch_ignore_if_zero_rip : 1; - struct cpu_perf_ibs __percpu *pcpu; - - struct attribute **format_attrs; -@@ -663,6 +664,10 @@ fail: - if (check_rip && (ibs_data.regs[2] & IBS_RIP_INVALID)) { - regs.flags &= ~PERF_EFLAGS_EXACT; - } else { -+ /* Workaround for erratum #1197 */ -+ if (perf_ibs->fetch_ignore_if_zero_rip && !(ibs_data.regs[1])) -+ goto out; -+ - set_linear_ip(®s, ibs_data.regs[1]); - regs.flags |= PERF_EFLAGS_EXACT; - } -@@ -756,6 +761,9 @@ static __init void perf_event_ibs_init(void) - if (boot_cpu_data.x86 >= 0x16 && boot_cpu_data.x86 <= 0x18) - perf_ibs_fetch.fetch_count_reset_broken = 1; - -+ if (boot_cpu_data.x86 == 0x19 && boot_cpu_data.x86_model < 0x10) -+ perf_ibs_fetch.fetch_ignore_if_zero_rip = 1; -+ - perf_ibs_pmu_init(&perf_ibs_fetch, "ibs_fetch"); - - if (ibs_caps & IBS_CAPS_OPCNT) { -diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c -index 6a98a76516214..2da6139b0977f 100644 ---- a/arch/x86/events/amd/iommu.c -+++ b/arch/x86/events/amd/iommu.c -@@ -18,8 +18,6 @@ - #include "../perf_event.h" - #include "iommu.h" - --#define COUNTER_SHIFT 16 -- - /* iommu pmu conf masks */ - #define GET_CSOURCE(x) ((x)->conf & 0xFFULL) - #define GET_DEVID(x) (((x)->conf >> 8) & 0xFFFFULL) -@@ -285,22 +283,31 @@ static void perf_iommu_start(struct perf_event *event, int flags) - WARN_ON_ONCE(!(hwc->state & PERF_HES_UPTODATE)); - hwc->state = 0; - -+ /* -+ * To account for power-gating, which prevents write to -+ * the counter, we need to enable the counter -+ * before setting up counter register. -+ */ -+ perf_iommu_enable_event(event); -+ - if (flags & PERF_EF_RELOAD) { -- u64 prev_raw_count = local64_read(&hwc->prev_count); -+ u64 count = 0; - struct amd_iommu *iommu = perf_event_2_iommu(event); - -+ /* -+ * Since the IOMMU PMU only support counting mode, -+ * the counter always start with value zero. -+ */ - amd_iommu_pc_set_reg(iommu, hwc->iommu_bank, hwc->iommu_cntr, -- IOMMU_PC_COUNTER_REG, &prev_raw_count); -+ IOMMU_PC_COUNTER_REG, &count); - } - -- perf_iommu_enable_event(event); - perf_event_update_userpage(event); -- - } - - static void perf_iommu_read(struct perf_event *event) - { -- u64 count, prev, delta; -+ u64 count; - struct hw_perf_event *hwc = &event->hw; - struct amd_iommu *iommu = perf_event_2_iommu(event); - -@@ -311,14 +318,11 @@ static void perf_iommu_read(struct perf_event *event) - /* IOMMU pc counter register is only 48 bits */ - count &= GENMASK_ULL(47, 0); - -- prev = local64_read(&hwc->prev_count); -- if (local64_cmpxchg(&hwc->prev_count, prev, count) != prev) -- return; -- -- /* Handle 48-bit counter overflow */ -- delta = (count << COUNTER_SHIFT) - (prev << COUNTER_SHIFT); -- delta >>= COUNTER_SHIFT; -- local64_add(delta, &event->count); -+ /* -+ * Since the counter always start with value zero, -+ * simply just accumulate the count for the event. -+ */ -+ local64_add(count, &event->count); - } - - static void perf_iommu_stop(struct perf_event *event, int flags) -@@ -328,15 +332,16 @@ static void perf_iommu_stop(struct perf_event *event, int flags) - if (hwc->state & PERF_HES_UPTODATE) - return; - -+ /* -+ * To account for power-gating, in which reading the counter would -+ * return zero, we need to read the register before disabling. -+ */ -+ perf_iommu_read(event); -+ hwc->state |= PERF_HES_UPTODATE; -+ - perf_iommu_disable_event(event); - WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED); - hwc->state |= PERF_HES_STOPPED; -- -- if (hwc->state & PERF_HES_UPTODATE) -- return; -- -- perf_iommu_read(event); -- hwc->state |= PERF_HES_UPTODATE; - } - - static int perf_iommu_add(struct perf_event *event, int flags) -diff --git a/arch/x86/events/amd/power.c b/arch/x86/events/amd/power.c -index abef51320e3a5..c4892b7d0c36b 100644 ---- a/arch/x86/events/amd/power.c -+++ b/arch/x86/events/amd/power.c -@@ -217,6 +217,7 @@ static struct pmu pmu_class = { - .stop = pmu_event_stop, - .read = pmu_event_read, - .capabilities = PERF_PMU_CAP_NO_EXCLUDE, -+ .module = THIS_MODULE, - }; - - static int power_cpu_exit(unsigned int cpu) -diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c -index 05e43d0f430bc..da289a44d5116 100644 ---- a/arch/x86/events/intel/pt.c -+++ b/arch/x86/events/intel/pt.c -@@ -62,7 +62,7 @@ static struct pt_cap_desc { - PT_CAP(single_range_output, 0, CPUID_ECX, BIT(2)), - PT_CAP(output_subsys, 0, CPUID_ECX, BIT(3)), - PT_CAP(payloads_lip, 0, CPUID_ECX, BIT(31)), -- PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x3), -+ PT_CAP(num_address_ranges, 1, CPUID_EAX, 0x7), - PT_CAP(mtc_periods, 1, CPUID_EAX, 0xffff0000), - PT_CAP(cycle_thresholds, 1, CPUID_EBX, 0xffff), - PT_CAP(psb_periods, 1, CPUID_EBX, 0xffff0000), -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index b1b96d461bc76..d65d1afb27161 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = { - }, - { /* Handle problems with rebooting on the OptiPlex 990. */ - .callback = set_pci_reboot, -- .ident = "Dell OptiPlex 990", -+ .ident = "Dell OptiPlex 990 BIOS A0x", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), - DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"), -+ DMI_MATCH(DMI_BIOS_VERSION, "A0"), - }, - }, - { /* Handle problems with rebooting on Dell 300's */ -diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig -index 8352037322dfb..499bdd1f0c715 100644 ---- a/arch/xtensa/Kconfig -+++ b/arch/xtensa/Kconfig -@@ -27,7 +27,7 @@ config XTENSA - select HAVE_DMA_CONTIGUOUS - select HAVE_EXIT_THREAD - select HAVE_FUNCTION_TRACER -- select HAVE_FUTEX_CMPXCHG if !MMU -+ select HAVE_FUTEX_CMPXCHG if !MMU && FUTEX - select HAVE_HW_BREAKPOINT if PERF_EVENTS - select HAVE_IRQ_TIME_ACCOUNTING - select HAVE_OPROFILE -diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig -index 0fc27ac14f29c..9f6782329a237 100644 ---- a/drivers/block/Kconfig -+++ b/drivers/block/Kconfig -@@ -230,7 +230,7 @@ config BLK_DEV_LOOP_MIN_COUNT - dynamically allocated with the /dev/loop-control interface. - - config BLK_DEV_CRYPTOLOOP -- tristate "Cryptoloop Support" -+ tristate "Cryptoloop Support (DEPRECATED)" - select CRYPTO - select CRYPTO_CBC - depends on BLK_DEV_LOOP -@@ -242,7 +242,7 @@ config BLK_DEV_CRYPTOLOOP - WARNING: This device is not safe for journaled file systems like - ext3 or Reiserfs. Please use the Device Mapper crypto module - instead, which can be configured to be on-disk compatible with the -- cryptoloop device. -+ cryptoloop device. cryptoloop support will be removed in Linux 5.16. - - source "drivers/block/drbd/Kconfig" - -diff --git a/drivers/block/cryptoloop.c b/drivers/block/cryptoloop.c -index 3cabc335ae744..f0a91faa43a89 100644 ---- a/drivers/block/cryptoloop.c -+++ b/drivers/block/cryptoloop.c -@@ -189,6 +189,8 @@ init_cryptoloop(void) - - if (rc) - printk(KERN_ERR "cryptoloop: loop_register_transfer failed\n"); -+ else -+ pr_warn("the cryptoloop driver has been deprecated and will be removed in in Linux 5.16\n"); - return rc; - } - -diff --git a/drivers/gpu/ipu-v3/ipu-cpmem.c b/drivers/gpu/ipu-v3/ipu-cpmem.c -index a1c85d1521f5c..82b244cb313e6 100644 ---- a/drivers/gpu/ipu-v3/ipu-cpmem.c -+++ b/drivers/gpu/ipu-v3/ipu-cpmem.c -@@ -585,21 +585,21 @@ static const struct ipu_rgb def_bgra_16 = { - .bits_per_pixel = 16, - }; - --#define Y_OFFSET(pix, x, y) ((x) + pix->width * (y)) --#define U_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * ((y) / 2) / 2) + (x) / 2) --#define V_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * pix->height / 4) + \ -- (pix->width * ((y) / 2) / 2) + (x) / 2) --#define U2_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * (y) / 2) + (x) / 2) --#define V2_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * pix->height / 2) + \ -- (pix->width * (y) / 2) + (x) / 2) --#define UV_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * ((y) / 2)) + (x)) --#define UV2_OFFSET(pix, x, y) ((pix->width * pix->height) + \ -- (pix->width * y) + (x)) -+#define Y_OFFSET(pix, x, y) ((x) + pix->bytesperline * (y)) -+#define U_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2) -+#define V_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * pix->height / 4) + \ -+ (pix->bytesperline * ((y) / 2) / 2) + (x) / 2) -+#define U2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * (y) / 2) + (x) / 2) -+#define V2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * pix->height / 2) + \ -+ (pix->bytesperline * (y) / 2) + (x) / 2) -+#define UV_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * ((y) / 2)) + (x)) -+#define UV2_OFFSET(pix, x, y) ((pix->bytesperline * pix->height) + \ -+ (pix->bytesperline * y) + (x)) - - #define NUM_ALPHA_CHANNELS 7 - -diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c -index 21f90a8874852..7d6a4ff6e1421 100644 ---- a/drivers/media/usb/stkwebcam/stk-webcam.c -+++ b/drivers/media/usb/stkwebcam/stk-webcam.c -@@ -1346,7 +1346,7 @@ static int stk_camera_probe(struct usb_interface *interface, - if (!dev->isoc_ep) { - pr_err("Could not find isoc-in endpoint\n"); - err = -ENODEV; -- goto error; -+ goto error_put; - } - dev->vsettings.palette = V4L2_PIX_FMT_RGB565; - dev->vsettings.mode = MODE_VGA; -@@ -1359,10 +1359,12 @@ static int stk_camera_probe(struct usb_interface *interface, - - err = stk_register_video_device(dev); - if (err) -- goto error; -+ goto error_put; - - return 0; - -+error_put: -+ usb_put_intf(interface); - error: - v4l2_ctrl_handler_free(hdl); - v4l2_device_unregister(&dev->v4l2_dev); -diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c -index 43a3f0dbf857c..f5aec28c77306 100644 ---- a/drivers/net/ethernet/cadence/macb_ptp.c -+++ b/drivers/net/ethernet/cadence/macb_ptp.c -@@ -275,6 +275,12 @@ void gem_ptp_rxstamp(struct macb *bp, struct sk_buff *skb, - - if (GEM_BFEXT(DMA_RXVALID, desc->addr)) { - desc_ptp = macb_ptp_desc(bp, desc); -+ /* Unlikely but check */ -+ if (!desc_ptp) { -+ dev_warn_ratelimited(&bp->pdev->dev, -+ "Timestamp not supported in BD\n"); -+ return; -+ } - gem_hw_timestamp(bp, desc_ptp->ts_1, desc_ptp->ts_2, &ts); - memset(shhwtstamps, 0, sizeof(struct skb_shared_hwtstamps)); - shhwtstamps->hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec); -@@ -307,8 +313,11 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb, - if (CIRC_SPACE(head, tail, PTP_TS_BUFFER_SIZE) == 0) - return -ENOMEM; - -- skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; - desc_ptp = macb_ptp_desc(queue->bp, desc); -+ /* Unlikely but check */ -+ if (!desc_ptp) -+ return -EINVAL; -+ skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; - tx_timestamp = &queue->tx_timestamps[head]; - tx_timestamp->skb = skb; - /* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */ -diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c -index bc1f5b36b5bf2..1db49424aa43c 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_main.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c -@@ -559,7 +559,12 @@ static int qed_enable_msix(struct qed_dev *cdev, - rc = cnt; - } - -- if (rc > 0) { -+ /* For VFs, we should return with an error in case we didn't get the -+ * exact number of msix vectors as we requested. -+ * Not doing that will lead to a crash when starting queues for -+ * this VF. -+ */ -+ if ((IS_PF(cdev) && rc > 0) || (IS_VF(cdev) && rc == cnt)) { - /* MSI-x configuration was achieved */ - int_params->out.int_mode = QED_INT_MODE_MSIX; - int_params->out.num_vectors = rc; -diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c -index ce3e62e73e4cd..1133f6fe21a0e 100644 ---- a/drivers/net/ethernet/qlogic/qede/qede_main.c -+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c -@@ -1773,6 +1773,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev) - } - - edev->int_info.used_cnt = 0; -+ edev->int_info.msix_cnt = 0; - } - - static int qede_req_msix_irqs(struct qede_dev *edev) -@@ -2317,7 +2318,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode, - goto out; - err4: - qede_sync_free_irqs(edev); -- memset(&edev->int_info.msix_cnt, 0, sizeof(struct qed_int_info)); - err3: - qede_napi_disable_remove(edev); - err2: -diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c -index fb51548c57e94..623d86e5e970f 100644 ---- a/drivers/net/ethernet/realtek/r8169_main.c -+++ b/drivers/net/ethernet/realtek/r8169_main.c -@@ -4713,6 +4713,7 @@ static void rtl_hw_start_8168g(struct rtl8169_private *tp) - rtl_eri_clear_bits(tp, 0x1b0, ERIAR_MASK_0011, BIT(12)); - - rtl_pcie_state_l2l3_disable(tp); -+ rtl_hw_aspm_clkreq_enable(tp, true); - } - - static void rtl_hw_start_8168g_1(struct rtl8169_private *tp) -diff --git a/drivers/net/ethernet/xilinx/ll_temac_main.c b/drivers/net/ethernet/xilinx/ll_temac_main.c -index 9a7af7dda70dc..bddd64e918ce0 100644 ---- a/drivers/net/ethernet/xilinx/ll_temac_main.c -+++ b/drivers/net/ethernet/xilinx/ll_temac_main.c -@@ -939,10 +939,8 @@ temac_start_xmit(struct sk_buff *skb, struct net_device *ndev) - wmb(); - lp->dma_out(lp, TX_TAILDESC_PTR, tail_p); /* DMA start */ - -- if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) { -- netdev_info(ndev, "%s -> netif_stop_queue\n", __func__); -+ if (temac_check_tx_bd_space(lp, MAX_SKB_FRAGS + 1)) - netif_stop_queue(ndev); -- } - - return NETDEV_TX_OK; - } -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 0241f0dcc093f..97c343d31f989 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3246,12 +3246,12 @@ static void fixup_mpss_256(struct pci_dev *dev) - { - dev->pcie_mpss = 1; /* 256 bytes */ - } --DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, -- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); --DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, -- PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); --DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SOLARFLARE, -- PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, -+ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0, fixup_mpss_256); -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, -+ PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, -+ PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); - - /* - * Intel 5000 and 5100 Memory controllers have an erratum with read completion -diff --git a/drivers/reset/reset-zynqmp.c b/drivers/reset/reset-zynqmp.c -index 99e75d92dadab..8a7473b6ba585 100644 ---- a/drivers/reset/reset-zynqmp.c -+++ b/drivers/reset/reset-zynqmp.c -@@ -46,7 +46,8 @@ static int zynqmp_reset_status(struct reset_controller_dev *rcdev, - unsigned long id) - { - struct zynqmp_reset_data *priv = to_zynqmp_reset_data(rcdev); -- int val, err; -+ int err; -+ u32 val; - - err = priv->eemi_ops->reset_get_status(ZYNQMP_RESET_ID + id, &val); - if (err) -diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c -index 448d7b11dec4c..f5c8e4eb62ae6 100644 ---- a/drivers/usb/host/xhci-debugfs.c -+++ b/drivers/usb/host/xhci-debugfs.c -@@ -197,12 +197,13 @@ static void xhci_ring_dump_segment(struct seq_file *s, - int i; - dma_addr_t dma; - union xhci_trb *trb; -+ char str[XHCI_MSG_MAX]; - - for (i = 0; i < TRBS_PER_SEGMENT; i++) { - trb = &seg->trbs[i]; - dma = seg->dma + i * sizeof(*trb); - seq_printf(s, "%pad: %s\n", &dma, -- xhci_decode_trb(le32_to_cpu(trb->generic.field[0]), -+ xhci_decode_trb(str, XHCI_MSG_MAX, le32_to_cpu(trb->generic.field[0]), - le32_to_cpu(trb->generic.field[1]), - le32_to_cpu(trb->generic.field[2]), - le32_to_cpu(trb->generic.field[3]))); -@@ -340,9 +341,10 @@ static int xhci_portsc_show(struct seq_file *s, void *unused) - { - struct xhci_port *port = s->private; - u32 portsc; -+ char str[XHCI_MSG_MAX]; - - portsc = readl(port->addr); -- seq_printf(s, "%s\n", xhci_decode_portsc(portsc)); -+ seq_printf(s, "%s\n", xhci_decode_portsc(str, portsc)); - - return 0; - } -diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c -index c1025d321a417..3da75b367f952 100644 ---- a/drivers/usb/host/xhci-rcar.c -+++ b/drivers/usb/host/xhci-rcar.c -@@ -134,6 +134,13 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) - const struct soc_device_attribute *attr; - const char *firmware_name; - -+ /* -+ * According to the datasheet, "Upon the completion of FW Download, -+ * there is no need to write or reload FW". -+ */ -+ if (readl(regs + RCAR_USB3_DL_CTRL) & RCAR_USB3_DL_CTRL_FW_SUCCESS) -+ return 0; -+ - attr = soc_device_match(rcar_quirks_match); - if (attr) - quirks = (uintptr_t)attr->data; -diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h -index 87da9098fb347..dab2af3f2c4f7 100644 ---- a/drivers/usb/host/xhci-trace.h -+++ b/drivers/usb/host/xhci-trace.h -@@ -25,8 +25,6 @@ - #include "xhci.h" - #include "xhci-dbgcap.h" - --#define XHCI_MSG_MAX 500 -- - DECLARE_EVENT_CLASS(xhci_log_msg, - TP_PROTO(struct va_format *vaf), - TP_ARGS(vaf), -@@ -122,6 +120,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, - __field(u32, field1) - __field(u32, field2) - __field(u32, field3) -+ __dynamic_array(char, str, XHCI_MSG_MAX) - ), - TP_fast_assign( - __entry->type = ring->type; -@@ -131,7 +130,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb, - __entry->field3 = le32_to_cpu(trb->field[3]); - ), - TP_printk("%s: %s", xhci_ring_type_string(__entry->type), -- xhci_decode_trb(__entry->field0, __entry->field1, -+ xhci_decode_trb(__get_str(str), XHCI_MSG_MAX, __entry->field0, __entry->field1, - __entry->field2, __entry->field3) - ) - ); -@@ -523,6 +522,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, - TP_STRUCT__entry( - __field(u32, portnum) - __field(u32, portsc) -+ __dynamic_array(char, str, XHCI_MSG_MAX) - ), - TP_fast_assign( - __entry->portnum = portnum; -@@ -530,7 +530,7 @@ DECLARE_EVENT_CLASS(xhci_log_portsc, - ), - TP_printk("port-%d: %s", - __entry->portnum, -- xhci_decode_portsc(__entry->portsc) -+ xhci_decode_portsc(__get_str(str), __entry->portsc) - ) - ); - -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index 834f32fe99308..02df309e44093 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -22,6 +22,9 @@ - #include "xhci-ext-caps.h" - #include "pci-quirks.h" - -+/* max buffer size for trace and debug messages */ -+#define XHCI_MSG_MAX 500 -+ - /* xHCI PCI Configuration Registers */ - #define XHCI_SBRN_OFFSET (0x60) - -@@ -2217,15 +2220,14 @@ static inline char *xhci_slot_state_string(u32 state) - } - } - --static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, -- u32 field3) -+static inline const char *xhci_decode_trb(char *str, size_t size, -+ u32 field0, u32 field1, u32 field2, u32 field3) - { -- static char str[256]; - int type = TRB_FIELD_TO_TYPE(field3); - - switch (type) { - case TRB_LINK: -- sprintf(str, -+ snprintf(str, size, - "LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c", - field1, field0, GET_INTR_TARGET(field2), - xhci_trb_type_string(type), -@@ -2242,7 +2244,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - case TRB_HC_EVENT: - case TRB_DEV_NOTE: - case TRB_MFINDEX_WRAP: -- sprintf(str, -+ snprintf(str, size, - "TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c", - field1, field0, - xhci_trb_comp_code_string(GET_COMP_CODE(field2)), -@@ -2255,7 +2257,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - - break; - case TRB_SETUP: -- sprintf(str, "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", -+ snprintf(str, size, -+ "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c", - field0 & 0xff, - (field0 & 0xff00) >> 8, - (field0 & 0xff000000) >> 24, -@@ -2272,7 +2275,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_DATA: -- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", -+ snprintf(str, size, -+ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c", - field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - xhci_trb_type_string(type), -@@ -2285,7 +2289,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_STATUS: -- sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", -+ snprintf(str, size, -+ "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c", - field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - xhci_trb_type_string(type), -@@ -2298,7 +2303,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - case TRB_ISOC: - case TRB_EVENT_DATA: - case TRB_TR_NOOP: -- sprintf(str, -+ snprintf(str, size, - "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c", - field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), -@@ -2315,21 +2320,21 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - - case TRB_CMD_NOOP: - case TRB_ENABLE_SLOT: -- sprintf(str, -+ snprintf(str, size, - "%s: flags %c", - xhci_trb_type_string(type), - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_DISABLE_SLOT: - case TRB_NEG_BANDWIDTH: -- sprintf(str, -+ snprintf(str, size, - "%s: slot %d flags %c", - xhci_trb_type_string(type), - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_ADDR_DEV: -- sprintf(str, -+ snprintf(str, size, - "%s: ctx %08x%08x slot %d flags %c:%c", - xhci_trb_type_string(type), - field1, field0, -@@ -2338,7 +2343,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_CONFIG_EP: -- sprintf(str, -+ snprintf(str, size, - "%s: ctx %08x%08x slot %d flags %c:%c", - xhci_trb_type_string(type), - field1, field0, -@@ -2347,7 +2352,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_EVAL_CONTEXT: -- sprintf(str, -+ snprintf(str, size, - "%s: ctx %08x%08x slot %d flags %c", - xhci_trb_type_string(type), - field1, field0, -@@ -2355,7 +2360,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_RESET_EP: -- sprintf(str, -+ snprintf(str, size, - "%s: ctx %08x%08x slot %d ep %d flags %c:%c", - xhci_trb_type_string(type), - field1, field0, -@@ -2376,7 +2381,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_SET_DEQ: -- sprintf(str, -+ snprintf(str, size, - "%s: deq %08x%08x stream %d slot %d ep %d flags %c", - xhci_trb_type_string(type), - field1, field0, -@@ -2387,14 +2392,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_RESET_DEV: -- sprintf(str, -+ snprintf(str, size, - "%s: slot %d flags %c", - xhci_trb_type_string(type), - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_FORCE_EVENT: -- sprintf(str, -+ snprintf(str, size, - "%s: event %08x%08x vf intr %d vf id %d flags %c", - xhci_trb_type_string(type), - field1, field0, -@@ -2403,14 +2408,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_SET_LT: -- sprintf(str, -+ snprintf(str, size, - "%s: belt %d flags %c", - xhci_trb_type_string(type), - TRB_TO_BELT(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_GET_BW: -- sprintf(str, -+ snprintf(str, size, - "%s: ctx %08x%08x slot %d speed %d flags %c", - xhci_trb_type_string(type), - field1, field0, -@@ -2419,7 +2424,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - case TRB_FORCE_HEADER: -- sprintf(str, -+ snprintf(str, size, - "%s: info %08x%08x%08x pkt type %d roothub port %d flags %c", - xhci_trb_type_string(type), - field2, field1, field0 & 0xffffffe0, -@@ -2428,7 +2433,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2, - field3 & TRB_CYCLE ? 'C' : 'c'); - break; - default: -- sprintf(str, -+ snprintf(str, size, - "type '%s' -> raw %08x %08x %08x %08x", - xhci_trb_type_string(type), - field0, field1, field2, field3); -@@ -2553,9 +2558,8 @@ static inline const char *xhci_portsc_link_state_string(u32 portsc) - return "Unknown"; - } - --static inline const char *xhci_decode_portsc(u32 portsc) -+static inline const char *xhci_decode_portsc(char *str, u32 portsc) - { -- static char str[256]; - int ret; - - ret = sprintf(str, "%s %s %s Link:%s PortSpeed:%d ", -diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c -index 08db02f3172df..619c4598e64ea 100644 ---- a/drivers/usb/mtu3/mtu3_gadget.c -+++ b/drivers/usb/mtu3/mtu3_gadget.c -@@ -72,14 +72,12 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) - u32 interval = 0; - u32 mult = 0; - u32 burst = 0; -- int max_packet; - int ret; - - desc = mep->desc; - comp_desc = mep->comp_desc; - mep->type = usb_endpoint_type(desc); -- max_packet = usb_endpoint_maxp(desc); -- mep->maxp = max_packet & GENMASK(10, 0); -+ mep->maxp = usb_endpoint_maxp(desc); - - switch (mtu->g.speed) { - case USB_SPEED_SUPER: -@@ -100,7 +98,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) - usb_endpoint_xfer_int(desc)) { - interval = desc->bInterval; - interval = clamp_val(interval, 1, 16) - 1; -- burst = (max_packet & GENMASK(12, 11)) >> 11; -+ mult = usb_endpoint_maxp_mult(desc) - 1; - } - break; - default: -diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c -index aefc1b58d9563..f5caf38ba2be0 100644 ---- a/drivers/usb/serial/mos7720.c -+++ b/drivers/usb/serial/mos7720.c -@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum, - int status; - - buf = kmalloc(1, GFP_KERNEL); -- if (!buf) -+ if (!buf) { -+ *data = 0; - return -ENOMEM; -+ } - - status = usb_control_msg(usbdev, pipe, request, requesttype, value, - index, buf, 1, MOS_WDR_TIMEOUT); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 29552d4f6845b..33b8fedab6c67 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -543,7 +543,7 @@ again: - * inode has not been flagged as nocompress. This flag can - * change at any time if we discover bad compression ratios. - */ -- if (nr_pages > 1 && inode_need_compress(inode, start, end)) { -+ if (inode_need_compress(inode, start, end)) { - WARN_ON(pages); - pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS); - if (!pages) { -diff --git a/fs/crypto/hooks.c b/fs/crypto/hooks.c -index a5a40a76b8ed7..82575cfbb04db 100644 ---- a/fs/crypto/hooks.c -+++ b/fs/crypto/hooks.c -@@ -305,3 +305,47 @@ err_kfree: - return ERR_PTR(err); - } - EXPORT_SYMBOL_GPL(fscrypt_get_symlink); -+ -+/** -+ * fscrypt_symlink_getattr() - set the correct st_size for encrypted symlinks -+ * @path: the path for the encrypted symlink being queried -+ * @stat: the struct being filled with the symlink's attributes -+ * -+ * Override st_size of encrypted symlinks to be the length of the decrypted -+ * symlink target (or the no-key encoded symlink target, if the key is -+ * unavailable) rather than the length of the encrypted symlink target. This is -+ * necessary for st_size to match the symlink target that userspace actually -+ * sees. POSIX requires this, and some userspace programs depend on it. -+ * -+ * This requires reading the symlink target from disk if needed, setting up the -+ * inode's encryption key if possible, and then decrypting or encoding the -+ * symlink target. This makes lstat() more heavyweight than is normally the -+ * case. However, decrypted symlink targets will be cached in ->i_link, so -+ * usually the symlink won't have to be read and decrypted again later if/when -+ * it is actually followed, readlink() is called, or lstat() is called again. -+ * -+ * Return: 0 on success, -errno on failure -+ */ -+int fscrypt_symlink_getattr(const struct path *path, struct kstat *stat) -+{ -+ struct dentry *dentry = path->dentry; -+ struct inode *inode = d_inode(dentry); -+ const char *link; -+ DEFINE_DELAYED_CALL(done); -+ -+ /* -+ * To get the symlink target that userspace will see (whether it's the -+ * decrypted target or the no-key encoded target), we can just get it in -+ * the same way the VFS does during path resolution and readlink(). -+ */ -+ link = READ_ONCE(inode->i_link); -+ if (!link) { -+ link = inode->i_op->get_link(dentry, inode, &done); -+ if (IS_ERR(link)) -+ return PTR_ERR(link); -+ } -+ stat->size = strlen(link); -+ do_delayed_call(&done); -+ return 0; -+} -+EXPORT_SYMBOL_GPL(fscrypt_symlink_getattr); -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 519378a15bc6b..46151bda62368 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, - ext4_write_lock_xattr(inode, &no_expand); - BUG_ON(!ext4_has_inline_data(inode)); - -+ /* -+ * ei->i_inline_off may have changed since ext4_write_begin() -+ * called ext4_try_to_write_inline_data() -+ */ -+ (void) ext4_find_inline_data_nolock(inode); -+ - kaddr = kmap_atomic(page); - ext4_write_inline_data(inode, &iloc, kaddr, pos, len); - kunmap_atomic(kaddr); -diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c -index dd05af983092d..a9457fed351ed 100644 ---- a/fs/ext4/symlink.c -+++ b/fs/ext4/symlink.c -@@ -52,10 +52,19 @@ static const char *ext4_encrypted_get_link(struct dentry *dentry, - return paddr; - } - -+static int ext4_encrypted_symlink_getattr(const struct path *path, -+ struct kstat *stat, u32 request_mask, -+ unsigned int query_flags) -+{ -+ ext4_getattr(path, stat, request_mask, query_flags); -+ -+ return fscrypt_symlink_getattr(path, stat); -+} -+ - const struct inode_operations ext4_encrypted_symlink_inode_operations = { - .get_link = ext4_encrypted_get_link, - .setattr = ext4_setattr, -- .getattr = ext4_getattr, -+ .getattr = ext4_encrypted_symlink_getattr, - .listxattr = ext4_listxattr, - }; - -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 3a97ac56821ba..81a18ba18e301 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -1256,9 +1256,18 @@ static const char *f2fs_encrypted_get_link(struct dentry *dentry, - return target; - } - -+static int f2fs_encrypted_symlink_getattr(const struct path *path, -+ struct kstat *stat, u32 request_mask, -+ unsigned int query_flags) -+{ -+ f2fs_getattr(path, stat, request_mask, query_flags); -+ -+ return fscrypt_symlink_getattr(path, stat); -+} -+ - const struct inode_operations f2fs_encrypted_symlink_inode_operations = { - .get_link = f2fs_encrypted_get_link, -- .getattr = f2fs_getattr, -+ .getattr = f2fs_encrypted_symlink_getattr, - .setattr = f2fs_setattr, - #ifdef CONFIG_F2FS_FS_XATTR - .listxattr = f2fs_listxattr, -diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c -index 8dada89bbe4da..6069c63d833ae 100644 ---- a/fs/ubifs/file.c -+++ b/fs/ubifs/file.c -@@ -1629,6 +1629,16 @@ static const char *ubifs_get_link(struct dentry *dentry, - return fscrypt_get_symlink(inode, ui->data, ui->data_len, done); - } - -+static int ubifs_symlink_getattr(const struct path *path, struct kstat *stat, -+ u32 request_mask, unsigned int query_flags) -+{ -+ ubifs_getattr(path, stat, request_mask, query_flags); -+ -+ if (IS_ENCRYPTED(d_inode(path->dentry))) -+ return fscrypt_symlink_getattr(path, stat); -+ return 0; -+} -+ - const struct address_space_operations ubifs_file_address_operations = { - .readpage = ubifs_readpage, - .writepage = ubifs_writepage, -@@ -1654,7 +1664,7 @@ const struct inode_operations ubifs_file_inode_operations = { - const struct inode_operations ubifs_symlink_inode_operations = { - .get_link = ubifs_get_link, - .setattr = ubifs_setattr, -- .getattr = ubifs_getattr, -+ .getattr = ubifs_symlink_getattr, - #ifdef CONFIG_UBIFS_FS_XATTR - .listxattr = ubifs_listxattr, - #endif -diff --git a/include/linux/fscrypt.h b/include/linux/fscrypt.h -index 032e5bcf97012..0d1a53d6c52dc 100644 ---- a/include/linux/fscrypt.h -+++ b/include/linux/fscrypt.h -@@ -298,6 +298,7 @@ extern int __fscrypt_encrypt_symlink(struct inode *inode, const char *target, - extern const char *fscrypt_get_symlink(struct inode *inode, const void *caddr, - unsigned int max_size, - struct delayed_call *done); -+int fscrypt_symlink_getattr(const struct path *path, struct kstat *stat); - static inline void fscrypt_set_ops(struct super_block *sb, - const struct fscrypt_operations *s_cop) - { -@@ -585,6 +586,12 @@ static inline const char *fscrypt_get_symlink(struct inode *inode, - return ERR_PTR(-EOPNOTSUPP); - } - -+static inline int fscrypt_symlink_getattr(const struct path *path, -+ struct kstat *stat) -+{ -+ return -EOPNOTSUPP; -+} -+ - static inline void fscrypt_set_ops(struct super_block *sb, - const struct fscrypt_operations *s_cop) - { -diff --git a/kernel/kthread.c b/kernel/kthread.c -index b2bac5d929d2b..63f7eb3c2640d 100644 ---- a/kernel/kthread.c -+++ b/kernel/kthread.c -@@ -76,6 +76,25 @@ static inline struct kthread *to_kthread(struct task_struct *k) - return (__force void *)k->set_child_tid; - } - -+/* -+ * Variant of to_kthread() that doesn't assume @p is a kthread. -+ * -+ * Per construction; when: -+ * -+ * (p->flags & PF_KTHREAD) && p->set_child_tid -+ * -+ * the task is both a kthread and struct kthread is persistent. However -+ * PF_KTHREAD on it's own is not, kernel_thread() can exec() (See umh.c and -+ * begin_new_exec()). -+ */ -+static inline struct kthread *__to_kthread(struct task_struct *p) -+{ -+ void *kthread = (__force void *)p->set_child_tid; -+ if (kthread && !(p->flags & PF_KTHREAD)) -+ kthread = NULL; -+ return kthread; -+} -+ - void free_kthread_struct(struct task_struct *k) - { - struct kthread *kthread; -@@ -176,10 +195,11 @@ void *kthread_data(struct task_struct *task) - */ - void *kthread_probe_data(struct task_struct *task) - { -- struct kthread *kthread = to_kthread(task); -+ struct kthread *kthread = __to_kthread(task); - void *data = NULL; - -- probe_kernel_read(&data, &kthread->data, sizeof(data)); -+ if (kthread) -+ probe_kernel_read(&data, &kthread->data, sizeof(data)); - return data; - } - -@@ -490,9 +510,9 @@ void kthread_set_per_cpu(struct task_struct *k, int cpu) - set_bit(KTHREAD_IS_PER_CPU, &kthread->flags); - } - --bool kthread_is_per_cpu(struct task_struct *k) -+bool kthread_is_per_cpu(struct task_struct *p) - { -- struct kthread *kthread = to_kthread(k); -+ struct kthread *kthread = __to_kthread(p); - if (!kthread) - return false; - -@@ -1272,11 +1292,9 @@ EXPORT_SYMBOL(kthread_destroy_worker); - */ - void kthread_associate_blkcg(struct cgroup_subsys_state *css) - { -- struct kthread *kthread; -+ struct kthread *kthread = __to_kthread(current); -+ - -- if (!(current->flags & PF_KTHREAD)) -- return; -- kthread = to_kthread(current); - if (!kthread) - return; - -@@ -1298,13 +1316,10 @@ EXPORT_SYMBOL(kthread_associate_blkcg); - */ - struct cgroup_subsys_state *kthread_blkcg(void) - { -- struct kthread *kthread; -+ struct kthread *kthread = __to_kthread(current); - -- if (current->flags & PF_KTHREAD) { -- kthread = to_kthread(current); -- if (kthread) -- return kthread->blkcg_css; -- } -+ if (kthread) -+ return kthread->blkcg_css; - return NULL; - } - EXPORT_SYMBOL(kthread_blkcg); -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 74cb20f32f72f..87d9fad9d01d6 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -7301,7 +7301,7 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) - return 0; - - /* Disregard pcpu kthreads; they are where they need to be. */ -- if ((p->flags & PF_KTHREAD) && kthread_is_per_cpu(p)) -+ if (kthread_is_per_cpu(p)) - return 0; - - if (!cpumask_test_cpu(env->dst_cpu, p->cpus_ptr)) { -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 4357f5475a504..283ac9d9f6dd0 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -906,7 +906,7 @@ static inline void __free_one_page(struct page *page, - unsigned int max_order; - struct capture_control *capc = task_capc(zone); - -- max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); -+ max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order); - - VM_BUG_ON(!zone_is_initialized(zone)); - VM_BUG_ON_PAGE(page->flags & PAGE_FLAGS_CHECK_AT_PREP, page); -@@ -919,7 +919,7 @@ static inline void __free_one_page(struct page *page, - VM_BUG_ON_PAGE(bad_range(zone, page), page); - - continue_merging: -- while (order < max_order - 1) { -+ while (order < max_order) { - if (compaction_capture(capc, page, order, migratetype)) { - __mod_zone_freepage_state(zone, -(1 << order), - migratetype); -@@ -945,7 +945,7 @@ continue_merging: - pfn = combined_pfn; - order++; - } -- if (max_order < MAX_ORDER) { -+ if (order < MAX_ORDER - 1) { - /* If we are here, it means order is >= pageblock_order. - * We want to prevent merge between freepages on isolate - * pageblock and normal pageblock. Without this, pageblock -@@ -966,7 +966,7 @@ continue_merging: - is_migrate_isolate(buddy_mt))) - goto done_merging; - } -- max_order++; -+ max_order = order + 1; - goto continue_merging; - } - -diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c -index c88612242c89f..f86f948a4b4c1 100644 ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -460,6 +460,23 @@ out_bh_enable: - local_bh_enable(); - } - -+/* -+ * The device used for looking up which routing table to use for sending an ICMP -+ * error is preferably the source whenever it is set, which should ensure the -+ * icmp error can be sent to the source host, else lookup using the routing -+ * table of the destination device, else use the main routing table (index 0). -+ */ -+static struct net_device *icmp_get_route_lookup_dev(struct sk_buff *skb) -+{ -+ struct net_device *route_lookup_dev = NULL; -+ -+ if (skb->dev) -+ route_lookup_dev = skb->dev; -+ else if (skb_dst(skb)) -+ route_lookup_dev = skb_dst(skb)->dev; -+ return route_lookup_dev; -+} -+ - static struct rtable *icmp_route_lookup(struct net *net, - struct flowi4 *fl4, - struct sk_buff *skb_in, -@@ -468,6 +485,7 @@ static struct rtable *icmp_route_lookup(struct net *net, - int type, int code, - struct icmp_bxm *param) - { -+ struct net_device *route_lookup_dev; - struct rtable *rt, *rt2; - struct flowi4 fl4_dec; - int err; -@@ -482,7 +500,8 @@ static struct rtable *icmp_route_lookup(struct net *net, - fl4->flowi4_proto = IPPROTO_ICMP; - fl4->fl4_icmp_type = type; - fl4->fl4_icmp_code = code; -- fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev); -+ route_lookup_dev = icmp_get_route_lookup_dev(skb_in); -+ fl4->flowi4_oif = l3mdev_master_ifindex(route_lookup_dev); - - security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4)); - rt = ip_route_output_key_hash(net, fl4, skb_in); -@@ -506,7 +525,7 @@ static struct rtable *icmp_route_lookup(struct net *net, - if (err) - goto relookup_failed; - -- if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev, -+ if (inet_addr_type_dev_table(net, route_lookup_dev, - fl4_dec.saddr) == RTN_LOCAL) { - rt2 = __ip_route_output_key(net, &fl4_dec); - if (IS_ERR(rt2)) -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index d2b1ae83f258d..b1ecc91955172 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -2730,6 +2730,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u - rv = 1; - } else if (im) { - if (src_addr) { -+ spin_lock_bh(&im->lock); - for (psf = im->sources; psf; psf = psf->sf_next) { - if (psf->sf_inaddr == src_addr) - break; -@@ -2740,6 +2741,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u - im->sfcount[MCAST_EXCLUDE]; - else - rv = im->sfcount[MCAST_EXCLUDE] != 0; -+ spin_unlock_bh(&im->lock); - } else - rv = 1; /* unspecified source; tentatively allow */ - } -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 1662573a40309..fd300c3adddec 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -1736,7 +1736,7 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream, - channels = params_channels(params); - frame_size = snd_pcm_format_size(format, channels); - if (frame_size > 0) -- params->fifo_size /= (unsigned)frame_size; -+ params->fifo_size /= frame_size; - } - return 0; - } -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index f486e680aed1d..abe371c01fba2 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -9160,6 +9160,16 @@ static int patch_alc269(struct hda_codec *codec) - - snd_hda_pick_fixup(codec, alc269_fixup_models, - alc269_fixup_tbl, alc269_fixups); -+ /* FIXME: both TX300 and ROG Strix G17 have the same SSID, and -+ * the quirk breaks the latter (bko#214101). -+ * Clear the wrong entry. -+ */ -+ if (codec->fixup_id == ALC282_FIXUP_ASUS_TX300 && -+ codec->core.vendor_id == 0x10ec0294) { -+ codec_dbg(codec, "Clear wrong fixup for ASUS ROG Strix G17\n"); -+ codec->fixup_id = HDA_FIXUP_ID_NOT_SET; -+ } -+ - snd_hda_pick_pin_fixup(codec, alc269_pin_fixup_tbl, alc269_fixups, true); - snd_hda_pick_pin_fixup(codec, alc269_fallback_pin_fixup_tbl, alc269_fixups, false); - snd_hda_pick_fixup(codec, NULL, alc269_fixup_vendor_tbl, -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 4d20f3f45f7e2..d5d828817c5e8 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1841,6 +1841,7 @@ static const struct registration_quirk registration_quirks[] = { - REG_QUIRK_ENTRY(0x0951, 0x16ed, 2), /* Kingston HyperX Cloud Alpha S */ - REG_QUIRK_ENTRY(0x0951, 0x16ea, 2), /* Kingston HyperX Cloud Flight S */ - REG_QUIRK_ENTRY(0x0ecb, 0x1f46, 2), /* JBL Quantum 600 */ -+ REG_QUIRK_ENTRY(0x0ecb, 0x1f47, 2), /* JBL Quantum 800 */ - REG_QUIRK_ENTRY(0x0ecb, 0x2039, 2), /* JBL Quantum 400 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203c, 2), /* JBL Quantum 600 */ - REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */ diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.145-146.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.145-146.patch deleted file mode 100644 index c7ea7f7d3d..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.145-146.patch +++ /dev/null @@ -1,5068 +0,0 @@ -diff --git a/Makefile b/Makefile -index c32a36c8ffc90..48d0c03acfc55 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 145 -+SUBLEVEL = 146 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -index 5b8bf58e89cb4..996e006e06c25 100644 ---- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -+++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi -@@ -208,12 +208,12 @@ - }; - - pinctrl_hvi3c3_default: hvi3c3_default { -- function = "HVI3C3"; -+ function = "I3C3"; - groups = "HVI3C3"; - }; - - pinctrl_hvi3c4_default: hvi3c4_default { -- function = "HVI3C4"; -+ function = "I3C4"; - groups = "HVI3C4"; - }; - -diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi -index 3efe9d41c2bb6..d7c9dbee0f016 100644 ---- a/arch/arm/boot/dts/meson8.dtsi -+++ b/arch/arm/boot/dts/meson8.dtsi -@@ -241,8 +241,13 @@ - "pp2", "ppmmu2", "pp4", "ppmmu4", - "pp5", "ppmmu5", "pp6", "ppmmu6"; - resets = <&reset RESET_MALI>; -+ - clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>; - clock-names = "bus", "core"; -+ -+ assigned-clocks = <&clkc CLKID_MALI>; -+ assigned-clock-rates = <318750000>; -+ - operating-points-v2 = <&gpu_opp_table>; - }; - }; -diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts -index bed1dfef19857..32d1c322dbc65 100644 ---- a/arch/arm/boot/dts/meson8b-ec100.dts -+++ b/arch/arm/boot/dts/meson8b-ec100.dts -@@ -148,7 +148,7 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -- vin-supply = <&vcc_5v>; -+ pwm-supply = <&vcc_5v>; - - pwms = <&pwm_cd 0 1148 0>; - pwm-dutycycle-range = <100 0>; -@@ -232,7 +232,7 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -- vin-supply = <&vcc_5v>; -+ pwm-supply = <&vcc_5v>; - - pwms = <&pwm_cd 1 1148 0>; - pwm-dutycycle-range = <100 0>; -diff --git a/arch/arm/boot/dts/meson8b-mxq.dts b/arch/arm/boot/dts/meson8b-mxq.dts -index 6e39ad52e42d3..ab8fe55963f7c 100644 ---- a/arch/arm/boot/dts/meson8b-mxq.dts -+++ b/arch/arm/boot/dts/meson8b-mxq.dts -@@ -39,6 +39,8 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -+ pwm-supply = <&vcc_5v>; -+ - pwms = <&pwm_cd 0 1148 0>; - pwm-dutycycle-range = <100 0>; - -@@ -84,7 +86,7 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -- vin-supply = <&vcc_5v>; -+ pwm-supply = <&vcc_5v>; - - pwms = <&pwm_cd 1 1148 0>; - pwm-dutycycle-range = <100 0>; -diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts -index 0f9c71137bed5..c413af9a7af8e 100644 ---- a/arch/arm/boot/dts/meson8b-odroidc1.dts -+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts -@@ -130,7 +130,7 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -- vin-supply = <&p5v0>; -+ pwm-supply = <&p5v0>; - - pwms = <&pwm_cd 0 12218 0>; - pwm-dutycycle-range = <91 0>; -@@ -162,7 +162,7 @@ - regulator-min-microvolt = <860000>; - regulator-max-microvolt = <1140000>; - -- vin-supply = <&p5v0>; -+ pwm-supply = <&p5v0>; - - pwms = <&pwm_cd 1 12218 0>; - pwm-dutycycle-range = <91 0>; -diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c -index 7216653424fd6..b51a8c7b01114 100644 ---- a/arch/arm/net/bpf_jit_32.c -+++ b/arch/arm/net/bpf_jit_32.c -@@ -1602,6 +1602,9 @@ exit: - rn = arm_bpf_get_reg32(src_lo, tmp2[1], ctx); - emit_ldx_r(dst, rn, off, ctx, BPF_SIZE(code)); - break; -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ break; - /* ST: *(size *)(dst + off) = imm */ - case BPF_ST | BPF_MEM | BPF_W: - case BPF_ST | BPF_MEM | BPF_H: -diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi -index 25549d9552ae2..84f92b44c3235 100644 ---- a/arch/arm64/boot/dts/exynos/exynos7.dtsi -+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi -@@ -113,7 +113,7 @@ - #address-cells = <0>; - interrupt-controller; - reg = <0x11001000 0x1000>, -- <0x11002000 0x1000>, -+ <0x11002000 0x2000>, - <0x11004000 0x2000>, - <0x11006000 0x2000>; - }; -diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts -index 67634cb01d6b6..cbdd46ed3ca63 100644 ---- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts -+++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts -@@ -277,10 +277,6 @@ - interrupt-parent = <&gpio1>; - interrupts = <28 IRQ_TYPE_LEVEL_LOW>; - -- /* Depends on LVDS */ -- max-clock = <135000000>; -- min-vrefresh = <50>; -- - adi,input-depth = <8>; - adi,input-colorspace = "rgb"; - adi,input-clock = "1x"; -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index 945e5f690edec..afc7d41347f73 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -701,6 +701,19 @@ emit_cond_jmp: - } - break; - -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ /* -+ * Nothing required here. -+ * -+ * In case of arm64, we rely on the firmware mitigation of -+ * Speculative Store Bypass as controlled via the ssbd kernel -+ * parameter. Whenever the mitigation is enabled, it works -+ * for all of the kernel code with no need to provide any -+ * additional instructions. -+ */ -+ break; -+ - /* ST: *(size *)(dst + off) = imm */ - case BPF_ST | BPF_MEM | BPF_W: - case BPF_ST | BPF_MEM | BPF_H: -diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c -index a4ebd2445edae..e5831cd293d05 100644 ---- a/arch/m68k/emu/nfeth.c -+++ b/arch/m68k/emu/nfeth.c -@@ -254,8 +254,8 @@ static void __exit nfeth_cleanup(void) - - for (i = 0; i < MAX_UNIT; i++) { - if (nfeth_dev[i]) { -- unregister_netdev(nfeth_dev[0]); -- free_netdev(nfeth_dev[0]); -+ unregister_netdev(nfeth_dev[i]); -+ free_netdev(nfeth_dev[i]); - } - } - free_irq(nfEtherIRQ, nfeth_interrupt); -diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c -index 561154cbcc401..b31b91e57c341 100644 ---- a/arch/mips/net/ebpf_jit.c -+++ b/arch/mips/net/ebpf_jit.c -@@ -1355,6 +1355,9 @@ jeq_common: - } - break; - -+ case BPF_ST | BPF_NOSPEC: /* speculation barrier */ -+ break; -+ - case BPF_ST | BPF_B | BPF_MEM: - case BPF_ST | BPF_H | BPF_MEM: - case BPF_ST | BPF_W | BPF_MEM: -diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c -index be3517ef0574d..20bfd753bcba6 100644 ---- a/arch/powerpc/net/bpf_jit_comp64.c -+++ b/arch/powerpc/net/bpf_jit_comp64.c -@@ -644,6 +644,12 @@ emit_clear: - } - break; - -+ /* -+ * BPF_ST NOSPEC (speculation barrier) -+ */ -+ case BPF_ST | BPF_NOSPEC: -+ break; -+ - /* - * BPF_ST(X) - */ -diff --git a/arch/riscv/net/bpf_jit_comp.c b/arch/riscv/net/bpf_jit_comp.c -index e2279fed8f564..0eefe6193253b 100644 ---- a/arch/riscv/net/bpf_jit_comp.c -+++ b/arch/riscv/net/bpf_jit_comp.c -@@ -1313,6 +1313,10 @@ out_be: - emit(rv_ld(rd, 0, RV_REG_T1), ctx); - break; - -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ break; -+ - /* ST: *(size *)(dst + off) = imm */ - case BPF_ST | BPF_MEM | BPF_B: - emit_imm(RV_REG_T1, imm, ctx); -diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h -index 0fe5600a037e4..4d59d11e6813d 100644 ---- a/arch/s390/include/asm/kvm_host.h -+++ b/arch/s390/include/asm/kvm_host.h -@@ -873,6 +873,7 @@ struct kvm_arch{ - atomic64_t cmma_dirty_pages; - /* subset of available cpu features enabled by user space */ - DECLARE_BITMAP(cpu_feat, KVM_S390_VM_CPU_FEAT_NR_BITS); -+ /* indexed by vcpu_idx */ - DECLARE_BITMAP(idle_mask, KVM_MAX_VCPUS); - struct kvm_s390_gisa_interrupt gisa_int; - }; -diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c -index 7184d55d87aae..b1aadc3ad065d 100644 ---- a/arch/s390/kernel/debug.c -+++ b/arch/s390/kernel/debug.c -@@ -327,24 +327,6 @@ static debug_info_t *debug_info_create(const char *name, int pages_per_area, - goto out; - - rc->mode = mode & ~S_IFMT; -- -- /* create root directory */ -- rc->debugfs_root_entry = debugfs_create_dir(rc->name, -- debug_debugfs_root_entry); -- -- /* append new element to linked list */ -- if (!debug_area_first) { -- /* first element in list */ -- debug_area_first = rc; -- rc->prev = NULL; -- } else { -- /* append element to end of list */ -- debug_area_last->next = rc; -- rc->prev = debug_area_last; -- } -- debug_area_last = rc; -- rc->next = NULL; -- - refcount_set(&rc->ref_count, 1); - out: - return rc; -@@ -404,27 +386,10 @@ static void debug_info_get(debug_info_t *db_info) - */ - static void debug_info_put(debug_info_t *db_info) - { -- int i; -- - if (!db_info) - return; -- if (refcount_dec_and_test(&db_info->ref_count)) { -- for (i = 0; i < DEBUG_MAX_VIEWS; i++) { -- if (!db_info->views[i]) -- continue; -- debugfs_remove(db_info->debugfs_entries[i]); -- } -- debugfs_remove(db_info->debugfs_root_entry); -- if (db_info == debug_area_first) -- debug_area_first = db_info->next; -- if (db_info == debug_area_last) -- debug_area_last = db_info->prev; -- if (db_info->prev) -- db_info->prev->next = db_info->next; -- if (db_info->next) -- db_info->next->prev = db_info->prev; -+ if (refcount_dec_and_test(&db_info->ref_count)) - debug_info_free(db_info); -- } - } - - /* -@@ -648,6 +613,31 @@ static int debug_close(struct inode *inode, struct file *file) - return 0; /* success */ - } - -+/* Create debugfs entries and add to internal list. */ -+static void _debug_register(debug_info_t *id) -+{ -+ /* create root directory */ -+ id->debugfs_root_entry = debugfs_create_dir(id->name, -+ debug_debugfs_root_entry); -+ -+ /* append new element to linked list */ -+ if (!debug_area_first) { -+ /* first element in list */ -+ debug_area_first = id; -+ id->prev = NULL; -+ } else { -+ /* append element to end of list */ -+ debug_area_last->next = id; -+ id->prev = debug_area_last; -+ } -+ debug_area_last = id; -+ id->next = NULL; -+ -+ debug_register_view(id, &debug_level_view); -+ debug_register_view(id, &debug_flush_view); -+ debug_register_view(id, &debug_pages_view); -+} -+ - /** - * debug_register_mode() - creates and initializes debug area. - * -@@ -677,19 +667,16 @@ debug_info_t *debug_register_mode(const char *name, int pages_per_area, - if ((uid != 0) || (gid != 0)) - pr_warn("Root becomes the owner of all s390dbf files in sysfs\n"); - BUG_ON(!initialized); -- mutex_lock(&debug_mutex); - - /* create new debug_info */ - rc = debug_info_create(name, pages_per_area, nr_areas, buf_size, mode); -- if (!rc) -- goto out; -- debug_register_view(rc, &debug_level_view); -- debug_register_view(rc, &debug_flush_view); -- debug_register_view(rc, &debug_pages_view); --out: -- if (!rc) -+ if (rc) { -+ mutex_lock(&debug_mutex); -+ _debug_register(rc); -+ mutex_unlock(&debug_mutex); -+ } else { - pr_err("Registering debug feature %s failed\n", name); -- mutex_unlock(&debug_mutex); -+ } - return rc; - } - EXPORT_SYMBOL(debug_register_mode); -@@ -718,6 +705,27 @@ debug_info_t *debug_register(const char *name, int pages_per_area, - } - EXPORT_SYMBOL(debug_register); - -+/* Remove debugfs entries and remove from internal list. */ -+static void _debug_unregister(debug_info_t *id) -+{ -+ int i; -+ -+ for (i = 0; i < DEBUG_MAX_VIEWS; i++) { -+ if (!id->views[i]) -+ continue; -+ debugfs_remove(id->debugfs_entries[i]); -+ } -+ debugfs_remove(id->debugfs_root_entry); -+ if (id == debug_area_first) -+ debug_area_first = id->next; -+ if (id == debug_area_last) -+ debug_area_last = id->prev; -+ if (id->prev) -+ id->prev->next = id->next; -+ if (id->next) -+ id->next->prev = id->prev; -+} -+ - /** - * debug_unregister() - give back debug area. - * -@@ -731,8 +739,10 @@ void debug_unregister(debug_info_t *id) - if (!id) - return; - mutex_lock(&debug_mutex); -- debug_info_put(id); -+ _debug_unregister(id); - mutex_unlock(&debug_mutex); -+ -+ debug_info_put(id); - } - EXPORT_SYMBOL(debug_unregister); - -diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c -index 62388a678b91a..fa9483aa4f575 100644 ---- a/arch/s390/kvm/interrupt.c -+++ b/arch/s390/kvm/interrupt.c -@@ -408,13 +408,13 @@ static unsigned long deliverable_irqs(struct kvm_vcpu *vcpu) - static void __set_cpu_idle(struct kvm_vcpu *vcpu) - { - kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT); -- set_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); -+ set_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask); - } - - static void __unset_cpu_idle(struct kvm_vcpu *vcpu) - { - kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT); -- clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); -+ clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask); - } - - static void __reset_intercept_indicators(struct kvm_vcpu *vcpu) -@@ -2984,18 +2984,18 @@ int kvm_s390_get_irq_state(struct kvm_vcpu *vcpu, __u8 __user *buf, int len) - - static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask) - { -- int vcpu_id, online_vcpus = atomic_read(&kvm->online_vcpus); -+ int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus); - struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int; - struct kvm_vcpu *vcpu; - -- for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) { -- vcpu = kvm_get_vcpu(kvm, vcpu_id); -+ for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) { -+ vcpu = kvm_get_vcpu(kvm, vcpu_idx); - if (psw_ioint_disabled(vcpu)) - continue; - deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24); - if (deliverable_mask) { - /* lately kicked but not yet running */ -- if (test_and_set_bit(vcpu_id, gi->kicked_mask)) -+ if (test_and_set_bit(vcpu_idx, gi->kicked_mask)) - return; - kvm_s390_vcpu_wakeup(vcpu); - return; -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 20ba8537dbcc2..9ed2fee612297 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -3726,7 +3726,7 @@ static int vcpu_pre_run(struct kvm_vcpu *vcpu) - kvm_s390_patch_guest_per_regs(vcpu); - } - -- clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.gisa_int.kicked_mask); -+ clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.gisa_int.kicked_mask); - - vcpu->arch.sie_block->icptcode = 0; - cpuflags = atomic_read(&vcpu->arch.sie_block->cpuflags); -diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h -index 6d9448dbd052b..63d94a5253a8f 100644 ---- a/arch/s390/kvm/kvm-s390.h -+++ b/arch/s390/kvm/kvm-s390.h -@@ -67,7 +67,7 @@ static inline int is_vcpu_stopped(struct kvm_vcpu *vcpu) - - static inline int is_vcpu_idle(struct kvm_vcpu *vcpu) - { -- return test_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask); -+ return test_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask); - } - - static inline int kvm_is_ucontrol(struct kvm *kvm) -diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c -index 460f255729402..5182e0836ca71 100644 ---- a/arch/s390/mm/kasan_init.c -+++ b/arch/s390/mm/kasan_init.c -@@ -101,6 +101,9 @@ static void __init kasan_early_vmemmap_populate(unsigned long address, - pgt_prot = pgprot_val(PAGE_KERNEL_EXEC); - sgt_prot = pgprot_val(SEGMENT_KERNEL_EXEC); - -+ /* -+ * The first 1MB of 1:1 mapping is mapped with 4KB pages -+ */ - while (address < end) { - pg_dir = pgd_offset_k(address); - if (pgd_none(*pg_dir)) { -@@ -146,30 +149,26 @@ static void __init kasan_early_vmemmap_populate(unsigned long address, - - pm_dir = pmd_offset(pu_dir, address); - if (pmd_none(*pm_dir)) { -- if (mode == POPULATE_ZERO_SHADOW && -- IS_ALIGNED(address, PMD_SIZE) && -+ if (IS_ALIGNED(address, PMD_SIZE) && - end - address >= PMD_SIZE) { -- pmd_populate(&init_mm, pm_dir, -- kasan_early_shadow_pte); -- address = (address + PMD_SIZE) & PMD_MASK; -- continue; -- } -- /* the first megabyte of 1:1 is mapped with 4k pages */ -- if (has_edat && address && end - address >= PMD_SIZE && -- mode != POPULATE_ZERO_SHADOW) { -- void *page; -- -- if (mode == POPULATE_ONE2ONE) { -- page = (void *)address; -- } else { -- page = kasan_early_alloc_segment(); -- memset(page, 0, _SEGMENT_SIZE); -+ if (mode == POPULATE_ZERO_SHADOW) { -+ pmd_populate(&init_mm, pm_dir, kasan_early_shadow_pte); -+ address = (address + PMD_SIZE) & PMD_MASK; -+ continue; -+ } else if (has_edat && address) { -+ void *page; -+ -+ if (mode == POPULATE_ONE2ONE) { -+ page = (void *)address; -+ } else { -+ page = kasan_early_alloc_segment(); -+ memset(page, 0, _SEGMENT_SIZE); -+ } -+ pmd_val(*pm_dir) = __pa(page) | sgt_prot; -+ address = (address + PMD_SIZE) & PMD_MASK; -+ continue; - } -- pmd_val(*pm_dir) = __pa(page) | sgt_prot; -- address = (address + PMD_SIZE) & PMD_MASK; -- continue; - } -- - pt_dir = kasan_early_pte_alloc(); - pmd_populate(&init_mm, pm_dir, pt_dir); - } else if (pmd_large(*pm_dir)) { -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index e160f4650f8e4..3e6612d8b921c 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -913,6 +913,11 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - break; - } - break; -+ /* -+ * BPF_NOSPEC (speculation barrier) -+ */ -+ case BPF_ST | BPF_NOSPEC: -+ break; - /* - * BPF_ST(X) - */ -diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c -index 3364e2a009899..fef734473c0f3 100644 ---- a/arch/sparc/net/bpf_jit_comp_64.c -+++ b/arch/sparc/net/bpf_jit_comp_64.c -@@ -1287,6 +1287,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) - return 1; - break; - } -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ break; - /* ST: *(size *)(dst + off) = imm */ - case BPF_ST | BPF_MEM | BPF_W: - case BPF_ST | BPF_MEM | BPF_H: -diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c -index ff07040287c40..b7baaa9733173 100644 ---- a/arch/x86/events/amd/ibs.c -+++ b/arch/x86/events/amd/ibs.c -@@ -562,6 +562,7 @@ static struct perf_ibs perf_ibs_op = { - .start = perf_ibs_start, - .stop = perf_ibs_stop, - .read = perf_ibs_read, -+ .capabilities = PERF_PMU_CAP_NO_EXCLUDE, - }, - .msr = MSR_AMD64_IBSOPCTL, - .config_mask = IBS_OP_CONFIG_MASK, -diff --git a/arch/x86/kernel/cpu/resctrl/monitor.c b/arch/x86/kernel/cpu/resctrl/monitor.c -index 21eb593e0313e..008bcb15fe96a 100644 ---- a/arch/x86/kernel/cpu/resctrl/monitor.c -+++ b/arch/x86/kernel/cpu/resctrl/monitor.c -@@ -242,6 +242,12 @@ static u64 __mon_event_count(u32 rmid, struct rmid_read *rr) - case QOS_L3_MBM_LOCAL_EVENT_ID: - m = &rr->d->mbm_local[rmid]; - break; -+ default: -+ /* -+ * Code would never reach here because an invalid -+ * event id would fail the __rmid_read. -+ */ -+ return RMID_VAL_ERROR; - } - - if (rr->first) { -diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c -index 023bd3e1aa0d2..3041015b05f71 100644 ---- a/arch/x86/kvm/vmx/nested.c -+++ b/arch/x86/kvm/vmx/nested.c -@@ -2057,12 +2057,11 @@ static void prepare_vmcs02_early(struct vcpu_vmx *vmx, struct vmcs12 *vmcs12) - ~PIN_BASED_VMX_PREEMPTION_TIMER); - - /* Posted interrupts setting is only taken from vmcs12. */ -- if (nested_cpu_has_posted_intr(vmcs12)) { -+ vmx->nested.pi_pending = false; -+ if (nested_cpu_has_posted_intr(vmcs12)) - vmx->nested.posted_intr_nv = vmcs12->posted_intr_nv; -- vmx->nested.pi_pending = false; -- } else { -+ else - exec_control &= ~PIN_BASED_POSTED_INTR; -- } - pin_controls_set(vmx, exec_control); - - /* -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 364e96e508d90..f1a0eebdcf641 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -2764,6 +2764,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - if (!msr_info->host_initiated) { - s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr; - adjust_tsc_offset_guest(vcpu, adj); -+ /* Before back to guest, tsc_timestamp must be adjusted -+ * as well, otherwise guest's percpu pvclock time could jump. -+ */ -+ kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu); - } - vcpu->arch.ia32_tsc_adjust_msr = data; - } -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 6e884f17634fe..55f62dca28aa2 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -728,6 +728,13 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, - } - break; - -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ if (boot_cpu_has(X86_FEATURE_XMM2)) -+ /* Emit 'lfence' */ -+ EMIT3(0x0F, 0xAE, 0xE8); -+ break; -+ - /* ST: *(u8*)(dst_reg + off) = imm */ - case BPF_ST | BPF_MEM | BPF_B: - if (is_ereg(dst_reg)) -diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c -index 0fcba32077c87..2914f900034e0 100644 ---- a/arch/x86/net/bpf_jit_comp32.c -+++ b/arch/x86/net/bpf_jit_comp32.c -@@ -1705,6 +1705,12 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image, - i++; - break; - } -+ /* speculation barrier */ -+ case BPF_ST | BPF_NOSPEC: -+ if (boot_cpu_has(X86_FEATURE_XMM2)) -+ /* Emit 'lfence' */ -+ EMIT3(0x0F, 0xAE, 0xE8); -+ break; - /* ST: *(u8*)(dst_reg + off) = imm */ - case BPF_ST | BPF_MEM | BPF_H: - case BPF_ST | BPF_MEM | BPF_B: -diff --git a/certs/Makefile b/certs/Makefile -index f4b90bad8690a..2baef6fba029e 100644 ---- a/certs/Makefile -+++ b/certs/Makefile -@@ -46,11 +46,19 @@ endif - redirect_openssl = 2>&1 - quiet_redirect_openssl = 2>&1 - silent_redirect_openssl = 2>/dev/null -+openssl_available = $(shell openssl help 2>/dev/null && echo yes) - - # We do it this way rather than having a boolean option for enabling an - # external private key, because 'make randconfig' might enable such a - # boolean option and we unfortunately can't make it depend on !RANDCONFIG. - ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") -+ -+ifeq ($(openssl_available),yes) -+X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) -+ -+$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) -+endif -+ - $(obj)/signing_key.pem: $(obj)/x509.genkey - @$(kecho) "###" - @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index f67b3fb33d579..7788af0ca1090 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -6394,7 +6394,7 @@ int ata_host_start(struct ata_host *host) - have_stop = 1; - } - -- if (host->ops->host_stop) -+ if (host->ops && host->ops->host_stop) - have_stop = 1; - - if (have_stop) { -diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c -index e0893f1b14522..43c0452a8ba91 100644 ---- a/drivers/base/regmap/regmap.c -+++ b/drivers/base/regmap/regmap.c -@@ -1505,7 +1505,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg, - if (ret) { - dev_err(map->dev, - "Error in caching of register: %x ret: %d\n", -- reg + i, ret); -+ reg + regmap_get_offset(map, i), ret); - return ret; - } - } -diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c -index 6535614a7dc13..1df2b5801c3bc 100644 ---- a/drivers/bcma/main.c -+++ b/drivers/bcma/main.c -@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq); - - void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core) - { -+ device_initialize(&core->dev); - core->dev.release = bcma_release_core_dev; - core->dev.bus = &bcma_bus_type; - dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index); -@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) - { - int err; - -- err = device_register(&core->dev); -+ err = device_add(&core->dev); - if (err) { - bcma_err(bus, "Could not register dev for core 0x%03X\n", - core->id.id); -- put_device(&core->dev); - return; - } - core->dev_registered = true; -@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus) - /* Now noone uses internally-handled cores, we can free them */ - list_for_each_entry_safe(core, tmp, &bus->cores, list) { - list_del(&core->list); -- kfree(core); -+ put_device(&core->dev); - } - } - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 25e81b1a59a54..bc3ab98855cf0 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1744,7 +1744,17 @@ static int nbd_dev_add(int index) - refcount_set(&nbd->refs, 1); - INIT_LIST_HEAD(&nbd->list); - disk->major = NBD_MAJOR; -+ -+ /* Too big first_minor can cause duplicate creation of -+ * sysfs files/links, since first_minor will be truncated to -+ * byte in __device_add_disk(). -+ */ - disk->first_minor = index << part_shift; -+ if (disk->first_minor > 0xff) { -+ err = -EINVAL; -+ goto out_free_idr; -+ } -+ - disk->fops = &nbd_fops; - disk->private_data = nbd; - sprintf(disk->disk_name, "nbd%d", index); -diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c -index 47680237d0beb..8bc893df47364 100644 ---- a/drivers/clk/mvebu/kirkwood.c -+++ b/drivers/clk/mvebu/kirkwood.c -@@ -265,6 +265,7 @@ static const char *powersave_parents[] = { - static const struct clk_muxing_soc_desc kirkwood_mux_desc[] __initconst = { - { "powersave", powersave_parents, ARRAY_SIZE(powersave_parents), - 11, 1, 0 }, -+ { } - }; - - static struct clk *clk_muxing_get_src( -diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c -index ef773db080e90..a0570213170d8 100644 ---- a/drivers/clocksource/sh_cmt.c -+++ b/drivers/clocksource/sh_cmt.c -@@ -568,7 +568,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag) - ch->flags |= flag; - - /* setup timeout if no clockevent */ -- if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT))) -+ if (ch->cmt->num_channels == 1 && -+ flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT))) - __sh_cmt_set_next(ch, ch->max_match_value); - out: - raw_spin_unlock_irqrestore(&ch->lock, flags); -@@ -604,20 +605,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs) - static u64 sh_cmt_clocksource_read(struct clocksource *cs) - { - struct sh_cmt_channel *ch = cs_to_sh_cmt(cs); -- unsigned long flags; - u32 has_wrapped; -- u64 value; -- u32 raw; - -- raw_spin_lock_irqsave(&ch->lock, flags); -- value = ch->total_cycles; -- raw = sh_cmt_get_counter(ch, &has_wrapped); -+ if (ch->cmt->num_channels == 1) { -+ unsigned long flags; -+ u64 value; -+ u32 raw; - -- if (unlikely(has_wrapped)) -- raw += ch->match_value + 1; -- raw_spin_unlock_irqrestore(&ch->lock, flags); -+ raw_spin_lock_irqsave(&ch->lock, flags); -+ value = ch->total_cycles; -+ raw = sh_cmt_get_counter(ch, &has_wrapped); -+ -+ if (unlikely(has_wrapped)) -+ raw += ch->match_value + 1; -+ raw_spin_unlock_irqrestore(&ch->lock, flags); -+ -+ return value + raw; -+ } - -- return value + raw; -+ return sh_cmt_get_counter(ch, &has_wrapped); - } - - static int sh_cmt_clocksource_enable(struct clocksource *cs) -@@ -680,7 +686,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch, - cs->disable = sh_cmt_clocksource_disable; - cs->suspend = sh_cmt_clocksource_suspend; - cs->resume = sh_cmt_clocksource_resume; -- cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8); -+ cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width); - cs->flags = CLOCK_SOURCE_IS_CONTINUOUS; - - dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n", -diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c -index 5c23a9a56921b..f261a57af1c01 100644 ---- a/drivers/counter/104-quad-8.c -+++ b/drivers/counter/104-quad-8.c -@@ -1230,12 +1230,13 @@ static ssize_t quad8_count_ceiling_write(struct counter_device *counter, - case 1: - case 3: - quad8_preset_register_set(priv, count->id, ceiling); -- break; -+ mutex_unlock(&priv->lock); -+ return len; - } - - mutex_unlock(&priv->lock); - -- return len; -+ return -EINVAL; - } - - static ssize_t quad8_count_preset_enable_read(struct counter_device *counter, -diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c -index f8a48a84df2ab..66fa524b6261e 100644 ---- a/drivers/crypto/mxs-dcp.c -+++ b/drivers/crypto/mxs-dcp.c -@@ -168,15 +168,19 @@ static struct dcp *global_sdcp; - - static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) - { -+ int dma_err; - struct dcp *sdcp = global_sdcp; - const int chan = actx->chan; - uint32_t stat; - unsigned long ret; - struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; -- - dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc), - DMA_TO_DEVICE); - -+ dma_err = dma_mapping_error(sdcp->dev, desc_phys); -+ if (dma_err) -+ return dma_err; -+ - reinit_completion(&sdcp->completion[chan]); - - /* Clear status register. */ -@@ -214,18 +218,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx) - static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, - struct ablkcipher_request *req, int init) - { -+ dma_addr_t key_phys, src_phys, dst_phys; - struct dcp *sdcp = global_sdcp; - struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; - struct dcp_aes_req_ctx *rctx = ablkcipher_request_ctx(req); - int ret; - -- dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, -- 2 * AES_KEYSIZE_128, -- DMA_TO_DEVICE); -- dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, -- DCP_BUF_SZ, DMA_TO_DEVICE); -- dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, -- DCP_BUF_SZ, DMA_FROM_DEVICE); -+ key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key, -+ 2 * AES_KEYSIZE_128, DMA_TO_DEVICE); -+ ret = dma_mapping_error(sdcp->dev, key_phys); -+ if (ret) -+ return ret; -+ -+ src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf, -+ DCP_BUF_SZ, DMA_TO_DEVICE); -+ ret = dma_mapping_error(sdcp->dev, src_phys); -+ if (ret) -+ goto err_src; -+ -+ dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, -+ DCP_BUF_SZ, DMA_FROM_DEVICE); -+ ret = dma_mapping_error(sdcp->dev, dst_phys); -+ if (ret) -+ goto err_dst; - - if (actx->fill % AES_BLOCK_SIZE) { - dev_err(sdcp->dev, "Invalid block size!\n"); -@@ -263,10 +278,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, - ret = mxs_dcp_start_dma(actx); - - aes_done_run: -+ dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); -+err_dst: -+ dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); -+err_src: - dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128, - DMA_TO_DEVICE); -- dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); -- dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE); - - return ret; - } -@@ -565,6 +582,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) - dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf, - DCP_BUF_SZ, DMA_TO_DEVICE); - -+ ret = dma_mapping_error(sdcp->dev, buf_phys); -+ if (ret) -+ return ret; -+ - /* Fill in the DMA descriptor. */ - desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE | - MXS_DCP_CONTROL0_INTERRUPT | -@@ -597,6 +618,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) - if (rctx->fini) { - digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf, - DCP_SHA_PAY_SZ, DMA_FROM_DEVICE); -+ ret = dma_mapping_error(sdcp->dev, digest_phys); -+ if (ret) -+ goto done_run; -+ - desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM; - desc->payload = digest_phys; - } -diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c -index f80db1eb29945..f8a146554b1f3 100644 ---- a/drivers/crypto/omap-sham.c -+++ b/drivers/crypto/omap-sham.c -@@ -1734,7 +1734,7 @@ static void omap_sham_done_task(unsigned long data) - if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags)) - goto finish; - } else if (test_bit(FLAGS_DMA_READY, &dd->flags)) { -- if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { -+ if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) { - omap_sham_update_dma_stop(dd); - if (dd->err) { - err = dd->err; -diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c -index d2d0ae445fd89..7c7d49a8a4034 100644 ---- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c -+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c -@@ -123,10 +123,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data) - hw_data->enable_error_correction = adf_vf_void_noop; - hw_data->init_admin_comms = adf_vf_int_noop; - hw_data->exit_admin_comms = adf_vf_void_noop; -- hw_data->send_admin_init = adf_vf2pf_init; -+ hw_data->send_admin_init = adf_vf2pf_notify_init; - hw_data->init_arb = adf_vf_int_noop; - hw_data->exit_arb = adf_vf_void_noop; -- hw_data->disable_iov = adf_vf2pf_shutdown; -+ hw_data->disable_iov = adf_vf2pf_notify_shutdown; - hw_data->get_accel_mask = get_accel_mask; - hw_data->get_ae_mask = get_ae_mask; - hw_data->get_num_accels = get_num_accels; -diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c -index 38e4bc04f407b..90e8a7564756b 100644 ---- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c -+++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c -@@ -123,10 +123,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data) - hw_data->enable_error_correction = adf_vf_void_noop; - hw_data->init_admin_comms = adf_vf_int_noop; - hw_data->exit_admin_comms = adf_vf_void_noop; -- hw_data->send_admin_init = adf_vf2pf_init; -+ hw_data->send_admin_init = adf_vf2pf_notify_init; - hw_data->init_arb = adf_vf_int_noop; - hw_data->exit_arb = adf_vf_void_noop; -- hw_data->disable_iov = adf_vf2pf_shutdown; -+ hw_data->disable_iov = adf_vf2pf_notify_shutdown; - hw_data->get_accel_mask = get_accel_mask; - hw_data->get_ae_mask = get_ae_mask; - hw_data->get_num_accels = get_num_accels; -diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h -index d78f8d5c89c3f..289dd7e48d4a4 100644 ---- a/drivers/crypto/qat/qat_common/adf_common_drv.h -+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h -@@ -239,8 +239,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, - void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); - void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev); - --int adf_vf2pf_init(struct adf_accel_dev *accel_dev); --void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev); -+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev); -+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev); - int adf_init_pf_wq(void); - void adf_exit_pf_wq(void); - int adf_init_vf_wq(void); -@@ -263,12 +263,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) - { - } - --static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev) -+static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) - { - return 0; - } - --static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) -+static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) - { - } - -diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c -index 26556c7130497..7a7d43c475342 100644 ---- a/drivers/crypto/qat/qat_common/adf_init.c -+++ b/drivers/crypto/qat/qat_common/adf_init.c -@@ -105,6 +105,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) - struct service_hndl *service; - struct list_head *list_itr; - struct adf_hw_device_data *hw_data = accel_dev->hw_device; -+ int ret; - - if (!hw_data) { - dev_err(&GET_DEV(accel_dev), -@@ -171,9 +172,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) - } - - hw_data->enable_error_correction(accel_dev); -- hw_data->enable_vf2pf_comms(accel_dev); -+ ret = hw_data->enable_vf2pf_comms(accel_dev); - -- return 0; -+ return ret; - } - EXPORT_SYMBOL_GPL(adf_dev_init); - -diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c -index 4898ef41fd9fd..7d319c5c071c4 100644 ---- a/drivers/crypto/qat/qat_common/adf_isr.c -+++ b/drivers/crypto/qat/qat_common/adf_isr.c -@@ -59,6 +59,8 @@ - #include "adf_transport_access_macros.h" - #include "adf_transport_internal.h" - -+#define ADF_MAX_NUM_VFS 32 -+ - static int adf_enable_msix(struct adf_accel_dev *accel_dev) - { - struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev; -@@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) - struct adf_bar *pmisc = - &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; - void __iomem *pmisc_bar_addr = pmisc->virt_addr; -- u32 vf_mask; -+ unsigned long vf_mask; - - /* Get the interrupt sources triggered by VFs */ - vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) & -@@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr) - * unless the VF is malicious and is attempting to - * flood the host OS with VF2PF interrupts. - */ -- for_each_set_bit(i, (const unsigned long *)&vf_mask, -- (sizeof(vf_mask) * BITS_PER_BYTE)) { -+ for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) { - vf_info = accel_dev->pf.vf_info + i; - - if (!__ratelimit(&vf_info->vf2pf_ratelimit)) { -diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -index b3875fdf6cd72..c64481160b711 100644 ---- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c -@@ -231,7 +231,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr) - - return ret; - } --EXPORT_SYMBOL_GPL(adf_iov_putmsg); - - void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info) - { -@@ -361,6 +360,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev) - msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT; - BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255); - -+ reinit_completion(&accel_dev->vf.iov_msg_completion); -+ - /* Send request from VF to PF */ - ret = adf_iov_putmsg(accel_dev, msg, 0); - if (ret) { -diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c -index cd5f37dffe8a6..1830194567e84 100644 ---- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c -+++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c -@@ -49,14 +49,14 @@ - #include "adf_pf2vf_msg.h" - - /** -- * adf_vf2pf_init() - send init msg to PF -+ * adf_vf2pf_notify_init() - send init msg to PF - * @accel_dev: Pointer to acceleration VF device. - * - * Function sends an init messge from the VF to a PF - * - * Return: 0 on success, error code otherwise. - */ --int adf_vf2pf_init(struct adf_accel_dev *accel_dev) -+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev) - { - u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | - (ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT)); -@@ -69,17 +69,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev) - set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status); - return 0; - } --EXPORT_SYMBOL_GPL(adf_vf2pf_init); -+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init); - - /** -- * adf_vf2pf_shutdown() - send shutdown msg to PF -+ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF - * @accel_dev: Pointer to acceleration VF device. - * - * Function sends a shutdown messge from the VF to a PF - * - * Return: void - */ --void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) -+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev) - { - u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | - (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT)); -@@ -89,4 +89,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev) - dev_err(&GET_DEV(accel_dev), - "Failed to send Shutdown event to PF\n"); - } --EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown); -+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown); -diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c -index df9a1f35b8320..ef90902c8200d 100644 ---- a/drivers/crypto/qat/qat_common/adf_vf_isr.c -+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c -@@ -203,6 +203,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) - struct adf_bar *pmisc = - &GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)]; - void __iomem *pmisc_bar_addr = pmisc->virt_addr; -+ bool handled = false; - u32 v_int; - - /* Read VF INT source CSR to determine the source of VF interrupt */ -@@ -215,7 +216,7 @@ static irqreturn_t adf_isr(int irq, void *privdata) - - /* Schedule tasklet to handle interrupt BH */ - tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet); -- return IRQ_HANDLED; -+ handled = true; - } - - /* Check bundle interrupt */ -@@ -227,10 +228,10 @@ static irqreturn_t adf_isr(int irq, void *privdata) - WRITE_CSR_INT_FLAG_AND_COL(bank->csr_addr, bank->bank_number, - 0); - tasklet_hi_schedule(&bank->resp_handler); -- return IRQ_HANDLED; -+ handled = true; - } - -- return IRQ_NONE; -+ return handled ? IRQ_HANDLED : IRQ_NONE; - } - - static int adf_request_msi_irq(struct adf_accel_dev *accel_dev) -diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c -index a3b4dd8099a7b..3a8361c83f0b1 100644 ---- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c -+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c -@@ -123,10 +123,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data) - hw_data->enable_error_correction = adf_vf_void_noop; - hw_data->init_admin_comms = adf_vf_int_noop; - hw_data->exit_admin_comms = adf_vf_void_noop; -- hw_data->send_admin_init = adf_vf2pf_init; -+ hw_data->send_admin_init = adf_vf2pf_notify_init; - hw_data->init_arb = adf_vf_int_noop; - hw_data->exit_arb = adf_vf_void_noop; -- hw_data->disable_iov = adf_vf2pf_shutdown; -+ hw_data->disable_iov = adf_vf2pf_notify_shutdown; - hw_data->get_accel_mask = get_accel_mask; - hw_data->get_ae_mask = get_ae_mask; - hw_data->get_num_accels = get_num_accels; -diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c -index f72be5f94e6fa..29576922df78f 100644 ---- a/drivers/edac/i10nm_base.c -+++ b/drivers/edac/i10nm_base.c -@@ -26,8 +26,8 @@ - pci_read_config_dword((d)->uracu, 0xd8 + (i) * 4, &(reg)) - #define I10NM_GET_DIMMMTR(m, i, j) \ - readl((m)->mbase + 0x2080c + (i) * 0x4000 + (j) * 4) --#define I10NM_GET_MCDDRTCFG(m, i, j) \ -- readl((m)->mbase + 0x20970 + (i) * 0x4000 + (j) * 4) -+#define I10NM_GET_MCDDRTCFG(m, i) \ -+ readl((m)->mbase + 0x20970 + (i) * 0x4000) - #define I10NM_GET_MCMTR(m, i) \ - readl((m)->mbase + 0x20ef8 + (i) * 0x4000) - -@@ -156,11 +156,11 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci) - continue; - - ndimms = 0; -+ mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i); - for (j = 0; j < I10NM_NUM_DIMMS; j++) { - dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms, - mci->n_layers, i, j, 0); - mtr = I10NM_GET_DIMMMTR(imc, i, j); -- mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i, j); - edac_dbg(1, "dimmmtr 0x%x mcddrtcfg 0x%x (mc%d ch%d dimm%d)\n", - mtr, mcddrtcfg, imc->mc, i, j); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c -index 82155ac3288a0..64ee44c2fdd1d 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c -@@ -163,17 +163,28 @@ static int acp_poweron(struct generic_pm_domain *genpd) - return 0; - } - --static struct device *get_mfd_cell_dev(const char *device_name, int r) -+static int acp_genpd_add_device(struct device *dev, void *data) - { -- char auto_dev_name[25]; -- struct device *dev; -+ struct generic_pm_domain *gpd = data; -+ int ret; - -- snprintf(auto_dev_name, sizeof(auto_dev_name), -- "%s.%d.auto", device_name, r); -- dev = bus_find_device_by_name(&platform_bus_type, NULL, auto_dev_name); -- dev_info(dev, "device %s added to pm domain\n", auto_dev_name); -+ ret = pm_genpd_add_device(gpd, dev); -+ if (ret) -+ dev_err(dev, "Failed to add dev to genpd %d\n", ret); - -- return dev; -+ return ret; -+} -+ -+static int acp_genpd_remove_device(struct device *dev, void *data) -+{ -+ int ret; -+ -+ ret = pm_genpd_remove_device(dev); -+ if (ret) -+ dev_err(dev, "Failed to remove dev from genpd %d\n", ret); -+ -+ /* Continue to remove */ -+ return 0; - } - - /** -@@ -184,11 +195,10 @@ static struct device *get_mfd_cell_dev(const char *device_name, int r) - */ - static int acp_hw_init(void *handle) - { -- int r, i; -+ int r; - uint64_t acp_base; - u32 val = 0; - u32 count = 0; -- struct device *dev; - struct i2s_platform_data *i2s_pdata = NULL; - - struct amdgpu_device *adev = (struct amdgpu_device *)handle; -@@ -344,15 +354,10 @@ static int acp_hw_init(void *handle) - if (r) - goto failure; - -- for (i = 0; i < ACP_DEVS ; i++) { -- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i); -- r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev); -- if (r) { -- dev_err(dev, "Failed to add dev to genpd\n"); -- goto failure; -- } -- } -- -+ r = device_for_each_child(adev->acp.parent, &adev->acp.acp_genpd->gpd, -+ acp_genpd_add_device); -+ if (r) -+ goto failure; - - /* Assert Soft reset of ACP */ - val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET); -@@ -413,10 +418,8 @@ failure: - */ - static int acp_hw_fini(void *handle) - { -- int i, ret; - u32 val = 0; - u32 count = 0; -- struct device *dev; - struct amdgpu_device *adev = (struct amdgpu_device *)handle; - - /* return early if no ACP */ -@@ -461,13 +464,8 @@ static int acp_hw_fini(void *handle) - udelay(100); - } - -- for (i = 0; i < ACP_DEVS ; i++) { -- dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i); -- ret = pm_genpd_remove_device(dev); -- /* If removal fails, dont giveup and try rest */ -- if (ret) -- dev_err(dev, "remove dev from genpd failed\n"); -- } -+ device_for_each_child(adev->acp.parent, NULL, -+ acp_genpd_remove_device); - - mfd_remove_devices(adev->acp.parent); - kfree(adev->acp.acp_res); -diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c -index 179e8d52cadb4..a08ca7a47400f 100644 ---- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c -+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c -@@ -281,10 +281,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx) - int i; - - for (i = 0; i < ctx->mixer_count; i++) { -- DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0); -- DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0); -- DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0); -- DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0); -+ enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id; -+ -+ DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0); -+ DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0); -+ DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0); -+ DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0); - } - } - -diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c -index 55ea4bc2ee9cb..0d37ae5b310c4 100644 ---- a/drivers/gpu/drm/msm/dsi/dsi.c -+++ b/drivers/gpu/drm/msm/dsi/dsi.c -@@ -26,8 +26,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) - } - - phy_pdev = of_find_device_by_node(phy_node); -- if (phy_pdev) -+ if (phy_pdev) { - msm_dsi->phy = platform_get_drvdata(phy_pdev); -+ msm_dsi->phy_dev = &phy_pdev->dev; -+ } - - of_node_put(phy_node); - -@@ -36,8 +38,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) - return -EPROBE_DEFER; - } - -- msm_dsi->phy_dev = get_device(&phy_pdev->dev); -- - return 0; - } - -diff --git a/drivers/gpu/drm/panfrost/panfrost_device.c b/drivers/gpu/drm/panfrost/panfrost_device.c -index 238fb6d54df47..413bf314a2bc3 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_device.c -+++ b/drivers/gpu/drm/panfrost/panfrost_device.c -@@ -59,7 +59,8 @@ static int panfrost_clk_init(struct panfrost_device *pfdev) - if (IS_ERR(pfdev->bus_clock)) { - dev_err(pfdev->dev, "get bus_clock failed %ld\n", - PTR_ERR(pfdev->bus_clock)); -- return PTR_ERR(pfdev->bus_clock); -+ err = PTR_ERR(pfdev->bus_clock); -+ goto disable_clock; - } - - if (pfdev->bus_clock) { -diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c -index ff340d7ae2e52..6a880c2623808 100644 ---- a/drivers/i2c/busses/i2c-highlander.c -+++ b/drivers/i2c/busses/i2c-highlander.c -@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, dev); - - dev->irq = platform_get_irq(pdev, 0); -- if (iic_force_poll) -+ if (dev->irq < 0 || iic_force_poll) - dev->irq = 0; - - if (dev->irq) { -diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c -index 2f8b8050a2233..899624721c1ea 100644 ---- a/drivers/i2c/busses/i2c-iop3xx.c -+++ b/drivers/i2c/busses/i2c-iop3xx.c -@@ -467,16 +467,14 @@ iop3xx_i2c_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -- ret = -ENXIO; -+ ret = irq; - goto unmap; - } - ret = request_irq(irq, iop3xx_i2c_irq_handler, 0, - pdev->name, adapter_data); - -- if (ret) { -- ret = -EIO; -+ if (ret) - goto unmap; -- } - - memcpy(new_adapter->name, pdev->name, strlen(pdev->name)); - new_adapter->owner = THIS_MODULE; -diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c -index e1ef0122ef759..5587e7c549c4f 100644 ---- a/drivers/i2c/busses/i2c-mt65xx.c -+++ b/drivers/i2c/busses/i2c-mt65xx.c -@@ -932,7 +932,7 @@ static int mtk_i2c_probe(struct platform_device *pdev) - return PTR_ERR(i2c->pdmabase); - - irq = platform_get_irq(pdev, 0); -- if (irq <= 0) -+ if (irq < 0) - return irq; - - init_completion(&i2c->msg_complete); -diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c -index d6322698b2458..e6f927c6f8af9 100644 ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -1141,7 +1141,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev) - */ - if (!(i2c->quirks & QUIRK_POLL)) { - i2c->irq = ret = platform_get_irq(pdev, 0); -- if (ret <= 0) { -+ if (ret < 0) { - dev_err(&pdev->dev, "cannot find IRQ\n"); - clk_unprepare(i2c->clk); - return ret; -diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c -index c94995f0daa2a..03ae33093ce63 100644 ---- a/drivers/leds/leds-lt3593.c -+++ b/drivers/leds/leds-lt3593.c -@@ -103,10 +103,9 @@ static int lt3593_led_probe(struct platform_device *pdev) - init_data.default_label = ":"; - - ret = devm_led_classdev_register_ext(dev, &led_data->cdev, &init_data); -- if (ret < 0) { -- fwnode_handle_put(child); -+ fwnode_handle_put(child); -+ if (ret < 0) - return ret; -- } - - led_data->cdev.dev->of_node = dev->of_node; - platform_set_drvdata(pdev, led_data); -diff --git a/drivers/leds/trigger/ledtrig-audio.c b/drivers/leds/trigger/ledtrig-audio.c -index f76621e88482d..c6b437e6369b8 100644 ---- a/drivers/leds/trigger/ledtrig-audio.c -+++ b/drivers/leds/trigger/ledtrig-audio.c -@@ -6,10 +6,33 @@ - #include - #include - #include -+#include "../leds.h" - --static struct led_trigger *ledtrig_audio[NUM_AUDIO_LEDS]; - static enum led_brightness audio_state[NUM_AUDIO_LEDS]; - -+static int ledtrig_audio_mute_activate(struct led_classdev *led_cdev) -+{ -+ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MUTE]); -+ return 0; -+} -+ -+static int ledtrig_audio_micmute_activate(struct led_classdev *led_cdev) -+{ -+ led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MICMUTE]); -+ return 0; -+} -+ -+static struct led_trigger ledtrig_audio[NUM_AUDIO_LEDS] = { -+ [LED_AUDIO_MUTE] = { -+ .name = "audio-mute", -+ .activate = ledtrig_audio_mute_activate, -+ }, -+ [LED_AUDIO_MICMUTE] = { -+ .name = "audio-micmute", -+ .activate = ledtrig_audio_micmute_activate, -+ }, -+}; -+ - enum led_brightness ledtrig_audio_get(enum led_audio type) - { - return audio_state[type]; -@@ -19,24 +42,22 @@ EXPORT_SYMBOL_GPL(ledtrig_audio_get); - void ledtrig_audio_set(enum led_audio type, enum led_brightness state) - { - audio_state[type] = state; -- led_trigger_event(ledtrig_audio[type], state); -+ led_trigger_event(&ledtrig_audio[type], state); - } - EXPORT_SYMBOL_GPL(ledtrig_audio_set); - - static int __init ledtrig_audio_init(void) - { -- led_trigger_register_simple("audio-mute", -- &ledtrig_audio[LED_AUDIO_MUTE]); -- led_trigger_register_simple("audio-micmute", -- &ledtrig_audio[LED_AUDIO_MICMUTE]); -+ led_trigger_register(&ledtrig_audio[LED_AUDIO_MUTE]); -+ led_trigger_register(&ledtrig_audio[LED_AUDIO_MICMUTE]); - return 0; - } - module_init(ledtrig_audio_init); - - static void __exit ledtrig_audio_exit(void) - { -- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MUTE]); -- led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MICMUTE]); -+ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MUTE]); -+ led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MICMUTE]); - } - module_exit(ledtrig_audio_exit); - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index b0d569032dd4e..efdf6ce0443ea 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -839,20 +839,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, - n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long); - d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL); - if (!d->full_dirty_stripes) -- return -ENOMEM; -+ goto out_free_stripe_sectors_dirty; - - idx = ida_simple_get(&bcache_device_idx, 0, - BCACHE_DEVICE_IDX_MAX, GFP_KERNEL); - if (idx < 0) -- return idx; -+ goto out_free_full_dirty_stripes; - - if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio), - BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER)) -- goto err; -+ goto out_ida_remove; - - d->disk = alloc_disk(BCACHE_MINORS); - if (!d->disk) -- goto err; -+ goto out_bioset_exit; - - set_capacity(d->disk, sectors); - snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx); -@@ -887,8 +887,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, - - return 0; - --err: -+out_bioset_exit: -+ bioset_exit(&d->bio_split); -+out_ida_remove: - ida_simple_remove(&bcache_device_idx, idx); -+out_free_full_dirty_stripes: -+ kvfree(d->full_dirty_stripes); -+out_free_stripe_sectors_dirty: -+ kvfree(d->stripe_sectors_dirty); - return -ENOMEM; - - } -diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c -index e43d8327b8103..1088161498df0 100644 ---- a/drivers/media/i2c/tda1997x.c -+++ b/drivers/media/i2c/tda1997x.c -@@ -2233,6 +2233,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd) - /* get initial HDMI status */ - state->hdmi_status = io_read(sd, REG_HDMI_FLAGS); - -+ io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN); - return 0; - } - -diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c -index 00c7bed3dd572..e6b68be09f8f0 100644 ---- a/drivers/media/platform/coda/coda-bit.c -+++ b/drivers/media/platform/coda/coda-bit.c -@@ -2023,17 +2023,25 @@ static int __coda_start_decoding(struct coda_ctx *ctx) - u32 src_fourcc, dst_fourcc; - int ret; - -+ q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT); -+ q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); -+ src_fourcc = q_data_src->fourcc; -+ dst_fourcc = q_data_dst->fourcc; -+ - if (!ctx->initialized) { - ret = __coda_decoder_seq_init(ctx); - if (ret < 0) - return ret; -+ } else { -+ ctx->frame_mem_ctrl &= ~(CODA_FRAME_CHROMA_INTERLEAVE | (0x3 << 9) | -+ CODA9_FRAME_TILED2LINEAR); -+ if (dst_fourcc == V4L2_PIX_FMT_NV12 || dst_fourcc == V4L2_PIX_FMT_YUYV) -+ ctx->frame_mem_ctrl |= CODA_FRAME_CHROMA_INTERLEAVE; -+ if (ctx->tiled_map_type == GDI_TILED_FRAME_MB_RASTER_MAP) -+ ctx->frame_mem_ctrl |= (0x3 << 9) | -+ ((ctx->use_vdoa) ? 0 : CODA9_FRAME_TILED2LINEAR); - } - -- q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT); -- q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE); -- src_fourcc = q_data_src->fourcc; -- dst_fourcc = q_data_dst->fourcc; -- - coda_write(dev, ctx->parabuf.paddr, CODA_REG_BIT_PARA_BUF_ADDR); - - ret = coda_alloc_framebuffers(ctx, q_data_dst, src_fourcc); -diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c -index 30028ceb548b1..766ca497f8565 100644 ---- a/drivers/media/platform/qcom/venus/venc.c -+++ b/drivers/media/platform/qcom/venus/venc.c -@@ -308,6 +308,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f) - else - return NULL; - fmt = find_format(inst, pixmp->pixelformat, f->type); -+ if (!fmt) -+ return NULL; - } - - pixmp->width = clamp(pixmp->width, frame_width_min(inst), -diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c -index 4077217777f92..93194f03764d2 100644 ---- a/drivers/media/spi/cxd2880-spi.c -+++ b/drivers/media/spi/cxd2880-spi.c -@@ -524,13 +524,13 @@ cxd2880_spi_probe(struct spi_device *spi) - if (IS_ERR(dvb_spi->vcc_supply)) { - if (PTR_ERR(dvb_spi->vcc_supply) == -EPROBE_DEFER) { - ret = -EPROBE_DEFER; -- goto fail_adapter; -+ goto fail_regulator; - } - dvb_spi->vcc_supply = NULL; - } else { - ret = regulator_enable(dvb_spi->vcc_supply); - if (ret) -- goto fail_adapter; -+ goto fail_regulator; - } - - dvb_spi->spi = spi; -@@ -618,6 +618,9 @@ fail_frontend: - fail_attach: - dvb_unregister_adapter(&dvb_spi->adapter); - fail_adapter: -+ if (!dvb_spi->vcc_supply) -+ regulator_disable(dvb_spi->vcc_supply); -+fail_regulator: - kfree(dvb_spi); - return ret; - } -diff --git a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c -index 2e07106f46803..bc4b2abdde1a4 100644 ---- a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c -@@ -17,7 +17,8 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d) - - if (d->props.i2c_algo == NULL) { - err("no i2c algorithm specified"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err; - } - - strscpy(d->i2c_adap.name, d->desc->name, sizeof(d->i2c_adap.name)); -@@ -27,11 +28,15 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d) - - i2c_set_adapdata(&d->i2c_adap, d); - -- if ((ret = i2c_add_adapter(&d->i2c_adap)) < 0) -+ ret = i2c_add_adapter(&d->i2c_adap); -+ if (ret < 0) { - err("could not add i2c adapter"); -+ goto err; -+ } - - d->state |= DVB_USB_STATE_I2C; - -+err: - return ret; - } - -diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c -index f57c4627624f5..e7720ff11d3d9 100644 ---- a/drivers/media/usb/dvb-usb/dvb-usb-init.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c -@@ -194,8 +194,8 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums) - - err_adapter_init: - dvb_usb_adapter_exit(d); --err_i2c_init: - dvb_usb_i2c_exit(d); -+err_i2c_init: - if (d->priv && d->props.priv_destroy) - d->props.priv_destroy(d); - err_priv_init: -diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c -index e368935a50894..c16d4f1624952 100644 ---- a/drivers/media/usb/dvb-usb/nova-t-usb2.c -+++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c -@@ -130,7 +130,7 @@ ret: - - static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) - { -- int i; -+ int i, ret; - u8 b; - - mac[0] = 0x00; -@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6]) - - /* this is a complete guess, but works for my box */ - for (i = 136; i < 139; i++) { -- dibusb_read_eeprom_byte(d,i, &b); -+ ret = dibusb_read_eeprom_byte(d, i, &b); -+ if (ret) -+ return ret; - - mac[5 - (i - 136)] = b; - } -diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c -index 381b5c898a076..b7ee972455e5b 100644 ---- a/drivers/media/usb/dvb-usb/vp702x.c -+++ b/drivers/media/usb/dvb-usb/vp702x.c -@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state) - static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6]) - { - u8 i, *buf; -+ int ret; - struct vp702x_device_state *st = d->priv; - - mutex_lock(&st->buf_mutex); - buf = st->buf; -- for (i = 6; i < 12; i++) -- vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1); -+ for (i = 6; i < 12; i++) { -+ ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, -+ &buf[i - 6], 1); -+ if (ret < 0) -+ goto err; -+ } - - memcpy(mac, buf, 6); -+err: - mutex_unlock(&st->buf_mutex); -- return 0; -+ return ret; - } - - static int vp702x_frontend_attach(struct dvb_usb_adapter *adap) -diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c -index 59529cbf9cd0b..0b6d77c3bec86 100644 ---- a/drivers/media/usb/em28xx/em28xx-input.c -+++ b/drivers/media/usb/em28xx/em28xx-input.c -@@ -842,7 +842,6 @@ error: - kfree(ir); - ref_put: - em28xx_shutdown_buttons(dev); -- kref_put(&dev->ref, em28xx_free_device); - return err; - } - -diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c -index 153a0c3e3da64..b9302d77d6c83 100644 ---- a/drivers/media/usb/go7007/go7007-driver.c -+++ b/drivers/media/usb/go7007/go7007-driver.c -@@ -691,49 +691,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board, - struct device *dev) - { - struct go7007 *go; -- int i; - - go = kzalloc(sizeof(struct go7007), GFP_KERNEL); - if (go == NULL) - return NULL; - go->dev = dev; - go->board_info = board; -- go->board_id = 0; - go->tuner_type = -1; -- go->channel_number = 0; -- go->name[0] = 0; - mutex_init(&go->hw_lock); - init_waitqueue_head(&go->frame_waitq); - spin_lock_init(&go->spinlock); - go->status = STATUS_INIT; -- memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter)); -- go->i2c_adapter_online = 0; -- go->interrupt_available = 0; - init_waitqueue_head(&go->interrupt_waitq); -- go->input = 0; - go7007_update_board(go); -- go->encoder_h_halve = 0; -- go->encoder_v_halve = 0; -- go->encoder_subsample = 0; - go->format = V4L2_PIX_FMT_MJPEG; - go->bitrate = 1500000; - go->fps_scale = 1; -- go->pali = 0; - go->aspect_ratio = GO7007_RATIO_1_1; -- go->gop_size = 0; -- go->ipb = 0; -- go->closed_gop = 0; -- go->repeat_seqhead = 0; -- go->seq_header_enable = 0; -- go->gop_header_enable = 0; -- go->dvd_mode = 0; -- go->interlace_coding = 0; -- for (i = 0; i < 4; ++i) -- go->modet[i].enable = 0; -- for (i = 0; i < 1624; ++i) -- go->modet_map[i] = 0; -- go->audio_deliver = NULL; -- go->audio_enabled = 0; - - return go; - } -diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c -index 6ace82028667b..7b280cb363271 100644 ---- a/drivers/mmc/host/dw_mmc.c -+++ b/drivers/mmc/host/dw_mmc.c -@@ -782,6 +782,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host, - int ret = 0; - - /* Set external dma config: burst size, burst width */ -+ memset(&cfg, 0, sizeof(cfg)); - cfg.dst_addr = host->phy_regs + fifo_offset; - cfg.src_addr = cfg.dst_addr; - cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; -diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c -index a0670e9cd0127..5553a5643f405 100644 ---- a/drivers/mmc/host/moxart-mmc.c -+++ b/drivers/mmc/host/moxart-mmc.c -@@ -631,6 +631,7 @@ static int moxart_probe(struct platform_device *pdev) - host->dma_chan_tx, host->dma_chan_rx); - host->have_dma = true; - -+ memset(&cfg, 0, sizeof(cfg)); - cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; - cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; - -diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -index d82a519a0cd9a..f9f246c82c974 100644 ---- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c -@@ -2013,10 +2013,11 @@ int rvu_mbox_handler_npc_mcam_unmap_counter(struct rvu *rvu, - index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry); - if (index >= mcam->bmap_entries) - break; -+ entry = index + 1; -+ - if (mcam->entry2cntr_map[index] != req->cntr) - continue; - -- entry = index + 1; - npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr, - index, req->cntr); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -index d48292ccda294..9239d767443f2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -@@ -234,18 +234,12 @@ struct ttc_params { - - void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, struct ttc_params *ttc_params); - void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params); --void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params); - - int mlx5e_create_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, - struct mlx5e_ttc_table *ttc); - void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv, - struct mlx5e_ttc_table *ttc); - --int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, -- struct mlx5e_ttc_table *ttc); --void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, -- struct mlx5e_ttc_table *ttc); -- - void mlx5e_destroy_flow_table(struct mlx5e_flow_table *ft); - - void mlx5e_enable_cvlan_filter(struct mlx5e_priv *priv); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -index c4ac7a9968d16..c3b9278486a1e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -@@ -1123,7 +1123,7 @@ void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, - ttc_params->inner_ttc = &priv->fs.inner_ttc; - } - --void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params) -+static void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params) - { - struct mlx5_flow_table_attr *ft_attr = &ttc_params->ft_attr; - -@@ -1142,8 +1142,8 @@ void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params) - ft_attr->prio = MLX5E_NIC_PRIO; - } - --int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, -- struct mlx5e_ttc_table *ttc) -+static int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params, -+ struct mlx5e_ttc_table *ttc) - { - struct mlx5e_flow_table *ft = &ttc->ft; - int err; -@@ -1173,8 +1173,8 @@ err: - return err; - } - --void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, -- struct mlx5e_ttc_table *ttc) -+static void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv, -+ struct mlx5e_ttc_table *ttc) - { - if (!mlx5e_tunnel_inner_ft_supported(priv->mdev)) - return; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -index 0fed2419623d1..1f3d12faa2a5b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -@@ -319,17 +319,6 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv) - } - - mlx5e_set_ttc_basic_params(priv, &ttc_params); -- mlx5e_set_inner_ttc_ft_params(&ttc_params); -- for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) -- ttc_params.indir_tirn[tt] = priv->inner_indir_tir[tt].tirn; -- -- err = mlx5e_create_inner_ttc_table(priv, &ttc_params, &priv->fs.inner_ttc); -- if (err) { -- netdev_err(priv->netdev, "Failed to create inner ttc table, err=%d\n", -- err); -- goto err_destroy_arfs_tables; -- } -- - mlx5e_set_ttc_ft_params(&ttc_params); - for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) - ttc_params.indir_tirn[tt] = priv->indir_tir[tt].tirn; -@@ -338,13 +327,11 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv) - if (err) { - netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n", - err); -- goto err_destroy_inner_ttc_table; -+ goto err_destroy_arfs_tables; - } - - return 0; - --err_destroy_inner_ttc_table: -- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc); - err_destroy_arfs_tables: - mlx5e_arfs_destroy_tables(priv); - -@@ -354,7 +341,6 @@ err_destroy_arfs_tables: - static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv) - { - mlx5e_destroy_ttc_table(priv, &priv->fs.ttc); -- mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc); - mlx5e_arfs_destroy_tables(priv); - } - -@@ -379,7 +365,7 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv) - if (err) - goto err_destroy_indirect_rqts; - -- err = mlx5e_create_indirect_tirs(priv, true); -+ err = mlx5e_create_indirect_tirs(priv, false); - if (err) - goto err_destroy_direct_rqts; - -diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c -index baac016f3ec0b..15591ad5fe4ea 100644 ---- a/drivers/net/ethernet/qualcomm/qca_spi.c -+++ b/drivers/net/ethernet/qualcomm/qca_spi.c -@@ -434,7 +434,7 @@ qcaspi_receive(struct qcaspi *qca) - skb_put(qca->rx_skb, retcode); - qca->rx_skb->protocol = eth_type_trans( - qca->rx_skb, qca->rx_skb->dev); -- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; -+ skb_checksum_none_assert(qca->rx_skb); - netif_rx_ni(qca->rx_skb); - qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, - net_dev->mtu + VLAN_ETH_HLEN); -diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c -index 0981068504fa7..ade70f5df496c 100644 ---- a/drivers/net/ethernet/qualcomm/qca_uart.c -+++ b/drivers/net/ethernet/qualcomm/qca_uart.c -@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data, - skb_put(qca->rx_skb, retcode); - qca->rx_skb->protocol = eth_type_trans( - qca->rx_skb, qca->rx_skb->dev); -- qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; -+ skb_checksum_none_assert(qca->rx_skb); - netif_rx_ni(qca->rx_skb); - qca->rx_skb = netdev_alloc_skb_ip_align(netdev, - netdev->mtu + -diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c -index c610fe21c85c0..31ffec3a59727 100644 ---- a/drivers/net/wireless/ath/ath6kl/wmi.c -+++ b/drivers/net/wireless/ath/ath6kl/wmi.c -@@ -2510,8 +2510,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx) - goto free_data_skb; - - for (index = 0; index < num_pri_streams; index++) { -- if (WARN_ON(!data_sync_bufs[index].skb)) -+ if (WARN_ON(!data_sync_bufs[index].skb)) { -+ ret = -ENOMEM; - goto free_data_skb; -+ } - - ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev, - data_sync_bufs[index]. -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -index bda042138e967..e6001f0a81a3a 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c -@@ -2073,7 +2073,7 @@ cleanup: - - err = brcmf_pcie_probe(pdev, NULL); - if (err) -- brcmf_err(bus, "probe after resume failed, err=%d\n", err); -+ __brcmf_err(NULL, __func__, "probe after resume failed, err=%d\n", err); - - return err; - } -diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c -index 03791f3fe480c..5e6c5d13319d5 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_hal.c -+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c -@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter) - } - - ta_firmware = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); -- if (!ta_firmware) -+ if (!ta_firmware) { -+ status = -ENOMEM; - goto fail_release_fw; -+ } - fw_p = ta_firmware; - instructions_sz = fw_entry->size; - rsi_dbg(INFO_ZONE, "FW Length = %d bytes\n", instructions_sz); -diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c -index a296f4e0d324a..e8aa3d4bda885 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_usb.c -+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c -@@ -806,6 +806,7 @@ static int rsi_probe(struct usb_interface *pfunction, - } else { - rsi_dbg(ERR_ZONE, "%s: Unsupported RSI device id 0x%x\n", - __func__, id->idProduct); -+ status = -ENODEV; - goto err1; - } - -diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c -index b8c0f75bfb7ba..dcc3d2393605e 100644 ---- a/drivers/nvme/host/rdma.c -+++ b/drivers/nvme/host/rdma.c -@@ -665,13 +665,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) - if (ret) - return ret; - -- ctrl->ctrl.queue_count = nr_io_queues + 1; -- if (ctrl->ctrl.queue_count < 2) { -+ if (nr_io_queues == 0) { - dev_err(ctrl->ctrl.device, - "unable to set any I/O queues\n"); - return -ENOMEM; - } - -+ ctrl->ctrl.queue_count = nr_io_queues + 1; - dev_info(ctrl->ctrl.device, - "creating %d I/O queues.\n", nr_io_queues); - -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index 718152adc6254..f6427a10a9908 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -1649,13 +1649,13 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl) - if (ret) - return ret; - -- ctrl->queue_count = nr_io_queues + 1; -- if (ctrl->queue_count < 2) { -+ if (nr_io_queues == 0) { - dev_err(ctrl->device, - "unable to set any I/O queues\n"); - return -ENOMEM; - } - -+ ctrl->queue_count = nr_io_queues + 1; - dev_info(ctrl->device, - "creating %d I/O queues.\n", nr_io_queues); - -diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c -index 4e9004fe5c6f3..5e47395afc1d5 100644 ---- a/drivers/nvme/target/fabrics-cmd.c -+++ b/drivers/nvme/target/fabrics-cmd.c -@@ -116,6 +116,7 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req) - if (!sqsize) { - pr_warn("queue size zero!\n"); - req->error_loc = offsetof(struct nvmf_connect_command, sqsize); -+ req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize); - ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR; - goto err; - } -@@ -250,11 +251,11 @@ static void nvmet_execute_io_connect(struct nvmet_req *req) - } - - status = nvmet_install_queue(ctrl, req); -- if (status) { -- /* pass back cntlid that had the issue of installing queue */ -- req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid); -+ if (status) - goto out_ctrl_put; -- } -+ -+ /* pass back cntlid for successful completion */ -+ req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid); - - pr_debug("adding queue %d to ctrl %d.\n", qid, ctrl->cntlid); - -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 3c3bc9f584983..58c33b65d451a 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -2253,7 +2253,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable - if (enable) { - int error; - -- if (pci_pme_capable(dev, state)) -+ /* -+ * Enable PME signaling if the device can signal PME from -+ * D3cold regardless of whether or not it can signal PME from -+ * the current target state, because that will allow it to -+ * signal PME when the hierarchy above it goes into D3cold and -+ * the device itself ends up in D3cold as a result of that. -+ */ -+ if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold)) - pci_pme_active(dev, true); - else - ret = 1; -@@ -2357,16 +2364,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup) - if (dev->current_state == PCI_D3cold) - target_state = PCI_D3cold; - -- if (wakeup) { -+ if (wakeup && dev->pme_support) { -+ pci_power_t state = target_state; -+ - /* - * Find the deepest state from which the device can generate - * PME#. - */ -- if (dev->pme_support) { -- while (target_state -- && !(dev->pme_support & (1 << target_state))) -- target_state--; -- } -+ while (state && !(dev->pme_support & (1 << state))) -+ state--; -+ -+ if (state) -+ return state; -+ else if (dev->pme_support & 1) -+ return PCI_D0; - } - - return target_state; -diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c -index f40fa0e63b6e5..993e4a4a34b38 100644 ---- a/drivers/power/supply/axp288_fuel_gauge.c -+++ b/drivers/power/supply/axp288_fuel_gauge.c -@@ -149,7 +149,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg) - } - - if (ret < 0) { -- dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret); -+ dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret); - return ret; - } - -@@ -163,7 +163,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val) - ret = regmap_write(info->regmap, reg, (unsigned int)val); - - if (ret < 0) -- dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret); -+ dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret); - - return ret; - } -diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c -index fa862f0380c41..ab4740c3bf573 100644 ---- a/drivers/power/supply/max17042_battery.c -+++ b/drivers/power/supply/max17042_battery.c -@@ -726,7 +726,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip) - struct max17042_config_data *config = chip->pdata->config_data; - - max17042_override_por(map, MAX17042_TGAIN, config->tgain); -- max17042_override_por(map, MAx17042_TOFF, config->toff); -+ max17042_override_por(map, MAX17042_TOFF, config->toff); - max17042_override_por(map, MAX17042_CGAIN, config->cgain); - max17042_override_por(map, MAX17042_COFF, config->coff); - -diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c -index cbadb1c996790..d2a37978fc3a8 100644 ---- a/drivers/regulator/vctrl-regulator.c -+++ b/drivers/regulator/vctrl-regulator.c -@@ -37,7 +37,6 @@ struct vctrl_voltage_table { - struct vctrl_data { - struct regulator_dev *rdev; - struct regulator_desc desc; -- struct regulator *ctrl_reg; - bool enabled; - unsigned int min_slew_down_rate; - unsigned int ovp_threshold; -@@ -82,7 +81,12 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV) - static int vctrl_get_voltage(struct regulator_dev *rdev) - { - struct vctrl_data *vctrl = rdev_get_drvdata(rdev); -- int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev); -+ int ctrl_uV; -+ -+ if (!rdev->supply) -+ return -EPROBE_DEFER; -+ -+ ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev); - - return vctrl_calc_output_voltage(vctrl, ctrl_uV); - } -@@ -92,14 +96,19 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, - unsigned int *selector) - { - struct vctrl_data *vctrl = rdev_get_drvdata(rdev); -- struct regulator *ctrl_reg = vctrl->ctrl_reg; -- int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev); -- int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV); -+ int orig_ctrl_uV; -+ int uV; - int ret; - -+ if (!rdev->supply) -+ return -EPROBE_DEFER; -+ -+ orig_ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev); -+ uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV); -+ - if (req_min_uV >= uV || !vctrl->ovp_threshold) - /* voltage rising or no OVP */ -- return regulator_set_voltage_rdev(ctrl_reg->rdev, -+ return regulator_set_voltage_rdev(rdev->supply->rdev, - vctrl_calc_ctrl_voltage(vctrl, req_min_uV), - vctrl_calc_ctrl_voltage(vctrl, req_max_uV), - PM_SUSPEND_ON); -@@ -117,7 +126,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, - next_uV = max_t(int, req_min_uV, uV - max_drop_uV); - next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV); - -- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, -+ ret = regulator_set_voltage_rdev(rdev->supply->rdev, - next_ctrl_uV, - next_ctrl_uV, - PM_SUSPEND_ON); -@@ -134,7 +143,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev, - - err: - /* Try to go back to original voltage */ -- regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV, -+ regulator_set_voltage_rdev(rdev->supply->rdev, orig_ctrl_uV, orig_ctrl_uV, - PM_SUSPEND_ON); - - return ret; -@@ -151,16 +160,18 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, - unsigned int selector) - { - struct vctrl_data *vctrl = rdev_get_drvdata(rdev); -- struct regulator *ctrl_reg = vctrl->ctrl_reg; - unsigned int orig_sel = vctrl->sel; - int ret; - -+ if (!rdev->supply) -+ return -EPROBE_DEFER; -+ - if (selector >= rdev->desc->n_voltages) - return -EINVAL; - - if (selector >= vctrl->sel || !vctrl->ovp_threshold) { - /* voltage rising or no OVP */ -- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, -+ ret = regulator_set_voltage_rdev(rdev->supply->rdev, - vctrl->vtable[selector].ctrl, - vctrl->vtable[selector].ctrl, - PM_SUSPEND_ON); -@@ -179,7 +190,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, - else - next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel; - -- ret = regulator_set_voltage_rdev(ctrl_reg->rdev, -+ ret = regulator_set_voltage_rdev(rdev->supply->rdev, - vctrl->vtable[next_sel].ctrl, - vctrl->vtable[next_sel].ctrl, - PM_SUSPEND_ON); -@@ -202,7 +213,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev, - err: - if (vctrl->sel != orig_sel) { - /* Try to go back to original voltage */ -- if (!regulator_set_voltage_rdev(ctrl_reg->rdev, -+ if (!regulator_set_voltage_rdev(rdev->supply->rdev, - vctrl->vtable[orig_sel].ctrl, - vctrl->vtable[orig_sel].ctrl, - PM_SUSPEND_ON)) -@@ -234,10 +245,6 @@ static int vctrl_parse_dt(struct platform_device *pdev, - u32 pval; - u32 vrange_ctrl[2]; - -- vctrl->ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl"); -- if (IS_ERR(vctrl->ctrl_reg)) -- return PTR_ERR(vctrl->ctrl_reg); -- - ret = of_property_read_u32(np, "ovp-threshold-percent", &pval); - if (!ret) { - vctrl->ovp_threshold = pval; -@@ -315,11 +322,11 @@ static int vctrl_cmp_ctrl_uV(const void *a, const void *b) - return at->ctrl - bt->ctrl; - } - --static int vctrl_init_vtable(struct platform_device *pdev) -+static int vctrl_init_vtable(struct platform_device *pdev, -+ struct regulator *ctrl_reg) - { - struct vctrl_data *vctrl = platform_get_drvdata(pdev); - struct regulator_desc *rdesc = &vctrl->desc; -- struct regulator *ctrl_reg = vctrl->ctrl_reg; - struct vctrl_voltage_range *vrange_ctrl = &vctrl->vrange.ctrl; - int n_voltages; - int ctrl_uV; -@@ -395,23 +402,19 @@ static int vctrl_init_vtable(struct platform_device *pdev) - static int vctrl_enable(struct regulator_dev *rdev) - { - struct vctrl_data *vctrl = rdev_get_drvdata(rdev); -- int ret = regulator_enable(vctrl->ctrl_reg); - -- if (!ret) -- vctrl->enabled = true; -+ vctrl->enabled = true; - -- return ret; -+ return 0; - } - - static int vctrl_disable(struct regulator_dev *rdev) - { - struct vctrl_data *vctrl = rdev_get_drvdata(rdev); -- int ret = regulator_disable(vctrl->ctrl_reg); - -- if (!ret) -- vctrl->enabled = false; -+ vctrl->enabled = false; - -- return ret; -+ return 0; - } - - static int vctrl_is_enabled(struct regulator_dev *rdev) -@@ -447,6 +450,7 @@ static int vctrl_probe(struct platform_device *pdev) - struct regulator_desc *rdesc; - struct regulator_config cfg = { }; - struct vctrl_voltage_range *vrange_ctrl; -+ struct regulator *ctrl_reg; - int ctrl_uV; - int ret; - -@@ -461,15 +465,20 @@ static int vctrl_probe(struct platform_device *pdev) - if (ret) - return ret; - -+ ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl"); -+ if (IS_ERR(ctrl_reg)) -+ return PTR_ERR(ctrl_reg); -+ - vrange_ctrl = &vctrl->vrange.ctrl; - - rdesc = &vctrl->desc; - rdesc->name = "vctrl"; - rdesc->type = REGULATOR_VOLTAGE; - rdesc->owner = THIS_MODULE; -+ rdesc->supply_name = "ctrl"; - -- if ((regulator_get_linear_step(vctrl->ctrl_reg) == 1) || -- (regulator_count_voltages(vctrl->ctrl_reg) == -EINVAL)) { -+ if ((regulator_get_linear_step(ctrl_reg) == 1) || -+ (regulator_count_voltages(ctrl_reg) == -EINVAL)) { - rdesc->continuous_voltage_range = true; - rdesc->ops = &vctrl_ops_cont; - } else { -@@ -486,11 +495,12 @@ static int vctrl_probe(struct platform_device *pdev) - cfg.init_data = init_data; - - if (!rdesc->continuous_voltage_range) { -- ret = vctrl_init_vtable(pdev); -+ ret = vctrl_init_vtable(pdev, ctrl_reg); - if (ret) - return ret; - -- ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev); -+ /* Use locked consumer API when not in regulator framework */ -+ ctrl_uV = regulator_get_voltage(ctrl_reg); - if (ctrl_uV < 0) { - dev_err(&pdev->dev, "failed to get control voltage\n"); - return ctrl_uV; -@@ -513,6 +523,9 @@ static int vctrl_probe(struct platform_device *pdev) - } - } - -+ /* Drop ctrl-supply here in favor of regulator core managed supply */ -+ devm_regulator_put(ctrl_reg); -+ - vctrl->rdev = devm_regulator_register(&pdev->dev, rdesc, &cfg); - if (IS_ERR(vctrl->rdev)) { - ret = PTR_ERR(vctrl->rdev); -diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c -index 5734a78dbb8e6..7950ac59b1744 100644 ---- a/drivers/s390/cio/css.c -+++ b/drivers/s390/cio/css.c -@@ -426,9 +426,26 @@ static ssize_t pimpampom_show(struct device *dev, - } - static DEVICE_ATTR_RO(pimpampom); - -+static ssize_t dev_busid_show(struct device *dev, -+ struct device_attribute *attr, -+ char *buf) -+{ -+ struct subchannel *sch = to_subchannel(dev); -+ struct pmcw *pmcw = &sch->schib.pmcw; -+ -+ if ((pmcw->st == SUBCHANNEL_TYPE_IO || -+ pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv) -+ return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid, -+ pmcw->dev); -+ else -+ return sysfs_emit(buf, "none\n"); -+} -+static DEVICE_ATTR_RO(dev_busid); -+ - static struct attribute *io_subchannel_type_attrs[] = { - &dev_attr_chpids.attr, - &dev_attr_pimpampom.attr, -+ &dev_attr_dev_busid.attr, - NULL, - }; - ATTRIBUTE_GROUPS(io_subchannel_type); -diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c -index 51850cc68b701..aa24237a78405 100644 ---- a/drivers/soc/qcom/rpmhpd.c -+++ b/drivers/soc/qcom/rpmhpd.c -@@ -235,12 +235,11 @@ static int rpmhpd_power_on(struct generic_pm_domain *domain) - static int rpmhpd_power_off(struct generic_pm_domain *domain) - { - struct rpmhpd *pd = domain_to_rpmhpd(domain); -- int ret = 0; -+ int ret; - - mutex_lock(&rpmhpd_lock); - -- ret = rpmhpd_aggregate_corner(pd, pd->level[0]); -- -+ ret = rpmhpd_aggregate_corner(pd, 0); - if (!ret) - pd->enabled = false; - -diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c -index 70c3c90b997c9..c428d0f78816e 100644 ---- a/drivers/soc/qcom/smsm.c -+++ b/drivers/soc/qcom/smsm.c -@@ -109,7 +109,7 @@ struct smsm_entry { - DECLARE_BITMAP(irq_enabled, 32); - DECLARE_BITMAP(irq_rising, 32); - DECLARE_BITMAP(irq_falling, 32); -- u32 last_value; -+ unsigned long last_value; - - u32 *remote_state; - u32 *subscription; -@@ -204,8 +204,7 @@ static irqreturn_t smsm_intr(int irq, void *data) - u32 val; - - val = readl(entry->remote_state); -- changed = val ^ entry->last_value; -- entry->last_value = val; -+ changed = val ^ xchg(&entry->last_value, val); - - for_each_set_bit(i, entry->irq_enabled, 32) { - if (!(changed & BIT(i))) -@@ -266,6 +265,12 @@ static void smsm_unmask_irq(struct irq_data *irqd) - struct qcom_smsm *smsm = entry->smsm; - u32 val; - -+ /* Make sure our last cached state is up-to-date */ -+ if (readl(entry->remote_state) & BIT(irq)) -+ set_bit(irq, &entry->last_value); -+ else -+ clear_bit(irq, &entry->last_value); -+ - set_bit(irq, entry->irq_enabled); - - if (entry->subscription) { -diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig -index b71b73bf5fc5c..785990720479c 100644 ---- a/drivers/soc/rockchip/Kconfig -+++ b/drivers/soc/rockchip/Kconfig -@@ -6,8 +6,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST - # - - config ROCKCHIP_GRF -- bool -- default y -+ bool "Rockchip General Register Files support" if COMPILE_TEST -+ default y if ARCH_ROCKCHIP - help - The General Register Files are a central component providing - special additional settings registers for a lot of soc-components. -diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c -index 40dccc580e866..3e0200618af30 100644 ---- a/drivers/spi/spi-fsl-dspi.c -+++ b/drivers/spi/spi-fsl-dspi.c -@@ -423,6 +423,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr) - goto err_rx_dma_buf; - } - -+ memset(&cfg, 0, sizeof(cfg)); - cfg.src_addr = phy_addr + SPI_POPR; - cfg.dst_addr = phy_addr + SPI_PUSHR; - cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; -diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c -index 8272bde5d706f..b5268b0d7b4c8 100644 ---- a/drivers/spi/spi-pic32.c -+++ b/drivers/spi/spi-pic32.c -@@ -361,6 +361,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width) - struct dma_slave_config cfg; - int ret; - -+ memset(&cfg, 0, sizeof(cfg)); - cfg.device_fc = true; - cfg.src_addr = pic32s->dma_base + buf_offset; - cfg.dst_addr = pic32s->dma_base + buf_offset; -diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c -index 09f983524d51b..e804a3854c351 100644 ---- a/drivers/spi/spi-sprd-adi.c -+++ b/drivers/spi/spi-sprd-adi.c -@@ -102,7 +102,7 @@ - #define HWRST_STATUS_WATCHDOG 0xf0 - - /* Use default timeout 50 ms that converts to watchdog values */ --#define WDG_LOAD_VAL ((50 * 1000) / 32768) -+#define WDG_LOAD_VAL ((50 * 32768) / 1000) - #define WDG_LOAD_MASK GENMASK(15, 0) - #define WDG_UNLOCK_KEY 0xe551 - -diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c -index 5cf6993ddce57..1ced6eb8b3303 100644 ---- a/drivers/spi/spi-zynq-qspi.c -+++ b/drivers/spi/spi-zynq-qspi.c -@@ -533,7 +533,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, - zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); - zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, - ZYNQ_QSPI_IXR_RXTX_MASK); -- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, -+ if (!wait_for_completion_timeout(&xqspi->data_completion, - msecs_to_jiffies(1000))) - err = -ETIMEDOUT; - } -@@ -551,7 +551,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, - zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); - zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, - ZYNQ_QSPI_IXR_RXTX_MASK); -- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, -+ if (!wait_for_completion_timeout(&xqspi->data_completion, - msecs_to_jiffies(1000))) - err = -ETIMEDOUT; - } -@@ -567,7 +567,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, - zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); - zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, - ZYNQ_QSPI_IXR_RXTX_MASK); -- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, -+ if (!wait_for_completion_timeout(&xqspi->data_completion, - msecs_to_jiffies(1000))) - err = -ETIMEDOUT; - -@@ -591,7 +591,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, - zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true); - zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET, - ZYNQ_QSPI_IXR_RXTX_MASK); -- if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion, -+ if (!wait_for_completion_timeout(&xqspi->data_completion, - msecs_to_jiffies(1000))) - err = -ETIMEDOUT; - } -diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c -index b053345dfd1ae..13e705b53217d 100644 ---- a/drivers/tty/serial/fsl_lpuart.c -+++ b/drivers/tty/serial/fsl_lpuart.c -@@ -2414,7 +2414,7 @@ static int lpuart_probe(struct platform_device *pdev) - return PTR_ERR(sport->port.membase); - - sport->port.membase += sdata->reg_off; -- sport->port.mapbase = res->start; -+ sport->port.mapbase = res->start + sdata->reg_off; - sport->port.dev = &pdev->dev; - sport->port.type = PORT_LPUART; - sport->devtype = sdata->devtype; -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index cee7514c3aaf2..ddfe873b5fccb 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -2176,8 +2176,6 @@ static int tty_fasync(int fd, struct file *filp, int on) - * Locking: - * Called functions take tty_ldiscs_lock - * current->signal->tty check is safe without locks -- * -- * FIXME: may race normal receive processing - */ - - static int tiocsti(struct tty_struct *tty, char __user *p) -@@ -2193,8 +2191,10 @@ static int tiocsti(struct tty_struct *tty, char __user *p) - ld = tty_ldisc_ref_wait(tty); - if (!ld) - return -EIO; -+ tty_buffer_lock_exclusive(tty->port); - if (ld->ops->receive_buf) - ld->ops->receive_buf(tty, &ch, &mbz, 1); -+ tty_buffer_unlock_exclusive(tty->port); - tty_ldisc_deref(ld); - return 0; - } -diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c -index 194ffb1ed4620..d7714c94b1196 100644 ---- a/drivers/usb/gadget/udc/at91_udc.c -+++ b/drivers/usb/gadget/udc/at91_udc.c -@@ -1878,7 +1878,9 @@ static int at91udc_probe(struct platform_device *pdev) - clk_disable(udc->iclk); - - /* request UDC and maybe VBUS irqs */ -- udc->udp_irq = platform_get_irq(pdev, 0); -+ udc->udp_irq = retval = platform_get_irq(pdev, 0); -+ if (retval < 0) -+ goto err_unprepare_iclk; - retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0, - driver_name, udc); - if (retval) { -diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c -index 3d33499db50b5..845aead48d85b 100644 ---- a/drivers/usb/gadget/udc/bdc/bdc_core.c -+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c -@@ -565,7 +565,8 @@ static int bdc_probe(struct platform_device *pdev) - if (ret) { - dev_err(dev, - "No suitable DMA config available, abort\n"); -- return -ENOTSUPP; -+ ret = -ENOTSUPP; -+ goto phycleanup; - } - dev_dbg(dev, "Using 32-bit address\n"); - } -diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c -index 35e02a8d0091a..bdba3f48c0527 100644 ---- a/drivers/usb/gadget/udc/mv_u3d_core.c -+++ b/drivers/usb/gadget/udc/mv_u3d_core.c -@@ -1922,14 +1922,6 @@ static int mv_u3d_probe(struct platform_device *dev) - goto err_get_irq; - } - u3d->irq = r->start; -- if (request_irq(u3d->irq, mv_u3d_irq, -- IRQF_SHARED, driver_name, u3d)) { -- u3d->irq = 0; -- dev_err(&dev->dev, "Request irq %d for u3d failed\n", -- u3d->irq); -- retval = -ENODEV; -- goto err_request_irq; -- } - - /* initialize gadget structure */ - u3d->gadget.ops = &mv_u3d_ops; /* usb_gadget_ops */ -@@ -1942,6 +1934,15 @@ static int mv_u3d_probe(struct platform_device *dev) - - mv_u3d_eps_init(u3d); - -+ if (request_irq(u3d->irq, mv_u3d_irq, -+ IRQF_SHARED, driver_name, u3d)) { -+ u3d->irq = 0; -+ dev_err(&dev->dev, "Request irq %d for u3d failed\n", -+ u3d->irq); -+ retval = -ENODEV; -+ goto err_request_irq; -+ } -+ - /* external vbus detection */ - if (u3d->vbus) { - u3d->clock_gating = 1; -@@ -1965,8 +1966,8 @@ static int mv_u3d_probe(struct platform_device *dev) - - err_unregister: - free_irq(u3d->irq, u3d); --err_request_irq: - err_get_irq: -+err_request_irq: - kfree(u3d->status_req); - err_alloc_status_req: - kfree(u3d->eps); -diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c -index 08a93cf68efff..b6653bc7acc26 100644 ---- a/drivers/usb/gadget/udc/renesas_usb3.c -+++ b/drivers/usb/gadget/udc/renesas_usb3.c -@@ -2692,10 +2692,15 @@ static const struct renesas_usb3_priv renesas_usb3_priv_r8a77990 = { - - static const struct of_device_id usb3_of_match[] = { - { -+ .compatible = "renesas,r8a774c0-usb3-peri", -+ .data = &renesas_usb3_priv_r8a77990, -+ }, { - .compatible = "renesas,r8a7795-usb3-peri", - .data = &renesas_usb3_priv_gen3, -- }, -- { -+ }, { -+ .compatible = "renesas,r8a77990-usb3-peri", -+ .data = &renesas_usb3_priv_r8a77990, -+ }, { - .compatible = "renesas,rcar-gen3-usb3-peri", - .data = &renesas_usb3_priv_gen3, - }, -@@ -2704,18 +2709,10 @@ static const struct of_device_id usb3_of_match[] = { - MODULE_DEVICE_TABLE(of, usb3_of_match); - - static const struct soc_device_attribute renesas_usb3_quirks_match[] = { -- { -- .soc_id = "r8a774c0", -- .data = &renesas_usb3_priv_r8a77990, -- }, - { - .soc_id = "r8a7795", .revision = "ES1.*", - .data = &renesas_usb3_priv_r8a7795_es1, - }, -- { -- .soc_id = "r8a77990", -- .data = &renesas_usb3_priv_r8a77990, -- }, - { /* sentinel */ }, - }; - -diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c -index a319b1df3011c..3626758b3e2aa 100644 ---- a/drivers/usb/host/ehci-orion.c -+++ b/drivers/usb/host/ehci-orion.c -@@ -264,8 +264,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) - * the clock does not exists. - */ - priv->clk = devm_clk_get(&pdev->dev, NULL); -- if (!IS_ERR(priv->clk)) -- clk_prepare_enable(priv->clk); -+ if (!IS_ERR(priv->clk)) { -+ err = clk_prepare_enable(priv->clk); -+ if (err) -+ goto err_put_hcd; -+ } - - priv->phy = devm_phy_optional_get(&pdev->dev, "usb"); - if (IS_ERR(priv->phy)) { -@@ -311,6 +314,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev) - err_dis_clk: - if (!IS_ERR(priv->clk)) - clk_disable_unprepare(priv->clk); -+err_put_hcd: - usb_put_hcd(hcd); - err: - dev_err(&pdev->dev, "init %s fail, %d\n", -diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c -index fb6f5e9ae5c62..fed43c6dd85cc 100644 ---- a/drivers/usb/host/ohci-tmio.c -+++ b/drivers/usb/host/ohci-tmio.c -@@ -202,6 +202,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) - if (!cell) - return -EINVAL; - -+ if (irq < 0) -+ return irq; -+ - hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev)); - if (!hcd) { - ret = -ENOMEM; -diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c -index b451f4695f3f0..446c7bf67873c 100644 ---- a/drivers/usb/phy/phy-fsl-usb.c -+++ b/drivers/usb/phy/phy-fsl-usb.c -@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev) - - /* request irq */ - p_otg->irq = platform_get_irq(pdev, 0); -+ if (p_otg->irq < 0) -+ return p_otg->irq; - status = request_irq(p_otg->irq, fsl_otg_isr, - IRQF_SHARED, driver_name, p_otg); - if (status) { -diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c -index baebb1f5a9737..a3e043e3e4aae 100644 ---- a/drivers/usb/phy/phy-tahvo.c -+++ b/drivers/usb/phy/phy-tahvo.c -@@ -393,7 +393,9 @@ static int tahvo_usb_probe(struct platform_device *pdev) - - dev_set_drvdata(&pdev->dev, tu); - -- tu->irq = platform_get_irq(pdev, 0); -+ tu->irq = ret = platform_get_irq(pdev, 0); -+ if (ret < 0) -+ return ret; - ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt, - IRQF_ONESHOT, - "tahvo-vbus", tu); -diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c -index 9a7e655d52801..9337c30f0743b 100644 ---- a/drivers/usb/phy/phy-twl6030-usb.c -+++ b/drivers/usb/phy/phy-twl6030-usb.c -@@ -348,6 +348,11 @@ static int twl6030_usb_probe(struct platform_device *pdev) - twl->irq2 = platform_get_irq(pdev, 1); - twl->linkstat = MUSB_UNKNOWN; - -+ if (twl->irq1 < 0) -+ return twl->irq1; -+ if (twl->irq2 < 0) -+ return twl->irq2; -+ - twl->comparator.set_vbus = twl6030_set_vbus; - twl->comparator.start_srp = twl6030_start_srp; - -diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c -index 746eebc411dfa..047f80ee37e81 100644 ---- a/drivers/video/backlight/pwm_bl.c -+++ b/drivers/video/backlight/pwm_bl.c -@@ -415,6 +415,33 @@ static bool pwm_backlight_is_linear(struct platform_pwm_backlight_data *data) - static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb) - { - struct device_node *node = pb->dev->of_node; -+ bool active = true; -+ -+ /* -+ * If the enable GPIO is present, observable (either as input -+ * or output) and off then the backlight is not currently active. -+ * */ -+ if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) -+ active = false; -+ -+ if (!regulator_is_enabled(pb->power_supply)) -+ active = false; -+ -+ if (!pwm_is_enabled(pb->pwm)) -+ active = false; -+ -+ /* -+ * Synchronize the enable_gpio with the observed state of the -+ * hardware. -+ */ -+ if (pb->enable_gpio) -+ gpiod_direction_output(pb->enable_gpio, active); -+ -+ /* -+ * Do not change pb->enabled here! pb->enabled essentially -+ * tells us if we own one of the regulator's use counts and -+ * right now we do not. -+ */ - - /* Not booted with device tree or no phandle link to the node */ - if (!node || !node->phandle) -@@ -426,20 +453,7 @@ static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb) - * assume that another driver will enable the backlight at the - * appropriate time. Therefore, if it is disabled, keep it so. - */ -- -- /* if the enable GPIO is disabled, do not enable the backlight */ -- if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0) -- return FB_BLANK_POWERDOWN; -- -- /* The regulator is disabled, do not enable the backlight */ -- if (!regulator_is_enabled(pb->power_supply)) -- return FB_BLANK_POWERDOWN; -- -- /* The PWM is disabled, keep it like this */ -- if (!pwm_is_enabled(pb->pwm)) -- return FB_BLANK_POWERDOWN; -- -- return FB_BLANK_UNBLANK; -+ return active ? FB_BLANK_UNBLANK: FB_BLANK_POWERDOWN; - } - - static int pwm_backlight_probe(struct platform_device *pdev) -@@ -508,18 +522,6 @@ static int pwm_backlight_probe(struct platform_device *pdev) - pb->enable_gpio = gpio_to_desc(data->enable_gpio); - } - -- /* -- * If the GPIO is not known to be already configured as output, that -- * is, if gpiod_get_direction returns either 1 or -EINVAL, change the -- * direction to output and set the GPIO as active. -- * Do not force the GPIO to active when it was already output as it -- * could cause backlight flickering or we would enable the backlight too -- * early. Leave the decision of the initial backlight state for later. -- */ -- if (pb->enable_gpio && -- gpiod_get_direction(pb->enable_gpio) != 0) -- gpiod_direction_output(pb->enable_gpio, 1); -- - pb->power_supply = devm_regulator_get(&pdev->dev, "power"); - if (IS_ERR(pb->power_supply)) { - ret = PTR_ERR(pb->power_supply); -diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c -index d87de5d467189..03b1bf994cc90 100644 ---- a/drivers/video/fbdev/core/fbmem.c -+++ b/drivers/video/fbdev/core/fbmem.c -@@ -957,6 +957,7 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) - struct fb_var_screeninfo old_var; - struct fb_videomode mode; - struct fb_event event; -+ u32 unused; - - if (var->activate & FB_ACTIVATE_INV_MODE) { - struct fb_videomode mode1, mode2; -@@ -1003,6 +1004,11 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) - if (var->xres < 8 || var->yres < 8) - return -EINVAL; - -+ /* Too huge resolution causes multiplication overflow. */ -+ if (check_mul_overflow(var->xres, var->yres, &unused) || -+ check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused)) -+ return -EINVAL; -+ - ret = info->fbops->fb_check_var(var, info); - - if (ret) -diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c -index 9bd03a2310328..171ad8b42107e 100644 ---- a/fs/cifs/cifs_unicode.c -+++ b/fs/cifs/cifs_unicode.c -@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen, - if (!dst) - return NULL; - cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage, -- NO_MAP_UNI_RSVD); -+ NO_MAP_UNI_RSVD); - } else { -- len = strnlen(src, maxlen); -- len++; -- dst = kmalloc(len, GFP_KERNEL); -- if (!dst) -- return NULL; -- strlcpy(dst, src, len); -+ dst = kstrndup(src, maxlen, GFP_KERNEL); - } - - return dst; -diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c -index 943637298f650..a32c5c7dcfd89 100644 ---- a/fs/debugfs/file.c -+++ b/fs/debugfs/file.c -@@ -178,8 +178,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp) - if (!fops_get(real_fops)) { - #ifdef CONFIG_MODULES - if (real_fops->owner && -- real_fops->owner->state == MODULE_STATE_GOING) -+ real_fops->owner->state == MODULE_STATE_GOING) { -+ r = -ENXIO; - goto out; -+ } - #endif - - /* Huh? Module did not clean up after itself at exit? */ -@@ -313,8 +315,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp) - if (!fops_get(real_fops)) { - #ifdef CONFIG_MODULES - if (real_fops->owner && -- real_fops->owner->state == MODULE_STATE_GOING) -+ real_fops->owner->state == MODULE_STATE_GOING) { -+ r = -ENXIO; - goto out; -+ } - #endif - - /* Huh? Module did not cleanup after itself at exit? */ -diff --git a/fs/fcntl.c b/fs/fcntl.c -index 3dc90e5293e65..fa0fdd829613c 100644 ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -993,13 +993,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) - { - while (fa) { - struct fown_struct *fown; -+ unsigned long flags; - - if (fa->magic != FASYNC_MAGIC) { - printk(KERN_ERR "kill_fasync: bad magic number in " - "fasync_struct!\n"); - return; - } -- read_lock(&fa->fa_lock); -+ read_lock_irqsave(&fa->fa_lock, flags); - if (fa->fa_file) { - fown = &fa->fa_file->f_owner; - /* Don't send SIGURG to processes which have not set a -@@ -1008,7 +1009,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) - if (!(sig == SIGURG && fown->signum == 0)) - send_sigio(fown, fa->fa_fd, band); - } -- read_unlock(&fa->fa_lock); -+ read_unlock_irqrestore(&fa->fa_lock, flags); - fa = rcu_dereference(fa->fa_next); - } - } -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 0883e5b24c901..1de59998e0e75 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -193,12 +193,11 @@ void fuse_finish_open(struct inode *inode, struct file *file) - struct fuse_file *ff = file->private_data; - struct fuse_conn *fc = get_fuse_conn(inode); - -- if (!(ff->open_flags & FOPEN_KEEP_CACHE)) -- invalidate_inode_pages2(inode->i_mapping); - if (ff->open_flags & FOPEN_STREAM) - stream_open(inode, file); - else if (ff->open_flags & FOPEN_NONSEEKABLE) - nonseekable_open(inode, file); -+ - if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) { - struct fuse_inode *fi = get_fuse_inode(inode); - -@@ -206,10 +205,14 @@ void fuse_finish_open(struct inode *inode, struct file *file) - fi->attr_version = atomic64_inc_return(&fc->attr_version); - i_size_write(inode, 0); - spin_unlock(&fi->lock); -+ truncate_pagecache(inode, 0); - fuse_invalidate_attr(inode); - if (fc->writeback_cache) - file_update_time(file); -+ } else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) { -+ invalidate_inode_pages2(inode->i_mapping); - } -+ - if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache) - fuse_link_write_file(file); - } -@@ -3185,7 +3188,7 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) - - static int fuse_writeback_range(struct inode *inode, loff_t start, loff_t end) - { -- int err = filemap_write_and_wait_range(inode->i_mapping, start, end); -+ int err = filemap_write_and_wait_range(inode->i_mapping, start, -1); - - if (!err) - fuse_sync_writes(inode); -diff --git a/fs/iomap/swapfile.c b/fs/iomap/swapfile.c -index bd0cc3dcc9807..2d18246f67266 100644 ---- a/fs/iomap/swapfile.c -+++ b/fs/iomap/swapfile.c -@@ -30,11 +30,16 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi) - { - struct iomap *iomap = &isi->iomap; - unsigned long nr_pages; -+ unsigned long max_pages; - uint64_t first_ppage; - uint64_t first_ppage_reported; - uint64_t next_ppage; - int error; - -+ if (unlikely(isi->nr_pages >= isi->sis->max)) -+ return 0; -+ max_pages = isi->sis->max - isi->nr_pages; -+ - /* - * Round the start up and the end down so that the physical - * extent aligns to a page boundary. -@@ -47,6 +52,7 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi) - if (first_ppage >= next_ppage) - return 0; - nr_pages = next_ppage - first_ppage; -+ nr_pages = min(nr_pages, max_pages); - - /* - * Calculate how much swap space we're adding; the first page contains -diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c -index 62c0462dc89f3..bf30f6ce8dd10 100644 ---- a/fs/isofs/inode.c -+++ b/fs/isofs/inode.c -@@ -155,7 +155,6 @@ struct iso9660_options{ - unsigned int overriderockperm:1; - unsigned int uid_set:1; - unsigned int gid_set:1; -- unsigned int utf8:1; - unsigned char map; - unsigned char check; - unsigned int blocksize; -@@ -355,7 +354,6 @@ static int parse_options(char *options, struct iso9660_options *popt) - popt->gid = GLOBAL_ROOT_GID; - popt->uid = GLOBAL_ROOT_UID; - popt->iocharset = NULL; -- popt->utf8 = 0; - popt->overriderockperm = 0; - popt->session=-1; - popt->sbsector=-1; -@@ -388,10 +386,13 @@ static int parse_options(char *options, struct iso9660_options *popt) - case Opt_cruft: - popt->cruft = 1; - break; -+#ifdef CONFIG_JOLIET - case Opt_utf8: -- popt->utf8 = 1; -+ kfree(popt->iocharset); -+ popt->iocharset = kstrdup("utf8", GFP_KERNEL); -+ if (!popt->iocharset) -+ return 0; - break; --#ifdef CONFIG_JOLIET - case Opt_iocharset: - kfree(popt->iocharset); - popt->iocharset = match_strdup(&args[0]); -@@ -494,7 +495,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root) - if (sbi->s_nocompress) seq_puts(m, ",nocompress"); - if (sbi->s_overriderockperm) seq_puts(m, ",overriderockperm"); - if (sbi->s_showassoc) seq_puts(m, ",showassoc"); -- if (sbi->s_utf8) seq_puts(m, ",utf8"); - - if (sbi->s_check) seq_printf(m, ",check=%c", sbi->s_check); - if (sbi->s_mapping) seq_printf(m, ",map=%c", sbi->s_mapping); -@@ -517,9 +517,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root) - seq_printf(m, ",fmode=%o", sbi->s_fmode); - - #ifdef CONFIG_JOLIET -- if (sbi->s_nls_iocharset && -- strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0) -+ if (sbi->s_nls_iocharset) - seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset); -+ else -+ seq_puts(m, ",iocharset=utf8"); - #endif - return 0; - } -@@ -867,14 +868,13 @@ root_found: - sbi->s_nls_iocharset = NULL; - - #ifdef CONFIG_JOLIET -- if (joliet_level && opt.utf8 == 0) { -+ if (joliet_level) { - char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT; -- sbi->s_nls_iocharset = load_nls(p); -- if (! sbi->s_nls_iocharset) { -- /* Fail only if explicit charset specified */ -- if (opt.iocharset) -+ if (strcmp(p, "utf8") != 0) { -+ sbi->s_nls_iocharset = opt.iocharset ? -+ load_nls(opt.iocharset) : load_nls_default(); -+ if (!sbi->s_nls_iocharset) - goto out_freesbi; -- sbi->s_nls_iocharset = load_nls_default(); - } - } - #endif -@@ -890,7 +890,6 @@ root_found: - sbi->s_gid = opt.gid; - sbi->s_uid_set = opt.uid_set; - sbi->s_gid_set = opt.gid_set; -- sbi->s_utf8 = opt.utf8; - sbi->s_nocompress = opt.nocompress; - sbi->s_overriderockperm = opt.overriderockperm; - /* -diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h -index 055ec6c586f7f..dcdc191ed1834 100644 ---- a/fs/isofs/isofs.h -+++ b/fs/isofs/isofs.h -@@ -44,7 +44,6 @@ struct isofs_sb_info { - unsigned char s_session; - unsigned int s_high_sierra:1; - unsigned int s_rock:2; -- unsigned int s_utf8:1; - unsigned int s_cruft:1; /* Broken disks with high byte of length - * containing junk */ - unsigned int s_nocompress:1; -diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c -index be8b6a9d0b926..c0f04a1e7f695 100644 ---- a/fs/isofs/joliet.c -+++ b/fs/isofs/joliet.c -@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls) - int - get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode) - { -- unsigned char utf8; - struct nls_table *nls; - unsigned char len = 0; - -- utf8 = ISOFS_SB(inode->i_sb)->s_utf8; - nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset; - -- if (utf8) { -+ if (!nls) { - len = utf16s_to_utf8s((const wchar_t *) de->name, - de->name_len[0] >> 1, UTF16_BIG_ENDIAN, - outname, PAGE_SIZE); -diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c -index 61d3cc2283dc8..498cb70c2c0d0 100644 ---- a/fs/lockd/svclock.c -+++ b/fs/lockd/svclock.c -@@ -634,7 +634,7 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file, - conflock->caller = "somehost"; /* FIXME */ - conflock->len = strlen(conflock->caller); - conflock->oh.len = 0; /* don't return OH info */ -- conflock->svid = ((struct nlm_lockowner *)lock->fl.fl_owner)->pid; -+ conflock->svid = lock->fl.fl_pid; - conflock->fl.fl_type = lock->fl.fl_type; - conflock->fl.fl_start = lock->fl.fl_start; - conflock->fl.fl_end = lock->fl.fl_end; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 8cb2f744dde6b..3283cc2a4e42c 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -2572,9 +2572,9 @@ static void force_expire_client(struct nfs4_client *clp) - struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id); - bool already_expired; - -- spin_lock(&clp->cl_lock); -+ spin_lock(&nn->client_lock); - clp->cl_time = 0; -- spin_unlock(&clp->cl_lock); -+ spin_unlock(&nn->client_lock); - - wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0); - spin_lock(&nn->client_lock); -diff --git a/fs/udf/misc.c b/fs/udf/misc.c -index 401e64cde1be0..853bcff51043f 100644 ---- a/fs/udf/misc.c -+++ b/fs/udf/misc.c -@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type, - else - offset = le32_to_cpu(eahd->appAttrLocation); - -- while (offset < iinfo->i_lenEAttr) { -+ while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) { -+ uint32_t attrLength; -+ - gaf = (struct genericFormat *)&ea[offset]; -+ attrLength = le32_to_cpu(gaf->attrLength); -+ -+ /* Detect undersized elements and buffer overflows */ -+ if ((attrLength < sizeof(*gaf)) || -+ (attrLength > (iinfo->i_lenEAttr - offset))) -+ break; -+ - if (le32_to_cpu(gaf->attrType) == type && - gaf->attrSubtype == subtype) - return gaf; - else -- offset += le32_to_cpu(gaf->attrLength); -+ offset += attrLength; - } - } - -diff --git a/fs/udf/super.c b/fs/udf/super.c -index 8bb001c7927f0..5663bae95700c 100644 ---- a/fs/udf/super.c -+++ b/fs/udf/super.c -@@ -108,16 +108,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb) - return NULL; - lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data; - partnum = le32_to_cpu(lvid->numOfPartitions); -- if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) - -- offsetof(struct logicalVolIntegrityDesc, impUse)) / -- (2 * sizeof(uint32_t)) < partnum) { -- udf_err(sb, "Logical volume integrity descriptor corrupted " -- "(numOfPartitions = %u)!\n", partnum); -- return NULL; -- } - /* The offset is to skip freeSpaceTable and sizeTable arrays */ - offset = partnum * 2 * sizeof(uint32_t); -- return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]); -+ return (struct logicalVolIntegrityDescImpUse *) -+ (((uint8_t *)(lvid + 1)) + offset); - } - - /* UDF filesystem type */ -@@ -349,10 +343,10 @@ static int udf_show_options(struct seq_file *seq, struct dentry *root) - seq_printf(seq, ",lastblock=%u", sbi->s_last_block); - if (sbi->s_anchor != 0) - seq_printf(seq, ",anchor=%u", sbi->s_anchor); -- if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) -- seq_puts(seq, ",utf8"); -- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP) && sbi->s_nls_map) -+ if (sbi->s_nls_map) - seq_printf(seq, ",iocharset=%s", sbi->s_nls_map->charset); -+ else -+ seq_puts(seq, ",iocharset=utf8"); - - return 0; - } -@@ -557,19 +551,24 @@ static int udf_parse_options(char *options, struct udf_options *uopt, - /* Ignored (never implemented properly) */ - break; - case Opt_utf8: -- uopt->flags |= (1 << UDF_FLAG_UTF8); -+ if (!remount) { -+ unload_nls(uopt->nls_map); -+ uopt->nls_map = NULL; -+ } - break; - case Opt_iocharset: - if (!remount) { -- if (uopt->nls_map) -- unload_nls(uopt->nls_map); -- /* -- * load_nls() failure is handled later in -- * udf_fill_super() after all options are -- * parsed. -- */ -+ unload_nls(uopt->nls_map); -+ uopt->nls_map = NULL; -+ } -+ /* When nls_map is not loaded then UTF-8 is used */ -+ if (!remount && strcmp(args[0].from, "utf8") != 0) { - uopt->nls_map = load_nls(args[0].from); -- uopt->flags |= (1 << UDF_FLAG_NLS_MAP); -+ if (!uopt->nls_map) { -+ pr_err("iocharset %s not found\n", -+ args[0].from); -+ return 0; -+ } - } - break; - case Opt_uforget: -@@ -1548,6 +1547,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ - struct udf_sb_info *sbi = UDF_SB(sb); - struct logicalVolIntegrityDesc *lvid; - int indirections = 0; -+ u32 parts, impuselen; - - while (++indirections <= UDF_MAX_LVID_NESTING) { - final_bh = NULL; -@@ -1574,15 +1574,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ - - lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data; - if (lvid->nextIntegrityExt.extLength == 0) -- return; -+ goto check; - - loc = leea_to_cpu(lvid->nextIntegrityExt); - } - - udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n", - UDF_MAX_LVID_NESTING); -+out_err: - brelse(sbi->s_lvid_bh); - sbi->s_lvid_bh = NULL; -+ return; -+check: -+ parts = le32_to_cpu(lvid->numOfPartitions); -+ impuselen = le32_to_cpu(lvid->lengthOfImpUse); -+ if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize || -+ sizeof(struct logicalVolIntegrityDesc) + impuselen + -+ 2 * parts * sizeof(u32) > sb->s_blocksize) { -+ udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), " -+ "ignoring.\n", parts, impuselen); -+ goto out_err; -+ } - } - - /* -@@ -2145,21 +2157,6 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) - if (!udf_parse_options((char *)options, &uopt, false)) - goto parse_options_failure; - -- if (uopt.flags & (1 << UDF_FLAG_UTF8) && -- uopt.flags & (1 << UDF_FLAG_NLS_MAP)) { -- udf_err(sb, "utf8 cannot be combined with iocharset\n"); -- goto parse_options_failure; -- } -- if ((uopt.flags & (1 << UDF_FLAG_NLS_MAP)) && !uopt.nls_map) { -- uopt.nls_map = load_nls_default(); -- if (!uopt.nls_map) -- uopt.flags &= ~(1 << UDF_FLAG_NLS_MAP); -- else -- udf_debug("Using default NLS map\n"); -- } -- if (!(uopt.flags & (1 << UDF_FLAG_NLS_MAP))) -- uopt.flags |= (1 << UDF_FLAG_UTF8); -- - fileset.logicalBlockNum = 0xFFFFFFFF; - fileset.partitionReferenceNum = 0xFFFF; - -@@ -2314,8 +2311,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) - error_out: - iput(sbi->s_vat_inode); - parse_options_failure: -- if (uopt.nls_map) -- unload_nls(uopt.nls_map); -+ unload_nls(uopt.nls_map); - if (lvid_open) - udf_close_lvid(sb); - brelse(sbi->s_lvid_bh); -@@ -2365,8 +2361,7 @@ static void udf_put_super(struct super_block *sb) - sbi = UDF_SB(sb); - - iput(sbi->s_vat_inode); -- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) -- unload_nls(sbi->s_nls_map); -+ unload_nls(sbi->s_nls_map); - if (!sb_rdonly(sb)) - udf_close_lvid(sb); - brelse(sbi->s_lvid_bh); -diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h -index 3d83be54c4748..8eace7a633d38 100644 ---- a/fs/udf/udf_sb.h -+++ b/fs/udf/udf_sb.h -@@ -20,8 +20,6 @@ - #define UDF_FLAG_UNDELETE 6 - #define UDF_FLAG_UNHIDE 7 - #define UDF_FLAG_VARCONV 8 --#define UDF_FLAG_NLS_MAP 9 --#define UDF_FLAG_UTF8 10 - #define UDF_FLAG_UID_FORGET 11 /* save -1 for uid to disk */ - #define UDF_FLAG_GID_FORGET 12 - #define UDF_FLAG_UID_SET 13 -diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c -index 5fcfa96463ebb..622569007b530 100644 ---- a/fs/udf/unicode.c -+++ b/fs/udf/unicode.c -@@ -177,7 +177,7 @@ static int udf_name_from_CS0(struct super_block *sb, - return 0; - } - -- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) -+ if (UDF_SB(sb)->s_nls_map) - conv_f = UDF_SB(sb)->s_nls_map->uni2char; - else - conv_f = NULL; -@@ -285,7 +285,7 @@ static int udf_name_to_CS0(struct super_block *sb, - if (ocu_max_len <= 0) - return 0; - -- if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP)) -+ if (UDF_SB(sb)->s_nls_map) - conv_f = UDF_SB(sb)->s_nls_map->char2uni; - else - conv_f = NULL; -diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h -index 22f070085971b..ee10a9f06b97c 100644 ---- a/include/linux/bpf_verifier.h -+++ b/include/linux/bpf_verifier.h -@@ -194,6 +194,13 @@ struct bpf_idx_pair { - u32 idx; - }; - -+struct bpf_id_pair { -+ u32 old; -+ u32 cur; -+}; -+ -+/* Maximum number of register states that can exist at once */ -+#define BPF_ID_MAP_SIZE (MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE) - #define MAX_CALL_FRAMES 8 - struct bpf_verifier_state { - /* call stack tracking */ -@@ -301,8 +308,8 @@ struct bpf_insn_aux_data { - }; - }; - int ctx_field_size; /* the ctx field size for load insn, maybe 0 */ -- int sanitize_stack_off; /* stack slot to be cleared */ - bool seen; /* this insn was processed by the verifier */ -+ bool sanitize_stack_spill; /* subject to Spectre v4 sanitation */ - bool zext_dst; /* this insn zero extends dst reg */ - u8 alu_state; /* used in combination with alu_limit */ - bool prune_point; -@@ -364,12 +371,14 @@ struct bpf_verifier_env { - struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */ - u32 used_map_cnt; /* number of used maps */ - u32 id_gen; /* used to generate unique reg IDs */ -+ bool explore_alu_limits; - bool allow_ptr_leaks; - bool seen_direct_write; - struct bpf_insn_aux_data *insn_aux_data; /* array of per-insn state */ - const struct bpf_line_info *prev_linfo; - struct bpf_verifier_log log; - struct bpf_subprog_info subprog_info[BPF_MAX_SUBPROGS + 1]; -+ struct bpf_id_pair idmap_scratch[BPF_ID_MAP_SIZE]; - struct { - int *insn_state; - int *insn_stack; -diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h -index 73f8c3cb95888..9ee6ccc18424f 100644 ---- a/include/linux/energy_model.h -+++ b/include/linux/energy_model.h -@@ -42,6 +42,22 @@ struct em_perf_domain { - - #define EM_CPU_MAX_POWER 0xFFFF - -+/* -+ * Increase resolution of energy estimation calculations for 64-bit -+ * architectures. The extra resolution improves decision made by EAS for the -+ * task placement when two Performance Domains might provide similar energy -+ * estimation values (w/o better resolution the values could be equal). -+ * -+ * We increase resolution only if we have enough bits to allow this increased -+ * resolution (i.e. 64-bit). The costs for increasing resolution when 32-bit -+ * are pretty high and the returns do not justify the increased costs. -+ */ -+#ifdef CONFIG_64BIT -+#define em_scale_power(p) ((p) * 1000) -+#else -+#define em_scale_power(p) (p) -+#endif -+ - struct em_data_callback { - /** - * active_power() - Provide power at the next capacity state of a CPU -diff --git a/include/linux/filter.h b/include/linux/filter.h -index c53e2fe3c8f7f..c4f89340f4986 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -68,6 +68,11 @@ struct ctl_table_header; - /* unused opcode to mark call to interpreter with arguments */ - #define BPF_CALL_ARGS 0xe0 - -+/* unused opcode to mark speculation barrier for mitigating -+ * Speculative Store Bypass -+ */ -+#define BPF_NOSPEC 0xc0 -+ - /* As per nm, we expose JITed images as text (code) section for - * kallsyms. That way, tools like perf can find it to match - * addresses. -@@ -368,6 +373,16 @@ static inline bool insn_is_zext(const struct bpf_insn *insn) - .off = 0, \ - .imm = 0 }) - -+/* Speculation barrier */ -+ -+#define BPF_ST_NOSPEC() \ -+ ((struct bpf_insn) { \ -+ .code = BPF_ST | BPF_NOSPEC, \ -+ .dst_reg = 0, \ -+ .src_reg = 0, \ -+ .off = 0, \ -+ .imm = 0 }) -+ - /* Internal classic blocks for direct assignment */ - - #define __BPF_STMT(CODE, K) \ -diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h -index 1f98b52118f0a..48be92aded5ee 100644 ---- a/include/linux/hrtimer.h -+++ b/include/linux/hrtimer.h -@@ -317,16 +317,12 @@ struct clock_event_device; - - extern void hrtimer_interrupt(struct clock_event_device *dev); - --extern void clock_was_set_delayed(void); -- - extern unsigned int hrtimer_resolution; - - #else - - #define hrtimer_resolution (unsigned int)LOW_RES_NSEC - --static inline void clock_was_set_delayed(void) { } -- - #endif - - static inline ktime_t -@@ -350,7 +346,6 @@ hrtimer_expires_remaining_adjusted(const struct hrtimer *timer) - timer->base->get_time()); - } - --extern void clock_was_set(void); - #ifdef CONFIG_TIMERFD - extern void timerfd_clock_was_set(void); - #else -diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h -index 4badd53229490..2f9ff5017f122 100644 ---- a/include/linux/power/max17042_battery.h -+++ b/include/linux/power/max17042_battery.h -@@ -69,7 +69,7 @@ enum max17042_register { - MAX17042_RelaxCFG = 0x2A, - MAX17042_MiscCFG = 0x2B, - MAX17042_TGAIN = 0x2C, -- MAx17042_TOFF = 0x2D, -+ MAX17042_TOFF = 0x2D, - MAX17042_CGAIN = 0x2E, - MAX17042_COFF = 0x2F, - -diff --git a/include/linux/time64.h b/include/linux/time64.h -index 5eab3f2635186..f6059c505986b 100644 ---- a/include/linux/time64.h -+++ b/include/linux/time64.h -@@ -33,7 +33,9 @@ struct itimerspec64 { - #define TIME64_MIN (-TIME64_MAX - 1) - - #define KTIME_MAX ((s64)~((u64)1 << 63)) -+#define KTIME_MIN (-KTIME_MAX - 1) - #define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) -+#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC) - - /* - * Limits for settimeofday(): -@@ -132,10 +134,13 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts) - */ - static inline s64 timespec64_to_ns(const struct timespec64 *ts) - { -- /* Prevent multiplication overflow */ -- if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) -+ /* Prevent multiplication overflow / underflow */ -+ if (ts->tv_sec >= KTIME_SEC_MAX) - return KTIME_MAX; - -+ if (ts->tv_sec <= KTIME_SEC_MIN) -+ return KTIME_MIN; -+ - return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec; - } - -diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h -index 8649422e760cc..63038eb23560b 100644 ---- a/include/uapi/linux/bpf.h -+++ b/include/uapi/linux/bpf.h -@@ -2264,7 +2264,7 @@ union bpf_attr { - * int bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) - * Description - * Select a **SO_REUSEPORT** socket from a -- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. -+ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. - * It checks the selected socket is matching the incoming - * request in the socket buffer. - * Return -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 323913ba13b38..d9a3d995bd966 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -31,6 +31,7 @@ - #include - #include - -+#include - #include - - /* Registers */ -@@ -1310,6 +1311,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) - /* Non-UAPI available opcodes. */ - [BPF_JMP | BPF_CALL_ARGS] = &&JMP_CALL_ARGS, - [BPF_JMP | BPF_TAIL_CALL] = &&JMP_TAIL_CALL, -+ [BPF_ST | BPF_NOSPEC] = &&ST_NOSPEC, - }; - #undef BPF_INSN_3_LBL - #undef BPF_INSN_2_LBL -@@ -1550,7 +1552,21 @@ out: - COND_JMP(s, JSGE, >=) - COND_JMP(s, JSLE, <=) - #undef COND_JMP -- /* STX and ST and LDX*/ -+ /* ST, STX and LDX*/ -+ ST_NOSPEC: -+ /* Speculation barrier for mitigating Speculative Store Bypass. -+ * In case of arm64, we rely on the firmware mitigation as -+ * controlled via the ssbd kernel parameter. Whenever the -+ * mitigation is enabled, it works for all of the kernel code -+ * with no need to provide any additional instructions here. -+ * In case of x86, we use 'lfence' insn for mitigation. We -+ * reuse preexisting logic from Spectre v1 mitigation that -+ * happens to produce the required code on x86 for v4 as well. -+ */ -+#ifdef CONFIG_X86 -+ barrier_nospec(); -+#endif -+ CONT; - #define LDST(SIZEOP, SIZE) \ - STX_MEM_##SIZEOP: \ - *(SIZE *)(unsigned long) (DST + insn->off) = SRC; \ -diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c -index b44d8c447afd1..ff1dd7d45b58a 100644 ---- a/kernel/bpf/disasm.c -+++ b/kernel/bpf/disasm.c -@@ -162,15 +162,17 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs, - else - verbose(cbs->private_data, "BUG_%02x\n", insn->code); - } else if (class == BPF_ST) { -- if (BPF_MODE(insn->code) != BPF_MEM) { -+ if (BPF_MODE(insn->code) == BPF_MEM) { -+ verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n", -+ insn->code, -+ bpf_ldst_string[BPF_SIZE(insn->code) >> 3], -+ insn->dst_reg, -+ insn->off, insn->imm); -+ } else if (BPF_MODE(insn->code) == 0xc0 /* BPF_NOSPEC, no UAPI */) { -+ verbose(cbs->private_data, "(%02x) nospec\n", insn->code); -+ } else { - verbose(cbs->private_data, "BUG_st_%02x\n", insn->code); -- return; - } -- verbose(cbs->private_data, "(%02x) *(%s *)(r%d %+d) = %d\n", -- insn->code, -- bpf_ldst_string[BPF_SIZE(insn->code) >> 3], -- insn->dst_reg, -- insn->off, insn->imm); - } else if (class == BPF_LDX) { - if (BPF_MODE(insn->code) != BPF_MEM) { - verbose(cbs->private_data, "BUG_ldx_%02x\n", insn->code); -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 4deaf15b7618b..60383b28549be 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -1920,6 +1920,19 @@ static int check_stack_write(struct bpf_verifier_env *env, - cur = env->cur_state->frame[env->cur_state->curframe]; - if (value_regno >= 0) - reg = &cur->regs[value_regno]; -+ if (!env->allow_ptr_leaks) { -+ bool sanitize = reg && is_spillable_regtype(reg->type); -+ -+ for (i = 0; i < size; i++) { -+ if (state->stack[spi].slot_type[i] == STACK_INVALID) { -+ sanitize = true; -+ break; -+ } -+ } -+ -+ if (sanitize) -+ env->insn_aux_data[insn_idx].sanitize_stack_spill = true; -+ } - - if (reg && size == BPF_REG_SIZE && register_is_const(reg) && - !register_is_null(reg) && env->allow_ptr_leaks) { -@@ -1942,47 +1955,10 @@ static int check_stack_write(struct bpf_verifier_env *env, - verbose(env, "invalid size of register spill\n"); - return -EACCES; - } -- - if (state != cur && reg->type == PTR_TO_STACK) { - verbose(env, "cannot spill pointers to stack into stack frame of the caller\n"); - return -EINVAL; - } -- -- if (!env->allow_ptr_leaks) { -- bool sanitize = false; -- -- if (state->stack[spi].slot_type[0] == STACK_SPILL && -- register_is_const(&state->stack[spi].spilled_ptr)) -- sanitize = true; -- for (i = 0; i < BPF_REG_SIZE; i++) -- if (state->stack[spi].slot_type[i] == STACK_MISC) { -- sanitize = true; -- break; -- } -- if (sanitize) { -- int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off; -- int soff = (-spi - 1) * BPF_REG_SIZE; -- -- /* detected reuse of integer stack slot with a pointer -- * which means either llvm is reusing stack slot or -- * an attacker is trying to exploit CVE-2018-3639 -- * (speculative store bypass) -- * Have to sanitize that slot with preemptive -- * store of zero. -- */ -- if (*poff && *poff != soff) { -- /* disallow programs where single insn stores -- * into two different stack slots, since verifier -- * cannot sanitize them -- */ -- verbose(env, -- "insn %d cannot access two stack slots fp%d and fp%d", -- insn_idx, *poff, soff); -- return -EINVAL; -- } -- *poff = soff; -- } -- } - save_register_state(state, spi, reg); - } else { - u8 type = STACK_MISC; -@@ -4473,6 +4449,12 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, - alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0; - alu_state |= ptr_is_dst_reg ? - BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST; -+ -+ /* Limit pruning on unknown scalars to enable deep search for -+ * potential masking differences from other program paths. -+ */ -+ if (!off_is_imm) -+ env->explore_alu_limits = true; - } - - err = update_alu_sanitation_state(aux, alu_state, alu_limit); -@@ -7000,13 +6982,6 @@ static bool range_within(struct bpf_reg_state *old, - old->smax_value >= cur->smax_value; - } - --/* Maximum number of register states that can exist at once */ --#define ID_MAP_SIZE (MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE) --struct idpair { -- u32 old; -- u32 cur; --}; -- - /* If in the old state two registers had the same id, then they need to have - * the same id in the new state as well. But that id could be different from - * the old state, so we need to track the mapping from old to new ids. -@@ -7017,11 +6992,11 @@ struct idpair { - * So we look through our idmap to see if this old id has been seen before. If - * so, we require the new id to match; otherwise, we add the id pair to the map. - */ --static bool check_ids(u32 old_id, u32 cur_id, struct idpair *idmap) -+static bool check_ids(u32 old_id, u32 cur_id, struct bpf_id_pair *idmap) - { - unsigned int i; - -- for (i = 0; i < ID_MAP_SIZE; i++) { -+ for (i = 0; i < BPF_ID_MAP_SIZE; i++) { - if (!idmap[i].old) { - /* Reached an empty slot; haven't seen this id before */ - idmap[i].old = old_id; -@@ -7133,8 +7108,8 @@ next: - } - - /* Returns true if (rold safe implies rcur safe) */ --static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur, -- struct idpair *idmap) -+static bool regsafe(struct bpf_verifier_env *env, struct bpf_reg_state *rold, -+ struct bpf_reg_state *rcur, struct bpf_id_pair *idmap) - { - bool equal; - -@@ -7160,6 +7135,8 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur, - return false; - switch (rold->type) { - case SCALAR_VALUE: -+ if (env->explore_alu_limits) -+ return false; - if (rcur->type == SCALAR_VALUE) { - if (!rold->precise && !rcur->precise) - return true; -@@ -7249,9 +7226,8 @@ static bool regsafe(struct bpf_reg_state *rold, struct bpf_reg_state *rcur, - return false; - } - --static bool stacksafe(struct bpf_func_state *old, -- struct bpf_func_state *cur, -- struct idpair *idmap) -+static bool stacksafe(struct bpf_verifier_env *env, struct bpf_func_state *old, -+ struct bpf_func_state *cur, struct bpf_id_pair *idmap) - { - int i, spi; - -@@ -7296,9 +7272,8 @@ static bool stacksafe(struct bpf_func_state *old, - continue; - if (old->stack[spi].slot_type[0] != STACK_SPILL) - continue; -- if (!regsafe(&old->stack[spi].spilled_ptr, -- &cur->stack[spi].spilled_ptr, -- idmap)) -+ if (!regsafe(env, &old->stack[spi].spilled_ptr, -+ &cur->stack[spi].spilled_ptr, idmap)) - /* when explored and current stack slot are both storing - * spilled registers, check that stored pointers types - * are the same as well. -@@ -7348,32 +7323,24 @@ static bool refsafe(struct bpf_func_state *old, struct bpf_func_state *cur) - * whereas register type in current state is meaningful, it means that - * the current state will reach 'bpf_exit' instruction safely - */ --static bool func_states_equal(struct bpf_func_state *old, -+static bool func_states_equal(struct bpf_verifier_env *env, struct bpf_func_state *old, - struct bpf_func_state *cur) - { -- struct idpair *idmap; -- bool ret = false; - int i; - -- idmap = kcalloc(ID_MAP_SIZE, sizeof(struct idpair), GFP_KERNEL); -- /* If we failed to allocate the idmap, just say it's not safe */ -- if (!idmap) -- return false; -- -- for (i = 0; i < MAX_BPF_REG; i++) { -- if (!regsafe(&old->regs[i], &cur->regs[i], idmap)) -- goto out_free; -- } -+ memset(env->idmap_scratch, 0, sizeof(env->idmap_scratch)); -+ for (i = 0; i < MAX_BPF_REG; i++) -+ if (!regsafe(env, &old->regs[i], &cur->regs[i], -+ env->idmap_scratch)) -+ return false; - -- if (!stacksafe(old, cur, idmap)) -- goto out_free; -+ if (!stacksafe(env, old, cur, env->idmap_scratch)) -+ return false; - - if (!refsafe(old, cur)) -- goto out_free; -- ret = true; --out_free: -- kfree(idmap); -- return ret; -+ return false; -+ -+ return true; - } - - static bool states_equal(struct bpf_verifier_env *env, -@@ -7400,7 +7367,7 @@ static bool states_equal(struct bpf_verifier_env *env, - for (i = 0; i <= old->curframe; i++) { - if (old->frame[i]->callsite != cur->frame[i]->callsite) - return false; -- if (!func_states_equal(old->frame[i], cur->frame[i])) -+ if (!func_states_equal(env, old->frame[i], cur->frame[i])) - return false; - } - return true; -@@ -8401,10 +8368,11 @@ static void convert_pseudo_ld_imm64(struct bpf_verifier_env *env) - * insni[off, off + cnt). Adjust corresponding insn_aux_data by copying - * [0, off) and [off, end) to new locations, so the patched range stays zero - */ --static int adjust_insn_aux_data(struct bpf_verifier_env *env, -- struct bpf_prog *new_prog, u32 off, u32 cnt) -+static void adjust_insn_aux_data(struct bpf_verifier_env *env, -+ struct bpf_insn_aux_data *new_data, -+ struct bpf_prog *new_prog, u32 off, u32 cnt) - { -- struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data; -+ struct bpf_insn_aux_data *old_data = env->insn_aux_data; - struct bpf_insn *insn = new_prog->insnsi; - bool old_seen = old_data[off].seen; - u32 prog_len; -@@ -8417,12 +8385,9 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, - old_data[off].zext_dst = insn_has_def32(env, insn + off + cnt - 1); - - if (cnt == 1) -- return 0; -+ return; - prog_len = new_prog->len; -- new_data = vzalloc(array_size(prog_len, -- sizeof(struct bpf_insn_aux_data))); -- if (!new_data) -- return -ENOMEM; -+ - memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off); - memcpy(new_data + off + cnt - 1, old_data + off, - sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1)); -@@ -8433,7 +8398,6 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env, - } - env->insn_aux_data = new_data; - vfree(old_data); -- return 0; - } - - static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len) -@@ -8454,6 +8418,14 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of - const struct bpf_insn *patch, u32 len) - { - struct bpf_prog *new_prog; -+ struct bpf_insn_aux_data *new_data = NULL; -+ -+ if (len > 1) { -+ new_data = vzalloc(array_size(env->prog->len + len - 1, -+ sizeof(struct bpf_insn_aux_data))); -+ if (!new_data) -+ return NULL; -+ } - - new_prog = bpf_patch_insn_single(env->prog, off, patch, len); - if (IS_ERR(new_prog)) { -@@ -8461,10 +8433,10 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of - verbose(env, - "insn %d cannot be patched due to 16-bit range\n", - env->insn_aux_data[off].orig_idx); -+ vfree(new_data); - return NULL; - } -- if (adjust_insn_aux_data(env, new_prog, off, len)) -- return NULL; -+ adjust_insn_aux_data(env, new_data, new_prog, off, len); - adjust_subprog_starts(env, off, len); - return new_prog; - } -@@ -8849,35 +8821,33 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) - - for (i = 0; i < insn_cnt; i++, insn++) { - bpf_convert_ctx_access_t convert_ctx_access; -+ bool ctx_access; - - if (insn->code == (BPF_LDX | BPF_MEM | BPF_B) || - insn->code == (BPF_LDX | BPF_MEM | BPF_H) || - insn->code == (BPF_LDX | BPF_MEM | BPF_W) || -- insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) -+ insn->code == (BPF_LDX | BPF_MEM | BPF_DW)) { - type = BPF_READ; -- else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) || -- insn->code == (BPF_STX | BPF_MEM | BPF_H) || -- insn->code == (BPF_STX | BPF_MEM | BPF_W) || -- insn->code == (BPF_STX | BPF_MEM | BPF_DW)) -+ ctx_access = true; -+ } else if (insn->code == (BPF_STX | BPF_MEM | BPF_B) || -+ insn->code == (BPF_STX | BPF_MEM | BPF_H) || -+ insn->code == (BPF_STX | BPF_MEM | BPF_W) || -+ insn->code == (BPF_STX | BPF_MEM | BPF_DW) || -+ insn->code == (BPF_ST | BPF_MEM | BPF_B) || -+ insn->code == (BPF_ST | BPF_MEM | BPF_H) || -+ insn->code == (BPF_ST | BPF_MEM | BPF_W) || -+ insn->code == (BPF_ST | BPF_MEM | BPF_DW)) { - type = BPF_WRITE; -- else -+ ctx_access = BPF_CLASS(insn->code) == BPF_STX; -+ } else { - continue; -+ } - - if (type == BPF_WRITE && -- env->insn_aux_data[i + delta].sanitize_stack_off) { -+ env->insn_aux_data[i + delta].sanitize_stack_spill) { - struct bpf_insn patch[] = { -- /* Sanitize suspicious stack slot with zero. -- * There are no memory dependencies for this store, -- * since it's only using frame pointer and immediate -- * constant of zero -- */ -- BPF_ST_MEM(BPF_DW, BPF_REG_FP, -- env->insn_aux_data[i + delta].sanitize_stack_off, -- 0), -- /* the original STX instruction will immediately -- * overwrite the same stack slot with appropriate value -- */ - *insn, -+ BPF_ST_NOSPEC(), - }; - - cnt = ARRAY_SIZE(patch); -@@ -8891,6 +8861,9 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) - continue; - } - -+ if (!ctx_access) -+ continue; -+ - switch (env->insn_aux_data[i + delta].ptr_type) { - case PTR_TO_CTX: - if (!ops->convert_ctx_access) -@@ -8952,6 +8925,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) - if (is_narrower_load && size < target_size) { - u8 shift = bpf_ctx_narrow_access_offset( - off, size, size_default) * 8; -+ if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) { -+ verbose(env, "bpf verifier narrow ctx load misconfigured\n"); -+ return -EINVAL; -+ } - if (ctx_field_size <= 4) { - if (shift) - insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, -diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c -index bab6a934862e3..badfa8f153599 100644 ---- a/kernel/cgroup/cpuset.c -+++ b/kernel/cgroup/cpuset.c -@@ -3166,6 +3166,13 @@ static void cpuset_hotplug_workfn(struct work_struct *work) - cpus_updated = !cpumask_equal(top_cpuset.effective_cpus, &new_cpus); - mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems); - -+ /* -+ * In the rare case that hotplug removes all the cpus in subparts_cpus, -+ * we assumed that cpus are updated. -+ */ -+ if (!cpus_updated && top_cpuset.nr_subparts_cpus) -+ cpus_updated = true; -+ - /* synchronize cpus_allowed to cpu_active_mask */ - if (cpus_updated) { - spin_lock_irq(&callback_lock); -diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c -index b5985da80acf0..7ccc8edce46dc 100644 ---- a/kernel/irq/timings.c -+++ b/kernel/irq/timings.c -@@ -799,12 +799,14 @@ static int __init irq_timings_test_irqs(struct timings_intervals *ti) - - __irq_timings_store(irq, irqs, ti->intervals[i]); - if (irqs->circ_timings[i & IRQ_TIMINGS_MASK] != index) { -+ ret = -EBADSLT; - pr_err("Failed to store in the circular buffer\n"); - goto out; - } - } - - if (irqs->count != ti->count) { -+ ret = -ERANGE; - pr_err("Count differs\n"); - goto out; - } -diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c -index c0c7784f074b2..b02fff28221f0 100644 ---- a/kernel/locking/mutex.c -+++ b/kernel/locking/mutex.c -@@ -938,7 +938,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, - struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) - { - struct mutex_waiter waiter; -- bool first = false; - struct ww_mutex *ww; - int ret; - -@@ -1017,6 +1016,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, - - set_current_state(state); - for (;;) { -+ bool first; -+ - /* - * Once we hold wait_lock, we're serialized against - * mutex_unlock() handing the lock off to us, do a trylock -@@ -1045,15 +1046,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, - spin_unlock(&lock->wait_lock); - schedule_preempt_disabled(); - -- /* -- * ww_mutex needs to always recheck its position since its waiter -- * list is not FIFO ordered. -- */ -- if (ww_ctx || !first) { -- first = __mutex_waiter_is_first(lock, &waiter); -- if (first) -- __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); -- } -+ first = __mutex_waiter_is_first(lock, &waiter); -+ if (first) -+ __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); - - set_current_state(state); - /* -diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c -index 8dac32bd90894..7ef35eb985baf 100644 ---- a/kernel/power/energy_model.c -+++ b/kernel/power/energy_model.c -@@ -149,7 +149,9 @@ static struct em_perf_domain *em_create_pd(cpumask_t *span, int nr_states, - /* Compute the cost of each capacity_state. */ - fmax = (u64) table[nr_states - 1].frequency; - for (i = 0; i < nr_states; i++) { -- table[i].cost = div64_u64(fmax * table[i].power, -+ unsigned long power_res = em_scale_power(table[i].power); -+ -+ table[i].cost = div64_u64(fmax * power_res, - table[i].frequency); - } - -diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h -index c0b8c458d8a6a..b8c9744ad595b 100644 ---- a/kernel/rcu/tree_stall.h -+++ b/kernel/rcu/tree_stall.h -@@ -7,6 +7,8 @@ - * Author: Paul E. McKenney - */ - -+#include -+ - ////////////////////////////////////////////////////////////////////////////// - // - // Controlling CPU stall warnings, including delay calculation. -@@ -525,6 +527,14 @@ static void check_cpu_stall(struct rcu_data *rdp) - (READ_ONCE(rnp->qsmask) & rdp->grpmask) && - cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { - -+ /* -+ * If a virtual machine is stopped by the host it can look to -+ * the watchdog like an RCU stall. Check to see if the host -+ * stopped the vm. -+ */ -+ if (kvm_check_and_clear_guest_paused()) -+ return; -+ - /* We haven't checked in, so go dump stack. */ - print_cpu_stall(); - if (rcu_cpu_stall_ftrace_dump) -@@ -534,6 +544,14 @@ static void check_cpu_stall(struct rcu_data *rdp) - ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) && - cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) { - -+ /* -+ * If a virtual machine is stopped by the host it can look to -+ * the watchdog like an RCU stall. Check to see if the host -+ * stopped the vm. -+ */ -+ if (kvm_check_and_clear_guest_paused()) -+ return; -+ - /* They had a few time units to dump stack, so complain. */ - print_other_cpu_stall(gs2); - if (rcu_cpu_stall_ftrace_dump) -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 8294debf68c4d..5dc43d37e6a2b 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -1110,6 +1110,23 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p) - uclamp_rq_dec_id(rq, p, clamp_id); - } - -+static inline void uclamp_rq_reinc_id(struct rq *rq, struct task_struct *p, -+ enum uclamp_id clamp_id) -+{ -+ if (!p->uclamp[clamp_id].active) -+ return; -+ -+ uclamp_rq_dec_id(rq, p, clamp_id); -+ uclamp_rq_inc_id(rq, p, clamp_id); -+ -+ /* -+ * Make sure to clear the idle flag if we've transiently reached 0 -+ * active tasks on rq. -+ */ -+ if (clamp_id == UCLAMP_MAX && (rq->uclamp_flags & UCLAMP_FLAG_IDLE)) -+ rq->uclamp_flags &= ~UCLAMP_FLAG_IDLE; -+} -+ - static inline void - uclamp_update_active(struct task_struct *p) - { -@@ -1133,12 +1150,8 @@ uclamp_update_active(struct task_struct *p) - * affecting a valid clamp bucket, the next time it's enqueued, - * it will already see the updated clamp bucket value. - */ -- for_each_clamp_id(clamp_id) { -- if (p->uclamp[clamp_id].active) { -- uclamp_rq_dec_id(rq, p, clamp_id); -- uclamp_rq_inc_id(rq, p, clamp_id); -- } -- } -+ for_each_clamp_id(clamp_id) -+ uclamp_rq_reinc_id(rq, p, clamp_id); - - task_rq_unlock(rq, p, &rf); - } -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 3cf776d5bce8f..2bda9fdba31c4 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -1654,6 +1654,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused - */ - raw_spin_lock(&rq->lock); - if (p->dl.dl_non_contending) { -+ update_rq_clock(rq); - sub_running_bw(&p->dl, &rq->dl); - p->dl.dl_non_contending = 0; - /* -@@ -2622,7 +2623,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr) - dl_se->dl_runtime = attr->sched_runtime; - dl_se->dl_deadline = attr->sched_deadline; - dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline; -- dl_se->flags = attr->sched_flags; -+ dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS; - dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime); - dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime); - } -@@ -2635,7 +2636,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr) - attr->sched_runtime = dl_se->dl_runtime; - attr->sched_deadline = dl_se->dl_deadline; - attr->sched_period = dl_se->dl_period; -- attr->sched_flags = dl_se->flags; -+ attr->sched_flags &= ~SCHED_DL_FLAGS; -+ attr->sched_flags |= dl_se->flags; - } - - /* -@@ -2710,7 +2712,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr) - if (dl_se->dl_runtime != attr->sched_runtime || - dl_se->dl_deadline != attr->sched_deadline || - dl_se->dl_period != attr->sched_period || -- dl_se->flags != attr->sched_flags) -+ dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS)) - return true; - - return false; -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 4e490e3db2f86..fe755c1a0af95 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -209,6 +209,8 @@ static inline int task_has_dl_policy(struct task_struct *p) - */ - #define SCHED_FLAG_SUGOV 0x10000000 - -+#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV) -+ - static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se) - { - #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 1f3e3a17f67e0..e1e8d5dab0c59 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -759,22 +759,6 @@ static void hrtimer_switch_to_hres(void) - retrigger_next_event(NULL); - } - --static void clock_was_set_work(struct work_struct *work) --{ -- clock_was_set(); --} -- --static DECLARE_WORK(hrtimer_work, clock_was_set_work); -- --/* -- * Called from timekeeping and resume code to reprogram the hrtimer -- * interrupt device on all cpus. -- */ --void clock_was_set_delayed(void) --{ -- schedule_work(&hrtimer_work); --} -- - #else - - static inline int hrtimer_is_hres_enabled(void) { return 0; } -@@ -892,6 +876,22 @@ void clock_was_set(void) - timerfd_clock_was_set(); - } - -+static void clock_was_set_work(struct work_struct *work) -+{ -+ clock_was_set(); -+} -+ -+static DECLARE_WORK(hrtimer_work, clock_was_set_work); -+ -+/* -+ * Called from timekeeping and resume code to reprogram the hrtimer -+ * interrupt device on all cpus and to notify timerfd. -+ */ -+void clock_was_set_delayed(void) -+{ -+ schedule_work(&hrtimer_work); -+} -+ - /* - * During resume we might have to reprogram the high resolution timer - * interrupt on all online CPUs. However, all other CPUs will be -@@ -1031,12 +1031,13 @@ static void __remove_hrtimer(struct hrtimer *timer, - * remove hrtimer, called with base lock held - */ - static inline int --remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart) -+remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, -+ bool restart, bool keep_local) - { - u8 state = timer->state; - - if (state & HRTIMER_STATE_ENQUEUED) { -- int reprogram; -+ bool reprogram; - - /* - * Remove the timer and force reprogramming when high -@@ -1049,8 +1050,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest - debug_deactivate(timer); - reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases); - -+ /* -+ * If the timer is not restarted then reprogramming is -+ * required if the timer is local. If it is local and about -+ * to be restarted, avoid programming it twice (on removal -+ * and a moment later when it's requeued). -+ */ - if (!restart) - state = HRTIMER_STATE_INACTIVE; -+ else -+ reprogram &= !keep_local; - - __remove_hrtimer(timer, base, state, reprogram); - return 1; -@@ -1104,9 +1113,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, - struct hrtimer_clock_base *base) - { - struct hrtimer_clock_base *new_base; -+ bool force_local, first; -+ -+ /* -+ * If the timer is on the local cpu base and is the first expiring -+ * timer then this might end up reprogramming the hardware twice -+ * (on removal and on enqueue). To avoid that by prevent the -+ * reprogram on removal, keep the timer local to the current CPU -+ * and enforce reprogramming after it is queued no matter whether -+ * it is the new first expiring timer again or not. -+ */ -+ force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases); -+ force_local &= base->cpu_base->next_timer == timer; - -- /* Remove an active timer from the queue: */ -- remove_hrtimer(timer, base, true); -+ /* -+ * Remove an active timer from the queue. In case it is not queued -+ * on the current CPU, make sure that remove_hrtimer() updates the -+ * remote data correctly. -+ * -+ * If it's on the current CPU and the first expiring timer, then -+ * skip reprogramming, keep the timer local and enforce -+ * reprogramming later if it was the first expiring timer. This -+ * avoids programming the underlying clock event twice (once at -+ * removal and once after enqueue). -+ */ -+ remove_hrtimer(timer, base, true, force_local); - - if (mode & HRTIMER_MODE_REL) - tim = ktime_add_safe(tim, base->get_time()); -@@ -1116,9 +1147,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, - hrtimer_set_expires_range_ns(timer, tim, delta_ns); - - /* Switch the timer base, if necessary: */ -- new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED); -+ if (!force_local) { -+ new_base = switch_hrtimer_base(timer, base, -+ mode & HRTIMER_MODE_PINNED); -+ } else { -+ new_base = base; -+ } -+ -+ first = enqueue_hrtimer(timer, new_base, mode); -+ if (!force_local) -+ return first; - -- return enqueue_hrtimer(timer, new_base, mode); -+ /* -+ * Timer was forced to stay on the current CPU to avoid -+ * reprogramming on removal and enqueue. Force reprogram the -+ * hardware by evaluating the new first expiring timer. -+ */ -+ hrtimer_force_reprogram(new_base->cpu_base, 1); -+ return 0; - } - - /** -@@ -1184,7 +1230,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer) - base = lock_hrtimer_base(timer, &flags); - - if (!hrtimer_callback_running(timer)) -- ret = remove_hrtimer(timer, base, false); -+ ret = remove_hrtimer(timer, base, false, false); - - unlock_hrtimer_base(timer, &flags); - -diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c -index eacb0ca301932..30e061b210b7c 100644 ---- a/kernel/time/posix-cpu-timers.c -+++ b/kernel/time/posix-cpu-timers.c -@@ -1201,8 +1201,6 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid, - } - } - -- if (!*newval) -- return; - *newval += now; - } - -diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h -index 7b24961367292..5294f5b1f9550 100644 ---- a/kernel/time/tick-internal.h -+++ b/kernel/time/tick-internal.h -@@ -165,3 +165,6 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases); - - extern u64 get_next_timer_interrupt(unsigned long basej, u64 basem); - void timer_clear_idle(void); -+ -+void clock_was_set(void); -+void clock_was_set_delayed(void); -diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c -index 20ed0f7667871..00825028cc847 100644 ---- a/lib/mpi/mpiutil.c -+++ b/lib/mpi/mpiutil.c -@@ -91,7 +91,7 @@ int mpi_resize(MPI a, unsigned nlimbs) - return 0; /* no need to do it */ - - if (a->d) { -- p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL); -+ p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL); - if (!p) - return -ENOMEM; - memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t)); -diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c -index 1c140af06d527..600b9563bfc53 100644 ---- a/net/6lowpan/debugfs.c -+++ b/net/6lowpan/debugfs.c -@@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev, - struct dentry *root; - char buf[32]; - -- WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE); -+ if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE)) -+ return; - - sprintf(buf, "%d", id); - -diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h -index c32638dddbf94..f6b9dc4e408f2 100644 ---- a/net/bluetooth/cmtp/cmtp.h -+++ b/net/bluetooth/cmtp/cmtp.h -@@ -26,7 +26,7 @@ - #include - #include - --#define BTNAMSIZ 18 -+#define BTNAMSIZ 21 - - /* CMTP ioctl defines */ - #define CMTPCONNADD _IOW('C', 200, int) -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index 83a07fca9000f..bdd330527cfa2 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -1297,6 +1297,12 @@ int hci_inquiry(void __user *arg) - goto done; - } - -+ /* Restrict maximum inquiry length to 60 seconds */ -+ if (ir.length > 60) { -+ err = -EINVAL; -+ goto done; -+ } -+ - hci_dev_lock(hdev); - if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || - inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) { -@@ -1685,6 +1691,14 @@ int hci_dev_do_close(struct hci_dev *hdev) - hci_request_cancel_all(hdev); - hci_req_sync_lock(hdev); - -+ if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && -+ !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && -+ test_bit(HCI_UP, &hdev->flags)) { -+ /* Execute vendor specific shutdown routine */ -+ if (hdev->shutdown) -+ hdev->shutdown(hdev); -+ } -+ - if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { - cancel_delayed_work_sync(&hdev->cmd_timer); - hci_req_sync_unlock(hdev); -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index b91d6b440fdf6..1b7540cb8e5c4 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -84,7 +84,6 @@ static void sco_sock_timeout(struct timer_list *t) - sk->sk_state_change(sk); - bh_unlock_sock(sk); - -- sco_sock_kill(sk); - sock_put(sk); - } - -@@ -176,7 +175,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err) - sco_sock_clear_timer(sk); - sco_chan_del(sk, err); - bh_unlock_sock(sk); -- sco_sock_kill(sk); - sock_put(sk); - } - -@@ -393,8 +391,7 @@ static void sco_sock_cleanup_listen(struct sock *parent) - */ - static void sco_sock_kill(struct sock *sk) - { -- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || -- sock_flag(sk, SOCK_DEAD)) -+ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) - return; - - BT_DBG("sk %p state %d", sk, sk->sk_state); -@@ -446,7 +443,6 @@ static void sco_sock_close(struct sock *sk) - lock_sock(sk); - __sco_sock_close(sk); - release_sock(sk); -- sco_sock_kill(sk); - } - - static void sco_sock_init(struct sock *sk, struct sock *parent) -@@ -761,6 +757,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) - cp.max_latency = cpu_to_le16(0xffff); - cp.retrans_effort = 0xff; - break; -+ default: -+ /* use CVSD settings as fallback */ -+ cp.max_latency = cpu_to_le16(0xffff); -+ cp.retrans_effort = 0xff; -+ break; - } - - hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index c303873496a34..9bf15512601bf 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -211,9 +211,9 @@ static int net_eq_idr(int id, void *net, void *peer) - return 0; - } - --/* Should be called with nsid_lock held. If a new id is assigned, the bool alloc -- * is set to true, thus the caller knows that the new id must be notified via -- * rtnl. -+/* Must be called from RCU-critical section or with nsid_lock held. If -+ * a new id is assigned, the bool alloc is set to true, thus the -+ * caller knows that the new id must be notified via rtnl. - */ - static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc) - { -@@ -237,7 +237,7 @@ static int __peernet2id_alloc(struct net *net, struct net *peer, bool *alloc) - return NETNSA_NSID_NOT_ASSIGNED; - } - --/* should be called with nsid_lock held */ -+/* Must be called from RCU-critical section or with nsid_lock held */ - static int __peernet2id(struct net *net, struct net *peer) - { - bool no = false; -@@ -281,9 +281,10 @@ int peernet2id(struct net *net, struct net *peer) - { - int id; - -- spin_lock_bh(&net->nsid_lock); -+ rcu_read_lock(); - id = __peernet2id(net, peer); -- spin_unlock_bh(&net->nsid_lock); -+ rcu_read_unlock(); -+ - return id; - } - EXPORT_SYMBOL(peernet2id); -@@ -962,6 +963,7 @@ struct rtnl_net_dump_cb { - int s_idx; - }; - -+/* Runs in RCU-critical section. */ - static int rtnl_net_dumpid_one(int id, void *peer, void *data) - { - struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data; -@@ -1046,19 +1048,9 @@ static int rtnl_net_dumpid(struct sk_buff *skb, struct netlink_callback *cb) - goto end; - } - -- spin_lock_bh(&net_cb.tgt_net->nsid_lock); -- if (net_cb.fillargs.add_ref && -- !net_eq(net_cb.ref_net, net_cb.tgt_net) && -- !spin_trylock_bh(&net_cb.ref_net->nsid_lock)) { -- spin_unlock_bh(&net_cb.tgt_net->nsid_lock); -- err = -EAGAIN; -- goto end; -- } -+ rcu_read_lock(); - idr_for_each(&net_cb.tgt_net->netns_ids, rtnl_net_dumpid_one, &net_cb); -- if (net_cb.fillargs.add_ref && -- !net_eq(net_cb.ref_net, net_cb.tgt_net)) -- spin_unlock_bh(&net_cb.ref_net->nsid_lock); -- spin_unlock_bh(&net_cb.tgt_net->nsid_lock); -+ rcu_read_unlock(); - - cb->args[0] = net_cb.idx; - end: -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 0e976848d4bb9..539492998864e 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -610,18 +610,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) - } - } - --static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash) -+static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash) - { -- struct fib_nh_exception *fnhe, *oldest; -+ struct fib_nh_exception __rcu **fnhe_p, **oldest_p; -+ struct fib_nh_exception *fnhe, *oldest = NULL; - -- oldest = rcu_dereference(hash->chain); -- for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe; -- fnhe = rcu_dereference(fnhe->fnhe_next)) { -- if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) -+ for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { -+ fnhe = rcu_dereference_protected(*fnhe_p, -+ lockdep_is_held(&fnhe_lock)); -+ if (!fnhe) -+ break; -+ if (!oldest || -+ time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) { - oldest = fnhe; -+ oldest_p = fnhe_p; -+ } - } - fnhe_flush_routes(oldest); -- return oldest; -+ *oldest_p = oldest->fnhe_next; -+ kfree_rcu(oldest, rcu); - } - - static inline u32 fnhe_hashfun(__be32 daddr) -@@ -700,16 +707,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, - if (rt) - fill_route_from_fnhe(rt, fnhe); - } else { -- if (depth > FNHE_RECLAIM_DEPTH) -- fnhe = fnhe_oldest(hash); -- else { -- fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); -- if (!fnhe) -- goto out_unlock; -- -- fnhe->fnhe_next = hash->chain; -- rcu_assign_pointer(hash->chain, fnhe); -+ /* Randomize max depth to avoid some side channels attacks. */ -+ int max_depth = FNHE_RECLAIM_DEPTH + -+ prandom_u32_max(FNHE_RECLAIM_DEPTH); -+ -+ while (depth > max_depth) { -+ fnhe_remove_oldest(hash); -+ depth--; - } -+ -+ fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC); -+ if (!fnhe) -+ goto out_unlock; -+ -+ fnhe->fnhe_next = hash->chain; -+ - fnhe->fnhe_genid = genid; - fnhe->fnhe_daddr = daddr; - fnhe->fnhe_gw = gw; -@@ -717,6 +729,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr, - fnhe->fnhe_mtu_locked = lock; - fnhe->fnhe_expires = max(1UL, expires); - -+ rcu_assign_pointer(hash->chain, fnhe); -+ - /* Exception created; mark the cached routes for the nexthop - * stale, so anyone caching it rechecks if this exception - * applies to them. -@@ -2990,7 +3004,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst, - udph = skb_put_zero(skb, sizeof(struct udphdr)); - udph->source = sport; - udph->dest = dport; -- udph->len = sizeof(struct udphdr); -+ udph->len = htons(sizeof(struct udphdr)); - udph->check = 0; - break; - } -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 91788ff19a5d4..2ce85e52aea7c 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -2304,6 +2304,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos) - static void *tcp_seek_last_pos(struct seq_file *seq) - { - struct tcp_iter_state *st = seq->private; -+ int bucket = st->bucket; - int offset = st->offset; - int orig_num = st->num; - void *rc = NULL; -@@ -2314,7 +2315,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) - break; - st->state = TCP_SEQ_STATE_LISTENING; - rc = listening_get_next(seq, NULL); -- while (offset-- && rc) -+ while (offset-- && rc && bucket == st->bucket) - rc = listening_get_next(seq, rc); - if (rc) - break; -@@ -2325,7 +2326,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq) - if (st->bucket > tcp_hashinfo.ehash_mask) - break; - rc = established_get_first(seq); -- while (offset-- && rc) -+ while (offset-- && rc && bucket == st->bucket) - rc = established_get_next(seq, rc); - } - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index d6fc22f7d7a67..575bd0f1b0089 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1667,6 +1667,7 @@ static int rt6_insert_exception(struct rt6_info *nrt, - struct in6_addr *src_key = NULL; - struct rt6_exception *rt6_ex; - struct fib6_nh *nh = res->nh; -+ int max_depth; - int err = 0; - - spin_lock_bh(&rt6_exception_lock); -@@ -1721,7 +1722,9 @@ static int rt6_insert_exception(struct rt6_info *nrt, - bucket->depth++; - net->ipv6.rt6_stats->fib_rt_cache++; - -- if (bucket->depth > FIB6_MAX_DEPTH) -+ /* Randomize max depth to avoid some side channels attacks. */ -+ max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH); -+ while (bucket->depth > max_depth) - rt6_exception_remove_oldest(bucket); - - out: -diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c -index 538722522ffe9..4dfac7a25e5ad 100644 ---- a/net/mac80211/tx.c -+++ b/net/mac80211/tx.c -@@ -3189,7 +3189,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata, - if (info->control.flags & IEEE80211_TX_CTRL_AMSDU) - return true; - -- if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr))) -+ if (!ieee80211_amsdu_realloc_pad(local, skb, -+ sizeof(*amsdu_hdr) + -+ local->hw.extra_tx_headroom)) - return false; - - data = skb_push(skb, sizeof(*amsdu_hdr)); -diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c -index 4cb43a2c07d14..8cd3daf0e3db6 100644 ---- a/net/netlabel/netlabel_cipso_v4.c -+++ b/net/netlabel/netlabel_cipso_v4.c -@@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, - } - doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, - sizeof(u32), -- GFP_KERNEL); -+ GFP_KERNEL | __GFP_NOWARN); - if (doi_def->map.std->lvl.local == NULL) { - ret_val = -ENOMEM; - goto add_std_failure; - } - doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, - sizeof(u32), -- GFP_KERNEL); -+ GFP_KERNEL | __GFP_NOWARN); - if (doi_def->map.std->lvl.cipso == NULL) { - ret_val = -ENOMEM; - goto add_std_failure; -@@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, - doi_def->map.std->cat.local = kcalloc( - doi_def->map.std->cat.local_size, - sizeof(u32), -- GFP_KERNEL); -+ GFP_KERNEL | __GFP_NOWARN); - if (doi_def->map.std->cat.local == NULL) { - ret_val = -ENOMEM; - goto add_std_failure; -@@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, - doi_def->map.std->cat.cipso = kcalloc( - doi_def->map.std->cat.cipso_size, - sizeof(u32), -- GFP_KERNEL); -+ GFP_KERNEL | __GFP_NOWARN); - if (doi_def->map.std->cat.cipso == NULL) { - ret_val = -ENOMEM; - goto add_std_failure; -diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c -index 39b427dc75128..e5972889cd81c 100644 ---- a/net/sched/sch_cbq.c -+++ b/net/sched/sch_cbq.c -@@ -1614,7 +1614,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t - err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack); - if (err) { - kfree(cl); -- return err; -+ goto failure; - } - - if (tca[TCA_RATE]) { -diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig -index d2054bec49094..748f3ee27b23d 100644 ---- a/security/integrity/ima/Kconfig -+++ b/security/integrity/ima/Kconfig -@@ -6,7 +6,6 @@ config IMA - select SECURITYFS - select CRYPTO - select CRYPTO_HMAC -- select CRYPTO_MD5 - select CRYPTO_SHA1 - select CRYPTO_HASH_INFO - select TCG_TPM if HAS_IOMEM && !UML -diff --git a/security/integrity/ima/ima_mok.c b/security/integrity/ima/ima_mok.c -index 1e5c019161738..95cc31525c573 100644 ---- a/security/integrity/ima/ima_mok.c -+++ b/security/integrity/ima/ima_mok.c -@@ -21,7 +21,7 @@ struct key *ima_blacklist_keyring; - /* - * Allocate the IMA blacklist keyring - */ --__init int ima_mok_init(void) -+static __init int ima_mok_init(void) - { - struct key_restriction *restriction; - -diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c -index 81906c25e4a87..016aff97e2fb2 100644 ---- a/sound/soc/codecs/wcd9335.c -+++ b/sound/soc/codecs/wcd9335.c -@@ -4076,6 +4076,16 @@ static int wcd9335_setup_irqs(struct wcd9335_codec *wcd) - return ret; - } - -+static void wcd9335_teardown_irqs(struct wcd9335_codec *wcd) -+{ -+ int i; -+ -+ /* disable interrupts on all slave ports */ -+ for (i = 0; i < WCD9335_SLIM_NUM_PORT_REG; i++) -+ regmap_write(wcd->if_regmap, WCD9335_SLIM_PGD_PORT_INT_EN0 + i, -+ 0x00); -+} -+ - static void wcd9335_cdc_sido_ccl_enable(struct wcd9335_codec *wcd, - bool ccl_flag) - { -@@ -4844,6 +4854,7 @@ static void wcd9335_codec_init(struct snd_soc_component *component) - static int wcd9335_codec_probe(struct snd_soc_component *component) - { - struct wcd9335_codec *wcd = dev_get_drvdata(component->dev); -+ int ret; - int i; - - snd_soc_component_init_regmap(component, wcd->regmap); -@@ -4861,7 +4872,15 @@ static int wcd9335_codec_probe(struct snd_soc_component *component) - for (i = 0; i < NUM_CODEC_DAIS; i++) - INIT_LIST_HEAD(&wcd->dai[i].slim_ch_list); - -- return wcd9335_setup_irqs(wcd); -+ ret = wcd9335_setup_irqs(wcd); -+ if (ret) -+ goto free_clsh_ctrl; -+ -+ return 0; -+ -+free_clsh_ctrl: -+ wcd_clsh_ctrl_free(wcd->clsh_ctrl); -+ return ret; - } - - static void wcd9335_codec_remove(struct snd_soc_component *comp) -@@ -4869,7 +4888,7 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp) - struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev); - - wcd_clsh_ctrl_free(wcd->clsh_ctrl); -- free_irq(regmap_irq_get_virq(wcd->irq_data, WCD9335_IRQ_SLIMBUS), wcd); -+ wcd9335_teardown_irqs(wcd); - } - - static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp, -diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c -index 1940b17f27efa..254b796e635d1 100644 ---- a/sound/soc/intel/skylake/skl-topology.c -+++ b/sound/soc/intel/skylake/skl-topology.c -@@ -113,7 +113,7 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w, - - static void skl_dump_mconfig(struct skl_dev *skl, struct skl_module_cfg *mcfg) - { -- struct skl_module_iface *iface = &mcfg->module->formats[0]; -+ struct skl_module_iface *iface = &mcfg->module->formats[mcfg->fmt_idx]; - - dev_dbg(skl->dev, "Dumping config\n"); - dev_dbg(skl->dev, "Input Format:\n"); -@@ -195,8 +195,8 @@ static void skl_tplg_update_params_fixup(struct skl_module_cfg *m_cfg, - struct skl_module_fmt *in_fmt, *out_fmt; - - /* Fixups will be applied to pin 0 only */ -- in_fmt = &m_cfg->module->formats[0].inputs[0].fmt; -- out_fmt = &m_cfg->module->formats[0].outputs[0].fmt; -+ in_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].inputs[0].fmt; -+ out_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].outputs[0].fmt; - - if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) { - if (is_fe) { -@@ -239,9 +239,9 @@ static void skl_tplg_update_buffer_size(struct skl_dev *skl, - /* Since fixups is applied to pin 0 only, ibs, obs needs - * change for pin 0 only - */ -- res = &mcfg->module->resources[0]; -- in_fmt = &mcfg->module->formats[0].inputs[0].fmt; -- out_fmt = &mcfg->module->formats[0].outputs[0].fmt; -+ res = &mcfg->module->resources[mcfg->res_idx]; -+ in_fmt = &mcfg->module->formats[mcfg->fmt_idx].inputs[0].fmt; -+ out_fmt = &mcfg->module->formats[mcfg->fmt_idx].outputs[0].fmt; - - if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT) - multiplier = 5; -@@ -1463,12 +1463,6 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol, - struct skl_dev *skl = get_skl_ctx(w->dapm->dev); - - if (ac->params) { -- /* -- * Widget data is expected to be stripped of T and L -- */ -- size -= 2 * sizeof(unsigned int); -- data += 2; -- - if (size > ac->max) - return -EINVAL; - ac->size = size; -@@ -1637,11 +1631,12 @@ int skl_tplg_update_pipe_params(struct device *dev, - struct skl_module_cfg *mconfig, - struct skl_pipe_params *params) - { -- struct skl_module_res *res = &mconfig->module->resources[0]; -+ struct skl_module_res *res; - struct skl_dev *skl = get_skl_ctx(dev); - struct skl_module_fmt *format = NULL; - u8 cfg_idx = mconfig->pipe->cur_config_idx; - -+ res = &mconfig->module->resources[mconfig->res_idx]; - skl_tplg_fill_dma_id(mconfig, params); - mconfig->fmt_idx = mconfig->mod_cfg[cfg_idx].fmt_idx; - mconfig->res_idx = mconfig->mod_cfg[cfg_idx].res_idx; -@@ -1650,9 +1645,9 @@ int skl_tplg_update_pipe_params(struct device *dev, - return 0; - - if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) -- format = &mconfig->module->formats[0].inputs[0].fmt; -+ format = &mconfig->module->formats[mconfig->fmt_idx].inputs[0].fmt; - else -- format = &mconfig->module->formats[0].outputs[0].fmt; -+ format = &mconfig->module->formats[mconfig->fmt_idx].outputs[0].fmt; - - /* set the hw_params */ - format->s_freq = params->s_freq; -diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h -index 8649422e760cc..63038eb23560b 100644 ---- a/tools/include/uapi/linux/bpf.h -+++ b/tools/include/uapi/linux/bpf.h -@@ -2264,7 +2264,7 @@ union bpf_attr { - * int bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags) - * Description - * Select a **SO_REUSEPORT** socket from a -- * **BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*. -+ * **BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*. - * It checks the selected socket is matching the incoming - * request in the socket buffer. - * Return diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.146-147.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.146-147.patch deleted file mode 100644 index 472a6d8d20..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.146-147.patch +++ /dev/null @@ -1,97 +0,0 @@ -diff --git a/Makefile b/Makefile -index 48d0c03acfc55..98227dae34947 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 146 -+SUBLEVEL = 147 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index bc3ab98855cf0..25e81b1a59a54 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -1744,17 +1744,7 @@ static int nbd_dev_add(int index) - refcount_set(&nbd->refs, 1); - INIT_LIST_HEAD(&nbd->list); - disk->major = NBD_MAJOR; -- -- /* Too big first_minor can cause duplicate creation of -- * sysfs files/links, since first_minor will be truncated to -- * byte in __device_add_disk(). -- */ - disk->first_minor = index << part_shift; -- if (disk->first_minor > 0xff) { -- err = -EINVAL; -- goto out_free_idr; -- } -- - disk->fops = &nbd_fops; - disk->private_data = nbd; - sprintf(disk->disk_name, "nbd%d", index); -diff --git a/include/linux/time64.h b/include/linux/time64.h -index f6059c505986b..5eab3f2635186 100644 ---- a/include/linux/time64.h -+++ b/include/linux/time64.h -@@ -33,9 +33,7 @@ struct itimerspec64 { - #define TIME64_MIN (-TIME64_MAX - 1) - - #define KTIME_MAX ((s64)~((u64)1 << 63)) --#define KTIME_MIN (-KTIME_MAX - 1) - #define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC) --#define KTIME_SEC_MIN (KTIME_MIN / NSEC_PER_SEC) - - /* - * Limits for settimeofday(): -@@ -134,13 +132,10 @@ static inline bool timespec64_valid_settod(const struct timespec64 *ts) - */ - static inline s64 timespec64_to_ns(const struct timespec64 *ts) - { -- /* Prevent multiplication overflow / underflow */ -- if (ts->tv_sec >= KTIME_SEC_MAX) -+ /* Prevent multiplication overflow */ -+ if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX) - return KTIME_MAX; - -- if (ts->tv_sec <= KTIME_SEC_MIN) -- return KTIME_MIN; -- - return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec; - } - -diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c -index 30e061b210b7c..eacb0ca301932 100644 ---- a/kernel/time/posix-cpu-timers.c -+++ b/kernel/time/posix-cpu-timers.c -@@ -1201,6 +1201,8 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid, - } - } - -+ if (!*newval) -+ return; - *newval += now; - } - -diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c -index bdd330527cfa2..c50e3e8afbd34 100644 ---- a/net/bluetooth/hci_core.c -+++ b/net/bluetooth/hci_core.c -@@ -1691,14 +1691,6 @@ int hci_dev_do_close(struct hci_dev *hdev) - hci_request_cancel_all(hdev); - hci_req_sync_lock(hdev); - -- if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && -- !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && -- test_bit(HCI_UP, &hdev->flags)) { -- /* Execute vendor specific shutdown routine */ -- if (hdev->shutdown) -- hdev->shutdown(hdev); -- } -- - if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { - cancel_delayed_work_sync(&hdev->cmd_timer); - hci_req_sync_unlock(hdev); diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.147-148.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.147-148.patch deleted file mode 100644 index e4f197b6b2..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.147-148.patch +++ /dev/null @@ -1,8519 +0,0 @@ -diff --git a/Documentation/admin-guide/devices.txt b/Documentation/admin-guide/devices.txt -index 1c5d2281efc97..771d9e7ae082b 100644 ---- a/Documentation/admin-guide/devices.txt -+++ b/Documentation/admin-guide/devices.txt -@@ -3002,10 +3002,10 @@ - 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device - ... - 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device -- 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device -- 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device -+ 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device -+ 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device - ... -- 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device -+ 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device - - 232 char Biometric Devices - 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device -diff --git a/Documentation/devicetree/bindings/arm/tegra.yaml b/Documentation/devicetree/bindings/arm/tegra.yaml -index 60b38eb5c61ab..56e1945911f1e 100644 ---- a/Documentation/devicetree/bindings/arm/tegra.yaml -+++ b/Documentation/devicetree/bindings/arm/tegra.yaml -@@ -49,7 +49,7 @@ properties: - - const: toradex,apalis_t30 - - const: nvidia,tegra30 - - items: -- - const: toradex,apalis_t30-eval-v1.1 -+ - const: toradex,apalis_t30-v1.1-eval - - const: toradex,apalis_t30-eval - - const: toradex,apalis_t30-v1.1 - - const: toradex,apalis_t30 -diff --git a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt -index 44919d48d2415..c459f169a9044 100644 ---- a/Documentation/devicetree/bindings/mtd/gpmc-nand.txt -+++ b/Documentation/devicetree/bindings/mtd/gpmc-nand.txt -@@ -122,7 +122,7 @@ on various other factors also like; - so the device should have enough free bytes available its OOB/Spare - area to accommodate ECC for entire page. In general following expression - helps in determining if given device can accommodate ECC syndrome: -- "2 + (PAGESIZE / 512) * ECC_BYTES" >= OOBSIZE" -+ "2 + (PAGESIZE / 512) * ECC_BYTES" <= OOBSIZE" - where - OOBSIZE number of bytes in OOB/spare area - PAGESIZE number of bytes in main-area of device page -diff --git a/Makefile b/Makefile -index 98227dae34947..b84706c6d6248 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 147 -+SUBLEVEL = 148 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c -index a2fbea3ee07c7..102418ac5ff4a 100644 ---- a/arch/arc/mm/cache.c -+++ b/arch/arc/mm/cache.c -@@ -1123,7 +1123,7 @@ void clear_user_page(void *to, unsigned long u_vaddr, struct page *page) - clear_page(to); - clear_bit(PG_dc_clean, &page->flags); - } -- -+EXPORT_SYMBOL(clear_user_page); - - /********************************************************************** - * Explicit Cache flush request from user space via syscall -diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile -index f0b3a9281d69b..fb6cb24bde5c9 100644 ---- a/arch/arm/boot/compressed/Makefile -+++ b/arch/arm/boot/compressed/Makefile -@@ -90,6 +90,8 @@ $(addprefix $(obj)/,$(libfdt_objs) atags_to_fdt.o): \ - $(addprefix $(obj)/,$(libfdt_hdrs)) - - ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) -+CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN} -+CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280 - OBJS += $(libfdt_objs) atags_to_fdt.o - endif - -diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts -index 5ff9a179c83c3..c80d1700e0949 100644 ---- a/arch/arm/boot/dts/imx53-ppd.dts -+++ b/arch/arm/boot/dts/imx53-ppd.dts -@@ -70,6 +70,12 @@ - clock-frequency = <11289600>; - }; - -+ achc_24M: achc-clock { -+ compatible = "fixed-clock"; -+ #clock-cells = <0>; -+ clock-frequency = <24000000>; -+ }; -+ - sgtlsound: sound { - compatible = "fsl,imx53-cpuvo-sgtl5000", - "fsl,imx-audio-sgtl5000"; -@@ -287,16 +293,13 @@ - &gpio4 12 GPIO_ACTIVE_LOW>; - status = "okay"; - -- spidev0: spi@0 { -- compatible = "ge,achc"; -- reg = <0>; -- spi-max-frequency = <1000000>; -- }; -- -- spidev1: spi@1 { -- compatible = "ge,achc"; -- reg = <1>; -- spi-max-frequency = <1000000>; -+ spidev0: spi@1 { -+ compatible = "ge,achc", "nxp,kinetis-k20"; -+ reg = <1>, <0>; -+ vdd-supply = <®_3v3>; -+ vdda-supply = <®_3v3>; -+ clocks = <&achc_24M>; -+ reset-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>; - }; - - gpioxra0: gpio@2 { -diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi -index 8b79b4112ee1a..2b075e287610f 100644 ---- a/arch/arm/boot/dts/qcom-apq8064.dtsi -+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi -@@ -1261,9 +1261,9 @@ - <&mmcc DSI1_BYTE_CLK>, - <&mmcc DSI_PIXEL_CLK>, - <&mmcc DSI1_ESC_CLK>; -- clock-names = "iface_clk", "bus_clk", "core_mmss_clk", -- "src_clk", "byte_clk", "pixel_clk", -- "core_clk"; -+ clock-names = "iface", "bus", "core_mmss", -+ "src", "byte", "pixel", -+ "core"; - - assigned-clocks = <&mmcc DSI1_BYTE_SRC>, - <&mmcc DSI1_ESC_SRC>, -diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi -index 20137fc578b1b..394a6b4dc69d5 100644 ---- a/arch/arm/boot/dts/tegra20-tamonten.dtsi -+++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi -@@ -185,8 +185,9 @@ - nvidia,pins = "ata", "atb", "atc", "atd", "ate", - "cdev1", "cdev2", "dap1", "dtb", "gma", - "gmb", "gmc", "gmd", "gme", "gpu7", -- "gpv", "i2cp", "pta", "rm", "slxa", -- "slxk", "spia", "spib", "uac"; -+ "gpv", "i2cp", "irrx", "irtx", "pta", -+ "rm", "slxa", "slxk", "spia", "spib", -+ "uac"; - nvidia,pull = ; - nvidia,tristate = ; - }; -@@ -211,7 +212,7 @@ - conf_ddc { - nvidia,pins = "ddc", "dta", "dtd", "kbca", - "kbcb", "kbcc", "kbcd", "kbce", "kbcf", -- "sdc"; -+ "sdc", "uad", "uca"; - nvidia,pull = ; - nvidia,tristate = ; - }; -@@ -221,10 +222,9 @@ - "lvp0", "owc", "sdb"; - nvidia,tristate = ; - }; -- conf_irrx { -- nvidia,pins = "irrx", "irtx", "sdd", "spic", -- "spie", "spih", "uaa", "uab", "uad", -- "uca", "ucb"; -+ conf_sdd { -+ nvidia,pins = "sdd", "spic", "spie", "spih", -+ "uaa", "uab", "ucb"; - nvidia,pull = ; - nvidia,tristate = ; - }; -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts -index 3595be0f25277..2d6c73d7d397c 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-frwy.dts -@@ -83,15 +83,9 @@ - }; - - eeprom@52 { -- compatible = "atmel,24c512"; -+ compatible = "onnn,cat24c04", "atmel,24c04"; - reg = <0x52>; - }; -- -- eeprom@53 { -- compatible = "atmel,24c512"; -- reg = <0x53>; -- }; -- - }; - }; - }; -diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -index 2743397591141..8858c1e92f23c 100644 ---- a/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -+++ b/arch/arm64/boot/dts/freescale/fsl-ls1046a-rdb.dts -@@ -58,14 +58,9 @@ - }; - - eeprom@52 { -- compatible = "atmel,24c512"; -+ compatible = "onnn,cat24c05", "atmel,24c04"; - reg = <0x52>; - }; -- -- eeprom@53 { -- compatible = "atmel,24c512"; -- reg = <0x53>; -- }; - }; - - &i2c3 { -diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi -index 631a7f77c3869..0b3eb8c0b8df0 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi -@@ -1082,13 +1082,13 @@ - - cpu@0 { - device_type = "cpu"; -- compatible = "nvidia,denver"; -+ compatible = "nvidia,tegra132-denver"; - reg = <0>; - }; - - cpu@1 { - device_type = "cpu"; -- compatible = "nvidia,denver"; -+ compatible = "nvidia,tegra132-denver"; - reg = <1>; - }; - }; -diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -index 0821754f0fd6d..90adff8aa9baf 100644 ---- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi -+++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi -@@ -1434,7 +1434,7 @@ - }; - - pcie_ep@14160000 { -- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; -+ compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; - reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */ - 0x00 0x36040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ -@@ -1466,7 +1466,7 @@ - }; - - pcie_ep@14180000 { -- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; -+ compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; - reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */ - 0x00 0x38040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ -@@ -1498,7 +1498,7 @@ - }; - - pcie_ep@141a0000 { -- compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; -+ compatible = "nvidia,tegra194-pcie-ep"; - power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; - reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */ - 0x00 0x3a040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ -diff --git a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts -index 70be3f95209bc..830d9f2c1e5f2 100644 ---- a/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts -+++ b/arch/arm64/boot/dts/qcom/ipq8074-hk01.dts -@@ -20,7 +20,7 @@ - stdout-path = "serial0"; - }; - -- memory { -+ memory@40000000 { - device_type = "memory"; - reg = <0x0 0x40000000 0x0 0x20000000>; - }; -diff --git a/arch/arm64/include/asm/kernel-pgtable.h b/arch/arm64/include/asm/kernel-pgtable.h -index 817efd95d539f..9679b74a20817 100644 ---- a/arch/arm64/include/asm/kernel-pgtable.h -+++ b/arch/arm64/include/asm/kernel-pgtable.h -@@ -65,8 +65,8 @@ - #define EARLY_KASLR (0) - #endif - --#define EARLY_ENTRIES(vstart, vend, shift) (((vend) >> (shift)) \ -- - ((vstart) >> (shift)) + 1 + EARLY_KASLR) -+#define EARLY_ENTRIES(vstart, vend, shift) \ -+ ((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR) - - #define EARLY_PGDS(vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT)) - -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index 04b982a2799eb..e62c9cbf99f46 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -498,7 +498,7 @@ size_t sve_state_size(struct task_struct const *task) - void sve_alloc(struct task_struct *task) - { - if (task->thread.sve_state) { -- memset(task->thread.sve_state, 0, sve_state_size(current)); -+ memset(task->thread.sve_state, 0, sve_state_size(task)); - return; - } - -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index a2e0b37549433..2f784d3b4b390 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -194,7 +194,7 @@ ENDPROC(preserve_boot_args) - * to be composed of multiple pages. (This effectively scales the end index). - * - * vstart: virtual address of start of range -- * vend: virtual address of end of range -+ * vend: virtual address of end of range - we map [vstart, vend] - * shift: shift used to transform virtual address into index - * ptrs: number of entries in page table - * istart: index in table corresponding to vstart -@@ -231,17 +231,18 @@ ENDPROC(preserve_boot_args) - * - * tbl: location of page table - * rtbl: address to be used for first level page table entry (typically tbl + PAGE_SIZE) -- * vstart: start address to map -- * vend: end address to map - we map [vstart, vend] -+ * vstart: virtual address of start of range -+ * vend: virtual address of end of range - we map [vstart, vend - 1] - * flags: flags to use to map last level entries - * phys: physical address corresponding to vstart - physical memory is contiguous - * pgds: the number of pgd entries - * - * Temporaries: istart, iend, tmp, count, sv - these need to be different registers -- * Preserves: vstart, vend, flags -- * Corrupts: tbl, rtbl, istart, iend, tmp, count, sv -+ * Preserves: vstart, flags -+ * Corrupts: tbl, rtbl, vend, istart, iend, tmp, count, sv - */ - .macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv -+ sub \vend, \vend, #1 - add \rtbl, \tbl, #PAGE_SIZE - mov \sv, \rtbl - mov \count, #0 -diff --git a/arch/m68k/Kconfig.bus b/arch/m68k/Kconfig.bus -index 9d0a3a23d50e5..355c51309ed85 100644 ---- a/arch/m68k/Kconfig.bus -+++ b/arch/m68k/Kconfig.bus -@@ -63,7 +63,7 @@ source "drivers/zorro/Kconfig" - - endif - --if !MMU -+if COLDFIRE - - config ISA_DMA_API - def_bool !M5272 -diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c -index 98a063093b69a..0be28adff5572 100644 ---- a/arch/mips/mti-malta/malta-dtshim.c -+++ b/arch/mips/mti-malta/malta-dtshim.c -@@ -22,7 +22,7 @@ - #define ROCIT_CONFIG_GEN1_MEMMAP_SHIFT 8 - #define ROCIT_CONFIG_GEN1_MEMMAP_MASK (0xf << 8) - --static unsigned char fdt_buf[16 << 10] __initdata; -+static unsigned char fdt_buf[16 << 10] __initdata __aligned(8); - - /* determined physical memory size, not overridden by command line args */ - extern unsigned long physical_memsize; -diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S -index c6481cfc5220f..6b27cf4a0d786 100644 ---- a/arch/openrisc/kernel/entry.S -+++ b/arch/openrisc/kernel/entry.S -@@ -547,6 +547,7 @@ EXCEPTION_ENTRY(_external_irq_handler) - l.bnf 1f // ext irq enabled, all ok. - l.nop - -+#ifdef CONFIG_PRINTK - l.addi r1,r1,-0x8 - l.movhi r3,hi(42f) - l.ori r3,r3,lo(42f) -@@ -560,6 +561,7 @@ EXCEPTION_ENTRY(_external_irq_handler) - .string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r" - .align 4 - .previous -+#endif - - l.ori r4,r4,SPR_SR_IEE // fix the bug - // l.sw PT_SR(r1),r4 -diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c -index 02895a8f2c551..92223f9ff05c7 100644 ---- a/arch/parisc/kernel/signal.c -+++ b/arch/parisc/kernel/signal.c -@@ -238,6 +238,12 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs, - #endif - - usp = (regs->gr[30] & ~(0x01UL)); -+#ifdef CONFIG_64BIT -+ if (is_compat_task()) { -+ /* The gcc alloca implementation leaves garbage in the upper 32 bits of sp */ -+ usp = (compat_uint_t)usp; -+ } -+#endif - /*FIXME: frame_size parameter is unused, remove it. */ - frame = get_sigframe(&ksig->ka, usp, sizeof(*frame)); - -diff --git a/arch/powerpc/configs/mpc885_ads_defconfig b/arch/powerpc/configs/mpc885_ads_defconfig -index 285d506c5a769..2f5e06309f096 100644 ---- a/arch/powerpc/configs/mpc885_ads_defconfig -+++ b/arch/powerpc/configs/mpc885_ads_defconfig -@@ -39,6 +39,7 @@ CONFIG_MTD_CFI_GEOMETRY=y - # CONFIG_MTD_CFI_I2 is not set - CONFIG_MTD_CFI_I4=y - CONFIG_MTD_CFI_AMDSTD=y -+CONFIG_MTD_PHYSMAP=y - CONFIG_MTD_PHYSMAP_OF=y - # CONFIG_BLK_DEV is not set - CONFIG_NETDEVICES=y -diff --git a/arch/powerpc/include/asm/pmc.h b/arch/powerpc/include/asm/pmc.h -index c6bbe9778d3cd..3c09109e708ef 100644 ---- a/arch/powerpc/include/asm/pmc.h -+++ b/arch/powerpc/include/asm/pmc.h -@@ -34,6 +34,13 @@ static inline void ppc_set_pmu_inuse(int inuse) - #endif - } - -+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE -+static inline int ppc_get_pmu_inuse(void) -+{ -+ return get_paca()->pmcregs_in_use; -+} -+#endif -+ - extern void power4_enable_pmcs(void); - - #else /* CONFIG_PPC64 */ -diff --git a/arch/powerpc/kernel/stacktrace.c b/arch/powerpc/kernel/stacktrace.c -index b13c6213b0d9b..890f95151fb44 100644 ---- a/arch/powerpc/kernel/stacktrace.c -+++ b/arch/powerpc/kernel/stacktrace.c -@@ -8,6 +8,7 @@ - * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp. - */ - -+#include - #include - #include - #include -diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c -index ab6eeb8e753e5..35fd67b4ceb41 100644 ---- a/arch/powerpc/kvm/book3s_64_vio_hv.c -+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c -@@ -177,10 +177,13 @@ static void kvmppc_rm_tce_put(struct kvmppc_spapr_tce_table *stt, - idx -= stt->offset; - page = stt->pages[idx / TCES_PER_PAGE]; - /* -- * page must not be NULL in real mode, -- * kvmppc_rm_ioba_validate() must have taken care of this. -+ * kvmppc_rm_ioba_validate() allows pages not be allocated if TCE is -+ * being cleared, otherwise it returns H_TOO_HARD and we skip this. - */ -- WARN_ON_ONCE_RM(!page); -+ if (!page) { -+ WARN_ON_ONCE_RM(tce != 0); -+ return; -+ } - tbl = kvmppc_page_address(page); - - tbl[idx % TCES_PER_PAGE] = tce; -diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c -index bba358f134718..6c99ccc3bfcb0 100644 ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -58,6 +58,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -3559,6 +3560,18 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, - cpu_has_feature(CPU_FTR_P9_TM_HV_ASSIST)) - kvmppc_restore_tm_hv(vcpu, vcpu->arch.shregs.msr, true); - -+#ifdef CONFIG_PPC_PSERIES -+ if (kvmhv_on_pseries()) { -+ barrier(); -+ if (vcpu->arch.vpa.pinned_addr) { -+ struct lppaca *lp = vcpu->arch.vpa.pinned_addr; -+ get_lppaca()->pmcregs_in_use = lp->pmcregs_in_use; -+ } else { -+ get_lppaca()->pmcregs_in_use = 1; -+ } -+ barrier(); -+ } -+#endif - kvmhv_load_guest_pmu(vcpu); - - msr_check_and_set(MSR_FP | MSR_VEC | MSR_VSX); -@@ -3693,6 +3706,13 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, - save_pmu |= nesting_enabled(vcpu->kvm); - - kvmhv_save_guest_pmu(vcpu, save_pmu); -+#ifdef CONFIG_PPC_PSERIES -+ if (kvmhv_on_pseries()) { -+ barrier(); -+ get_lppaca()->pmcregs_in_use = ppc_get_pmu_inuse(); -+ barrier(); -+ } -+#endif - - vc->entry_exit_map = 0x101; - vc->in_guest = 0; -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index c6fbbd29bd871..feaf6ca2e76c1 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -3137,7 +3137,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_P9_TM_HV_ASSIST) - /* The following code handles the fake_suspend = 1 case */ - mflr r0 - std r0, PPC_LR_STKOFF(r1) -- stdu r1, -PPC_MIN_STKFRM(r1) -+ stdu r1, -TM_FRAME_SIZE(r1) - - /* Turn on TM. */ - mfmsr r8 -@@ -3152,10 +3152,42 @@ BEGIN_FTR_SECTION - END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_SO_BUG) - nop - -+ /* -+ * It's possible that treclaim. may modify registers, if we have lost -+ * track of fake-suspend state in the guest due to it using rfscv. -+ * Save and restore registers in case this occurs. -+ */ -+ mfspr r3, SPRN_DSCR -+ mfspr r4, SPRN_XER -+ mfspr r5, SPRN_AMR -+ /* SPRN_TAR would need to be saved here if the kernel ever used it */ -+ mfcr r12 -+ SAVE_NVGPRS(r1) -+ SAVE_GPR(2, r1) -+ SAVE_GPR(3, r1) -+ SAVE_GPR(4, r1) -+ SAVE_GPR(5, r1) -+ stw r12, 8(r1) -+ std r1, HSTATE_HOST_R1(r13) -+ - /* We have to treclaim here because that's the only way to do S->N */ - li r3, TM_CAUSE_KVM_RESCHED - TRECLAIM(R3) - -+ GET_PACA(r13) -+ ld r1, HSTATE_HOST_R1(r13) -+ REST_GPR(2, r1) -+ REST_GPR(3, r1) -+ REST_GPR(4, r1) -+ REST_GPR(5, r1) -+ lwz r12, 8(r1) -+ REST_NVGPRS(r1) -+ mtspr SPRN_DSCR, r3 -+ mtspr SPRN_XER, r4 -+ mtspr SPRN_AMR, r5 -+ mtcr r12 -+ HMT_MEDIUM -+ - /* - * We were in fake suspend, so we are not going to save the - * register state as the guest checkpointed state (since -@@ -3183,7 +3215,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_P9_TM_XER_SO_BUG) - std r5, VCPU_TFHAR(r9) - std r6, VCPU_TFIAR(r9) - -- addi r1, r1, PPC_MIN_STKFRM -+ addi r1, r1, TM_FRAME_SIZE - ld r0, PPC_LR_STKOFF(r1) - mtlr r0 - blr -diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c -index 6884d16ec19b9..732cfc53e260d 100644 ---- a/arch/powerpc/perf/hv-gpci.c -+++ b/arch/powerpc/perf/hv-gpci.c -@@ -164,7 +164,7 @@ static unsigned long single_gpci_request(u32 req, u32 starting_index, - */ - count = 0; - for (i = offset; i < offset + length; i++) -- count |= arg->bytes[i] << (i - offset); -+ count |= (u64)(arg->bytes[i]) << ((length - 1 - (i - offset)) * 8); - - *value = count; - out: -diff --git a/arch/s390/include/asm/setup.h b/arch/s390/include/asm/setup.h -index 1932088686a68..e6a5007f017d8 100644 ---- a/arch/s390/include/asm/setup.h -+++ b/arch/s390/include/asm/setup.h -@@ -39,6 +39,7 @@ - #define MACHINE_FLAG_NX BIT(15) - #define MACHINE_FLAG_GS BIT(16) - #define MACHINE_FLAG_SCC BIT(17) -+#define MACHINE_FLAG_PCI_MIO BIT(18) - - #define LPP_MAGIC BIT(31) - #define LPP_PID_MASK _AC(0xffffffff, UL) -@@ -106,6 +107,7 @@ extern unsigned long __swsusp_reset_dma; - #define MACHINE_HAS_NX (S390_lowcore.machine_flags & MACHINE_FLAG_NX) - #define MACHINE_HAS_GS (S390_lowcore.machine_flags & MACHINE_FLAG_GS) - #define MACHINE_HAS_SCC (S390_lowcore.machine_flags & MACHINE_FLAG_SCC) -+#define MACHINE_HAS_PCI_MIO (S390_lowcore.machine_flags & MACHINE_FLAG_PCI_MIO) - - /* - * Console mode. Override with conmode= -diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c -index 2531776cf6cf9..eb89cb0aa60b4 100644 ---- a/arch/s390/kernel/early.c -+++ b/arch/s390/kernel/early.c -@@ -252,6 +252,10 @@ static __init void detect_machine_facilities(void) - clock_comparator_max = -1ULL >> 1; - __ctl_set_bit(0, 53); - } -+ if (IS_ENABLED(CONFIG_PCI) && test_facility(153)) { -+ S390_lowcore.machine_flags |= MACHINE_FLAG_PCI_MIO; -+ /* the control bit is set during PCI initialization */ -+ } - } - - static inline void save_vector_registers(void) -diff --git a/arch/s390/kernel/jump_label.c b/arch/s390/kernel/jump_label.c -index ab584e8e35275..9156653b56f69 100644 ---- a/arch/s390/kernel/jump_label.c -+++ b/arch/s390/kernel/jump_label.c -@@ -36,7 +36,7 @@ static void jump_label_bug(struct jump_entry *entry, struct insn *expected, - unsigned char *ipe = (unsigned char *)expected; - unsigned char *ipn = (unsigned char *)new; - -- pr_emerg("Jump label code mismatch at %pS [%p]\n", ipc, ipc); -+ pr_emerg("Jump label code mismatch at %pS [%px]\n", ipc, ipc); - pr_emerg("Found: %6ph\n", ipc); - pr_emerg("Expected: %6ph\n", ipe); - pr_emerg("New: %6ph\n", ipn); -diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c -index c1d96e588152b..5521f593cd20a 100644 ---- a/arch/s390/mm/init.c -+++ b/arch/s390/mm/init.c -@@ -168,9 +168,9 @@ static void pv_init(void) - return; - - /* make sure bounce buffers are shared */ -+ swiotlb_force = SWIOTLB_FORCE; - swiotlb_init(1); - swiotlb_update_mem_attributes(); -- swiotlb_force = SWIOTLB_FORCE; - } - - void __init mem_init(void) -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 3e6612d8b921c..2d29966276296 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -569,10 +569,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT4(0xb9080000, dst_reg, src_reg); - break; - case BPF_ALU | BPF_ADD | BPF_K: /* dst = (u32) dst + (u32) imm */ -- if (!imm) -- break; -- /* alfi %dst,imm */ -- EMIT6_IMM(0xc20b0000, dst_reg, imm); -+ if (imm != 0) { -+ /* alfi %dst,imm */ -+ EMIT6_IMM(0xc20b0000, dst_reg, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_ADD | BPF_K: /* dst = dst + imm */ -@@ -594,17 +594,22 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT4(0xb9090000, dst_reg, src_reg); - break; - case BPF_ALU | BPF_SUB | BPF_K: /* dst = (u32) dst - (u32) imm */ -- if (!imm) -- break; -- /* alfi %dst,-imm */ -- EMIT6_IMM(0xc20b0000, dst_reg, -imm); -+ if (imm != 0) { -+ /* alfi %dst,-imm */ -+ EMIT6_IMM(0xc20b0000, dst_reg, -imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_SUB | BPF_K: /* dst = dst - imm */ - if (!imm) - break; -- /* agfi %dst,-imm */ -- EMIT6_IMM(0xc2080000, dst_reg, -imm); -+ if (imm == -0x80000000) { -+ /* algfi %dst,0x80000000 */ -+ EMIT6_IMM(0xc20a0000, dst_reg, 0x80000000); -+ } else { -+ /* agfi %dst,-imm */ -+ EMIT6_IMM(0xc2080000, dst_reg, -imm); -+ } - break; - /* - * BPF_MUL -@@ -619,10 +624,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT4(0xb90c0000, dst_reg, src_reg); - break; - case BPF_ALU | BPF_MUL | BPF_K: /* dst = (u32) dst * (u32) imm */ -- if (imm == 1) -- break; -- /* msfi %r5,imm */ -- EMIT6_IMM(0xc2010000, dst_reg, imm); -+ if (imm != 1) { -+ /* msfi %r5,imm */ -+ EMIT6_IMM(0xc2010000, dst_reg, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_MUL | BPF_K: /* dst = dst * imm */ -@@ -675,6 +680,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - if (BPF_OP(insn->code) == BPF_MOD) - /* lhgi %dst,0 */ - EMIT4_IMM(0xa7090000, dst_reg, 0); -+ else -+ EMIT_ZERO(dst_reg); - break; - } - /* lhi %w0,0 */ -@@ -769,10 +776,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT4(0xb9820000, dst_reg, src_reg); - break; - case BPF_ALU | BPF_XOR | BPF_K: /* dst = (u32) dst ^ (u32) imm */ -- if (!imm) -- break; -- /* xilf %dst,imm */ -- EMIT6_IMM(0xc0070000, dst_reg, imm); -+ if (imm != 0) { -+ /* xilf %dst,imm */ -+ EMIT6_IMM(0xc0070000, dst_reg, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_XOR | BPF_K: /* dst = dst ^ imm */ -@@ -793,10 +800,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT6_DISP_LH(0xeb000000, 0x000d, dst_reg, dst_reg, src_reg, 0); - break; - case BPF_ALU | BPF_LSH | BPF_K: /* dst = (u32) dst << (u32) imm */ -- if (imm == 0) -- break; -- /* sll %dst,imm(%r0) */ -- EMIT4_DISP(0x89000000, dst_reg, REG_0, imm); -+ if (imm != 0) { -+ /* sll %dst,imm(%r0) */ -+ EMIT4_DISP(0x89000000, dst_reg, REG_0, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_LSH | BPF_K: /* dst = dst << imm */ -@@ -818,10 +825,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT6_DISP_LH(0xeb000000, 0x000c, dst_reg, dst_reg, src_reg, 0); - break; - case BPF_ALU | BPF_RSH | BPF_K: /* dst = (u32) dst >> (u32) imm */ -- if (imm == 0) -- break; -- /* srl %dst,imm(%r0) */ -- EMIT4_DISP(0x88000000, dst_reg, REG_0, imm); -+ if (imm != 0) { -+ /* srl %dst,imm(%r0) */ -+ EMIT4_DISP(0x88000000, dst_reg, REG_0, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_RSH | BPF_K: /* dst = dst >> imm */ -@@ -843,10 +850,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, - EMIT6_DISP_LH(0xeb000000, 0x000a, dst_reg, dst_reg, src_reg, 0); - break; - case BPF_ALU | BPF_ARSH | BPF_K: /* ((s32) dst >> imm */ -- if (imm == 0) -- break; -- /* sra %dst,imm(%r0) */ -- EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm); -+ if (imm != 0) { -+ /* sra %dst,imm(%r0) */ -+ EMIT4_DISP(0x8a000000, dst_reg, REG_0, imm); -+ } - EMIT_ZERO(dst_reg); - break; - case BPF_ALU64 | BPF_ARSH | BPF_K: /* ((s64) dst) >>= imm */ -diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c -index 6105b1b6e49b7..b8ddacf1efe11 100644 ---- a/arch/s390/pci/pci.c -+++ b/arch/s390/pci/pci.c -@@ -854,7 +854,6 @@ static void zpci_mem_exit(void) - } - - static unsigned int s390_pci_probe __initdata = 1; --static unsigned int s390_pci_no_mio __initdata; - unsigned int s390_pci_force_floating __initdata; - static unsigned int s390_pci_initialized; - -@@ -865,7 +864,7 @@ char * __init pcibios_setup(char *str) - return NULL; - } - if (!strcmp(str, "nomio")) { -- s390_pci_no_mio = 1; -+ S390_lowcore.machine_flags &= ~MACHINE_FLAG_PCI_MIO; - return NULL; - } - if (!strcmp(str, "force_floating")) { -@@ -890,7 +889,7 @@ static int __init pci_base_init(void) - if (!test_facility(69) || !test_facility(71)) - return 0; - -- if (test_facility(153) && !s390_pci_no_mio) { -+ if (MACHINE_HAS_PCI_MIO) { - static_branch_enable(&have_mio); - ctl_set_bit(2, 5); - } -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index b8541d77452c1..a37ccafe065ba 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -1355,18 +1355,18 @@ int kern_addr_valid(unsigned long addr) - return 0; - - p4d = p4d_offset(pgd, addr); -- if (p4d_none(*p4d)) -+ if (!p4d_present(*p4d)) - return 0; - - pud = pud_offset(p4d, addr); -- if (pud_none(*pud)) -+ if (!pud_present(*pud)) - return 0; - - if (pud_large(*pud)) - return pfn_valid(pud_pfn(*pud)); - - pmd = pmd_offset(pud, addr); -- if (pmd_none(*pmd)) -+ if (!pmd_present(*pmd)) - return 0; - - if (pmd_large(*pmd)) -diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c -index 3e66feff524a8..b99074ca5e686 100644 ---- a/arch/x86/xen/enlighten_pv.c -+++ b/arch/x86/xen/enlighten_pv.c -@@ -1183,6 +1183,11 @@ static void __init xen_dom0_set_legacy_features(void) - x86_platform.legacy.rtc = 1; - } - -+static void __init xen_domu_set_legacy_features(void) -+{ -+ x86_platform.legacy.rtc = 0; -+} -+ - /* First C function to be called on Xen boot */ - asmlinkage __visible void __init xen_start_kernel(void) - { -@@ -1353,6 +1358,8 @@ asmlinkage __visible void __init xen_start_kernel(void) - add_preferred_console("xenboot", 0, NULL); - if (pci_xen) - x86_init.pci.arch_init = pci_xen_init; -+ x86_platform.set_legacy_features = -+ xen_domu_set_legacy_features; - } else { - const struct dom0_vga_console_info *info = - (void *)((char *)xen_start_info + -diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c -index 12fcb3858303a..8b1e40ec58f65 100644 ---- a/arch/x86/xen/p2m.c -+++ b/arch/x86/xen/p2m.c -@@ -622,8 +622,8 @@ int xen_alloc_p2m_entry(unsigned long pfn) - } - - /* Expanded the p2m? */ -- if (pfn > xen_p2m_last_pfn) { -- xen_p2m_last_pfn = pfn; -+ if (pfn >= xen_p2m_last_pfn) { -+ xen_p2m_last_pfn = ALIGN(pfn + 1, P2M_PER_PAGE); - HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn; - } - -diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c -index af81a62faba64..e7faea3d73d3b 100644 ---- a/arch/xtensa/platforms/iss/console.c -+++ b/arch/xtensa/platforms/iss/console.c -@@ -168,9 +168,13 @@ static const struct tty_operations serial_ops = { - - int __init rs_init(void) - { -- tty_port_init(&serial_port); -+ int ret; - - serial_driver = alloc_tty_driver(SERIAL_MAX_NUM_LINES); -+ if (!serial_driver) -+ return -ENOMEM; -+ -+ tty_port_init(&serial_port); - - pr_info("%s %s\n", serial_name, serial_version); - -@@ -190,8 +194,15 @@ int __init rs_init(void) - tty_set_operations(serial_driver, &serial_ops); - tty_port_link_device(&serial_port, serial_driver, 0); - -- if (tty_register_driver(serial_driver)) -- panic("Couldn't register serial driver\n"); -+ ret = tty_register_driver(serial_driver); -+ if (ret) { -+ pr_err("Couldn't register serial driver\n"); -+ tty_driver_kref_put(serial_driver); -+ tty_port_destroy(&serial_port); -+ -+ return ret; -+ } -+ - return 0; - } - -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index 136232a01f715..8dee243e639f0 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -2523,6 +2523,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) - * are likely to increase the throughput. - */ - bfqq->new_bfqq = new_bfqq; -+ /* -+ * The above assignment schedules the following redirections: -+ * each time some I/O for bfqq arrives, the process that -+ * generated that I/O is disassociated from bfqq and -+ * associated with new_bfqq. Here we increases new_bfqq->ref -+ * in advance, adding the number of processes that are -+ * expected to be associated with new_bfqq as they happen to -+ * issue I/O. -+ */ - new_bfqq->ref += process_refs; - return new_bfqq; - } -@@ -2582,6 +2591,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, - { - struct bfq_queue *in_service_bfqq, *new_bfqq; - -+ /* if a merge has already been setup, then proceed with that first */ -+ if (bfqq->new_bfqq) -+ return bfqq->new_bfqq; -+ - /* - * Do not perform queue merging if the device is non - * rotational and performs internal queueing. In fact, such a -@@ -2636,9 +2649,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, - if (bfq_too_late_for_merging(bfqq)) - return NULL; - -- if (bfqq->new_bfqq) -- return bfqq->new_bfqq; -- - if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) - return NULL; - -@@ -5004,7 +5014,7 @@ bfq_set_next_ioprio_data(struct bfq_queue *bfqq, struct bfq_io_cq *bic) - if (bfqq->new_ioprio >= IOPRIO_BE_NR) { - pr_crit("bfq_set_next_ioprio_data: new_ioprio %d\n", - bfqq->new_ioprio); -- bfqq->new_ioprio = IOPRIO_BE_NR; -+ bfqq->new_ioprio = IOPRIO_BE_NR - 1; - } - - bfqq->entity.new_weight = bfq_ioprio_to_weight(bfqq->new_ioprio); -diff --git a/block/blk-zoned.c b/block/blk-zoned.c -index b17c094cb977c..a85d0a06a6ff2 100644 ---- a/block/blk-zoned.c -+++ b/block/blk-zoned.c -@@ -316,9 +316,6 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode, - if (!blk_queue_is_zoned(q)) - return -ENOTTY; - -- if (!capable(CAP_SYS_ADMIN)) -- return -EACCES; -- - if (copy_from_user(&rep, argp, sizeof(struct blk_zone_report))) - return -EFAULT; - -@@ -374,9 +371,6 @@ int blkdev_reset_zones_ioctl(struct block_device *bdev, fmode_t mode, - if (!blk_queue_is_zoned(q)) - return -ENOTTY; - -- if (!capable(CAP_SYS_ADMIN)) -- return -EACCES; -- - if (!(mode & FMODE_WRITE)) - return -EBADF; - -diff --git a/block/bsg.c b/block/bsg.c -index 0d012efef5274..c8b9714e69232 100644 ---- a/block/bsg.c -+++ b/block/bsg.c -@@ -371,10 +371,13 @@ static long bsg_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - case SG_GET_RESERVED_SIZE: - case SG_SET_RESERVED_SIZE: - case SG_EMULATED_HOST: -- case SCSI_IOCTL_SEND_COMMAND: - return scsi_cmd_ioctl(bd->queue, NULL, file->f_mode, cmd, uarg); - case SG_IO: - return bsg_sg_io(bd->queue, file->f_mode, uarg); -+ case SCSI_IOCTL_SEND_COMMAND: -+ pr_warn_ratelimited("%s: calling unsupported SCSI_IOCTL_SEND_COMMAND\n", -+ current->comm); -+ return -EINVAL; - default: - return -ENOTTY; - } -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 7788af0ca1090..5c354c7aff946 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4556,6 +4556,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, -+ { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | -+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, -+ { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | -+ ATA_HORKAGE_ZERO_AFTER_TRIM, }, - { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, - -diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c -index 9dcef6ac643b9..982fe91125322 100644 ---- a/drivers/ata/sata_dwc_460ex.c -+++ b/drivers/ata/sata_dwc_460ex.c -@@ -1249,24 +1249,20 @@ static int sata_dwc_probe(struct platform_device *ofdev) - irq = irq_of_parse_and_map(np, 0); - if (irq == NO_IRQ) { - dev_err(&ofdev->dev, "no SATA DMA irq\n"); -- err = -ENODEV; -- goto error_out; -+ return -ENODEV; - } - - #ifdef CONFIG_SATA_DWC_OLD_DMA - if (!of_find_property(np, "dmas", NULL)) { - err = sata_dwc_dma_init_old(ofdev, hsdev); - if (err) -- goto error_out; -+ return err; - } - #endif - - hsdev->phy = devm_phy_optional_get(hsdev->dev, "sata-phy"); -- if (IS_ERR(hsdev->phy)) { -- err = PTR_ERR(hsdev->phy); -- hsdev->phy = NULL; -- goto error_out; -- } -+ if (IS_ERR(hsdev->phy)) -+ return PTR_ERR(hsdev->phy); - - err = phy_init(hsdev->phy); - if (err) -diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c -index 977d27bd1a220..9a9dec657c166 100644 ---- a/drivers/base/power/trace.c -+++ b/drivers/base/power/trace.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - - #include - -@@ -165,6 +166,9 @@ void generate_pm_trace(const void *tracedata, unsigned int user) - const char *file = *(const char **)(tracedata + 2); - unsigned int user_hash_value, file_hash_value; - -+ if (!x86_platform.legacy.rtc) -+ return; -+ - user_hash_value = user % USERHASH; - file_hash_value = hash_string(lineno, file, FILEHASH); - set_magic_time(user_hash_value, file_hash_value, dev_hash_value); -@@ -267,6 +271,9 @@ static struct notifier_block pm_trace_nb = { - - static int early_resume_init(void) - { -+ if (!x86_platform.legacy.rtc) -+ return 0; -+ - hash_value_early_read = read_magic_time(); - register_pm_notifier(&pm_trace_nb); - return 0; -@@ -277,6 +284,9 @@ static int late_resume_init(void) - unsigned int val = hash_value_early_read; - unsigned int user, file, dev; - -+ if (!x86_platform.legacy.rtc) -+ return 0; -+ - user = val % USERHASH; - val = val / USERHASH; - file = val % FILEHASH; -diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c -index 44a46dcc0518b..d7fe1303f79dc 100644 ---- a/drivers/clk/at91/clk-generated.c -+++ b/drivers/clk/at91/clk-generated.c -@@ -18,8 +18,6 @@ - - #define GENERATED_MAX_DIV 255 - --#define GCK_INDEX_DT_AUDIO_PLL 5 -- - struct clk_generated { - struct clk_hw hw; - struct regmap *regmap; -@@ -29,7 +27,7 @@ struct clk_generated { - u32 gckdiv; - const struct clk_pcr_layout *layout; - u8 parent_id; -- bool audio_pll_allowed; -+ int chg_pid; - }; - - #define to_clk_generated(hw) \ -@@ -109,7 +107,7 @@ static void clk_generated_best_diff(struct clk_rate_request *req, - tmp_rate = parent_rate / div; - tmp_diff = abs(req->rate - tmp_rate); - -- if (*best_diff < 0 || *best_diff > tmp_diff) { -+ if (*best_diff < 0 || *best_diff >= tmp_diff) { - *best_rate = tmp_rate; - *best_diff = tmp_diff; - req->best_parent_rate = parent_rate; -@@ -129,7 +127,16 @@ static int clk_generated_determine_rate(struct clk_hw *hw, - int i; - u32 div; - -- for (i = 0; i < clk_hw_get_num_parents(hw) - 1; i++) { -+ /* do not look for a rate that is outside of our range */ -+ if (gck->range.max && req->rate > gck->range.max) -+ req->rate = gck->range.max; -+ if (gck->range.min && req->rate < gck->range.min) -+ req->rate = gck->range.min; -+ -+ for (i = 0; i < clk_hw_get_num_parents(hw); i++) { -+ if (gck->chg_pid == i) -+ continue; -+ - parent = clk_hw_get_parent_by_index(hw, i); - if (!parent) - continue; -@@ -161,10 +168,10 @@ static int clk_generated_determine_rate(struct clk_hw *hw, - * that the only clks able to modify gck rate are those of audio IPs. - */ - -- if (!gck->audio_pll_allowed) -+ if (gck->chg_pid < 0) - goto end; - -- parent = clk_hw_get_parent_by_index(hw, GCK_INDEX_DT_AUDIO_PLL); -+ parent = clk_hw_get_parent_by_index(hw, gck->chg_pid); - if (!parent) - goto end; - -@@ -271,8 +278,8 @@ struct clk_hw * __init - at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, - const struct clk_pcr_layout *layout, - const char *name, const char **parent_names, -- u8 num_parents, u8 id, bool pll_audio, -- const struct clk_range *range) -+ u8 num_parents, u8 id, -+ const struct clk_range *range, int chg_pid) - { - struct clk_generated *gck; - struct clk_init_data init; -@@ -287,15 +294,16 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, - init.ops = &generated_ops; - init.parent_names = parent_names; - init.num_parents = num_parents; -- init.flags = CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE | -- CLK_SET_RATE_PARENT; -+ init.flags = CLK_SET_RATE_GATE | CLK_SET_PARENT_GATE; -+ if (chg_pid >= 0) -+ init.flags |= CLK_SET_RATE_PARENT; - - gck->id = id; - gck->hw.init = &init; - gck->regmap = regmap; - gck->lock = lock; - gck->range = *range; -- gck->audio_pll_allowed = pll_audio; -+ gck->chg_pid = chg_pid; - gck->layout = layout; - - clk_generated_startup(gck); -diff --git a/drivers/clk/at91/dt-compat.c b/drivers/clk/at91/dt-compat.c -index aa1754eac59ff..8a652c44c25ab 100644 ---- a/drivers/clk/at91/dt-compat.c -+++ b/drivers/clk/at91/dt-compat.c -@@ -22,6 +22,8 @@ - - #define SYSTEM_MAX_ID 31 - -+#define GCK_INDEX_DT_AUDIO_PLL 5 -+ - #ifdef CONFIG_HAVE_AT91_AUDIO_PLL - static void __init of_sama5d2_clk_audio_pll_frac_setup(struct device_node *np) - { -@@ -135,7 +137,7 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) - return; - - for_each_child_of_node(np, gcknp) { -- bool pll_audio = false; -+ int chg_pid = INT_MIN; - - if (of_property_read_u32(gcknp, "reg", &id)) - continue; -@@ -152,12 +154,12 @@ static void __init of_sama5d2_clk_generated_setup(struct device_node *np) - if (of_device_is_compatible(np, "atmel,sama5d2-clk-generated") && - (id == GCK_ID_I2S0 || id == GCK_ID_I2S1 || - id == GCK_ID_CLASSD)) -- pll_audio = true; -+ chg_pid = GCK_INDEX_DT_AUDIO_PLL; - - hw = at91_clk_register_generated(regmap, &pmc_pcr_lock, - &dt_pcr_layout, name, - parent_names, num_parents, -- id, pll_audio, &range); -+ id, &range, chg_pid); - if (IS_ERR(hw)) - continue; - -diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h -index 9b8db9cdcda53..8a88ad2360742 100644 ---- a/drivers/clk/at91/pmc.h -+++ b/drivers/clk/at91/pmc.h -@@ -118,8 +118,8 @@ struct clk_hw * __init - at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock, - const struct clk_pcr_layout *layout, - const char *name, const char **parent_names, -- u8 num_parents, u8 id, bool pll_audio, -- const struct clk_range *range); -+ u8 num_parents, u8 id, -+ const struct clk_range *range, int chg_pid); - - struct clk_hw * __init - at91_clk_register_h32mx(struct regmap *regmap, const char *name, -diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c -index e3f4c8f20223a..39923899478f9 100644 ---- a/drivers/clk/at91/sam9x60.c -+++ b/drivers/clk/at91/sam9x60.c -@@ -124,7 +124,6 @@ static const struct { - char *n; - u8 id; - struct clk_range r; -- bool pll; - } sam9x60_gck[] = { - { .n = "flex0_gclk", .id = 5, }, - { .n = "flex1_gclk", .id = 6, }, -@@ -144,11 +143,9 @@ static const struct { - { .n = "sdmmc1_gclk", .id = 26, .r = { .min = 0, .max = 105000000 }, }, - { .n = "flex11_gclk", .id = 32, }, - { .n = "flex12_gclk", .id = 33, }, -- { .n = "i2s_gclk", .id = 34, .r = { .min = 0, .max = 105000000 }, -- .pll = true, }, -+ { .n = "i2s_gclk", .id = 34, .r = { .min = 0, .max = 105000000 }, }, - { .n = "pit64b_gclk", .id = 37, }, -- { .n = "classd_gclk", .id = 42, .r = { .min = 0, .max = 100000000 }, -- .pll = true, }, -+ { .n = "classd_gclk", .id = 42, .r = { .min = 0, .max = 100000000 }, }, - { .n = "tcb1_gclk", .id = 45, }, - { .n = "dbgu_gclk", .id = 47, }, - }; -@@ -285,8 +282,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np) - sam9x60_gck[i].n, - parent_names, 6, - sam9x60_gck[i].id, -- sam9x60_gck[i].pll, -- &sam9x60_gck[i].r); -+ &sam9x60_gck[i].r, INT_MIN); - if (IS_ERR(hw)) - goto err_free; - -diff --git a/drivers/clk/at91/sama5d2.c b/drivers/clk/at91/sama5d2.c -index ff7e3f727082e..d3c4bceb032d1 100644 ---- a/drivers/clk/at91/sama5d2.c -+++ b/drivers/clk/at91/sama5d2.c -@@ -115,21 +115,20 @@ static const struct { - char *n; - u8 id; - struct clk_range r; -- bool pll; -+ int chg_pid; - } sama5d2_gck[] = { -- { .n = "sdmmc0_gclk", .id = 31, }, -- { .n = "sdmmc1_gclk", .id = 32, }, -- { .n = "tcb0_gclk", .id = 35, .r = { .min = 0, .max = 83000000 }, }, -- { .n = "tcb1_gclk", .id = 36, .r = { .min = 0, .max = 83000000 }, }, -- { .n = "pwm_gclk", .id = 38, .r = { .min = 0, .max = 83000000 }, }, -- { .n = "isc_gclk", .id = 46, }, -- { .n = "pdmic_gclk", .id = 48, }, -- { .n = "i2s0_gclk", .id = 54, .pll = true }, -- { .n = "i2s1_gclk", .id = 55, .pll = true }, -- { .n = "can0_gclk", .id = 56, .r = { .min = 0, .max = 80000000 }, }, -- { .n = "can1_gclk", .id = 57, .r = { .min = 0, .max = 80000000 }, }, -- { .n = "classd_gclk", .id = 59, .r = { .min = 0, .max = 100000000 }, -- .pll = true }, -+ { .n = "sdmmc0_gclk", .id = 31, .chg_pid = INT_MIN, }, -+ { .n = "sdmmc1_gclk", .id = 32, .chg_pid = INT_MIN, }, -+ { .n = "tcb0_gclk", .id = 35, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, -+ { .n = "tcb1_gclk", .id = 36, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, -+ { .n = "pwm_gclk", .id = 38, .chg_pid = INT_MIN, .r = { .min = 0, .max = 83000000 }, }, -+ { .n = "isc_gclk", .id = 46, .chg_pid = INT_MIN, }, -+ { .n = "pdmic_gclk", .id = 48, .chg_pid = INT_MIN, }, -+ { .n = "i2s0_gclk", .id = 54, .chg_pid = 5, }, -+ { .n = "i2s1_gclk", .id = 55, .chg_pid = 5, }, -+ { .n = "can0_gclk", .id = 56, .chg_pid = INT_MIN, .r = { .min = 0, .max = 80000000 }, }, -+ { .n = "can1_gclk", .id = 57, .chg_pid = INT_MIN, .r = { .min = 0, .max = 80000000 }, }, -+ { .n = "classd_gclk", .id = 59, .chg_pid = 5, .r = { .min = 0, .max = 100000000 }, }, - }; - - static const struct clk_programmable_layout sama5d2_programmable_layout = { -@@ -317,8 +316,8 @@ static void __init sama5d2_pmc_setup(struct device_node *np) - sama5d2_gck[i].n, - parent_names, 6, - sama5d2_gck[i].id, -- sama5d2_gck[i].pll, -- &sama5d2_gck[i].r); -+ &sama5d2_gck[i].r, -+ sama5d2_gck[i].chg_pid); - if (IS_ERR(hw)) - goto err_free; - -diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c -index bc6ccf2c7aae0..c636c9ba01008 100644 ---- a/drivers/cpufreq/powernv-cpufreq.c -+++ b/drivers/cpufreq/powernv-cpufreq.c -@@ -36,6 +36,7 @@ - #define MAX_PSTATE_SHIFT 32 - #define LPSTATE_SHIFT 48 - #define GPSTATE_SHIFT 56 -+#define MAX_NR_CHIPS 32 - - #define MAX_RAMP_DOWN_TIME 5120 - /* -@@ -1050,12 +1051,20 @@ static int init_chip_info(void) - unsigned int *chip; - unsigned int cpu, i; - unsigned int prev_chip_id = UINT_MAX; -+ cpumask_t *chip_cpu_mask; - int ret = 0; - - chip = kcalloc(num_possible_cpus(), sizeof(*chip), GFP_KERNEL); - if (!chip) - return -ENOMEM; - -+ /* Allocate a chip cpu mask large enough to fit mask for all chips */ -+ chip_cpu_mask = kcalloc(MAX_NR_CHIPS, sizeof(cpumask_t), GFP_KERNEL); -+ if (!chip_cpu_mask) { -+ ret = -ENOMEM; -+ goto free_and_return; -+ } -+ - for_each_possible_cpu(cpu) { - unsigned int id = cpu_to_chip_id(cpu); - -@@ -1063,22 +1072,25 @@ static int init_chip_info(void) - prev_chip_id = id; - chip[nr_chips++] = id; - } -+ cpumask_set_cpu(cpu, &chip_cpu_mask[nr_chips-1]); - } - - chips = kcalloc(nr_chips, sizeof(struct chip), GFP_KERNEL); - if (!chips) { - ret = -ENOMEM; -- goto free_and_return; -+ goto out_free_chip_cpu_mask; - } - - for (i = 0; i < nr_chips; i++) { - chips[i].id = chip[i]; -- cpumask_copy(&chips[i].mask, cpumask_of_node(chip[i])); -+ cpumask_copy(&chips[i].mask, &chip_cpu_mask[i]); - INIT_WORK(&chips[i].throttle, powernv_cpufreq_work_fn); - for_each_cpu(cpu, &chips[i].mask) - per_cpu(chip_info, cpu) = &chips[i]; - } - -+out_free_chip_cpu_mask: -+ kfree(chip_cpu_mask); - free_and_return: - kfree(chip); - return ret; -diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c -index 66fa524b6261e..5471110792071 100644 ---- a/drivers/crypto/mxs-dcp.c -+++ b/drivers/crypto/mxs-dcp.c -@@ -298,21 +298,20 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - - struct scatterlist *dst = req->dst; - struct scatterlist *src = req->src; -- const int nents = sg_nents(req->src); -+ int dst_nents = sg_nents(dst); - - const int out_off = DCP_BUF_SZ; - uint8_t *in_buf = sdcp->coh->aes_in_buf; - uint8_t *out_buf = sdcp->coh->aes_out_buf; - -- uint8_t *out_tmp, *src_buf, *dst_buf = NULL; - uint32_t dst_off = 0; -+ uint8_t *src_buf = NULL; - uint32_t last_out_len = 0; - - uint8_t *key = sdcp->coh->aes_key; - - int ret = 0; -- int split = 0; -- unsigned int i, len, clen, rem = 0, tlen = 0; -+ unsigned int i, len, clen, tlen = 0; - int init = 0; - bool limit_hit = false; - -@@ -330,7 +329,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); - } - -- for_each_sg(req->src, src, nents, i) { -+ for_each_sg(req->src, src, sg_nents(src), i) { - src_buf = sg_virt(src); - len = sg_dma_len(src); - tlen += len; -@@ -355,34 +354,17 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) - * submit the buffer. - */ - if (actx->fill == out_off || sg_is_last(src) || -- limit_hit) { -+ limit_hit) { - ret = mxs_dcp_run_aes(actx, req, init); - if (ret) - return ret; - init = 0; - -- out_tmp = out_buf; -+ sg_pcopy_from_buffer(dst, dst_nents, out_buf, -+ actx->fill, dst_off); -+ dst_off += actx->fill; - last_out_len = actx->fill; -- while (dst && actx->fill) { -- if (!split) { -- dst_buf = sg_virt(dst); -- dst_off = 0; -- } -- rem = min(sg_dma_len(dst) - dst_off, -- actx->fill); -- -- memcpy(dst_buf + dst_off, out_tmp, rem); -- out_tmp += rem; -- dst_off += rem; -- actx->fill -= rem; -- -- if (dst_off == sg_dma_len(dst)) { -- dst = sg_next(dst); -- split = 0; -- } else { -- split = 1; -- } -- } -+ actx->fill = 0; - } - } while (len); - -diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c -index 67736c801f3ca..cc70da05db4b5 100644 ---- a/drivers/dma/imx-sdma.c -+++ b/drivers/dma/imx-sdma.c -@@ -377,7 +377,6 @@ struct sdma_channel { - unsigned long watermark_level; - u32 shp_addr, per_addr; - enum dma_status status; -- bool context_loaded; - struct imx_dma_data data; - struct work_struct terminate_worker; - }; -@@ -988,9 +987,6 @@ static int sdma_load_context(struct sdma_channel *sdmac) - int ret; - unsigned long flags; - -- if (sdmac->context_loaded) -- return 0; -- - if (sdmac->direction == DMA_DEV_TO_MEM) - load_address = sdmac->pc_from_device; - else if (sdmac->direction == DMA_DEV_TO_DEV) -@@ -1033,8 +1029,6 @@ static int sdma_load_context(struct sdma_channel *sdmac) - - spin_unlock_irqrestore(&sdma->channel_0_lock, flags); - -- sdmac->context_loaded = true; -- - return ret; - } - -@@ -1074,7 +1068,6 @@ static void sdma_channel_terminate_work(struct work_struct *work) - sdmac->desc = NULL; - spin_unlock_irqrestore(&sdmac->vc.lock, flags); - vchan_dma_desc_free_list(&sdmac->vc, &head); -- sdmac->context_loaded = false; - } - - static int sdma_disable_channel_async(struct dma_chan *chan) -@@ -1141,7 +1134,6 @@ static void sdma_set_watermarklevel_for_p2p(struct sdma_channel *sdmac) - static int sdma_config_channel(struct dma_chan *chan) - { - struct sdma_channel *sdmac = to_sdma_chan(chan); -- int ret; - - sdma_disable_channel(chan); - -@@ -1181,9 +1173,7 @@ static int sdma_config_channel(struct dma_chan *chan) - sdmac->watermark_level = 0; /* FIXME: M3_BASE_ADDRESS */ - } - -- ret = sdma_load_context(sdmac); -- -- return ret; -+ return 0; - } - - static int sdma_set_channel_priority(struct sdma_channel *sdmac, -@@ -1335,7 +1325,6 @@ static void sdma_free_chan_resources(struct dma_chan *chan) - - sdmac->event_id0 = 0; - sdmac->event_id1 = 0; -- sdmac->context_loaded = false; - - sdma_set_channel_priority(sdmac, 0); - -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -index d1e278e999eeb..1b2fa83798304 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h -@@ -762,7 +762,7 @@ enum amd_hw_ip_block_type { - MAX_HWIP - }; - --#define HWIP_MAX_INSTANCE 8 -+#define HWIP_MAX_INSTANCE 10 - - struct amd_powerplay { - void *pp_handle; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c -index 70dbe343f51df..89cecdba81ace 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c -@@ -339,7 +339,7 @@ static void amdgpu_i2c_put_byte(struct amdgpu_i2c_chan *i2c_bus, - void - amdgpu_i2c_router_select_ddc_port(const struct amdgpu_connector *amdgpu_connector) - { -- u8 val; -+ u8 val = 0; - - if (!amdgpu_connector->router.ddc_valid) - return; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -index 28361a9c5addc..532d1842f6a30 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -200,7 +200,7 @@ void amdgpu_bo_placement_from_domain(struct amdgpu_bo *abo, u32 domain) - c++; - } - -- BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS); -+ BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS); - - placement->num_placement = c; - placement->placement = places; -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -index 8a32b5c93778b..bd7ae3e130b6f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras_eeprom.c -@@ -138,7 +138,7 @@ int amdgpu_ras_eeprom_init(struct amdgpu_ras_eeprom_control *control) - return ret; - } - -- __decode_table_header_from_buff(hdr, &buff[2]); -+ __decode_table_header_from_buff(hdr, buff); - - if (hdr->header == EEPROM_TABLE_HDR_VAL) { - control->num_recs = (hdr->tbl_size - EEPROM_TABLE_HEADER_SIZE) / -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -index 88813dad731fa..c021519af8106 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c -@@ -98,36 +98,78 @@ void mqd_symmetrically_map_cu_mask(struct mqd_manager *mm, - uint32_t *se_mask) - { - struct kfd_cu_info cu_info; -- uint32_t cu_per_se[KFD_MAX_NUM_SE] = {0}; -- int i, se, sh, cu = 0; -- -+ uint32_t cu_per_sh[KFD_MAX_NUM_SE][KFD_MAX_NUM_SH_PER_SE] = {0}; -+ int i, se, sh, cu; - amdgpu_amdkfd_get_cu_info(mm->dev->kgd, &cu_info); - - if (cu_mask_count > cu_info.cu_active_number) - cu_mask_count = cu_info.cu_active_number; - -+ /* Exceeding these bounds corrupts the stack and indicates a coding error. -+ * Returning with no CU's enabled will hang the queue, which should be -+ * attention grabbing. -+ */ -+ if (cu_info.num_shader_engines > KFD_MAX_NUM_SE) { -+ pr_err("Exceeded KFD_MAX_NUM_SE, chip reports %d\n", cu_info.num_shader_engines); -+ return; -+ } -+ if (cu_info.num_shader_arrays_per_engine > KFD_MAX_NUM_SH_PER_SE) { -+ pr_err("Exceeded KFD_MAX_NUM_SH, chip reports %d\n", -+ cu_info.num_shader_arrays_per_engine * cu_info.num_shader_engines); -+ return; -+ } -+ /* Count active CUs per SH. -+ * -+ * Some CUs in an SH may be disabled. HW expects disabled CUs to be -+ * represented in the high bits of each SH's enable mask (the upper and lower -+ * 16 bits of se_mask) and will take care of the actual distribution of -+ * disabled CUs within each SH automatically. -+ * Each half of se_mask must be filled only on bits 0-cu_per_sh[se][sh]-1. -+ * -+ * See note on Arcturus cu_bitmap layout in gfx_v9_0_get_cu_info. -+ */ - for (se = 0; se < cu_info.num_shader_engines; se++) - for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) -- cu_per_se[se] += hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]); -- -- /* Symmetrically map cu_mask to all SEs: -- * cu_mask[0] bit0 -> se_mask[0] bit0; -- * cu_mask[0] bit1 -> se_mask[1] bit0; -- * ... (if # SE is 4) -- * cu_mask[0] bit4 -> se_mask[0] bit1; -+ cu_per_sh[se][sh] = hweight32(cu_info.cu_bitmap[se % 4][sh + (se / 4)]); -+ -+ /* Symmetrically map cu_mask to all SEs & SHs: -+ * se_mask programs up to 2 SH in the upper and lower 16 bits. -+ * -+ * Examples -+ * Assuming 1 SH/SE, 4 SEs: -+ * cu_mask[0] bit0 -> se_mask[0] bit0 -+ * cu_mask[0] bit1 -> se_mask[1] bit0 -+ * ... -+ * cu_mask[0] bit4 -> se_mask[0] bit1 -+ * ... -+ * -+ * Assuming 2 SH/SE, 4 SEs -+ * cu_mask[0] bit0 -> se_mask[0] bit0 (SE0,SH0,CU0) -+ * cu_mask[0] bit1 -> se_mask[1] bit0 (SE1,SH0,CU0) -+ * ... -+ * cu_mask[0] bit4 -> se_mask[0] bit16 (SE0,SH1,CU0) -+ * cu_mask[0] bit5 -> se_mask[1] bit16 (SE1,SH1,CU0) -+ * ... -+ * cu_mask[0] bit8 -> se_mask[0] bit1 (SE0,SH0,CU1) - * ... -+ * -+ * First ensure all CUs are disabled, then enable user specified CUs. - */ -- se = 0; -- for (i = 0; i < cu_mask_count; i++) { -- if (cu_mask[i / 32] & (1 << (i % 32))) -- se_mask[se] |= 1 << cu; -- -- do { -- se++; -- if (se == cu_info.num_shader_engines) { -- se = 0; -- cu++; -+ for (i = 0; i < cu_info.num_shader_engines; i++) -+ se_mask[i] = 0; -+ -+ i = 0; -+ for (cu = 0; cu < 16; cu++) { -+ for (sh = 0; sh < cu_info.num_shader_arrays_per_engine; sh++) { -+ for (se = 0; se < cu_info.num_shader_engines; se++) { -+ if (cu_per_sh[se][sh] > cu) { -+ if (cu_mask[i / 32] & (1 << (i % 32))) -+ se_mask[se] |= 1 << (cu + sh * 16); -+ i++; -+ if (i == cu_mask_count) -+ return; -+ } - } -- } while (cu >= cu_per_se[se] && cu < 32); -+ } - } - } -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h -index fbdb16418847c..4edc012e31387 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h -@@ -27,6 +27,7 @@ - #include "kfd_priv.h" - - #define KFD_MAX_NUM_SE 8 -+#define KFD_MAX_NUM_SH_PER_SE 2 - - /** - * struct mqd_manager -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -index f3dfb2887ae0b..2cdcefab2d7d4 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c -@@ -95,29 +95,29 @@ static ssize_t dp_link_settings_read(struct file *f, char __user *buf, - - rd_buf_ptr = rd_buf; - -- str_len = strlen("Current: %d %d %d "); -- snprintf(rd_buf_ptr, str_len, "Current: %d %d %d ", -+ str_len = strlen("Current: %d 0x%x %d "); -+ snprintf(rd_buf_ptr, str_len, "Current: %d 0x%x %d ", - link->cur_link_settings.lane_count, - link->cur_link_settings.link_rate, - link->cur_link_settings.link_spread); - rd_buf_ptr += str_len; - -- str_len = strlen("Verified: %d %d %d "); -- snprintf(rd_buf_ptr, str_len, "Verified: %d %d %d ", -+ str_len = strlen("Verified: %d 0x%x %d "); -+ snprintf(rd_buf_ptr, str_len, "Verified: %d 0x%x %d ", - link->verified_link_cap.lane_count, - link->verified_link_cap.link_rate, - link->verified_link_cap.link_spread); - rd_buf_ptr += str_len; - -- str_len = strlen("Reported: %d %d %d "); -- snprintf(rd_buf_ptr, str_len, "Reported: %d %d %d ", -+ str_len = strlen("Reported: %d 0x%x %d "); -+ snprintf(rd_buf_ptr, str_len, "Reported: %d 0x%x %d ", - link->reported_link_cap.lane_count, - link->reported_link_cap.link_rate, - link->reported_link_cap.link_spread); - rd_buf_ptr += str_len; - -- str_len = strlen("Preferred: %d %d %d "); -- snprintf(rd_buf_ptr, str_len, "Preferred: %d %d %d\n", -+ str_len = strlen("Preferred: %d 0x%x %d "); -+ snprintf(rd_buf_ptr, str_len, "Preferred: %d 0x%x %d\n", - link->preferred_link_setting.lane_count, - link->preferred_link_setting.link_rate, - link->preferred_link_setting.link_spread); -diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -index 60123db7ba02f..bc5ebea1abede 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c -@@ -3264,13 +3264,12 @@ static enum dc_status dcn10_set_clock(struct dc *dc, - struct dc_clock_config clock_cfg = {0}; - struct dc_clocks *current_clocks = &context->bw_ctx.bw.dcn.clk; - -- if (dc->clk_mgr && dc->clk_mgr->funcs->get_clock) -- dc->clk_mgr->funcs->get_clock(dc->clk_mgr, -- context, clock_type, &clock_cfg); -- -- if (!dc->clk_mgr->funcs->get_clock) -+ if (!dc->clk_mgr || !dc->clk_mgr->funcs->get_clock) - return DC_FAIL_UNSUPPORTED_1; - -+ dc->clk_mgr->funcs->get_clock(dc->clk_mgr, -+ context, clock_type, &clock_cfg); -+ - if (clk_khz > clock_cfg.max_clock_khz) - return DC_FAIL_CLK_EXCEED_MAX; - -@@ -3288,7 +3287,7 @@ static enum dc_status dcn10_set_clock(struct dc *dc, - else - return DC_ERROR_UNEXPECTED; - -- if (dc->clk_mgr && dc->clk_mgr->funcs->update_clocks) -+ if (dc->clk_mgr->funcs->update_clocks) - dc->clk_mgr->funcs->update_clocks(dc->clk_mgr, - context, true); - return DC_OK; -diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -index 2b1175bb2daee..d2ea4c003d442 100644 ---- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c -@@ -2232,7 +2232,7 @@ void dcn20_set_mcif_arb_params( - wb_arb_params->cli_watermark[k] = get_wm_writeback_urgent(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000; - wb_arb_params->pstate_watermark[k] = get_wm_writeback_dram_clock_change(&context->bw_ctx.dml, pipes, pipe_cnt) * 1000; - } -- wb_arb_params->time_per_pixel = 16.0 / context->res_ctx.pipe_ctx[i].stream->phy_pix_clk; /* 4 bit fraction, ms */ -+ wb_arb_params->time_per_pixel = 16.0 * 1000 / (context->res_ctx.pipe_ctx[i].stream->phy_pix_clk / 1000); /* 4 bit fraction, ms */ - wb_arb_params->slice_lines = 32; - wb_arb_params->arbitration_slice = 2; - wb_arb_params->max_scaled_time = dcn20_calc_max_scaled_time(wb_arb_params->time_per_pixel, -diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c -index 00debd02c3220..0ba92428ef560 100644 ---- a/drivers/gpu/drm/drm_debugfs.c -+++ b/drivers/gpu/drm/drm_debugfs.c -@@ -91,6 +91,7 @@ static int drm_clients_info(struct seq_file *m, void *data) - mutex_lock(&dev->filelist_mutex); - list_for_each_entry_reverse(priv, &dev->filelist, lhead) { - struct task_struct *task; -+ bool is_current_master = drm_is_current_master(priv); - - rcu_read_lock(); /* locks pid_task()->comm */ - task = pid_task(priv->pid, PIDTYPE_PID); -@@ -99,7 +100,7 @@ static int drm_clients_info(struct seq_file *m, void *data) - task ? task->comm : "", - pid_vnr(priv->pid), - priv->minor->index, -- drm_is_current_master(priv) ? 'y' : 'n', -+ is_current_master ? 'y' : 'n', - priv->authenticated ? 'y' : 'n', - from_kuid_munged(seq_user_ns(m), uid), - priv->magic); -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -index 0c9c40720ca9a..35225ff8792dd 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c -@@ -397,8 +397,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state, - if (switch_mmu_context) { - struct etnaviv_iommu_context *old_context = gpu->mmu_context; - -- etnaviv_iommu_context_get(mmu_context); -- gpu->mmu_context = mmu_context; -+ gpu->mmu_context = etnaviv_iommu_context_get(mmu_context); - etnaviv_iommu_context_put(old_context); - } - -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -index cb1faaac380a3..519948637186e 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c -@@ -304,8 +304,7 @@ struct etnaviv_vram_mapping *etnaviv_gem_mapping_get( - list_del(&mapping->obj_node); - } - -- etnaviv_iommu_context_get(mmu_context); -- mapping->context = mmu_context; -+ mapping->context = etnaviv_iommu_context_get(mmu_context); - mapping->use = 1; - - ret = etnaviv_iommu_map_gem(mmu_context, etnaviv_obj, -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -index 1ba83a90cdef6..7085b08b1db42 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c -@@ -534,8 +534,7 @@ int etnaviv_ioctl_gem_submit(struct drm_device *dev, void *data, - goto err_submit_objects; - - submit->ctx = file->driver_priv; -- etnaviv_iommu_context_get(submit->ctx->mmu); -- submit->mmu_context = submit->ctx->mmu; -+ submit->mmu_context = etnaviv_iommu_context_get(submit->ctx->mmu); - submit->exec_state = args->exec_state; - submit->flags = args->flags; - -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -index 85de8551ce866..db35736d47af2 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c -@@ -545,6 +545,12 @@ static int etnaviv_hw_reset(struct etnaviv_gpu *gpu) - /* We rely on the GPU running, so program the clock */ - etnaviv_gpu_update_clock(gpu); - -+ gpu->fe_running = false; -+ gpu->exec_state = -1; -+ if (gpu->mmu_context) -+ etnaviv_iommu_context_put(gpu->mmu_context); -+ gpu->mmu_context = NULL; -+ - return 0; - } - -@@ -607,19 +613,23 @@ void etnaviv_gpu_start_fe(struct etnaviv_gpu *gpu, u32 address, u16 prefetch) - VIVS_MMUv2_SEC_COMMAND_CONTROL_ENABLE | - VIVS_MMUv2_SEC_COMMAND_CONTROL_PREFETCH(prefetch)); - } -+ -+ gpu->fe_running = true; - } - --static void etnaviv_gpu_start_fe_idleloop(struct etnaviv_gpu *gpu) -+static void etnaviv_gpu_start_fe_idleloop(struct etnaviv_gpu *gpu, -+ struct etnaviv_iommu_context *context) - { -- u32 address = etnaviv_cmdbuf_get_va(&gpu->buffer, -- &gpu->mmu_context->cmdbuf_mapping); - u16 prefetch; -+ u32 address; - - /* setup the MMU */ -- etnaviv_iommu_restore(gpu, gpu->mmu_context); -+ etnaviv_iommu_restore(gpu, context); - - /* Start command processor */ - prefetch = etnaviv_buffer_init(gpu); -+ address = etnaviv_cmdbuf_get_va(&gpu->buffer, -+ &gpu->mmu_context->cmdbuf_mapping); - - etnaviv_gpu_start_fe(gpu, address, prefetch); - } -@@ -790,7 +800,6 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu) - /* Now program the hardware */ - mutex_lock(&gpu->lock); - etnaviv_gpu_hw_init(gpu); -- gpu->exec_state = -1; - mutex_unlock(&gpu->lock); - - pm_runtime_mark_last_busy(gpu->dev); -@@ -994,8 +1003,6 @@ void etnaviv_gpu_recover_hang(struct etnaviv_gpu *gpu) - spin_unlock(&gpu->event_spinlock); - - etnaviv_gpu_hw_init(gpu); -- gpu->exec_state = -1; -- gpu->mmu_context = NULL; - - mutex_unlock(&gpu->lock); - pm_runtime_mark_last_busy(gpu->dev); -@@ -1306,14 +1313,12 @@ struct dma_fence *etnaviv_gpu_submit(struct etnaviv_gem_submit *submit) - goto out_unlock; - } - -- if (!gpu->mmu_context) { -- etnaviv_iommu_context_get(submit->mmu_context); -- gpu->mmu_context = submit->mmu_context; -- etnaviv_gpu_start_fe_idleloop(gpu); -- } else { -- etnaviv_iommu_context_get(gpu->mmu_context); -- submit->prev_mmu_context = gpu->mmu_context; -- } -+ if (!gpu->fe_running) -+ etnaviv_gpu_start_fe_idleloop(gpu, submit->mmu_context); -+ -+ if (submit->prev_mmu_context) -+ etnaviv_iommu_context_put(submit->prev_mmu_context); -+ submit->prev_mmu_context = etnaviv_iommu_context_get(gpu->mmu_context); - - if (submit->nr_pmrs) { - gpu->event[event[1]].sync_point = &sync_point_perfmon_sample_pre; -@@ -1530,7 +1535,7 @@ int etnaviv_gpu_wait_idle(struct etnaviv_gpu *gpu, unsigned int timeout_ms) - - static int etnaviv_gpu_hw_suspend(struct etnaviv_gpu *gpu) - { -- if (gpu->initialized && gpu->mmu_context) { -+ if (gpu->initialized && gpu->fe_running) { - /* Replace the last WAIT with END */ - mutex_lock(&gpu->lock); - etnaviv_buffer_end(gpu); -@@ -1543,8 +1548,7 @@ static int etnaviv_gpu_hw_suspend(struct etnaviv_gpu *gpu) - */ - etnaviv_gpu_wait_idle(gpu, 100); - -- etnaviv_iommu_context_put(gpu->mmu_context); -- gpu->mmu_context = NULL; -+ gpu->fe_running = false; - } - - gpu->exec_state = -1; -@@ -1692,6 +1696,9 @@ static void etnaviv_gpu_unbind(struct device *dev, struct device *master, - etnaviv_gpu_hw_suspend(gpu); - #endif - -+ if (gpu->mmu_context) -+ etnaviv_iommu_context_put(gpu->mmu_context); -+ - if (gpu->initialized) { - etnaviv_cmdbuf_free(&gpu->buffer); - etnaviv_iommu_global_fini(gpu); -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h -index 8f9bd4edc96a5..02478c75f8968 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.h -+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.h -@@ -101,6 +101,7 @@ struct etnaviv_gpu { - struct workqueue_struct *wq; - struct drm_gpu_scheduler sched; - bool initialized; -+ bool fe_running; - - /* 'ring'-buffer: */ - struct etnaviv_cmdbuf buffer; -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c -index 1a7c89a67bea3..afe5dd6a9925b 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_iommu.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu.c -@@ -92,6 +92,10 @@ static void etnaviv_iommuv1_restore(struct etnaviv_gpu *gpu, - struct etnaviv_iommuv1_context *v1_context = to_v1_context(context); - u32 pgtable; - -+ if (gpu->mmu_context) -+ etnaviv_iommu_context_put(gpu->mmu_context); -+ gpu->mmu_context = etnaviv_iommu_context_get(context); -+ - /* set base addresses */ - gpu_write(gpu, VIVS_MC_MEMORY_BASE_ADDR_RA, context->global->memory_base); - gpu_write(gpu, VIVS_MC_MEMORY_BASE_ADDR_FE, context->global->memory_base); -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c -index f8bf488e9d717..d664ae29ae209 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_iommu_v2.c -@@ -172,6 +172,10 @@ static void etnaviv_iommuv2_restore_nonsec(struct etnaviv_gpu *gpu, - if (gpu_read(gpu, VIVS_MMUv2_CONTROL) & VIVS_MMUv2_CONTROL_ENABLE) - return; - -+ if (gpu->mmu_context) -+ etnaviv_iommu_context_put(gpu->mmu_context); -+ gpu->mmu_context = etnaviv_iommu_context_get(context); -+ - prefetch = etnaviv_buffer_config_mmuv2(gpu, - (u32)v2_context->mtlb_dma, - (u32)context->global->bad_page_dma); -@@ -192,6 +196,10 @@ static void etnaviv_iommuv2_restore_sec(struct etnaviv_gpu *gpu, - if (gpu_read(gpu, VIVS_MMUv2_SEC_CONTROL) & VIVS_MMUv2_SEC_CONTROL_ENABLE) - return; - -+ if (gpu->mmu_context) -+ etnaviv_iommu_context_put(gpu->mmu_context); -+ gpu->mmu_context = etnaviv_iommu_context_get(context); -+ - gpu_write(gpu, VIVS_MMUv2_PTA_ADDRESS_LOW, - lower_32_bits(context->global->v2.pta_dma)); - gpu_write(gpu, VIVS_MMUv2_PTA_ADDRESS_HIGH, -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c -index 3607d348c2980..707f5c1a58740 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c -+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c -@@ -204,6 +204,7 @@ static int etnaviv_iommu_find_iova(struct etnaviv_iommu_context *context, - */ - list_for_each_entry_safe(m, n, &list, scan_node) { - etnaviv_iommu_remove_mapping(context, m); -+ etnaviv_iommu_context_put(m->context); - m->context = NULL; - list_del_init(&m->mmu_node); - list_del_init(&m->scan_node); -diff --git a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h -index d1d6902fd13be..e4a0b7d09c2ea 100644 ---- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.h -+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.h -@@ -105,9 +105,11 @@ void etnaviv_iommu_dump(struct etnaviv_iommu_context *ctx, void *buf); - struct etnaviv_iommu_context * - etnaviv_iommu_context_init(struct etnaviv_iommu_global *global, - struct etnaviv_cmdbuf_suballoc *suballoc); --static inline void etnaviv_iommu_context_get(struct etnaviv_iommu_context *ctx) -+static inline struct etnaviv_iommu_context * -+etnaviv_iommu_context_get(struct etnaviv_iommu_context *ctx) - { - kref_get(&ctx->refcount); -+ return ctx; - } - void etnaviv_iommu_context_put(struct etnaviv_iommu_context *ctx); - void etnaviv_iommu_restore(struct etnaviv_gpu *gpu, -diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c -index 58b89ec11b0eb..a3c9d8b9e1a18 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_dma.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c -@@ -140,6 +140,8 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev, - EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE); - else if (IS_ENABLED(CONFIG_IOMMU_DMA)) - mapping = iommu_get_domain_for_dev(priv->dma_dev); -+ else -+ mapping = ERR_PTR(-ENODEV); - - if (IS_ERR(mapping)) - return PTR_ERR(mapping); -diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c -index 20194d86d0339..4f0c6d58e06fa 100644 ---- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c -+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c -@@ -108,13 +108,6 @@ static void mdp4_disable_commit(struct msm_kms *kms) - - static void mdp4_prepare_commit(struct msm_kms *kms, struct drm_atomic_state *state) - { -- int i; -- struct drm_crtc *crtc; -- struct drm_crtc_state *crtc_state; -- -- /* see 119ecb7fd */ -- for_each_new_crtc_in_state(state, crtc, crtc_state, i) -- drm_crtc_vblank_get(crtc); - } - - static void mdp4_flush_commit(struct msm_kms *kms, unsigned crtc_mask) -@@ -133,12 +126,6 @@ static void mdp4_wait_flush(struct msm_kms *kms, unsigned crtc_mask) - - static void mdp4_complete_commit(struct msm_kms *kms, unsigned crtc_mask) - { -- struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms)); -- struct drm_crtc *crtc; -- -- /* see 119ecb7fd */ -- for_each_crtc_mask(mdp4_kms->dev, crtc, crtc_mask) -- drm_crtc_vblank_put(crtc); - } - - static long mdp4_round_pixclk(struct msm_kms *kms, unsigned long rate, -@@ -418,6 +405,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) - { - struct platform_device *pdev = to_platform_device(dev->dev); - struct mdp4_platform_config *config = mdp4_get_config(pdev); -+ struct msm_drm_private *priv = dev->dev_private; - struct mdp4_kms *mdp4_kms; - struct msm_kms *kms = NULL; - struct msm_gem_address_space *aspace; -@@ -432,7 +420,8 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev) - - mdp_kms_init(&mdp4_kms->base, &kms_funcs); - -- kms = &mdp4_kms->base.base; -+ priv->kms = &mdp4_kms->base.base; -+ kms = priv->kms; - - mdp4_kms->dev = dev; - -diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c -index bfd503d220881..8a014dc115712 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_mmu.c -+++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c -@@ -52,25 +52,16 @@ static int write_cmd(struct panfrost_device *pfdev, u32 as_nr, u32 cmd) - } - - static void lock_region(struct panfrost_device *pfdev, u32 as_nr, -- u64 iova, size_t size) -+ u64 iova, u64 size) - { - u8 region_width; - u64 region = iova & PAGE_MASK; -- /* -- * fls returns: -- * 1 .. 32 -- * -- * 10 + fls(num_pages) -- * results in the range (11 .. 42) -- */ -- -- size = round_up(size, PAGE_SIZE); - -- region_width = 10 + fls(size >> PAGE_SHIFT); -- if ((size >> PAGE_SHIFT) != (1ul << (region_width - 11))) { -- /* not pow2, so must go up to the next pow2 */ -- region_width += 1; -- } -+ /* The size is encoded as ceil(log2) minus(1), which may be calculated -+ * with fls. The size must be clamped to hardware bounds. -+ */ -+ size = max_t(u64, size, AS_LOCK_REGION_MIN_SIZE); -+ region_width = fls64(size - 1) - 1; - region |= region_width; - - /* Lock the region that needs to be updated */ -@@ -81,7 +72,7 @@ static void lock_region(struct panfrost_device *pfdev, u32 as_nr, - - - static int mmu_hw_do_operation_locked(struct panfrost_device *pfdev, int as_nr, -- u64 iova, size_t size, u32 op) -+ u64 iova, u64 size, u32 op) - { - if (as_nr < 0) - return 0; -@@ -98,7 +89,7 @@ static int mmu_hw_do_operation_locked(struct panfrost_device *pfdev, int as_nr, - - static int mmu_hw_do_operation(struct panfrost_device *pfdev, - struct panfrost_mmu *mmu, -- u64 iova, size_t size, u32 op) -+ u64 iova, u64 size, u32 op) - { - int ret; - -@@ -115,7 +106,7 @@ static void panfrost_mmu_enable(struct panfrost_device *pfdev, struct panfrost_m - u64 transtab = cfg->arm_mali_lpae_cfg.transtab; - u64 memattr = cfg->arm_mali_lpae_cfg.memattr; - -- mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0UL, AS_COMMAND_FLUSH_MEM); -+ mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0ULL, AS_COMMAND_FLUSH_MEM); - - mmu_write(pfdev, AS_TRANSTAB_LO(as_nr), transtab & 0xffffffffUL); - mmu_write(pfdev, AS_TRANSTAB_HI(as_nr), transtab >> 32); -@@ -131,7 +122,7 @@ static void panfrost_mmu_enable(struct panfrost_device *pfdev, struct panfrost_m - - static void panfrost_mmu_disable(struct panfrost_device *pfdev, u32 as_nr) - { -- mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0UL, AS_COMMAND_FLUSH_MEM); -+ mmu_hw_do_operation_locked(pfdev, as_nr, 0, ~0ULL, AS_COMMAND_FLUSH_MEM); - - mmu_write(pfdev, AS_TRANSTAB_LO(as_nr), 0); - mmu_write(pfdev, AS_TRANSTAB_HI(as_nr), 0); -@@ -231,7 +222,7 @@ static size_t get_pgsize(u64 addr, size_t size) - - static void panfrost_mmu_flush_range(struct panfrost_device *pfdev, - struct panfrost_mmu *mmu, -- u64 iova, size_t size) -+ u64 iova, u64 size) - { - if (mmu->as < 0) - return; -diff --git a/drivers/gpu/drm/panfrost/panfrost_regs.h b/drivers/gpu/drm/panfrost/panfrost_regs.h -index eddaa62ad8b0e..2ae3a4d301d39 100644 ---- a/drivers/gpu/drm/panfrost/panfrost_regs.h -+++ b/drivers/gpu/drm/panfrost/panfrost_regs.h -@@ -318,6 +318,8 @@ - #define AS_FAULTSTATUS_ACCESS_TYPE_READ (0x2 << 8) - #define AS_FAULTSTATUS_ACCESS_TYPE_WRITE (0x3 << 8) - -+#define AS_LOCK_REGION_MIN_SIZE (1ULL << 15) -+ - #define gpu_write(dev, reg, data) writel(data, dev->iomem + reg) - #define gpu_read(dev, reg) readl(dev->iomem + reg) - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index 6d551ae251c0a..ea4c97f5b0736 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -415,8 +415,6 @@ static int hidinput_get_battery_property(struct power_supply *psy, - - if (dev->battery_status == HID_BATTERY_UNKNOWN) - val->intval = POWER_SUPPLY_STATUS_UNKNOWN; -- else if (dev->battery_capacity == 100) -- val->intval = POWER_SUPPLY_STATUS_FULL; - else - val->intval = POWER_SUPPLY_STATUS_DISCHARGING; - break; -diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c -index 6f7a3702b5fba..ac076ac73de5d 100644 ---- a/drivers/hid/i2c-hid/i2c-hid-core.c -+++ b/drivers/hid/i2c-hid/i2c-hid-core.c -@@ -178,8 +178,6 @@ static const struct i2c_hid_quirks { - I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, - { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_3118, - I2C_HID_QUIRK_NO_IRQ_AFTER_RESET }, -- { USB_VENDOR_ID_ELAN, HID_ANY_ID, -- I2C_HID_QUIRK_BOGUS_IRQ }, - { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, - I2C_HID_QUIRK_RESET_ON_RESUME }, - { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393, -@@ -190,7 +188,8 @@ static const struct i2c_hid_quirks { - * Sending the wakeup after reset actually break ELAN touchscreen controller - */ - { USB_VENDOR_ID_ELAN, HID_ANY_ID, -- I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET }, -+ I2C_HID_QUIRK_NO_WAKEUP_AFTER_RESET | -+ I2C_HID_QUIRK_BOGUS_IRQ }, - { 0, 0 } - }; - -diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c -index e6c022e1dc1cf..17cc8b3fc5d82 100644 ---- a/drivers/iio/dac/ad5624r_spi.c -+++ b/drivers/iio/dac/ad5624r_spi.c -@@ -229,7 +229,7 @@ static int ad5624r_probe(struct spi_device *spi) - if (!indio_dev) - return -ENOMEM; - st = iio_priv(indio_dev); -- st->reg = devm_regulator_get(&spi->dev, "vcc"); -+ st->reg = devm_regulator_get_optional(&spi->dev, "vref"); - if (!IS_ERR(st->reg)) { - ret = regulator_enable(st->reg); - if (ret) -@@ -240,6 +240,22 @@ static int ad5624r_probe(struct spi_device *spi) - goto error_disable_reg; - - voltage_uv = ret; -+ } else { -+ if (PTR_ERR(st->reg) != -ENODEV) -+ return PTR_ERR(st->reg); -+ /* Backwards compatibility. This naming is not correct */ -+ st->reg = devm_regulator_get_optional(&spi->dev, "vcc"); -+ if (!IS_ERR(st->reg)) { -+ ret = regulator_enable(st->reg); -+ if (ret) -+ return ret; -+ -+ ret = regulator_get_voltage(st->reg); -+ if (ret < 0) -+ goto error_disable_reg; -+ -+ voltage_uv = ret; -+ } - } - - spi_set_drvdata(spi, indio_dev); -diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c -index da8adadf47559..75b6da00065a3 100644 ---- a/drivers/infiniband/core/iwcm.c -+++ b/drivers/infiniband/core/iwcm.c -@@ -1187,29 +1187,34 @@ static int __init iw_cm_init(void) - - ret = iwpm_init(RDMA_NL_IWCM); - if (ret) -- pr_err("iw_cm: couldn't init iwpm\n"); -- else -- rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table); -+ return ret; -+ - iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0); - if (!iwcm_wq) -- return -ENOMEM; -+ goto err_alloc; - - iwcm_ctl_table_hdr = register_net_sysctl(&init_net, "net/iw_cm", - iwcm_ctl_table); - if (!iwcm_ctl_table_hdr) { - pr_err("iw_cm: couldn't register sysctl paths\n"); -- destroy_workqueue(iwcm_wq); -- return -ENOMEM; -+ goto err_sysctl; - } - -+ rdma_nl_register(RDMA_NL_IWCM, iwcm_nl_cb_table); - return 0; -+ -+err_sysctl: -+ destroy_workqueue(iwcm_wq); -+err_alloc: -+ iwpm_exit(RDMA_NL_IWCM); -+ return -ENOMEM; - } - - static void __exit iw_cm_cleanup(void) - { -+ rdma_nl_unregister(RDMA_NL_IWCM); - unregister_net_sysctl_table(iwcm_ctl_table_hdr); - destroy_workqueue(iwcm_wq); -- rdma_nl_unregister(RDMA_NL_IWCM); - iwpm_exit(RDMA_NL_IWCM); - } - -diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c -index 4edae89e8e3ca..17f1e59ab12ee 100644 ---- a/drivers/infiniband/hw/efa/efa_verbs.c -+++ b/drivers/infiniband/hw/efa/efa_verbs.c -@@ -745,7 +745,6 @@ struct ib_qp *efa_create_qp(struct ib_pd *ibpd, - rq_entry_inserted = true; - qp->qp_handle = create_qp_resp.qp_handle; - qp->ibqp.qp_num = create_qp_resp.qp_num; -- qp->ibqp.qp_type = init_attr->qp_type; - qp->max_send_wr = init_attr->cap.max_send_wr; - qp->max_recv_wr = init_attr->cap.max_recv_wr; - qp->max_send_sge = init_attr->cap.max_send_sge; -diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c -index fbff6b2f00e71..1256dbd5b2ef0 100644 ---- a/drivers/infiniband/hw/hfi1/init.c -+++ b/drivers/infiniband/hw/hfi1/init.c -@@ -664,12 +664,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd, - - ppd->pkeys[default_pkey_idx] = DEFAULT_P_KEY; - ppd->part_enforce |= HFI1_PART_ENFORCE_IN; -- -- if (loopback) { -- dd_dev_err(dd, "Faking data partition 0x8001 in idx %u\n", -- !default_pkey_idx); -- ppd->pkeys[!default_pkey_idx] = 0x8001; -- } -+ ppd->pkeys[0] = 0x8001; - - INIT_WORK(&ppd->link_vc_work, handle_verify_cap); - INIT_WORK(&ppd->link_up_work, handle_link_up); -diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c -index d85648b9c247a..571c04e70343a 100644 ---- a/drivers/md/dm-crypt.c -+++ b/drivers/md/dm-crypt.c -@@ -2092,7 +2092,12 @@ static void *crypt_page_alloc(gfp_t gfp_mask, void *pool_data) - struct crypt_config *cc = pool_data; - struct page *page; - -- if (unlikely(percpu_counter_compare(&cc->n_allocated_pages, dm_crypt_pages_per_client) >= 0) && -+ /* -+ * Note, percpu_counter_read_positive() may over (and under) estimate -+ * the current usage by at most (batch - 1) * num_online_cpus() pages, -+ * but avoids potential spinlock contention of an exact result. -+ */ -+ if (unlikely(percpu_counter_read_positive(&cc->n_allocated_pages) >= dm_crypt_pages_per_client) && - likely(gfp_mask & __GFP_NORETRY)) - return NULL; - -diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c -index 082796534b0ae..bb02354a48b81 100644 ---- a/drivers/media/dvb-frontends/dib8000.c -+++ b/drivers/media/dvb-frontends/dib8000.c -@@ -2107,32 +2107,55 @@ static void dib8000_load_ana_fe_coefs(struct dib8000_state *state, const s16 *an - dib8000_write_word(state, 117 + mode, ana_fe[mode]); - } - --static const u16 lut_prbs_2k[14] = { -- 0, 0x423, 0x009, 0x5C7, 0x7A6, 0x3D8, 0x527, 0x7FF, 0x79B, 0x3D6, 0x3A2, 0x53B, 0x2F4, 0x213 -+static const u16 lut_prbs_2k[13] = { -+ 0x423, 0x009, 0x5C7, -+ 0x7A6, 0x3D8, 0x527, -+ 0x7FF, 0x79B, 0x3D6, -+ 0x3A2, 0x53B, 0x2F4, -+ 0x213 - }; --static const u16 lut_prbs_4k[14] = { -- 0, 0x208, 0x0C3, 0x7B9, 0x423, 0x5C7, 0x3D8, 0x7FF, 0x3D6, 0x53B, 0x213, 0x029, 0x0D0, 0x48E -+ -+static const u16 lut_prbs_4k[13] = { -+ 0x208, 0x0C3, 0x7B9, -+ 0x423, 0x5C7, 0x3D8, -+ 0x7FF, 0x3D6, 0x53B, -+ 0x213, 0x029, 0x0D0, -+ 0x48E - }; --static const u16 lut_prbs_8k[14] = { -- 0, 0x740, 0x069, 0x7DD, 0x208, 0x7B9, 0x5C7, 0x7FF, 0x53B, 0x029, 0x48E, 0x4C4, 0x367, 0x684 -+ -+static const u16 lut_prbs_8k[13] = { -+ 0x740, 0x069, 0x7DD, -+ 0x208, 0x7B9, 0x5C7, -+ 0x7FF, 0x53B, 0x029, -+ 0x48E, 0x4C4, 0x367, -+ 0x684 - }; - - static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel) - { - int sub_channel_prbs_group = 0; -+ int prbs_group; - -- sub_channel_prbs_group = (subchannel / 3) + 1; -- dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]); -+ sub_channel_prbs_group = subchannel / 3; -+ if (sub_channel_prbs_group >= ARRAY_SIZE(lut_prbs_2k)) -+ return 0; - - switch (state->fe[0]->dtv_property_cache.transmission_mode) { - case TRANSMISSION_MODE_2K: -- return lut_prbs_2k[sub_channel_prbs_group]; -+ prbs_group = lut_prbs_2k[sub_channel_prbs_group]; -+ break; - case TRANSMISSION_MODE_4K: -- return lut_prbs_4k[sub_channel_prbs_group]; -+ prbs_group = lut_prbs_4k[sub_channel_prbs_group]; -+ break; - default: - case TRANSMISSION_MODE_8K: -- return lut_prbs_8k[sub_channel_prbs_group]; -+ prbs_group = lut_prbs_8k[sub_channel_prbs_group]; - } -+ -+ dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", -+ sub_channel_prbs_group, subchannel, prbs_group); -+ -+ return prbs_group; - } - - static void dib8000_set_13seg_channel(struct dib8000_state *state) -@@ -2409,10 +2432,8 @@ static void dib8000_set_isdbt_common_channel(struct dib8000_state *state, u8 seq - /* TSB or ISDBT ? apply it now */ - if (c->isdbt_sb_mode) { - dib8000_set_sb_channel(state); -- if (c->isdbt_sb_subchannel < 14) -- init_prbs = dib8000_get_init_prbs(state, c->isdbt_sb_subchannel); -- else -- init_prbs = 0; -+ init_prbs = dib8000_get_init_prbs(state, -+ c->isdbt_sb_subchannel); - } else { - dib8000_set_13seg_channel(state); - init_prbs = 0xfff; -@@ -3004,6 +3025,7 @@ static int dib8000_tune(struct dvb_frontend *fe) - - unsigned long *timeout = &state->timeout; - unsigned long now = jiffies; -+ u16 init_prbs; - #ifdef DIB8000_AGC_FREEZE - u16 agc1, agc2; - #endif -@@ -3302,8 +3324,10 @@ static int dib8000_tune(struct dvb_frontend *fe) - break; - - case CT_DEMOD_STEP_11: /* 41 : init prbs autosearch */ -- if (state->subchannel <= 41) { -- dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel)); -+ init_prbs = dib8000_get_init_prbs(state, state->subchannel); -+ -+ if (init_prbs) { -+ dib8000_set_subchannel_prbs(state, init_prbs); - *tune_state = CT_DEMOD_STEP_9; - } else { - *tune_state = CT_DEMOD_STOP; -diff --git a/drivers/media/i2c/imx258.c b/drivers/media/i2c/imx258.c -index f86ae18bc104b..ffaa4a91e5713 100644 ---- a/drivers/media/i2c/imx258.c -+++ b/drivers/media/i2c/imx258.c -@@ -22,7 +22,7 @@ - #define IMX258_CHIP_ID 0x0258 - - /* V_TIMING internal */ --#define IMX258_VTS_30FPS 0x0c98 -+#define IMX258_VTS_30FPS 0x0c50 - #define IMX258_VTS_30FPS_2K 0x0638 - #define IMX258_VTS_30FPS_VGA 0x034c - #define IMX258_VTS_MAX 0xffff -@@ -46,7 +46,7 @@ - /* Analog gain control */ - #define IMX258_REG_ANALOG_GAIN 0x0204 - #define IMX258_ANA_GAIN_MIN 0 --#define IMX258_ANA_GAIN_MAX 0x1fff -+#define IMX258_ANA_GAIN_MAX 480 - #define IMX258_ANA_GAIN_STEP 1 - #define IMX258_ANA_GAIN_DEFAULT 0x0 - -diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c -index 1088161498df0..18a2027ba1450 100644 ---- a/drivers/media/i2c/tda1997x.c -+++ b/drivers/media/i2c/tda1997x.c -@@ -1695,14 +1695,15 @@ static int tda1997x_query_dv_timings(struct v4l2_subdev *sd, - struct v4l2_dv_timings *timings) - { - struct tda1997x_state *state = to_state(sd); -+ int ret; - - v4l_dbg(1, debug, state->client, "%s\n", __func__); - memset(timings, 0, sizeof(struct v4l2_dv_timings)); - mutex_lock(&state->lock); -- tda1997x_detect_std(state, timings); -+ ret = tda1997x_detect_std(state, timings); - mutex_unlock(&state->lock); - -- return 0; -+ return ret; - } - - static const struct v4l2_subdev_video_ops tda1997x_video_ops = { -diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c -index a632602131f21..efb80a78d2fa2 100644 ---- a/drivers/media/platform/tegra-cec/tegra_cec.c -+++ b/drivers/media/platform/tegra-cec/tegra_cec.c -@@ -366,7 +366,11 @@ static int tegra_cec_probe(struct platform_device *pdev) - return -ENOENT; - } - -- clk_prepare_enable(cec->clk); -+ ret = clk_prepare_enable(cec->clk); -+ if (ret) { -+ dev_err(&pdev->dev, "Unable to prepare clock for CEC\n"); -+ return ret; -+ } - - /* set context info. */ - cec->dev = &pdev->dev; -@@ -446,9 +450,7 @@ static int tegra_cec_resume(struct platform_device *pdev) - - dev_notice(&pdev->dev, "Resuming\n"); - -- clk_prepare_enable(cec->clk); -- -- return 0; -+ return clk_prepare_enable(cec->clk); - } - #endif - -diff --git a/drivers/media/rc/rc-loopback.c b/drivers/media/rc/rc-loopback.c -index ef8b83b707df0..13ab7312fa3b5 100644 ---- a/drivers/media/rc/rc-loopback.c -+++ b/drivers/media/rc/rc-loopback.c -@@ -42,7 +42,7 @@ static int loop_set_tx_mask(struct rc_dev *dev, u32 mask) - - if ((mask & (RXMASK_REGULAR | RXMASK_LEARNING)) != mask) { - dprintk("invalid tx mask: %u\n", mask); -- return -EINVAL; -+ return 2; - } - - dprintk("setting tx mask: %u\n", mask); -diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c -index 7d60dd3b0bd85..db7f8f8ee2f9f 100644 ---- a/drivers/media/usb/uvc/uvc_v4l2.c -+++ b/drivers/media/usb/uvc/uvc_v4l2.c -@@ -894,8 +894,8 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) - { - struct uvc_fh *handle = fh; - struct uvc_video_chain *chain = handle->chain; -+ u8 *buf; - int ret; -- u8 i; - - if (chain->selector == NULL || - (chain->dev->quirks & UVC_QUIRK_IGNORE_SELECTOR_UNIT)) { -@@ -903,22 +903,27 @@ static int uvc_ioctl_g_input(struct file *file, void *fh, unsigned int *input) - return 0; - } - -+ buf = kmalloc(1, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ - ret = uvc_query_ctrl(chain->dev, UVC_GET_CUR, chain->selector->id, - chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, -- &i, 1); -- if (ret < 0) -- return ret; -+ buf, 1); -+ if (!ret) -+ *input = *buf - 1; - -- *input = i - 1; -- return 0; -+ kfree(buf); -+ -+ return ret; - } - - static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) - { - struct uvc_fh *handle = fh; - struct uvc_video_chain *chain = handle->chain; -+ u8 *buf; - int ret; -- u32 i; - - ret = uvc_acquire_privileges(handle); - if (ret < 0) -@@ -934,10 +939,17 @@ static int uvc_ioctl_s_input(struct file *file, void *fh, unsigned int input) - if (input >= chain->selector->bNrInPins) - return -EINVAL; - -- i = input + 1; -- return uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, -- chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, -- &i, 1); -+ buf = kmalloc(1, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ -+ *buf = input + 1; -+ ret = uvc_query_ctrl(chain->dev, UVC_SET_CUR, chain->selector->id, -+ chain->dev->intfnum, UVC_SU_INPUT_SELECT_CONTROL, -+ buf, 1); -+ kfree(buf); -+ -+ return ret; - } - - static int uvc_ioctl_queryctrl(struct file *file, void *fh, -diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c -index 4f23e939ead0b..60454e1b727e9 100644 ---- a/drivers/media/v4l2-core/v4l2-dv-timings.c -+++ b/drivers/media/v4l2-core/v4l2-dv-timings.c -@@ -196,7 +196,7 @@ bool v4l2_find_dv_timings_cap(struct v4l2_dv_timings *t, - if (!v4l2_valid_dv_timings(t, cap, fnc, fnc_handle)) - return false; - -- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) { -+ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) { - if (v4l2_valid_dv_timings(v4l2_dv_timings_presets + i, cap, - fnc, fnc_handle) && - v4l2_match_dv_timings(t, v4l2_dv_timings_presets + i, -@@ -218,7 +218,7 @@ bool v4l2_find_dv_timings_cea861_vic(struct v4l2_dv_timings *t, u8 vic) - { - unsigned int i; - -- for (i = 0; i < v4l2_dv_timings_presets[i].bt.width; i++) { -+ for (i = 0; v4l2_dv_timings_presets[i].bt.width; i++) { - const struct v4l2_bt_timings *bt = - &v4l2_dv_timings_presets[i].bt; - -diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c -index 3e9dc92cb467b..842de1f352dfc 100644 ---- a/drivers/mfd/ab8500-core.c -+++ b/drivers/mfd/ab8500-core.c -@@ -493,7 +493,7 @@ static int ab8500_handle_hierarchical_line(struct ab8500 *ab8500, - if (line == AB8540_INT_GPIO43F || line == AB8540_INT_GPIO44F) - line += 1; - -- handle_nested_irq(irq_create_mapping(ab8500->domain, line)); -+ handle_nested_irq(irq_find_mapping(ab8500->domain, line)); - } - - return 0; -diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c -index aa59496e43768..9db1000944c34 100644 ---- a/drivers/mfd/axp20x.c -+++ b/drivers/mfd/axp20x.c -@@ -125,12 +125,13 @@ static const struct regmap_range axp288_writeable_ranges[] = { - - static const struct regmap_range axp288_volatile_ranges[] = { - regmap_reg_range(AXP20X_PWR_INPUT_STATUS, AXP288_POWER_REASON), -+ regmap_reg_range(AXP22X_PWR_OUT_CTRL1, AXP22X_ALDO3_V_OUT), - regmap_reg_range(AXP288_BC_GLOBAL, AXP288_BC_GLOBAL), - regmap_reg_range(AXP288_BC_DET_STAT, AXP20X_VBUS_IPSOUT_MGMT), - regmap_reg_range(AXP20X_CHRG_BAK_CTRL, AXP20X_CHRG_BAK_CTRL), - regmap_reg_range(AXP20X_IRQ1_EN, AXP20X_IPSOUT_V_HIGH_L), - regmap_reg_range(AXP20X_TIMER_CTRL, AXP20X_TIMER_CTRL), -- regmap_reg_range(AXP22X_GPIO_STATE, AXP22X_GPIO_STATE), -+ regmap_reg_range(AXP20X_GPIO1_CTRL, AXP22X_GPIO_STATE), - regmap_reg_range(AXP288_RT_BATT_V_H, AXP288_RT_BATT_V_L), - regmap_reg_range(AXP20X_FG_RES, AXP288_FG_CC_CAP_REG), - }; -diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c -index dfac6afa82ca5..f1f2ad9ff0b34 100644 ---- a/drivers/mfd/db8500-prcmu.c -+++ b/drivers/mfd/db8500-prcmu.c -@@ -1695,22 +1695,20 @@ static long round_clock_rate(u8 clock, unsigned long rate) - } - - static const unsigned long db8500_armss_freqs[] = { -- 200000000, -- 400000000, -- 800000000, -+ 199680000, -+ 399360000, -+ 798720000, - 998400000 - }; - - /* The DB8520 has slightly higher ARMSS max frequency */ - static const unsigned long db8520_armss_freqs[] = { -- 200000000, -- 400000000, -- 800000000, -+ 199680000, -+ 399360000, -+ 798720000, - 1152000000 - }; - -- -- - static long round_armss_rate(unsigned long rate) - { - unsigned long freq = 0; -diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c -index 1aee3b3253fc9..508349399f8af 100644 ---- a/drivers/mfd/stmpe.c -+++ b/drivers/mfd/stmpe.c -@@ -1091,7 +1091,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) - - if (variant->id_val == STMPE801_ID || - variant->id_val == STMPE1600_ID) { -- int base = irq_create_mapping(stmpe->domain, 0); -+ int base = irq_find_mapping(stmpe->domain, 0); - - handle_nested_irq(base); - return IRQ_HANDLED; -@@ -1119,7 +1119,7 @@ static irqreturn_t stmpe_irq(int irq, void *data) - while (status) { - int bit = __ffs(status); - int line = bank * 8 + bit; -- int nestedirq = irq_create_mapping(stmpe->domain, line); -+ int nestedirq = irq_find_mapping(stmpe->domain, line); - - handle_nested_irq(nestedirq); - status &= ~(1 << bit); -diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c -index 67c9995bb1aa6..23cfbd050120d 100644 ---- a/drivers/mfd/tc3589x.c -+++ b/drivers/mfd/tc3589x.c -@@ -187,7 +187,7 @@ again: - - while (status) { - int bit = __ffs(status); -- int virq = irq_create_mapping(tc3589x->domain, bit); -+ int virq = irq_find_mapping(tc3589x->domain, bit); - - handle_nested_irq(virq); - status &= ~(1 << bit); -diff --git a/drivers/mfd/tqmx86.c b/drivers/mfd/tqmx86.c -index 22d2f02d855c2..ccc5a9ac788c1 100644 ---- a/drivers/mfd/tqmx86.c -+++ b/drivers/mfd/tqmx86.c -@@ -210,6 +210,8 @@ static int tqmx86_probe(struct platform_device *pdev) - - /* Assumes the IRQ resource is first. */ - tqmx_gpio_resources[0].start = gpio_irq; -+ } else { -+ tqmx_gpio_resources[0].flags = 0; - } - - ocores_platfom_data.clock_khz = tqmx86_board_id_to_clk_rate(board_id); -diff --git a/drivers/mfd/wm8994-irq.c b/drivers/mfd/wm8994-irq.c -index 6c3a619e26286..651a028bc519a 100644 ---- a/drivers/mfd/wm8994-irq.c -+++ b/drivers/mfd/wm8994-irq.c -@@ -154,7 +154,7 @@ static irqreturn_t wm8994_edge_irq(int irq, void *data) - struct wm8994 *wm8994 = data; - - while (gpio_get_value_cansleep(wm8994->pdata.irq_gpio)) -- handle_nested_irq(irq_create_mapping(wm8994->edge_irq, 0)); -+ handle_nested_irq(irq_find_mapping(wm8994->edge_irq, 0)); - - return IRQ_HANDLED; - } -diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c -index c2338750313c4..a49782dd903cd 100644 ---- a/drivers/misc/vmw_vmci/vmci_queue_pair.c -+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c -@@ -2238,7 +2238,8 @@ int vmci_qp_broker_map(struct vmci_handle handle, - - result = VMCI_SUCCESS; - -- if (context_id != VMCI_HOST_CONTEXT_ID) { -+ if (context_id != VMCI_HOST_CONTEXT_ID && -+ !QPBROKERSTATE_HAS_MEM(entry)) { - struct vmci_qp_page_store page_store; - - page_store.pages = guest_mem; -@@ -2345,7 +2346,8 @@ int vmci_qp_broker_unmap(struct vmci_handle handle, - goto out; - } - -- if (context_id != VMCI_HOST_CONTEXT_ID) { -+ if (context_id != VMCI_HOST_CONTEXT_ID && -+ QPBROKERSTATE_HAS_MEM(entry)) { - qp_acquire_queue_mutex(entry->produce_q); - result = qp_save_headers(entry); - if (result < VMCI_SUCCESS) -diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c -index 8322d22a59c45..e92f9373e2274 100644 ---- a/drivers/mmc/core/block.c -+++ b/drivers/mmc/core/block.c -@@ -591,6 +591,7 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - } - - mmc_wait_for_req(card->host, &mrq); -+ memcpy(&idata->ic.response, cmd.resp, sizeof(cmd.resp)); - - if (cmd.error) { - dev_err(mmc_dev(card->host), "%s: cmd error %d\n", -@@ -640,8 +641,6 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, - if (idata->ic.postsleep_min_us) - usleep_range(idata->ic.postsleep_min_us, idata->ic.postsleep_max_us); - -- memcpy(&(idata->ic.response), cmd.resp, sizeof(cmd.resp)); -- - if (idata->rpmb || (cmd.flags & MMC_RSP_R1B) == MMC_RSP_R1B) { - /* - * Ensure RPMB/R1B command has completed by polling CMD13 -diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c -index 11087976ab19c..9ff718b61c72e 100644 ---- a/drivers/mmc/host/rtsx_pci_sdmmc.c -+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c -@@ -539,9 +539,22 @@ static int sd_write_long_data(struct realtek_pci_sdmmc *host, - return 0; - } - -+static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host) -+{ -+ rtsx_pci_write_register(host->pcr, SD_CFG1, -+ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128); -+} -+ -+static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host) -+{ -+ rtsx_pci_write_register(host->pcr, SD_CFG1, -+ SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0); -+} -+ - static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) - { - struct mmc_data *data = mrq->data; -+ int err; - - if (host->sg_count < 0) { - data->error = host->sg_count; -@@ -550,22 +563,19 @@ static int sd_rw_multi(struct realtek_pci_sdmmc *host, struct mmc_request *mrq) - return data->error; - } - -- if (data->flags & MMC_DATA_READ) -- return sd_read_long_data(host, mrq); -+ if (data->flags & MMC_DATA_READ) { -+ if (host->initial_mode) -+ sd_disable_initial_mode(host); - -- return sd_write_long_data(host, mrq); --} -+ err = sd_read_long_data(host, mrq); - --static inline void sd_enable_initial_mode(struct realtek_pci_sdmmc *host) --{ -- rtsx_pci_write_register(host->pcr, SD_CFG1, -- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_128); --} -+ if (host->initial_mode) -+ sd_enable_initial_mode(host); - --static inline void sd_disable_initial_mode(struct realtek_pci_sdmmc *host) --{ -- rtsx_pci_write_register(host->pcr, SD_CFG1, -- SD_CLK_DIVIDE_MASK, SD_CLK_DIVIDE_0); -+ return err; -+ } -+ -+ return sd_write_long_data(host, mrq); - } - - static void sd_normal_rw(struct realtek_pci_sdmmc *host, -diff --git a/drivers/mmc/host/sdhci-of-arasan.c b/drivers/mmc/host/sdhci-of-arasan.c -index 7023cbec4017b..dd10f7abf5a71 100644 ---- a/drivers/mmc/host/sdhci-of-arasan.c -+++ b/drivers/mmc/host/sdhci-of-arasan.c -@@ -192,7 +192,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock) - * through low speeds without power cycling. - */ - sdhci_set_clock(host, host->max_clk); -- phy_power_on(sdhci_arasan->phy); -+ if (phy_power_on(sdhci_arasan->phy)) { -+ pr_err("%s: Cannot power on phy.\n", -+ mmc_hostname(host->mmc)); -+ return; -+ } -+ - sdhci_arasan->is_phy_on = true; - - /* -@@ -228,7 +233,12 @@ static void sdhci_arasan_set_clock(struct sdhci_host *host, unsigned int clock) - msleep(20); - - if (ctrl_phy) { -- phy_power_on(sdhci_arasan->phy); -+ if (phy_power_on(sdhci_arasan->phy)) { -+ pr_err("%s: Cannot power on phy.\n", -+ mmc_hostname(host->mmc)); -+ return; -+ } -+ - sdhci_arasan->is_phy_on = true; - } - } -@@ -416,7 +426,9 @@ static int sdhci_arasan_suspend(struct device *dev) - ret = phy_power_off(sdhci_arasan->phy); - if (ret) { - dev_err(dev, "Cannot power off phy.\n"); -- sdhci_resume_host(host); -+ if (sdhci_resume_host(host)) -+ dev_err(dev, "Cannot resume host.\n"); -+ - return ret; - } - sdhci_arasan->is_phy_on = false; -diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c -index 2d1c22dc88c15..cc5009200cc23 100644 ---- a/drivers/mtd/nand/raw/cafe_nand.c -+++ b/drivers/mtd/nand/raw/cafe_nand.c -@@ -757,7 +757,7 @@ static int cafe_nand_probe(struct pci_dev *pdev, - "CAFE NAND", mtd); - if (err) { - dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq); -- goto out_ior; -+ goto out_free_rs; - } - - /* Disable master reset, enable NAND clock */ -@@ -801,6 +801,8 @@ static int cafe_nand_probe(struct pci_dev *pdev, - /* Disable NAND IRQ in global IRQ mask register */ - cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); - free_irq(pdev->irq, mtd); -+ out_free_rs: -+ free_rs(cafe->rs); - out_ior: - pci_iounmap(pdev, cafe->mmio); - out_free_mtd: -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index e21643377162b..1949f631e1bc5 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -1926,7 +1926,6 @@ static int __bond_release_one(struct net_device *bond_dev, - /* recompute stats just before removing the slave */ - bond_get_stats(bond->dev, &bond->bond_stats); - -- bond_upper_dev_unlink(bond, slave); - /* unregister rx_handler early so bond_handle_frame wouldn't be called - * for this slave anymore. - */ -@@ -1935,6 +1934,8 @@ static int __bond_release_one(struct net_device *bond_dev, - if (BOND_MODE(bond) == BOND_MODE_8023AD) - bond_3ad_unbind_slave(slave); - -+ bond_upper_dev_unlink(bond, slave); -+ - if (bond_mode_can_use_xmit_hash(bond)) - bond_update_slave_arr(bond, slave); - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index e78b683f73052..825d840cdb8c3 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -2353,9 +2353,8 @@ static int b53_switch_init(struct b53_device *dev) - dev->cpu_port = 5; - } - -- /* cpu port is always last */ -- dev->num_ports = dev->cpu_port + 1; - dev->enabled_ports |= BIT(dev->cpu_port); -+ dev->num_ports = fls(dev->enabled_ports); - - /* Include non standard CPU port built-in PHYs to be probed */ - if (is539x(dev) || is531x5(dev)) { -diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c -index af3d56636a076..3225de0f655f2 100644 ---- a/drivers/net/dsa/lantiq_gswip.c -+++ b/drivers/net/dsa/lantiq_gswip.c -@@ -837,7 +837,8 @@ static int gswip_setup(struct dsa_switch *ds) - - gswip_switch_mask(priv, 0, GSWIP_MAC_CTRL_2_MLEN, - GSWIP_MAC_CTRL_2p(cpu_port)); -- gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8, GSWIP_MAC_FLEN); -+ gswip_switch_w(priv, VLAN_ETH_FRAME_LEN + 8 + ETH_FCS_LEN, -+ GSWIP_MAC_FLEN); - gswip_switch_mask(priv, 0, GSWIP_BM_QUEUE_GCTRL_GL_MOD, - GSWIP_BM_QUEUE_GCTRL); - -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -index cf39623b828b7..4630998d47fd4 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -@@ -1246,7 +1246,7 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, - - /* SR-IOV capability was enabled but there are no VFs*/ - if (iov->total == 0) { -- err = -EINVAL; -+ err = 0; - goto failed; - } - -diff --git a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c -index 0ccdde366ae17..540d99f59226e 100644 ---- a/drivers/net/ethernet/chelsio/cxgb/cxgb2.c -+++ b/drivers/net/ethernet/chelsio/cxgb/cxgb2.c -@@ -1153,6 +1153,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!adapter->registered_device_map) { - pr_err("%s: could not register any net devices\n", - pci_name(pdev)); -+ err = -EINVAL; - goto out_release_adapter_res; - } - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -index e64e175162068..db9c8f943811b 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c -@@ -56,6 +56,7 @@ MODULE_PARM_DESC(debug, " Network interface message level setting"); - #define HNS3_OUTER_VLAN_TAG 2 - - #define HNS3_MIN_TX_LEN 33U -+#define HNS3_MIN_TUN_PKT_LEN 65U - - /* hns3_pci_tbl - PCI Device ID Table - * -@@ -931,8 +932,11 @@ static int hns3_set_l2l3l4(struct sk_buff *skb, u8 ol4_proto, - l4.tcp->doff); - break; - case IPPROTO_UDP: -- if (hns3_tunnel_csum_bug(skb)) -- return skb_checksum_help(skb); -+ if (hns3_tunnel_csum_bug(skb)) { -+ int ret = skb_put_padto(skb, HNS3_MIN_TUN_PKT_LEN); -+ -+ return ret ? ret : skb_checksum_help(skb); -+ } - - hns3_set_field(*type_cs_vlan_tso, HNS3_TXD_L4CS_B, 1); - hns3_set_field(*type_cs_vlan_tso, HNS3_TXD_L4T_S, -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index aa402e2671212..f44e8401496b1 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -1328,9 +1328,10 @@ static void hclge_init_kdump_kernel_config(struct hclge_dev *hdev) - - static int hclge_configure(struct hclge_dev *hdev) - { -+ const struct cpumask *cpumask = cpu_online_mask; - struct hclge_cfg cfg; - unsigned int i; -- int ret; -+ int node, ret; - - ret = hclge_get_cfg(hdev, &cfg); - if (ret) { -@@ -1390,11 +1391,12 @@ static int hclge_configure(struct hclge_dev *hdev) - - hclge_init_kdump_kernel_config(hdev); - -- /* Set the init affinity based on pci func number */ -- i = cpumask_weight(cpumask_of_node(dev_to_node(&hdev->pdev->dev))); -- i = i ? PCI_FUNC(hdev->pdev->devfn) % i : 0; -- cpumask_set_cpu(cpumask_local_spread(i, dev_to_node(&hdev->pdev->dev)), -- &hdev->affinity_mask); -+ /* Set the affinity based on numa node */ -+ node = dev_to_node(&hdev->pdev->dev); -+ if (node != NUMA_NO_NODE) -+ cpumask = cpumask_of_node(node); -+ -+ cpumask_copy(&hdev->affinity_mask, cpumask); - - return ret; - } -@@ -6683,11 +6685,12 @@ static void hclge_ae_stop(struct hnae3_handle *handle) - hclge_clear_arfs_rules(handle); - spin_unlock_bh(&hdev->fd_rule_lock); - -- /* If it is not PF reset, the firmware will disable the MAC, -+ /* If it is not PF reset or FLR, the firmware will disable the MAC, - * so it only need to stop phy here. - */ - if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state) && -- hdev->reset_type != HNAE3_FUNC_RESET) { -+ hdev->reset_type != HNAE3_FUNC_RESET && -+ hdev->reset_type != HNAE3_FLR_RESET) { - hclge_mac_stop_phy(hdev); - hclge_update_link_status(hdev); - return; -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -index ea348ebbbf2e9..db2e9dd5681eb 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c -@@ -1956,6 +1956,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data) - - hclgevf_enable_vector(&hdev->misc_vector, false); - event_cause = hclgevf_check_evt_cause(hdev, &clearval); -+ if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) -+ hclgevf_clear_event_cause(hdev, clearval); - - switch (event_cause) { - case HCLGEVF_VECTOR0_EVENT_RST: -@@ -1968,10 +1970,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data) - break; - } - -- if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) { -- hclgevf_clear_event_cause(hdev, clearval); -+ if (event_cause != HCLGEVF_VECTOR0_EVENT_OTHER) - hclgevf_enable_vector(&hdev->misc_vector, true); -- } - - return IRQ_HANDLED; - } -diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c -index ecfe588f330ef..cfe7229593ead 100644 ---- a/drivers/net/ethernet/ibm/ibmvnic.c -+++ b/drivers/net/ethernet/ibm/ibmvnic.c -@@ -4277,6 +4277,14 @@ static int handle_login_rsp(union ibmvnic_crq *login_rsp_crq, - return 0; - } - -+ if (adapter->failover_pending) { -+ adapter->init_done_rc = -EAGAIN; -+ netdev_dbg(netdev, "Failover pending, ignoring login response\n"); -+ complete(&adapter->init_done); -+ /* login response buffer will be released on reset */ -+ return 0; -+ } -+ - netdev->mtu = adapter->req_mtu - ETH_HLEN; - - netdev_dbg(adapter->netdev, "Login Response Buffer:\n"); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 94a3f000e999b..bc46c262b42d8 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -142,6 +142,30 @@ enum iavf_status iavf_free_virt_mem_d(struct iavf_hw *hw, - return 0; - } - -+/** -+ * iavf_lock_timeout - try to set bit but give up after timeout -+ * @adapter: board private structure -+ * @bit: bit to set -+ * @msecs: timeout in msecs -+ * -+ * Returns 0 on success, negative on failure -+ **/ -+static int iavf_lock_timeout(struct iavf_adapter *adapter, -+ enum iavf_critical_section_t bit, -+ unsigned int msecs) -+{ -+ unsigned int wait, delay = 10; -+ -+ for (wait = 0; wait < msecs; wait += delay) { -+ if (!test_and_set_bit(bit, &adapter->crit_section)) -+ return 0; -+ -+ msleep(delay); -+ } -+ -+ return -1; -+} -+ - /** - * iavf_schedule_reset - Set the flags and schedule a reset event - * @adapter: board private structure -@@ -1961,7 +1985,6 @@ static void iavf_watchdog_task(struct work_struct *work) - /* check for hw reset */ - reg_val = rd32(hw, IAVF_VF_ARQLEN1) & IAVF_VF_ARQLEN1_ARQENABLE_MASK; - if (!reg_val) { -- adapter->state = __IAVF_RESETTING; - adapter->flags |= IAVF_FLAG_RESET_PENDING; - adapter->aq_required = 0; - adapter->current_op = VIRTCHNL_OP_UNKNOWN; -@@ -2077,6 +2100,10 @@ static void iavf_reset_task(struct work_struct *work) - if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section)) - return; - -+ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200)) { -+ schedule_work(&adapter->reset_task); -+ return; -+ } - while (test_and_set_bit(__IAVF_IN_CLIENT_TASK, - &adapter->crit_section)) - usleep_range(500, 1000); -@@ -2291,6 +2318,8 @@ static void iavf_adminq_task(struct work_struct *work) - if (!event.msg_buf) - goto out; - -+ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 200)) -+ goto freedom; - do { - ret = iavf_clean_arq_element(hw, &event, &pending); - v_op = (enum virtchnl_ops)le32_to_cpu(event.desc.cookie_high); -@@ -2304,6 +2333,7 @@ static void iavf_adminq_task(struct work_struct *work) - if (pending != 0) - memset(event.msg_buf, 0, IAVF_MAX_AQ_BUF_SIZE); - } while (pending); -+ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); - - if ((adapter->flags & - (IAVF_FLAG_RESET_PENDING | IAVF_FLAG_RESET_NEEDED)) || -@@ -3600,6 +3630,10 @@ static void iavf_init_task(struct work_struct *work) - init_task.work); - struct iavf_hw *hw = &adapter->hw; - -+ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) { -+ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__); -+ return; -+ } - switch (adapter->state) { - case __IAVF_STARTUP: - if (iavf_startup(adapter) < 0) -@@ -3612,14 +3646,14 @@ static void iavf_init_task(struct work_struct *work) - case __IAVF_INIT_GET_RESOURCES: - if (iavf_init_get_resources(adapter) < 0) - goto init_failed; -- return; -+ goto out; - default: - goto init_failed; - } - - queue_delayed_work(iavf_wq, &adapter->init_task, - msecs_to_jiffies(30)); -- return; -+ goto out; - init_failed: - if (++adapter->aq_wait_count > IAVF_AQ_MAX_ERR) { - dev_err(&adapter->pdev->dev, -@@ -3628,9 +3662,11 @@ init_failed: - iavf_shutdown_adminq(hw); - adapter->state = __IAVF_STARTUP; - queue_delayed_work(iavf_wq, &adapter->init_task, HZ * 5); -- return; -+ goto out; - } - queue_delayed_work(iavf_wq, &adapter->init_task, HZ); -+out: -+ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); - } - - /** -@@ -3647,9 +3683,12 @@ static void iavf_shutdown(struct pci_dev *pdev) - if (netif_running(netdev)) - iavf_close(netdev); - -+ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) -+ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__); - /* Prevent the watchdog from running. */ - adapter->state = __IAVF_REMOVE; - adapter->aq_required = 0; -+ clear_bit(__IAVF_IN_CRITICAL_TASK, &adapter->crit_section); - - #ifdef CONFIG_PM - pci_save_state(pdev); -@@ -3878,10 +3917,6 @@ static void iavf_remove(struct pci_dev *pdev) - err); - } - -- /* Shut down all the garbage mashers on the detention level */ -- adapter->state = __IAVF_REMOVE; -- adapter->aq_required = 0; -- adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED; - iavf_request_reset(adapter); - msleep(50); - /* If the FW isn't responding, kick it once, but only once. */ -@@ -3889,6 +3924,13 @@ static void iavf_remove(struct pci_dev *pdev) - iavf_request_reset(adapter); - msleep(50); - } -+ if (iavf_lock_timeout(adapter, __IAVF_IN_CRITICAL_TASK, 5000)) -+ dev_warn(&adapter->pdev->dev, "failed to set __IAVF_IN_CRITICAL_TASK in %s\n", __FUNCTION__); -+ -+ /* Shut down all the garbage mashers on the detention level */ -+ adapter->state = __IAVF_REMOVE; -+ adapter->aq_required = 0; -+ adapter->flags &= ~IAVF_FLAG_REINIT_ITR_NEEDED; - iavf_free_all_tx_resources(adapter); - iavf_free_all_rx_resources(adapter); - iavf_misc_irq_disable(adapter); -diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c -index 084cf4a4114ad..9ba05d9aa8e08 100644 ---- a/drivers/net/ethernet/intel/igc/igc_main.c -+++ b/drivers/net/ethernet/intel/igc/igc_main.c -@@ -2693,6 +2693,7 @@ static irqreturn_t igc_msix_ring(int irq, void *data) - */ - static int igc_request_msix(struct igc_adapter *adapter) - { -+ unsigned int num_q_vectors = adapter->num_q_vectors; - int i = 0, err = 0, vector = 0, free_vector = 0; - struct net_device *netdev = adapter->netdev; - -@@ -2701,7 +2702,13 @@ static int igc_request_msix(struct igc_adapter *adapter) - if (err) - goto err_out; - -- for (i = 0; i < adapter->num_q_vectors; i++) { -+ if (num_q_vectors > MAX_Q_VECTORS) { -+ num_q_vectors = MAX_Q_VECTORS; -+ dev_warn(&adapter->pdev->dev, -+ "The number of queue vectors (%d) is higher than max allowed (%d)\n", -+ adapter->num_q_vectors, MAX_Q_VECTORS); -+ } -+ for (i = 0; i < num_q_vectors; i++) { - struct igc_q_vector *q_vector = adapter->q_vector[i]; - - vector++; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 76547d35cd0e1..bf091a6c0cd2d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -865,7 +865,7 @@ static void cb_timeout_handler(struct work_struct *work) - ent->ret = -ETIMEDOUT; - mlx5_core_warn(dev, "cmd[%d]: %s(0x%x) Async, timeout. Will cause a leak of a command resource\n", - ent->idx, mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); -- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true); - - out: - cmd_ent_put(ent); /* for the cmd_ent_get() took on schedule delayed work */ -@@ -977,7 +977,7 @@ static void cmd_work_handler(struct work_struct *work) - MLX5_SET(mbox_out, ent->out, status, status); - MLX5_SET(mbox_out, ent->out, syndrome, drv_synd); - -- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true); - return; - } - -@@ -991,7 +991,7 @@ static void cmd_work_handler(struct work_struct *work) - poll_timeout(ent); - /* make sure we read the descriptor after ownership is SW */ - rmb(); -- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT)); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); - } - } - -@@ -1051,7 +1051,7 @@ static void wait_func_handle_exec_timeout(struct mlx5_core_dev *dev, - mlx5_command_str(msg_to_opcode(ent->in)), msg_to_opcode(ent->in)); - - ent->ret = -ETIMEDOUT; -- mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, true); - } - - static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -index dc36b0db37222..97359417c6e7f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -@@ -1005,7 +1005,7 @@ int mlx5_fw_tracer_init(struct mlx5_fw_tracer *tracer) - err = mlx5_core_alloc_pd(dev, &tracer->buff.pdn); - if (err) { - mlx5_core_warn(dev, "FWTracer: Failed to allocate PD %d\n", err); -- return err; -+ goto err_cancel_work; - } - - err = mlx5_fw_tracer_create_mkey(tracer); -@@ -1029,6 +1029,7 @@ err_notifier_unregister: - mlx5_core_destroy_mkey(dev, &tracer->buff.mkey); - err_dealloc_pd: - mlx5_core_dealloc_pd(dev, tracer->buff.pdn); -+err_cancel_work: - cancel_work_sync(&tracer->read_fw_strings_work); - return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 739bf5dc5a252..5fe4e028567a9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -1606,9 +1606,9 @@ static int build_match_list(struct match_list_head *match_head, - - curr_match = kmalloc(sizeof(*curr_match), GFP_ATOMIC); - if (!curr_match) { -+ rcu_read_unlock(); - free_match_list(match_head, ft_locked); -- err = -ENOMEM; -- goto out; -+ return -ENOMEM; - } - if (!tree_get_node(&g->node)) { - kfree(curr_match); -@@ -1617,7 +1617,6 @@ static int build_match_list(struct match_list_head *match_head, - curr_match->g = g; - list_add_tail(&curr_match->list, &match_head->list); - } --out: - rcu_read_unlock(); - return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -index f012aac83b10e..401564b94eb10 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c -@@ -603,6 +603,7 @@ static int dr_cmd_modify_qp_rtr2rts(struct mlx5_core_dev *mdev, - MLX5_SET(qpc, qpc, log_ack_req_freq, 0); - MLX5_SET(qpc, qpc, retry_count, attr->retry_cnt); - MLX5_SET(qpc, qpc, rnr_retry, attr->rnr_retry); -+ MLX5_SET(qpc, qpc, primary_address_path.ack_timeout, 0x8); /* ~1ms */ - - return mlx5_core_qp_modify(mdev, MLX5_CMD_OP_RTR2RTS_QP, 0, qpc, - &dr_qp->mqp); -diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c -index 5d85ae59bc51e..3769b15b04b3b 100644 ---- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c -+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c -@@ -3173,6 +3173,7 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn, - struct qed_nvm_image_att *p_image_att) - { - enum nvm_image_type type; -+ int rc; - u32 i; - - /* Translate image_id into MFW definitions */ -@@ -3198,7 +3199,10 @@ qed_mcp_get_nvm_image_att(struct qed_hwfn *p_hwfn, - return -EINVAL; - } - -- qed_mcp_nvm_info_populate(p_hwfn); -+ rc = qed_mcp_nvm_info_populate(p_hwfn); -+ if (rc) -+ return rc; -+ - for (i = 0; i < p_hwfn->nvm_info.num_images; i++) - if (type == p_hwfn->nvm_info.image_att[i].image_type) - break; -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c -index c48a0e2d4d7ef..6a009d51ec510 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c -@@ -440,7 +440,6 @@ int qlcnic_pinit_from_rom(struct qlcnic_adapter *adapter) - QLCWR32(adapter, QLCNIC_CRB_PEG_NET_4 + 0x3c, 1); - msleep(20); - -- qlcnic_rom_unlock(adapter); - /* big hammer don't reset CAM block on reset */ - QLCWR32(adapter, QLCNIC_ROMUSB_GLB_SW_RESET, 0xfeffffff); - -diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c -index 274e5b4bc4ac8..f158fdf3aab2c 100644 ---- a/drivers/net/ethernet/rdc/r6040.c -+++ b/drivers/net/ethernet/rdc/r6040.c -@@ -119,6 +119,8 @@ - #define PHY_ST 0x8A /* PHY status register */ - #define MAC_SM 0xAC /* MAC status machine */ - #define MAC_SM_RST 0x0002 /* MAC status machine reset */ -+#define MD_CSC 0xb6 /* MDC speed control register */ -+#define MD_CSC_DEFAULT 0x0030 - #define MAC_ID 0xBE /* Identifier register */ - - #define TX_DCNT 0x80 /* TX descriptor count */ -@@ -354,8 +356,9 @@ static void r6040_reset_mac(struct r6040_private *lp) - { - void __iomem *ioaddr = lp->base; - int limit = MAC_DEF_TIMEOUT; -- u16 cmd; -+ u16 cmd, md_csc; - -+ md_csc = ioread16(ioaddr + MD_CSC); - iowrite16(MAC_RST, ioaddr + MCR1); - while (limit--) { - cmd = ioread16(ioaddr + MCR1); -@@ -367,6 +370,10 @@ static void r6040_reset_mac(struct r6040_private *lp) - iowrite16(MAC_SM_RST, ioaddr + MAC_SM); - iowrite16(0, ioaddr + MAC_SM); - mdelay(5); -+ -+ /* Restore MDIO clock frequency */ -+ if (md_csc != MD_CSC_DEFAULT) -+ iowrite16(md_csc, ioaddr + MD_CSC); - } - - static void r6040_init_mac_regs(struct net_device *dev) -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 931a44fe7afe8..50d85d0372302 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -2567,6 +2567,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev) - else - txdesc->status |= cpu_to_le32(TD_TACT); - -+ wmb(); /* cur_tx must be incremented after TACT bit was set */ - mdp->cur_tx++; - - if (!(sh_eth_read(ndev, EDTRR) & mdp->cd->edtrr_trns)) -diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -index 0f56f8e336917..03b11f191c262 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c -@@ -288,10 +288,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - val &= ~NSS_COMMON_GMAC_CTL_PHY_IFACE_SEL; - break; - default: -- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", -- phy_modes(gmac->phy_mode)); -- err = -EINVAL; -- goto err_remove_config_dt; -+ goto err_unsupported_phy; - } - regmap_write(gmac->nss_common, NSS_COMMON_GMAC_CTL(gmac->id), val); - -@@ -308,10 +305,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - NSS_COMMON_CLK_SRC_CTRL_OFFSET(gmac->id); - break; - default: -- dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", -- phy_modes(gmac->phy_mode)); -- err = -EINVAL; -- goto err_remove_config_dt; -+ goto err_unsupported_phy; - } - regmap_write(gmac->nss_common, NSS_COMMON_CLK_SRC_CTRL, val); - -@@ -328,8 +322,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - NSS_COMMON_CLK_GATE_GMII_TX_EN(gmac->id); - break; - default: -- /* We don't get here; the switch above will have errored out */ -- unreachable(); -+ goto err_unsupported_phy; - } - regmap_write(gmac->nss_common, NSS_COMMON_CLK_GATE, val); - -@@ -360,6 +353,11 @@ static int ipq806x_gmac_probe(struct platform_device *pdev) - - return 0; - -+err_unsupported_phy: -+ dev_err(&pdev->dev, "Unsupported PHY mode: \"%s\"\n", -+ phy_modes(gmac->phy_mode)); -+ err = -EINVAL; -+ - err_remove_config_dt: - stmmac_remove_config_dt(pdev, plat_dat); - -diff --git a/drivers/net/ethernet/wiznet/w5100.c b/drivers/net/ethernet/wiznet/w5100.c -index bede1ff289c59..a65b7291e12a2 100644 ---- a/drivers/net/ethernet/wiznet/w5100.c -+++ b/drivers/net/ethernet/wiznet/w5100.c -@@ -1052,6 +1052,8 @@ static int w5100_mmio_probe(struct platform_device *pdev) - mac_addr = data->mac_addr; - - mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ if (!mem) -+ return -EINVAL; - if (resource_size(mem) < W5100_BUS_DIRECT_SIZE) - ops = &w5100_mmio_indirect_ops; - else -diff --git a/drivers/net/phy/dp83640_reg.h b/drivers/net/phy/dp83640_reg.h -index 21aa24c741b96..daae7fa58fb82 100644 ---- a/drivers/net/phy/dp83640_reg.h -+++ b/drivers/net/phy/dp83640_reg.h -@@ -5,7 +5,7 @@ - #ifndef HAVE_DP83640_REGISTERS - #define HAVE_DP83640_REGISTERS - --#define PAGE0 0x0000 -+/* #define PAGE0 0x0000 */ - #define PHYCR2 0x001c /* PHY Control Register 2 */ - - #define PAGE4 0x0004 -diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c -index eb100eb33de3d..77ac5a721e7b6 100644 ---- a/drivers/net/usb/cdc_mbim.c -+++ b/drivers/net/usb/cdc_mbim.c -@@ -653,6 +653,11 @@ static const struct usb_device_id mbim_devs[] = { - .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, - }, - -+ /* Telit LN920 */ -+ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1061, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), -+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, -+ }, -+ - /* default entry */ - { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), - .driver_info = (unsigned long)&cdc_mbim_info_zlp, -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -index b4885a700296e..b0a4ca3559fd8 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c -@@ -3351,7 +3351,8 @@ found: - "Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n", - cptr, code, reference, length, major, minor); - if ((!AR_SREV_9485(ah) && length >= 1024) || -- (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) { -+ (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) || -+ (length > cptr)) { - ath_dbg(common, EEPROM, "Skipping bad header\n"); - cptr -= COMP_HDR_LEN; - continue; -diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c -index 9fd8e64288ffa..7e2e22b6bbbc5 100644 ---- a/drivers/net/wireless/ath/ath9k/hw.c -+++ b/drivers/net/wireless/ath/ath9k/hw.c -@@ -1622,7 +1622,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah) - ath9k_hw_gpio_request_out(ah, i, NULL, - AR_GPIO_OUTPUT_MUX_AS_OUTPUT); - ath9k_hw_set_gpio(ah, i, !!(ah->gpio_val & BIT(i))); -- ath9k_hw_gpio_free(ah, i); - } - } - -@@ -2730,14 +2729,17 @@ static void ath9k_hw_gpio_cfg_output_mux(struct ath_hw *ah, u32 gpio, u32 type) - static void ath9k_hw_gpio_cfg_soc(struct ath_hw *ah, u32 gpio, bool out, - const char *label) - { -+ int err; -+ - if (ah->caps.gpio_requested & BIT(gpio)) - return; - -- /* may be requested by BSP, free anyway */ -- gpio_free(gpio); -- -- if (gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label)) -+ err = gpio_request_one(gpio, out ? GPIOF_OUT_INIT_LOW : GPIOF_IN, label); -+ if (err) { -+ ath_err(ath9k_hw_common(ah), "request GPIO%d failed:%d\n", -+ gpio, err); - return; -+ } - - ah->caps.gpio_requested |= BIT(gpio); - } -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c -index 9c417dd062913..7736621dca653 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c -@@ -1043,8 +1043,10 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm, - return -ENOMEM; - - #ifdef CONFIG_IWLWIFI_DEBUGFS -- if (mvm->beacon_inject_active) -+ if (mvm->beacon_inject_active) { -+ dev_kfree_skb(beacon); - return -EBUSY; -+ } - #endif - - ret = iwl_mvm_mac_ctxt_send_beacon(mvm, vif, beacon); -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index 09b1a6beee77c..081cbc9ec7368 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -2970,16 +2970,20 @@ static void iwl_mvm_check_he_obss_narrow_bw_ru_iter(struct wiphy *wiphy, - void *_data) - { - struct iwl_mvm_he_obss_narrow_bw_ru_data *data = _data; -+ const struct cfg80211_bss_ies *ies; - const struct element *elem; - -- elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, bss->ies->data, -- bss->ies->len); -+ rcu_read_lock(); -+ ies = rcu_dereference(bss->ies); -+ elem = cfg80211_find_elem(WLAN_EID_EXT_CAPABILITY, ies->data, -+ ies->len); - - if (!elem || elem->datalen < 10 || - !(elem->data[10] & - WLAN_EXT_CAPA10_OBSS_NARROW_BW_RU_TOLERANCE_SUPPORT)) { - data->tolerated = false; - } -+ rcu_read_unlock(); - } - - static void iwl_mvm_check_he_obss_narrow_bw_ru(struct ieee80211_hw *hw, -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -index 8b0576cde797e..a9aab6c690e85 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c -@@ -687,10 +687,26 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg, - - mvm->fw_restart = iwlwifi_mod_params.fw_restart ? -1 : 0; - -- mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE; -- mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE; -- mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE; -- mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE; -+ if (iwl_mvm_has_new_tx_api(mvm)) { -+ /* -+ * If we have the new TX/queue allocation API initialize them -+ * all to invalid numbers. We'll rewrite the ones that we need -+ * later, but that doesn't happen for all of them all of the -+ * time (e.g. P2P Device is optional), and if a dynamic queue -+ * ends up getting number 2 (IWL_MVM_DQA_P2P_DEVICE_QUEUE) then -+ * iwl_mvm_is_static_queue() erroneously returns true, and we -+ * might have things getting stuck. -+ */ -+ mvm->aux_queue = IWL_MVM_INVALID_QUEUE; -+ mvm->snif_queue = IWL_MVM_INVALID_QUEUE; -+ mvm->probe_queue = IWL_MVM_INVALID_QUEUE; -+ mvm->p2p_dev_queue = IWL_MVM_INVALID_QUEUE; -+ } else { -+ mvm->aux_queue = IWL_MVM_DQA_AUX_QUEUE; -+ mvm->snif_queue = IWL_MVM_DQA_INJECT_MONITOR_QUEUE; -+ mvm->probe_queue = IWL_MVM_DQA_AP_PROBE_RESP_QUEUE; -+ mvm->p2p_dev_queue = IWL_MVM_DQA_P2P_DEVICE_QUEUE; -+ } - - mvm->sf_state = SF_UNINIT; - if (iwl_mvm_has_unified_ucode(mvm)) -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -index 40cafcf40ccf0..5df4bbb6c6de3 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c -@@ -346,8 +346,9 @@ static int iwl_mvm_invalidate_sta_queue(struct iwl_mvm *mvm, int queue, - } - - static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta, -- int queue, u8 tid, u8 flags) -+ u16 *queueptr, u8 tid, u8 flags) - { -+ int queue = *queueptr; - struct iwl_scd_txq_cfg_cmd cmd = { - .scd_queue = queue, - .action = SCD_CFG_DISABLE_QUEUE, -@@ -356,6 +357,7 @@ static int iwl_mvm_disable_txq(struct iwl_mvm *mvm, struct ieee80211_sta *sta, - - if (iwl_mvm_has_new_tx_api(mvm)) { - iwl_trans_txq_free(mvm->trans, queue); -+ *queueptr = IWL_MVM_INVALID_QUEUE; - - return 0; - } -@@ -517,6 +519,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue, - u8 sta_id, tid; - unsigned long disable_agg_tids = 0; - bool same_sta; -+ u16 queue_tmp = queue; - int ret; - - lockdep_assert_held(&mvm->mutex); -@@ -539,7 +542,7 @@ static int iwl_mvm_free_inactive_queue(struct iwl_mvm *mvm, int queue, - iwl_mvm_invalidate_sta_queue(mvm, queue, - disable_agg_tids, false); - -- ret = iwl_mvm_disable_txq(mvm, old_sta, queue, tid, 0); -+ ret = iwl_mvm_disable_txq(mvm, old_sta, &queue_tmp, tid, 0); - if (ret) { - IWL_ERR(mvm, - "Failed to free inactive queue %d (ret=%d)\n", -@@ -1209,6 +1212,7 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm, - unsigned int wdg_timeout = - iwl_mvm_get_wd_timeout(mvm, mvmsta->vif, false, false); - int queue = -1; -+ u16 queue_tmp; - unsigned long disable_agg_tids = 0; - enum iwl_mvm_agg_state queue_state; - bool shared_queue = false, inc_ssn; -@@ -1357,7 +1361,8 @@ static int iwl_mvm_sta_alloc_queue(struct iwl_mvm *mvm, - return 0; - - out_err: -- iwl_mvm_disable_txq(mvm, sta, queue, tid, 0); -+ queue_tmp = queue; -+ iwl_mvm_disable_txq(mvm, sta, &queue_tmp, tid, 0); - - return ret; - } -@@ -1795,7 +1800,7 @@ static void iwl_mvm_disable_sta_queues(struct iwl_mvm *mvm, - if (mvm_sta->tid_data[i].txq_id == IWL_MVM_INVALID_QUEUE) - continue; - -- iwl_mvm_disable_txq(mvm, sta, mvm_sta->tid_data[i].txq_id, i, -+ iwl_mvm_disable_txq(mvm, sta, &mvm_sta->tid_data[i].txq_id, i, - 0); - mvm_sta->tid_data[i].txq_id = IWL_MVM_INVALID_QUEUE; - } -@@ -2005,7 +2010,7 @@ static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx, - ret = iwl_mvm_add_int_sta_common(mvm, sta, NULL, macidx, maccolor); - if (ret) { - if (!iwl_mvm_has_new_tx_api(mvm)) -- iwl_mvm_disable_txq(mvm, NULL, *queue, -+ iwl_mvm_disable_txq(mvm, NULL, queue, - IWL_MAX_TID_COUNT, 0); - return ret; - } -@@ -2073,7 +2078,7 @@ int iwl_mvm_rm_snif_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) - if (WARN_ON_ONCE(mvm->snif_sta.sta_id == IWL_MVM_INVALID_STA)) - return -EINVAL; - -- iwl_mvm_disable_txq(mvm, NULL, mvm->snif_queue, IWL_MAX_TID_COUNT, 0); -+ iwl_mvm_disable_txq(mvm, NULL, &mvm->snif_queue, IWL_MAX_TID_COUNT, 0); - ret = iwl_mvm_rm_sta_common(mvm, mvm->snif_sta.sta_id); - if (ret) - IWL_WARN(mvm, "Failed sending remove station\n"); -@@ -2090,7 +2095,7 @@ int iwl_mvm_rm_aux_sta(struct iwl_mvm *mvm) - if (WARN_ON_ONCE(mvm->aux_sta.sta_id == IWL_MVM_INVALID_STA)) - return -EINVAL; - -- iwl_mvm_disable_txq(mvm, NULL, mvm->aux_queue, IWL_MAX_TID_COUNT, 0); -+ iwl_mvm_disable_txq(mvm, NULL, &mvm->aux_queue, IWL_MAX_TID_COUNT, 0); - ret = iwl_mvm_rm_sta_common(mvm, mvm->aux_sta.sta_id); - if (ret) - IWL_WARN(mvm, "Failed sending remove station\n"); -@@ -2186,7 +2191,7 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm, - struct ieee80211_vif *vif) - { - struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); -- int queue; -+ u16 *queueptr, queue; - - lockdep_assert_held(&mvm->mutex); - -@@ -2195,10 +2200,10 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm, - switch (vif->type) { - case NL80211_IFTYPE_AP: - case NL80211_IFTYPE_ADHOC: -- queue = mvm->probe_queue; -+ queueptr = &mvm->probe_queue; - break; - case NL80211_IFTYPE_P2P_DEVICE: -- queue = mvm->p2p_dev_queue; -+ queueptr = &mvm->p2p_dev_queue; - break; - default: - WARN(1, "Can't free bcast queue on vif type %d\n", -@@ -2206,7 +2211,8 @@ static void iwl_mvm_free_bcast_sta_queues(struct iwl_mvm *mvm, - return; - } - -- iwl_mvm_disable_txq(mvm, NULL, queue, IWL_MAX_TID_COUNT, 0); -+ queue = *queueptr; -+ iwl_mvm_disable_txq(mvm, NULL, queueptr, IWL_MAX_TID_COUNT, 0); - if (iwl_mvm_has_new_tx_api(mvm)) - return; - -@@ -2441,7 +2447,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) - - iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true, 0); - -- iwl_mvm_disable_txq(mvm, NULL, mvmvif->cab_queue, 0, 0); -+ iwl_mvm_disable_txq(mvm, NULL, &mvmvif->cab_queue, 0, 0); - - ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id); - if (ret) -diff --git a/drivers/ntb/test/ntb_msi_test.c b/drivers/ntb/test/ntb_msi_test.c -index 99d826ed9c341..662067dc9ce2c 100644 ---- a/drivers/ntb/test/ntb_msi_test.c -+++ b/drivers/ntb/test/ntb_msi_test.c -@@ -372,8 +372,10 @@ static int ntb_msit_probe(struct ntb_client *client, struct ntb_dev *ntb) - if (ret) - goto remove_dbgfs; - -- if (!nm->isr_ctx) -+ if (!nm->isr_ctx) { -+ ret = -ENOMEM; - goto remove_dbgfs; -+ } - - ntb_link_enable(ntb, NTB_SPEED_AUTO, NTB_WIDTH_AUTO); - -diff --git a/drivers/ntb/test/ntb_perf.c b/drivers/ntb/test/ntb_perf.c -index 5ce4766a6c9eb..251fe75798c13 100644 ---- a/drivers/ntb/test/ntb_perf.c -+++ b/drivers/ntb/test/ntb_perf.c -@@ -597,6 +597,7 @@ static int perf_setup_inbuf(struct perf_peer *peer) - return -ENOMEM; - } - if (!IS_ALIGNED(peer->inbuf_xlat, xlat_align)) { -+ ret = -EINVAL; - dev_err(&perf->ntb->dev, "Unaligned inbuf allocated\n"); - goto err_free_inbuf; - } -diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c -index f6427a10a9908..38bbbbbc6f47f 100644 ---- a/drivers/nvme/host/tcp.c -+++ b/drivers/nvme/host/tcp.c -@@ -642,17 +642,9 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb, - unsigned int *offset, size_t *len) - { - struct nvme_tcp_data_pdu *pdu = (void *)queue->pdu; -- struct nvme_tcp_request *req; -- struct request *rq; -- -- rq = blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id); -- if (!rq) { -- dev_err(queue->ctrl->ctrl.device, -- "queue %d tag %#x not found\n", -- nvme_tcp_queue_id(queue), pdu->command_id); -- return -ENOENT; -- } -- req = blk_mq_rq_to_pdu(rq); -+ struct request *rq = -+ blk_mq_tag_to_rq(nvme_tcp_tagset(queue), pdu->command_id); -+ struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq); - - while (true) { - int recv_len, ret; -diff --git a/drivers/of/kobj.c b/drivers/of/kobj.c -index a32e60b024b8d..6675b5e56960c 100644 ---- a/drivers/of/kobj.c -+++ b/drivers/of/kobj.c -@@ -119,7 +119,7 @@ int __of_attach_node_sysfs(struct device_node *np) - struct property *pp; - int rc; - -- if (!of_kset) -+ if (!IS_ENABLED(CONFIG_SYSFS) || !of_kset) - return 0; - - np->kobj.kset = of_kset; -diff --git a/drivers/opp/of.c b/drivers/opp/of.c -index 603c688fe23dc..30cc407c8f93f 100644 ---- a/drivers/opp/of.c -+++ b/drivers/opp/of.c -@@ -95,15 +95,7 @@ static struct dev_pm_opp *_find_opp_of_np(struct opp_table *opp_table, - static struct device_node *of_parse_required_opp(struct device_node *np, - int index) - { -- struct device_node *required_np; -- -- required_np = of_parse_phandle(np, "required-opps", index); -- if (unlikely(!required_np)) { -- pr_err("%s: Unable to parse required-opps: %pOF, index: %d\n", -- __func__, np, index); -- } -- -- return required_np; -+ return of_parse_phandle(np, "required-opps", index); - } - - /* The caller must call dev_pm_opp_put_opp_table() after the table is used */ -@@ -996,7 +988,7 @@ int of_get_required_opp_performance_state(struct device_node *np, int index) - - required_np = of_parse_required_opp(np, index); - if (!required_np) -- return -EINVAL; -+ return -ENODEV; - - opp_table = _find_table_of_opp_np(required_np); - if (IS_ERR(opp_table)) { -diff --git a/drivers/parport/ieee1284_ops.c b/drivers/parport/ieee1284_ops.c -index 5d41dda6da4e7..75daa16f38b7f 100644 ---- a/drivers/parport/ieee1284_ops.c -+++ b/drivers/parport/ieee1284_ops.c -@@ -535,7 +535,7 @@ size_t parport_ieee1284_ecp_read_data (struct parport *port, - goto out; - - /* Yield the port for a while. */ -- if (count && dev->port->irq != PARPORT_IRQ_NONE) { -+ if (dev->port->irq != PARPORT_IRQ_NONE) { - parport_release (dev); - schedule_timeout_interruptible(msecs_to_jiffies(40)); - parport_claim_or_block (dev); -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 0a2902569f140..0538348ed843f 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -62,6 +62,7 @@ - #define PIO_COMPLETION_STATUS_CRS 2 - #define PIO_COMPLETION_STATUS_CA 4 - #define PIO_NON_POSTED_REQ BIT(10) -+#define PIO_ERR_STATUS BIT(11) - #define PIO_ADDR_LS (PIO_BASE_ADDR + 0x8) - #define PIO_ADDR_MS (PIO_BASE_ADDR + 0xc) - #define PIO_WR_DATA (PIO_BASE_ADDR + 0x10) -@@ -176,7 +177,7 @@ - (PCIE_CONF_BUS(bus) | PCIE_CONF_DEV(PCI_SLOT(devfn)) | \ - PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where)) - --#define PIO_RETRY_CNT 500 -+#define PIO_RETRY_CNT 750000 /* 1.5 s */ - #define PIO_RETRY_DELAY 2 /* 2 us*/ - - #define LINK_WAIT_MAX_RETRIES 10 -@@ -193,6 +194,7 @@ struct advk_pcie { - struct list_head resources; - struct irq_domain *irq_domain; - struct irq_chip irq_chip; -+ raw_spinlock_t irq_lock; - struct irq_domain *msi_domain; - struct irq_domain *msi_inner_domain; - struct irq_chip msi_bottom_irq_chip; -@@ -363,7 +365,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG); - } - --static void advk_pcie_check_pio_status(struct advk_pcie *pcie) -+static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val) - { - struct device *dev = &pcie->pdev->dev; - u32 reg; -@@ -374,14 +376,49 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) - status = (reg & PIO_COMPLETION_STATUS_MASK) >> - PIO_COMPLETION_STATUS_SHIFT; - -- if (!status) -- return; -- -+ /* -+ * According to HW spec, the PIO status check sequence as below: -+ * 1) even if COMPLETION_STATUS(bit9:7) indicates successful, -+ * it still needs to check Error Status(bit11), only when this bit -+ * indicates no error happen, the operation is successful. -+ * 2) value Unsupported Request(1) of COMPLETION_STATUS(bit9:7) only -+ * means a PIO write error, and for PIO read it is successful with -+ * a read value of 0xFFFFFFFF. -+ * 3) value Completion Retry Status(CRS) of COMPLETION_STATUS(bit9:7) -+ * only means a PIO write error, and for PIO read it is successful -+ * with a read value of 0xFFFF0001. -+ * 4) value Completer Abort (CA) of COMPLETION_STATUS(bit9:7) means -+ * error for both PIO read and PIO write operation. -+ * 5) other errors are indicated as 'unknown'. -+ */ - switch (status) { -+ case PIO_COMPLETION_STATUS_OK: -+ if (reg & PIO_ERR_STATUS) { -+ strcomp_status = "COMP_ERR"; -+ break; -+ } -+ /* Get the read result */ -+ if (val) -+ *val = advk_readl(pcie, PIO_RD_DATA); -+ /* No error */ -+ strcomp_status = NULL; -+ break; - case PIO_COMPLETION_STATUS_UR: - strcomp_status = "UR"; - break; - case PIO_COMPLETION_STATUS_CRS: -+ /* PCIe r4.0, sec 2.3.2, says: -+ * If CRS Software Visibility is not enabled, the Root Complex -+ * must re-issue the Configuration Request as a new Request. -+ * A Root Complex implementation may choose to limit the number -+ * of Configuration Request/CRS Completion Status loops before -+ * determining that something is wrong with the target of the -+ * Request and taking appropriate action, e.g., complete the -+ * Request to the host as a failed transaction. -+ * -+ * To simplify implementation do not re-issue the Configuration -+ * Request and complete the Request as a failed transaction. -+ */ - strcomp_status = "CRS"; - break; - case PIO_COMPLETION_STATUS_CA: -@@ -392,6 +429,9 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) - break; - } - -+ if (!strcomp_status) -+ return 0; -+ - if (reg & PIO_NON_POSTED_REQ) - str_posted = "Non-posted"; - else -@@ -399,6 +439,8 @@ static void advk_pcie_check_pio_status(struct advk_pcie *pcie) - - dev_err(dev, "%s PIO Response Status: %s, %#x @ %#x\n", - str_posted, strcomp_status, reg, advk_readl(pcie, PIO_ADDR_LS)); -+ -+ return -EFAULT; - } - - static int advk_pcie_wait_pio(struct advk_pcie *pcie) -@@ -625,10 +667,13 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - if (ret < 0) - return PCIBIOS_SET_FAILED; - -- advk_pcie_check_pio_status(pcie); -+ /* Check PIO status and get the read result */ -+ ret = advk_pcie_check_pio_status(pcie, val); -+ if (ret < 0) { -+ *val = 0xffffffff; -+ return PCIBIOS_SET_FAILED; -+ } - -- /* Get the read result */ -- *val = advk_readl(pcie, PIO_RD_DATA); - if (size == 1) - *val = (*val >> (8 * (where & 3))) & 0xff; - else if (size == 2) -@@ -692,7 +737,9 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, - if (ret < 0) - return PCIBIOS_SET_FAILED; - -- advk_pcie_check_pio_status(pcie); -+ ret = advk_pcie_check_pio_status(pcie, NULL); -+ if (ret < 0) -+ return PCIBIOS_SET_FAILED; - - return PCIBIOS_SUCCESSFUL; - } -@@ -766,22 +813,28 @@ static void advk_pcie_irq_mask(struct irq_data *d) - { - struct advk_pcie *pcie = d->domain->host_data; - irq_hw_number_t hwirq = irqd_to_hwirq(d); -+ unsigned long flags; - u32 mask; - -+ raw_spin_lock_irqsave(&pcie->irq_lock, flags); - mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); - mask |= PCIE_ISR1_INTX_ASSERT(hwirq); - advk_writel(pcie, mask, PCIE_ISR1_MASK_REG); -+ raw_spin_unlock_irqrestore(&pcie->irq_lock, flags); - } - - static void advk_pcie_irq_unmask(struct irq_data *d) - { - struct advk_pcie *pcie = d->domain->host_data; - irq_hw_number_t hwirq = irqd_to_hwirq(d); -+ unsigned long flags; - u32 mask; - -+ raw_spin_lock_irqsave(&pcie->irq_lock, flags); - mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); - mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq); - advk_writel(pcie, mask, PCIE_ISR1_MASK_REG); -+ raw_spin_unlock_irqrestore(&pcie->irq_lock, flags); - } - - static int advk_pcie_irq_map(struct irq_domain *h, -@@ -865,6 +918,8 @@ static int advk_pcie_init_irq_domain(struct advk_pcie *pcie) - struct irq_chip *irq_chip; - int ret = 0; - -+ raw_spin_lock_init(&pcie->irq_lock); -+ - pcie_intc_node = of_get_next_child(node, NULL); - if (!pcie_intc_node) { - dev_err(dev, "No PCIe Intc node found\n"); -diff --git a/drivers/pci/controller/pcie-xilinx-nwl.c b/drivers/pci/controller/pcie-xilinx-nwl.c -index 45c0f344ccd16..11b046b20b92a 100644 ---- a/drivers/pci/controller/pcie-xilinx-nwl.c -+++ b/drivers/pci/controller/pcie-xilinx-nwl.c -@@ -6,6 +6,7 @@ - * (C) Copyright 2014 - 2015, Xilinx, Inc. - */ - -+#include - #include - #include - #include -@@ -169,6 +170,7 @@ struct nwl_pcie { - u8 root_busno; - struct nwl_msi msi; - struct irq_domain *legacy_irq_domain; -+ struct clk *clk; - raw_spinlock_t leg_mask_lock; - }; - -@@ -839,6 +841,16 @@ static int nwl_pcie_probe(struct platform_device *pdev) - return err; - } - -+ pcie->clk = devm_clk_get(dev, NULL); -+ if (IS_ERR(pcie->clk)) -+ return PTR_ERR(pcie->clk); -+ -+ err = clk_prepare_enable(pcie->clk); -+ if (err) { -+ dev_err(dev, "can't enable PCIe ref clock\n"); -+ return err; -+ } -+ - err = nwl_pcie_bridge_init(pcie); - if (err) { - dev_err(dev, "HW Initialization failed\n"); -diff --git a/drivers/pci/hotplug/TODO b/drivers/pci/hotplug/TODO -index a32070be5adf9..cc6194aa24c15 100644 ---- a/drivers/pci/hotplug/TODO -+++ b/drivers/pci/hotplug/TODO -@@ -40,9 +40,6 @@ ibmphp: - - * The return value of pci_hp_register() is not checked. - --* iounmap(io_mem) is called in the error path of ebda_rsrc_controller() -- and once more in the error path of its caller ibmphp_access_ebda(). -- - * The various slot data structures are difficult to follow and need to be - simplified. A lot of functions are too large and too complex, they need - to be broken up into smaller, manageable pieces. Negative examples are -diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c -index 11a2661dc0627..7fb75401ad8a7 100644 ---- a/drivers/pci/hotplug/ibmphp_ebda.c -+++ b/drivers/pci/hotplug/ibmphp_ebda.c -@@ -714,8 +714,7 @@ static int __init ebda_rsrc_controller(void) - /* init hpc structure */ - hpc_ptr = alloc_ebda_hpc(slot_num, bus_num); - if (!hpc_ptr) { -- rc = -ENOMEM; -- goto error_no_hpc; -+ return -ENOMEM; - } - hpc_ptr->ctlr_id = ctlr_id; - hpc_ptr->ctlr_relative_id = ctlr; -@@ -910,8 +909,6 @@ error: - kfree(tmp_slot); - error_no_slot: - free_ebda_hpc(hpc_ptr); --error_no_hpc: -- iounmap(io_mem); - return rc; - } - -diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c -index 5bb37671a86ad..c8bd243717b7b 100644 ---- a/drivers/pci/msi.c -+++ b/drivers/pci/msi.c -@@ -782,6 +782,9 @@ static void msix_mask_all(void __iomem *base, int tsize) - u32 ctrl = PCI_MSIX_ENTRY_CTRL_MASKBIT; - int i; - -+ if (pci_msi_ignore_mask) -+ return; -+ - for (i = 0; i < tsize; i++, base += PCI_MSIX_ENTRY_SIZE) - writel(ctrl, base + PCI_MSIX_ENTRY_VECTOR_CTRL); - } -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 58c33b65d451a..b9550cd4280ca 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -224,7 +224,7 @@ static int pci_dev_str_match_path(struct pci_dev *dev, const char *path, - - *endptr = strchrnul(path, ';'); - -- wpath = kmemdup_nul(path, *endptr - path, GFP_KERNEL); -+ wpath = kmemdup_nul(path, *endptr - path, GFP_ATOMIC); - if (!wpath) - return -ENOMEM; - -@@ -1672,11 +1672,7 @@ static int pci_enable_device_flags(struct pci_dev *dev, unsigned long flags) - * so that things like MSI message writing will behave as expected - * (e.g. if the device really is in D0 at enable time). - */ -- if (dev->pm_cap) { -- u16 pmcsr; -- pci_read_config_word(dev, dev->pm_cap + PCI_PM_CTRL, &pmcsr); -- dev->current_state = (pmcsr & PCI_PM_CTRL_STATE_MASK); -- } -+ pci_update_current_state(dev, dev->current_state); - - if (atomic_inc_return(&dev->enable_cnt) > 1) - return 0; /* already enabled */ -diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c -index 1b330129089fe..8637f6068f9c2 100644 ---- a/drivers/pci/pcie/portdrv_core.c -+++ b/drivers/pci/pcie/portdrv_core.c -@@ -255,8 +255,13 @@ static int get_port_device_capability(struct pci_dev *dev) - services |= PCIE_PORT_SERVICE_DPC; - - if (pci_pcie_type(dev) == PCI_EXP_TYPE_DOWNSTREAM || -- pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) -- services |= PCIE_PORT_SERVICE_BWNOTIF; -+ pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT) { -+ u32 linkcap; -+ -+ pcie_capability_read_dword(dev, PCI_EXP_LNKCAP, &linkcap); -+ if (linkcap & PCI_EXP_LNKCAP_LBNC) -+ services |= PCIE_PORT_SERVICE_BWNOTIF; -+ } - - return services; - } -diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c -index 97c343d31f989..686298c0f6cda 100644 ---- a/drivers/pci/quirks.c -+++ b/drivers/pci/quirks.c -@@ -3252,6 +3252,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, - PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256); - DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLARFLARE, - PCI_DEVICE_ID_SOLARFLARE_SFC4000B, fixup_mpss_256); -+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_ASMEDIA, 0x0612, fixup_mpss_256); - - /* - * Intel 5000 and 5100 Memory controllers have an erratum with read completion -@@ -4683,6 +4684,18 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) - PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); - } - -+/* -+ * Each of these NXP Root Ports is in a Root Complex with a unique segment -+ * number and does provide isolation features to disable peer transactions -+ * and validate bus numbers in requests, but does not provide an ACS -+ * capability. -+ */ -+static int pci_quirk_nxp_rp_acs(struct pci_dev *dev, u16 acs_flags) -+{ -+ return pci_acs_ctrl_enabled(acs_flags, -+ PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF); -+} -+ - static int pci_quirk_al_acs(struct pci_dev *dev, u16 acs_flags) - { - if (pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) -@@ -4909,6 +4922,10 @@ static const struct pci_dev_acs_enabled { - { 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */ - /* Cavium ThunderX */ - { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs }, -+ /* Cavium multi-function devices */ -+ { PCI_VENDOR_ID_CAVIUM, 0xA026, pci_quirk_mf_endpoint_acs }, -+ { PCI_VENDOR_ID_CAVIUM, 0xA059, pci_quirk_mf_endpoint_acs }, -+ { PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs }, - /* APM X-Gene */ - { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs }, - /* Ampere Computing */ -@@ -4929,6 +4946,39 @@ static const struct pci_dev_acs_enabled { - { PCI_VENDOR_ID_ZHAOXIN, 0x3038, pci_quirk_mf_endpoint_acs }, - { PCI_VENDOR_ID_ZHAOXIN, 0x3104, pci_quirk_mf_endpoint_acs }, - { PCI_VENDOR_ID_ZHAOXIN, 0x9083, pci_quirk_mf_endpoint_acs }, -+ /* NXP root ports, xx=16, 12, or 08 cores */ -+ /* LX2xx0A : without security features + CAN-FD */ -+ { PCI_VENDOR_ID_NXP, 0x8d81, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8da1, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d83, pci_quirk_nxp_rp_acs }, -+ /* LX2xx0C : security features + CAN-FD */ -+ { PCI_VENDOR_ID_NXP, 0x8d80, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8da0, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d82, pci_quirk_nxp_rp_acs }, -+ /* LX2xx0E : security features + CAN */ -+ { PCI_VENDOR_ID_NXP, 0x8d90, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8db0, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d92, pci_quirk_nxp_rp_acs }, -+ /* LX2xx0N : without security features + CAN */ -+ { PCI_VENDOR_ID_NXP, 0x8d91, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8db1, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d93, pci_quirk_nxp_rp_acs }, -+ /* LX2xx2A : without security features + CAN-FD */ -+ { PCI_VENDOR_ID_NXP, 0x8d89, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8da9, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d8b, pci_quirk_nxp_rp_acs }, -+ /* LX2xx2C : security features + CAN-FD */ -+ { PCI_VENDOR_ID_NXP, 0x8d88, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8da8, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d8a, pci_quirk_nxp_rp_acs }, -+ /* LX2xx2E : security features + CAN */ -+ { PCI_VENDOR_ID_NXP, 0x8d98, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8db8, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d9a, pci_quirk_nxp_rp_acs }, -+ /* LX2xx2N : without security features + CAN */ -+ { PCI_VENDOR_ID_NXP, 0x8d99, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8db9, pci_quirk_nxp_rp_acs }, -+ { PCI_VENDOR_ID_NXP, 0x8d9b, pci_quirk_nxp_rp_acs }, - /* Zhaoxin Root/Downstream Ports */ - { PCI_VENDOR_ID_ZHAOXIN, PCI_ANY_ID, pci_quirk_zhaoxin_pcie_ports_acs }, - { 0 } -@@ -5393,7 +5443,7 @@ DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, - PCI_CLASS_MULTIMEDIA_HD_AUDIO, 8, quirk_gpu_hda); - - /* -- * Create device link for NVIDIA GPU with integrated USB xHCI Host -+ * Create device link for GPUs with integrated USB xHCI Host - * controller to VGA. - */ - static void quirk_gpu_usb(struct pci_dev *usb) -@@ -5402,9 +5452,11 @@ static void quirk_gpu_usb(struct pci_dev *usb) - } - DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, - PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb); -+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID, -+ PCI_CLASS_SERIAL_USB, 8, quirk_gpu_usb); - - /* -- * Create device link for NVIDIA GPU with integrated Type-C UCSI controller -+ * Create device link for GPUs with integrated Type-C UCSI controller - * to VGA. Currently there is no class code defined for UCSI device over PCI - * so using UNKNOWN class for now and it will be updated when UCSI - * over PCI gets a class code. -@@ -5417,6 +5469,9 @@ static void quirk_gpu_usb_typec_ucsi(struct pci_dev *ucsi) - DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, - PCI_CLASS_SERIAL_UNKNOWN, 8, - quirk_gpu_usb_typec_ucsi); -+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_ATI, PCI_ANY_ID, -+ PCI_CLASS_SERIAL_UNKNOWN, 8, -+ quirk_gpu_usb_typec_ucsi); - - /* - * Enable the NVIDIA GPU integrated HDA controller if the BIOS left it -diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c -index 8b003c890b87b..c9f03418e71e0 100644 ---- a/drivers/pci/syscall.c -+++ b/drivers/pci/syscall.c -@@ -22,8 +22,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsigned long, bus, unsigned long, dfn, - long err; - int cfg_ret; - -+ err = -EPERM; -+ dev = NULL; - if (!capable(CAP_SYS_ADMIN)) -- return -EPERM; -+ goto error; - - err = -ENODEV; - dev = pci_get_domain_bus_and_slot(0, bus, dfn); -diff --git a/drivers/pinctrl/pinctrl-ingenic.c b/drivers/pinctrl/pinctrl-ingenic.c -index 91596eee0bda1..ba078a7098468 100644 ---- a/drivers/pinctrl/pinctrl-ingenic.c -+++ b/drivers/pinctrl/pinctrl-ingenic.c -@@ -348,7 +348,7 @@ static const struct ingenic_chip_info jz4725b_chip_info = { - }; - - static const u32 jz4760_pull_ups[6] = { -- 0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0xfffff00f, -+ 0xffffffff, 0xfffcf3ff, 0xffffffff, 0xffffcfff, 0xfffffb7c, 0x0000000f, - }; - - static const u32 jz4760_pull_downs[6] = { -@@ -611,11 +611,11 @@ static const struct ingenic_chip_info jz4760b_chip_info = { - }; - - static const u32 jz4770_pull_ups[6] = { -- 0x3fffffff, 0xfff0030c, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0xffa7f00f, -+ 0x3fffffff, 0xfff0f3fc, 0xffffffff, 0xffff4fff, 0xfffffb7c, 0x0024f00f, - }; - - static const u32 jz4770_pull_downs[6] = { -- 0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x00580ff0, -+ 0x00000000, 0x000f0c03, 0x00000000, 0x0000b000, 0x00000483, 0x005b0ff0, - }; - - static int jz4770_uart0_data_pins[] = { 0xa0, 0xa3, }; -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index a9d511982780c..fb1c8965cb991 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -1201,6 +1201,7 @@ static int pcs_parse_bits_in_pinctrl_entry(struct pcs_device *pcs, - - if (PCS_HAS_PINCONF) { - dev_err(pcs->dev, "pinconf not supported\n"); -+ res = -ENOTSUPP; - goto free_pingroups; - } - -diff --git a/drivers/pinctrl/pinctrl-stmfx.c b/drivers/pinctrl/pinctrl-stmfx.c -index ccdf0bb214149..835c14bb315bc 100644 ---- a/drivers/pinctrl/pinctrl-stmfx.c -+++ b/drivers/pinctrl/pinctrl-stmfx.c -@@ -540,7 +540,7 @@ static irqreturn_t stmfx_pinctrl_irq_thread_fn(int irq, void *dev_id) - u8 pending[NR_GPIO_REGS]; - u8 src[NR_GPIO_REGS] = {0, 0, 0}; - unsigned long n, status; -- int ret; -+ int i, ret; - - ret = regmap_bulk_read(pctl->stmfx->map, STMFX_REG_IRQ_GPI_PENDING, - &pending, NR_GPIO_REGS); -@@ -550,7 +550,9 @@ static irqreturn_t stmfx_pinctrl_irq_thread_fn(int irq, void *dev_id) - regmap_bulk_write(pctl->stmfx->map, STMFX_REG_IRQ_GPI_SRC, - src, NR_GPIO_REGS); - -- status = *(unsigned long *)pending; -+ BUILD_BUG_ON(NR_GPIO_REGS > sizeof(status)); -+ for (i = 0, status = 0; i < NR_GPIO_REGS; i++) -+ status |= (unsigned long)pending[i] << (i * 8); - for_each_set_bit(n, &status, gc->ngpio) { - handle_nested_irq(irq_find_mapping(gc->irq.domain, n)); - stmfx_pinctrl_irq_toggle_trigger(pctl, n); -diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c -index f26574ef234ab..601fffeba39fe 100644 ---- a/drivers/pinctrl/samsung/pinctrl-samsung.c -+++ b/drivers/pinctrl/samsung/pinctrl-samsung.c -@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev, - pin_bank->grange.pin_base = drvdata->pin_base - + pin_bank->pin_base; - pin_bank->grange.base = pin_bank->grange.pin_base; -- pin_bank->grange.npins = pin_bank->gpio_chip.ngpio; -+ pin_bank->grange.npins = pin_bank->nr_pins; - pin_bank->grange.gc = &pin_bank->gpio_chip; - pinctrl_add_gpio_range(drvdata->pctl_dev, &pin_bank->grange); - } -diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c -index f659f96bda128..9b575e9dd71c5 100644 ---- a/drivers/platform/chrome/cros_ec_proto.c -+++ b/drivers/platform/chrome/cros_ec_proto.c -@@ -213,6 +213,15 @@ static int cros_ec_host_command_proto_query(struct cros_ec_device *ec_dev, - msg->insize = sizeof(struct ec_response_get_protocol_info); - - ret = send_command(ec_dev, msg); -+ /* -+ * Send command once again when timeout occurred. -+ * Fingerprint MCU (FPMCU) is restarted during system boot which -+ * introduces small window in which FPMCU won't respond for any -+ * messages sent by kernel. There is no need to wait before next -+ * attempt because we waited at least EC_MSG_DEADLINE_MS. -+ */ -+ if (ret == -ETIMEDOUT) -+ ret = send_command(ec_dev, msg); - - if (ret < 0) { - dev_dbg(ec_dev->dev, -diff --git a/drivers/platform/x86/dell-smbios-wmi.c b/drivers/platform/x86/dell-smbios-wmi.c -index c97bd4a452422..5821e9d9a4ce4 100644 ---- a/drivers/platform/x86/dell-smbios-wmi.c -+++ b/drivers/platform/x86/dell-smbios-wmi.c -@@ -69,6 +69,7 @@ static int run_smbios_call(struct wmi_device *wdev) - if (obj->type == ACPI_TYPE_INTEGER) - dev_dbg(&wdev->dev, "SMBIOS call failed: %llu\n", - obj->integer.value); -+ kfree(output.pointer); - return -EIO; - } - memcpy(&priv->buf->std, obj->buffer.pointer, obj->buffer.length); -diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c -index ab4740c3bf573..f8f8207a1895e 100644 ---- a/drivers/power/supply/max17042_battery.c -+++ b/drivers/power/supply/max17042_battery.c -@@ -842,8 +842,12 @@ static irqreturn_t max17042_thread_handler(int id, void *dev) - { - struct max17042_chip *chip = dev; - u32 val; -+ int ret; -+ -+ ret = regmap_read(chip->regmap, MAX17042_STATUS, &val); -+ if (ret) -+ return IRQ_HANDLED; - -- regmap_read(chip->regmap, MAX17042_STATUS, &val); - if ((val & STATUS_INTR_SOCMIN_BIT) || - (val & STATUS_INTR_SOCMAX_BIT)) { - dev_info(&chip->client->dev, "SOC threshold INTR\n"); -diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c -index 2c0467a9e7179..8d1b1fda62dd1 100644 ---- a/drivers/rtc/rtc-tps65910.c -+++ b/drivers/rtc/rtc-tps65910.c -@@ -460,6 +460,6 @@ static struct platform_driver tps65910_rtc_driver = { - }; - - module_platform_driver(tps65910_rtc_driver); --MODULE_ALIAS("platform:rtc-tps65910"); -+MODULE_ALIAS("platform:tps65910-rtc"); - MODULE_AUTHOR("Venu Byravarasu "); - MODULE_LICENSE("GPL"); -diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c -index cc5e84b80c699..faa3a4b8ed91d 100644 ---- a/drivers/s390/char/sclp_early.c -+++ b/drivers/s390/char/sclp_early.c -@@ -40,13 +40,14 @@ static void __init sclp_early_facilities_detect(struct read_info_sccb *sccb) - sclp.has_gisaf = !!(sccb->fac118 & 0x08); - sclp.has_hvs = !!(sccb->fac119 & 0x80); - sclp.has_kss = !!(sccb->fac98 & 0x01); -- sclp.has_sipl = !!(sccb->cbl & 0x4000); - if (sccb->fac85 & 0x02) - S390_lowcore.machine_flags |= MACHINE_FLAG_ESOP; - if (sccb->fac91 & 0x40) - S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_GUEST; - if (sccb->cpuoff > 134) - sclp.has_diag318 = !!(sccb->byte_134 & 0x80); -+ if (sccb->cpuoff > 137) -+ sclp.has_sipl = !!(sccb->cbl & 0x4000); - sclp.rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2; - sclp.rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2; - sclp.rzm <<= 20; -diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c -index 6e988233fb81f..6a54556119dd6 100644 ---- a/drivers/scsi/BusLogic.c -+++ b/drivers/scsi/BusLogic.c -@@ -3601,7 +3601,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt, - if (buf[0] != '\n' || len > 1) - printk("%sscsi%d: %s", blogic_msglevelmap[msglevel], adapter->host_no, buf); - } else -- printk("%s", buf); -+ pr_cont("%s", buf); - } else { - if (begin) { - if (adapter != NULL && adapter->adapter_initd) -@@ -3609,7 +3609,7 @@ static void blogic_msg(enum blogic_msglevel msglevel, char *fmt, - else - printk("%s%s", blogic_msglevelmap[msglevel], buf); - } else -- printk("%s", buf); -+ pr_cont("%s", buf); - } - begin = (buf[len - 1] == '\n'); - } -diff --git a/drivers/scsi/pcmcia/fdomain_cs.c b/drivers/scsi/pcmcia/fdomain_cs.c -index e42acf314d068..33df6a9ba9b5f 100644 ---- a/drivers/scsi/pcmcia/fdomain_cs.c -+++ b/drivers/scsi/pcmcia/fdomain_cs.c -@@ -45,8 +45,10 @@ static int fdomain_probe(struct pcmcia_device *link) - goto fail_disable; - - if (!request_region(link->resource[0]->start, FDOMAIN_REGION_SIZE, -- "fdomain_cs")) -+ "fdomain_cs")) { -+ ret = -EBUSY; - goto fail_disable; -+ } - - sh = fdomain_create(link->resource[0]->start, link->irq, 7, &link->dev); - if (!sh) { -diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c -index 7a6306f8483ec..c95e04cc64240 100644 ---- a/drivers/scsi/qedf/qedf_main.c -+++ b/drivers/scsi/qedf/qedf_main.c -@@ -2894,7 +2894,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) - { - u32 *list; - int i; -- int status = 0, rc; -+ int status; - u32 *pbl; - dma_addr_t page; - int num_pages; -@@ -2906,7 +2906,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) - */ - if (!qedf->num_queues) { - QEDF_ERR(&(qedf->dbg_ctx), "No MSI-X vectors available!\n"); -- return 1; -+ return -ENOMEM; - } - - /* -@@ -2914,7 +2914,7 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) - * addresses of our queues - */ - if (!qedf->p_cpuq) { -- status = 1; -+ status = -EINVAL; - QEDF_ERR(&qedf->dbg_ctx, "p_cpuq is NULL.\n"); - goto mem_alloc_failure; - } -@@ -2930,8 +2930,8 @@ static int qedf_alloc_global_queues(struct qedf_ctx *qedf) - "qedf->global_queues=%p.\n", qedf->global_queues); - - /* Allocate DMA coherent buffers for BDQ */ -- rc = qedf_alloc_bdq(qedf); -- if (rc) { -+ status = qedf_alloc_bdq(qedf); -+ if (status) { - QEDF_ERR(&qedf->dbg_ctx, "Unable to allocate bdq.\n"); - goto mem_alloc_failure; - } -diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c -index 1ec42c5f0b2a0..92c4a367b7bd7 100644 ---- a/drivers/scsi/qedi/qedi_main.c -+++ b/drivers/scsi/qedi/qedi_main.c -@@ -1553,7 +1553,7 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) - { - u32 *list; - int i; -- int status = 0, rc; -+ int status; - u32 *pbl; - dma_addr_t page; - int num_pages; -@@ -1564,14 +1564,14 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) - */ - if (!qedi->num_queues) { - QEDI_ERR(&qedi->dbg_ctx, "No MSI-X vectors available!\n"); -- return 1; -+ return -ENOMEM; - } - - /* Make sure we allocated the PBL that will contain the physical - * addresses of our queues - */ - if (!qedi->p_cpuq) { -- status = 1; -+ status = -EINVAL; - goto mem_alloc_failure; - } - -@@ -1586,13 +1586,13 @@ static int qedi_alloc_global_queues(struct qedi_ctx *qedi) - "qedi->global_queues=%p.\n", qedi->global_queues); - - /* Allocate DMA coherent buffers for BDQ */ -- rc = qedi_alloc_bdq(qedi); -- if (rc) -+ status = qedi_alloc_bdq(qedi); -+ if (status) - goto mem_alloc_failure; - - /* Allocate DMA coherent buffers for NVM_ISCSI_CFG */ -- rc = qedi_alloc_nvm_iscsi_cfg(qedi); -- if (rc) -+ status = qedi_alloc_nvm_iscsi_cfg(qedi); -+ if (status) - goto mem_alloc_failure; - - /* Allocate a CQ and an associated PBL for each MSI-X -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 11656e864fca9..97453c12b7358 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -84,8 +84,9 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport, - struct qla_hw_data *ha; - struct qla_qpair *qpair; - -- if (!qidx) -- qidx++; -+ /* Map admin queue and 1st IO queue to index 0 */ -+ if (qidx) -+ qidx--; - - vha = (struct scsi_qla_host *)lport->private; - ha = vha->hw; -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 052ce78814075..28cbefe715e59 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -2799,6 +2800,11 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - return ret; - } - -+ if (is_kdump_kernel()) { -+ ql2xmqsupport = 0; -+ ql2xallocfwdump = 0; -+ } -+ - /* This may fail but that's ok */ - pci_enable_pcie_error_reporting(pdev); - -diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c -index 9bc451004184f..80ff00025c03d 100644 ---- a/drivers/scsi/smartpqi/smartpqi_init.c -+++ b/drivers/scsi/smartpqi/smartpqi_init.c -@@ -1192,6 +1192,7 @@ static int pqi_get_raid_map(struct pqi_ctrl_info *ctrl_info, - "Requested %d bytes, received %d bytes", - raid_map_size, - get_unaligned_le32(&raid_map->structure_size)); -+ rc = -EINVAL; - goto error; - } - } -diff --git a/drivers/soc/aspeed/aspeed-lpc-ctrl.c b/drivers/soc/aspeed/aspeed-lpc-ctrl.c -index 01ed21e8bfee5..040c7dc1d4792 100644 ---- a/drivers/soc/aspeed/aspeed-lpc-ctrl.c -+++ b/drivers/soc/aspeed/aspeed-lpc-ctrl.c -@@ -46,7 +46,7 @@ static int aspeed_lpc_ctrl_mmap(struct file *file, struct vm_area_struct *vma) - unsigned long vsize = vma->vm_end - vma->vm_start; - pgprot_t prot = vma->vm_page_prot; - -- if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size) -+ if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT) - return -EINVAL; - - /* ast2400/2500 AHB accesses are not cache coherent */ -diff --git a/drivers/soc/aspeed/aspeed-p2a-ctrl.c b/drivers/soc/aspeed/aspeed-p2a-ctrl.c -index b60fbeaffcbd0..20b5fb2a207cc 100644 ---- a/drivers/soc/aspeed/aspeed-p2a-ctrl.c -+++ b/drivers/soc/aspeed/aspeed-p2a-ctrl.c -@@ -110,7 +110,7 @@ static int aspeed_p2a_mmap(struct file *file, struct vm_area_struct *vma) - vsize = vma->vm_end - vma->vm_start; - prot = vma->vm_page_prot; - -- if (vma->vm_pgoff + vsize > ctrl->mem_base + ctrl->mem_size) -+ if (vma->vm_pgoff + vma_pages(vma) > ctrl->mem_size >> PAGE_SHIFT) - return -EINVAL; - - /* ast2400/2500 AHB accesses are not cache coherent */ -diff --git a/drivers/soc/qcom/qcom_aoss.c b/drivers/soc/qcom/qcom_aoss.c -index 33a27e6c6d67d..45c5aa712edac 100644 ---- a/drivers/soc/qcom/qcom_aoss.c -+++ b/drivers/soc/qcom/qcom_aoss.c -@@ -472,12 +472,12 @@ static int qmp_cooling_device_add(struct qmp *qmp, - static int qmp_cooling_devices_register(struct qmp *qmp) - { - struct device_node *np, *child; -- int count = QMP_NUM_COOLING_RESOURCES; -+ int count = 0; - int ret; - - np = qmp->dev->of_node; - -- qmp->cooling_devs = devm_kcalloc(qmp->dev, count, -+ qmp->cooling_devs = devm_kcalloc(qmp->dev, QMP_NUM_COOLING_RESOURCES, - sizeof(*qmp->cooling_devs), - GFP_KERNEL); - -@@ -493,12 +493,16 @@ static int qmp_cooling_devices_register(struct qmp *qmp) - goto unroll; - } - -+ if (!count) -+ devm_kfree(qmp->dev, qmp->cooling_devs); -+ - return 0; - - unroll: - while (--count >= 0) - thermal_cooling_device_unregister - (qmp->cooling_devs[count].cdev); -+ devm_kfree(qmp->dev, qmp->cooling_devs); - - return ret; - } -diff --git a/drivers/staging/board/board.c b/drivers/staging/board/board.c -index cb6feb34dd401..f980af0373452 100644 ---- a/drivers/staging/board/board.c -+++ b/drivers/staging/board/board.c -@@ -136,6 +136,7 @@ int __init board_staging_register_clock(const struct board_staging_clk *bsc) - static int board_staging_add_dev_domain(struct platform_device *pdev, - const char *domain) - { -+ struct device *dev = &pdev->dev; - struct of_phandle_args pd_args; - struct device_node *np; - -@@ -148,7 +149,11 @@ static int board_staging_add_dev_domain(struct platform_device *pdev, - pd_args.np = np; - pd_args.args_count = 0; - -- return of_genpd_add_device(&pd_args, &pdev->dev); -+ /* Initialization similar to device_pm_init_common() */ -+ spin_lock_init(&dev->power.lock); -+ dev->power.early_init = true; -+ -+ return of_genpd_add_device(&pd_args, dev); - } - #else - static inline int board_staging_add_dev_domain(struct platform_device *pdev, -diff --git a/drivers/staging/ks7010/ks7010_sdio.c b/drivers/staging/ks7010/ks7010_sdio.c -index 4b379542ecd50..3fbe223d59b8e 100644 ---- a/drivers/staging/ks7010/ks7010_sdio.c -+++ b/drivers/staging/ks7010/ks7010_sdio.c -@@ -938,9 +938,9 @@ static void ks7010_private_init(struct ks_wlan_private *priv, - memset(&priv->wstats, 0, sizeof(priv->wstats)); - - /* sleep mode */ -+ atomic_set(&priv->sleepstatus.status, 0); - atomic_set(&priv->sleepstatus.doze_request, 0); - atomic_set(&priv->sleepstatus.wakeup_request, 0); -- atomic_set(&priv->sleepstatus.wakeup_request, 0); - - trx_device_init(priv); - hostif_init(priv); -diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c -index 1deb74112ad43..11d9d9155eef2 100644 ---- a/drivers/staging/rts5208/rtsx_scsi.c -+++ b/drivers/staging/rts5208/rtsx_scsi.c -@@ -2802,10 +2802,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) - } - - if (dev_info_id == 0x15) { -- buf_len = 0x3A; -+ buf_len = 0x3C; - data_len = 0x3A; - } else { -- buf_len = 0x6A; -+ buf_len = 0x6C; - data_len = 0x6A; - } - -@@ -2855,11 +2855,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) - } - - rtsx_stor_set_xfer_buf(buf, buf_len, srb); -- -- if (dev_info_id == 0x15) -- scsi_set_resid(srb, scsi_bufflen(srb) - 0x3C); -- else -- scsi_set_resid(srb, scsi_bufflen(srb) - 0x6C); -+ scsi_set_resid(srb, scsi_bufflen(srb) - buf_len); - - kfree(buf); - return STATUS_SUCCESS; -diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c -index 596ad3edec9c0..48fabece76443 100644 ---- a/drivers/target/target_core_xcopy.c -+++ b/drivers/target/target_core_xcopy.c -@@ -533,7 +533,6 @@ void target_xcopy_release_pt(void) - * @cdb: SCSI CDB to be copied into @xpt_cmd. - * @remote_port: If false, use the LUN through which the XCOPY command has - * been received. If true, use @se_dev->xcopy_lun. -- * @alloc_mem: Whether or not to allocate an SGL list. - * - * Set up a SCSI command (READ or WRITE) that will be used to execute an - * XCOPY command. -@@ -543,12 +542,9 @@ static int target_xcopy_setup_pt_cmd( - struct xcopy_op *xop, - struct se_device *se_dev, - unsigned char *cdb, -- bool remote_port, -- bool alloc_mem) -+ bool remote_port) - { - struct se_cmd *cmd = &xpt_cmd->se_cmd; -- sense_reason_t sense_rc; -- int ret = 0, rc; - - /* - * Setup LUN+port to honor reservations based upon xop->op_origin for -@@ -564,46 +560,17 @@ static int target_xcopy_setup_pt_cmd( - cmd->se_cmd_flags |= SCF_SE_LUN_CMD; - - cmd->tag = 0; -- sense_rc = target_setup_cmd_from_cdb(cmd, cdb); -- if (sense_rc) { -- ret = -EINVAL; -- goto out; -- } -+ if (target_setup_cmd_from_cdb(cmd, cdb)) -+ return -EINVAL; - -- if (alloc_mem) { -- rc = target_alloc_sgl(&cmd->t_data_sg, &cmd->t_data_nents, -- cmd->data_length, false, false); -- if (rc < 0) { -- ret = rc; -- goto out; -- } -- /* -- * Set this bit so that transport_free_pages() allows the -- * caller to release SGLs + physical memory allocated by -- * transport_generic_get_mem().. -- */ -- cmd->se_cmd_flags |= SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC; -- } else { -- /* -- * Here the previously allocated SGLs for the internal READ -- * are mapped zero-copy to the internal WRITE. -- */ -- sense_rc = transport_generic_map_mem_to_cmd(cmd, -- xop->xop_data_sg, xop->xop_data_nents, -- NULL, 0); -- if (sense_rc) { -- ret = -EINVAL; -- goto out; -- } -+ if (transport_generic_map_mem_to_cmd(cmd, xop->xop_data_sg, -+ xop->xop_data_nents, NULL, 0)) -+ return -EINVAL; - -- pr_debug("Setup PASSTHROUGH_NOALLOC t_data_sg: %p t_data_nents:" -- " %u\n", cmd->t_data_sg, cmd->t_data_nents); -- } -+ pr_debug("Setup PASSTHROUGH_NOALLOC t_data_sg: %p t_data_nents:" -+ " %u\n", cmd->t_data_sg, cmd->t_data_nents); - - return 0; -- --out: -- return ret; - } - - static int target_xcopy_issue_pt_cmd(struct xcopy_pt_cmd *xpt_cmd) -@@ -660,15 +627,13 @@ static int target_xcopy_read_source( - xop->src_pt_cmd = xpt_cmd; - - rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, src_dev, &cdb[0], -- remote_port, true); -+ remote_port); - if (rc < 0) { - ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status; - transport_generic_free_cmd(se_cmd, 0); - return rc; - } - -- xop->xop_data_sg = se_cmd->t_data_sg; -- xop->xop_data_nents = se_cmd->t_data_nents; - pr_debug("XCOPY-READ: Saved xop->xop_data_sg: %p, num: %u for READ" - " memory\n", xop->xop_data_sg, xop->xop_data_nents); - -@@ -678,12 +643,6 @@ static int target_xcopy_read_source( - transport_generic_free_cmd(se_cmd, 0); - return rc; - } -- /* -- * Clear off the allocated t_data_sg, that has been saved for -- * zero-copy WRITE submission reuse in struct xcopy_op.. -- */ -- se_cmd->t_data_sg = NULL; -- se_cmd->t_data_nents = 0; - - return 0; - } -@@ -722,19 +681,9 @@ static int target_xcopy_write_destination( - xop->dst_pt_cmd = xpt_cmd; - - rc = target_xcopy_setup_pt_cmd(xpt_cmd, xop, dst_dev, &cdb[0], -- remote_port, false); -+ remote_port); - if (rc < 0) { -- struct se_cmd *src_cmd = &xop->src_pt_cmd->se_cmd; - ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status; -- /* -- * If the failure happened before the t_mem_list hand-off in -- * target_xcopy_setup_pt_cmd(), Reset memory + clear flag so that -- * core releases this memory on error during X-COPY WRITE I/O. -- */ -- src_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC; -- src_cmd->t_data_sg = xop->xop_data_sg; -- src_cmd->t_data_nents = xop->xop_data_nents; -- - transport_generic_free_cmd(se_cmd, 0); - return rc; - } -@@ -742,7 +691,6 @@ static int target_xcopy_write_destination( - rc = target_xcopy_issue_pt_cmd(xpt_cmd); - if (rc < 0) { - ec_cmd->scsi_status = xpt_cmd->se_cmd.scsi_status; -- se_cmd->se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC; - transport_generic_free_cmd(se_cmd, 0); - return rc; - } -@@ -758,7 +706,7 @@ static void target_xcopy_do_work(struct work_struct *work) - sector_t src_lba, dst_lba, end_lba; - unsigned int max_sectors; - int rc = 0; -- unsigned short nolb, cur_nolb, max_nolb, copied_nolb = 0; -+ unsigned short nolb, max_nolb, copied_nolb = 0; - - if (target_parse_xcopy_cmd(xop) != TCM_NO_SENSE) - goto err_free; -@@ -788,7 +736,23 @@ static void target_xcopy_do_work(struct work_struct *work) - (unsigned long long)src_lba, (unsigned long long)dst_lba); - - while (src_lba < end_lba) { -- cur_nolb = min(nolb, max_nolb); -+ unsigned short cur_nolb = min(nolb, max_nolb); -+ u32 cur_bytes = cur_nolb * src_dev->dev_attrib.block_size; -+ -+ if (cur_bytes != xop->xop_data_bytes) { -+ /* -+ * (Re)allocate a buffer large enough to hold the XCOPY -+ * I/O size, which can be reused each read / write loop. -+ */ -+ target_free_sgl(xop->xop_data_sg, xop->xop_data_nents); -+ rc = target_alloc_sgl(&xop->xop_data_sg, -+ &xop->xop_data_nents, -+ cur_bytes, -+ false, false); -+ if (rc < 0) -+ goto out; -+ xop->xop_data_bytes = cur_bytes; -+ } - - pr_debug("target_xcopy_do_work: Calling read src_dev: %p src_lba: %llu," - " cur_nolb: %hu\n", src_dev, (unsigned long long)src_lba, cur_nolb); -@@ -819,12 +783,11 @@ static void target_xcopy_do_work(struct work_struct *work) - nolb -= cur_nolb; - - transport_generic_free_cmd(&xop->src_pt_cmd->se_cmd, 0); -- xop->dst_pt_cmd->se_cmd.se_cmd_flags &= ~SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC; -- - transport_generic_free_cmd(&xop->dst_pt_cmd->se_cmd, 0); - } - - xcopy_pt_undepend_remotedev(xop); -+ target_free_sgl(xop->xop_data_sg, xop->xop_data_nents); - kfree(xop); - - pr_debug("target_xcopy_do_work: Final src_lba: %llu, dst_lba: %llu\n", -@@ -838,6 +801,7 @@ static void target_xcopy_do_work(struct work_struct *work) - - out: - xcopy_pt_undepend_remotedev(xop); -+ target_free_sgl(xop->xop_data_sg, xop->xop_data_nents); - - err_free: - kfree(xop); -diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h -index 974bc1e19ff2b..a1805a14eea07 100644 ---- a/drivers/target/target_core_xcopy.h -+++ b/drivers/target/target_core_xcopy.h -@@ -41,6 +41,7 @@ struct xcopy_op { - struct xcopy_pt_cmd *src_pt_cmd; - struct xcopy_pt_cmd *dst_pt_cmd; - -+ u32 xop_data_bytes; - u32 xop_data_nents; - struct scatterlist *xop_data_sg; - struct work_struct xop_work; -diff --git a/drivers/tty/hvc/hvsi.c b/drivers/tty/hvc/hvsi.c -index 66f95f758be05..73226337f5610 100644 ---- a/drivers/tty/hvc/hvsi.c -+++ b/drivers/tty/hvc/hvsi.c -@@ -1038,7 +1038,7 @@ static const struct tty_operations hvsi_ops = { - - static int __init hvsi_init(void) - { -- int i; -+ int i, ret; - - hvsi_driver = alloc_tty_driver(hvsi_count); - if (!hvsi_driver) -@@ -1069,12 +1069,25 @@ static int __init hvsi_init(void) - } - hvsi_wait = wait_for_state; /* irqs active now */ - -- if (tty_register_driver(hvsi_driver)) -- panic("Couldn't register hvsi console driver\n"); -+ ret = tty_register_driver(hvsi_driver); -+ if (ret) { -+ pr_err("Couldn't register hvsi console driver\n"); -+ goto err_free_irq; -+ } - - printk(KERN_DEBUG "HVSI: registered %i devices\n", hvsi_count); - - return 0; -+err_free_irq: -+ hvsi_wait = poll_for_state; -+ for (i = 0; i < hvsi_count; i++) { -+ struct hvsi_struct *hp = &hvsi_ports[i]; -+ -+ free_irq(hp->virq, hp); -+ } -+ tty_driver_kref_put(hvsi_driver); -+ -+ return ret; - } - device_initcall(hvsi_init); - -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 43fc5b6a25d35..a2bb103f22fc6 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -89,7 +89,7 @@ static void moan_device(const char *str, struct pci_dev *dev) - - static int - setup_port(struct serial_private *priv, struct uart_8250_port *port, -- int bar, int offset, int regshift) -+ u8 bar, unsigned int offset, int regshift) - { - struct pci_dev *dev = priv->dev; - -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 8a7c6d65f10ef..777ef1a9591c0 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -125,7 +125,8 @@ static const struct serial8250_config uart_config[] = { - .name = "16C950/954", - .fifo_size = 128, - .tx_loadsz = 128, -- .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10, -+ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_01, -+ .rxtrig_bytes = {16, 32, 112, 120}, - /* UART_CAP_EFR breaks billionon CF bluetooth card. */ - .flags = UART_CAP_FIFO | UART_CAP_SLEEP, - }, -diff --git a/drivers/tty/serial/jsm/jsm_neo.c b/drivers/tty/serial/jsm/jsm_neo.c -index bf0e2a4cb0cef..c6f927a76c3be 100644 ---- a/drivers/tty/serial/jsm/jsm_neo.c -+++ b/drivers/tty/serial/jsm/jsm_neo.c -@@ -815,7 +815,9 @@ static void neo_parse_isr(struct jsm_board *brd, u32 port) - /* Parse any modem signal changes */ - jsm_dbg(INTR, &ch->ch_bd->pci_dev, - "MOD_STAT: sending to parse_modem_sigs\n"); -+ spin_lock_irqsave(&ch->uart_port.lock, lock_flags); - neo_parse_modem(ch, readb(&ch->ch_neo_uart->msr)); -+ spin_unlock_irqrestore(&ch->uart_port.lock, lock_flags); - } - } - -diff --git a/drivers/tty/serial/jsm/jsm_tty.c b/drivers/tty/serial/jsm/jsm_tty.c -index 689774c073ca4..8438454ca653f 100644 ---- a/drivers/tty/serial/jsm/jsm_tty.c -+++ b/drivers/tty/serial/jsm/jsm_tty.c -@@ -187,6 +187,7 @@ static void jsm_tty_break(struct uart_port *port, int break_state) - - static int jsm_tty_open(struct uart_port *port) - { -+ unsigned long lock_flags; - struct jsm_board *brd; - struct jsm_channel *channel = - container_of(port, struct jsm_channel, uart_port); -@@ -240,6 +241,7 @@ static int jsm_tty_open(struct uart_port *port) - channel->ch_cached_lsr = 0; - channel->ch_stops_sent = 0; - -+ spin_lock_irqsave(&port->lock, lock_flags); - termios = &port->state->port.tty->termios; - channel->ch_c_cflag = termios->c_cflag; - channel->ch_c_iflag = termios->c_iflag; -@@ -259,6 +261,7 @@ static int jsm_tty_open(struct uart_port *port) - jsm_carrier(channel); - - channel->ch_open_count++; -+ spin_unlock_irqrestore(&port->lock, lock_flags); - - jsm_dbg(OPEN, &channel->ch_bd->pci_dev, "finish\n"); - return 0; -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 97ee1fc1cd247..ecff9b2088087 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -1763,6 +1763,10 @@ static irqreturn_t sci_br_interrupt(int irq, void *ptr) - - /* Handle BREAKs */ - sci_handle_breaks(port); -+ -+ /* drop invalid character received before break was detected */ -+ serial_port_in(port, SCxRDR); -+ - sci_clear_SCxSR(port, SCxSR_BREAK_CLEAR(port)); - - return IRQ_HANDLED; -@@ -1842,7 +1846,8 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr) - ret = sci_er_interrupt(irq, ptr); - - /* Break Interrupt */ -- if ((ssr_status & SCxSR_BRK(port)) && err_enabled) -+ if (s->irqs[SCIx_ERI_IRQ] != s->irqs[SCIx_BRI_IRQ] && -+ (ssr_status & SCxSR_BRK(port)) && err_enabled) - ret = sci_br_interrupt(irq, ptr); - - /* Overrun Interrupt */ -diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c -index 48e4a5ca18359..f5f56ee07729f 100644 ---- a/drivers/usb/chipidea/host.c -+++ b/drivers/usb/chipidea/host.c -@@ -233,18 +233,26 @@ static int ci_ehci_hub_control( - ) - { - struct ehci_hcd *ehci = hcd_to_ehci(hcd); -+ unsigned int ports = HCS_N_PORTS(ehci->hcs_params); - u32 __iomem *status_reg; -- u32 temp; -+ u32 temp, port_index; - unsigned long flags; - int retval = 0; - struct device *dev = hcd->self.controller; - struct ci_hdrc *ci = dev_get_drvdata(dev); - -- status_reg = &ehci->regs->port_status[(wIndex & 0xff) - 1]; -+ port_index = wIndex & 0xff; -+ port_index -= (port_index > 0); -+ status_reg = &ehci->regs->port_status[port_index]; - - spin_lock_irqsave(&ehci->lock, flags); - - if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) { -+ if (!wIndex || wIndex > ports) { -+ retval = -EPIPE; -+ goto done; -+ } -+ - temp = ehci_readl(ehci, status_reg); - if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) { - retval = -EPIPE; -@@ -273,7 +281,7 @@ static int ci_ehci_hub_control( - ehci_writel(ehci, temp, status_reg); - } - -- set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports); -+ set_bit(port_index, &ehci->suspended_ports); - goto done; - } - -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index 24dad1d78d1ea..6bd3fdb925cd9 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -481,7 +481,7 @@ static u8 encode_bMaxPower(enum usb_device_speed speed, - { - unsigned val; - -- if (c->MaxPower) -+ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER)) - val = c->MaxPower; - else - val = CONFIG_USB_GADGET_VBUS_DRAW; -@@ -905,7 +905,11 @@ static int set_config(struct usb_composite_dev *cdev, - } - - /* when we return, be sure our power usage is valid */ -- power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW; -+ if (c->MaxPower || (c->bmAttributes & USB_CONFIG_ATT_SELFPOWER)) -+ power = c->MaxPower; -+ else -+ power = CONFIG_USB_GADGET_VBUS_DRAW; -+ - if (gadget->speed < USB_SPEED_SUPER) - power = min(power, 500U); - else -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 99b840daf3d94..57da62e331848 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -491,8 +491,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb, - } - spin_unlock_irqrestore(&dev->lock, flags); - -- if (skb && !in) { -- dev_kfree_skb_any(skb); -+ if (!in) { -+ if (skb) -+ dev_kfree_skb_any(skb); - return NETDEV_TX_OK; - } - -diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c -index b6f196f5e252e..b0e0f8ea98a9c 100644 ---- a/drivers/usb/host/ehci-mv.c -+++ b/drivers/usb/host/ehci-mv.c -@@ -41,26 +41,25 @@ struct ehci_hcd_mv { - int (*set_vbus)(unsigned int vbus); - }; - --static void ehci_clock_enable(struct ehci_hcd_mv *ehci_mv) -+static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv) - { -- clk_prepare_enable(ehci_mv->clk); --} -+ int retval; - --static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv) --{ -- clk_disable_unprepare(ehci_mv->clk); --} -+ retval = clk_prepare_enable(ehci_mv->clk); -+ if (retval) -+ return retval; - --static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv) --{ -- ehci_clock_enable(ehci_mv); -- return phy_init(ehci_mv->phy); -+ retval = phy_init(ehci_mv->phy); -+ if (retval) -+ clk_disable_unprepare(ehci_mv->clk); -+ -+ return retval; - } - - static void mv_ehci_disable(struct ehci_hcd_mv *ehci_mv) - { - phy_exit(ehci_mv->phy); -- ehci_clock_disable(ehci_mv); -+ clk_disable_unprepare(ehci_mv->clk); - } - - static int mv_ehci_reset(struct usb_hcd *hcd) -diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c -index c3f74d6674e1d..f457e083a6f89 100644 ---- a/drivers/usb/host/fotg210-hcd.c -+++ b/drivers/usb/host/fotg210-hcd.c -@@ -2511,11 +2511,6 @@ retry_xacterr: - return count; - } - --/* high bandwidth multiplier, as encoded in highspeed endpoint descriptors */ --#define hb_mult(wMaxPacketSize) (1 + (((wMaxPacketSize) >> 11) & 0x03)) --/* ... and packet size, for any kind of endpoint descriptor */ --#define max_packet(wMaxPacketSize) ((wMaxPacketSize) & 0x07ff) -- - /* reverse of qh_urb_transaction: free a list of TDs. - * used for cleanup after errors, before HC sees an URB's TDs. - */ -@@ -2601,7 +2596,7 @@ static struct list_head *qh_urb_transaction(struct fotg210_hcd *fotg210, - token |= (1 /* "in" */ << 8); - /* else it's already initted to "out" pid (0 << 8) */ - -- maxpacket = max_packet(usb_maxpacket(urb->dev, urb->pipe, !is_input)); -+ maxpacket = usb_maxpacket(urb->dev, urb->pipe, !is_input); - - /* - * buffer gets wrapped in one or more qtds; -@@ -2715,9 +2710,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, - gfp_t flags) - { - struct fotg210_qh *qh = fotg210_qh_alloc(fotg210, flags); -+ struct usb_host_endpoint *ep; - u32 info1 = 0, info2 = 0; - int is_input, type; - int maxp = 0; -+ int mult; - struct usb_tt *tt = urb->dev->tt; - struct fotg210_qh_hw *hw; - -@@ -2732,14 +2729,15 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, - - is_input = usb_pipein(urb->pipe); - type = usb_pipetype(urb->pipe); -- maxp = usb_maxpacket(urb->dev, urb->pipe, !is_input); -+ ep = usb_pipe_endpoint(urb->dev, urb->pipe); -+ maxp = usb_endpoint_maxp(&ep->desc); -+ mult = usb_endpoint_maxp_mult(&ep->desc); - - /* 1024 byte maxpacket is a hardware ceiling. High bandwidth - * acts like up to 3KB, but is built from smaller packets. - */ -- if (max_packet(maxp) > 1024) { -- fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", -- max_packet(maxp)); -+ if (maxp > 1024) { -+ fotg210_dbg(fotg210, "bogus qh maxpacket %d\n", maxp); - goto done; - } - -@@ -2753,8 +2751,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, - */ - if (type == PIPE_INTERRUPT) { - qh->usecs = NS_TO_US(usb_calc_bus_time(USB_SPEED_HIGH, -- is_input, 0, -- hb_mult(maxp) * max_packet(maxp))); -+ is_input, 0, mult * maxp)); - qh->start = NO_FRAME; - - if (urb->dev->speed == USB_SPEED_HIGH) { -@@ -2791,7 +2788,7 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, - think_time = tt ? tt->think_time : 0; - qh->tt_usecs = NS_TO_US(think_time + - usb_calc_bus_time(urb->dev->speed, -- is_input, 0, max_packet(maxp))); -+ is_input, 0, maxp)); - qh->period = urb->interval; - if (qh->period > fotg210->periodic_size) { - qh->period = fotg210->periodic_size; -@@ -2854,11 +2851,11 @@ static struct fotg210_qh *qh_make(struct fotg210_hcd *fotg210, struct urb *urb, - * to help them do so. So now people expect to use - * such nonconformant devices with Linux too; sigh. - */ -- info1 |= max_packet(maxp) << 16; -+ info1 |= maxp << 16; - info2 |= (FOTG210_TUNE_MULT_HS << 30); - } else { /* PIPE_INTERRUPT */ -- info1 |= max_packet(maxp) << 16; -- info2 |= hb_mult(maxp) << 30; -+ info1 |= maxp << 16; -+ info2 |= mult << 30; - } - break; - default: -@@ -3928,6 +3925,7 @@ static void iso_stream_init(struct fotg210_hcd *fotg210, - int is_input; - long bandwidth; - unsigned multi; -+ struct usb_host_endpoint *ep; - - /* - * this might be a "high bandwidth" highspeed endpoint, -@@ -3935,14 +3933,14 @@ static void iso_stream_init(struct fotg210_hcd *fotg210, - */ - epnum = usb_pipeendpoint(pipe); - is_input = usb_pipein(pipe) ? USB_DIR_IN : 0; -- maxp = usb_maxpacket(dev, pipe, !is_input); -+ ep = usb_pipe_endpoint(dev, pipe); -+ maxp = usb_endpoint_maxp(&ep->desc); - if (is_input) - buf1 = (1 << 11); - else - buf1 = 0; - -- maxp = max_packet(maxp); -- multi = hb_mult(maxp); -+ multi = usb_endpoint_maxp_mult(&ep->desc); - buf1 |= maxp; - maxp *= multi; - -@@ -4463,13 +4461,12 @@ static bool itd_complete(struct fotg210_hcd *fotg210, struct fotg210_itd *itd) - - /* HC need not update length with this error */ - if (!(t & FOTG210_ISOC_BABBLE)) { -- desc->actual_length = -- fotg210_itdlen(urb, desc, t); -+ desc->actual_length = FOTG210_ITD_LENGTH(t); - urb->actual_length += desc->actual_length; - } - } else if (likely((t & FOTG210_ISOC_ACTIVE) == 0)) { - desc->status = 0; -- desc->actual_length = fotg210_itdlen(urb, desc, t); -+ desc->actual_length = FOTG210_ITD_LENGTH(t); - urb->actual_length += desc->actual_length; - } else { - /* URB was too late */ -diff --git a/drivers/usb/host/fotg210.h b/drivers/usb/host/fotg210.h -index 1b4db95e5c43a..291add93d84ee 100644 ---- a/drivers/usb/host/fotg210.h -+++ b/drivers/usb/host/fotg210.h -@@ -686,11 +686,6 @@ static inline unsigned fotg210_read_frame_index(struct fotg210_hcd *fotg210) - return fotg210_readl(fotg210, &fotg210->regs->frame_index); - } - --#define fotg210_itdlen(urb, desc, t) ({ \ -- usb_pipein((urb)->pipe) ? \ -- (desc)->length - FOTG210_ITD_LENGTH(t) : \ -- FOTG210_ITD_LENGTH(t); \ --}) - /*-------------------------------------------------------------------------*/ - - #endif /* __LINUX_FOTG210_H */ -diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c -index a3813c75a3de8..505da4999e208 100644 ---- a/drivers/usb/host/xhci.c -+++ b/drivers/usb/host/xhci.c -@@ -4662,19 +4662,19 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -- if (xhci->quirks & XHCI_INTEL_HOST) -- timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); -- else -- timeout_ns = udev->u1_params.sel; -- - /* Prevent U1 if service interval is shorter than U1 exit latency */ - if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -- if (xhci_service_interval_to_ns(desc) <= timeout_ns) { -+ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) { - dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n"); - return USB3_LPM_DISABLED; - } - } - -+ if (xhci->quirks & XHCI_INTEL_HOST) -+ timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); -+ else -+ timeout_ns = udev->u1_params.sel; -+ - /* The U1 timeout is encoded in 1us intervals. - * Don't return a timeout of zero, because that's USB3_LPM_DISABLED. - */ -@@ -4726,19 +4726,19 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, - { - unsigned long long timeout_ns; - -- if (xhci->quirks & XHCI_INTEL_HOST) -- timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); -- else -- timeout_ns = udev->u2_params.sel; -- - /* Prevent U2 if service interval is shorter than U2 exit latency */ - if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { -- if (xhci_service_interval_to_ns(desc) <= timeout_ns) { -+ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) { - dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n"); - return USB3_LPM_DISABLED; - } - } - -+ if (xhci->quirks & XHCI_INTEL_HOST) -+ timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); -+ else -+ timeout_ns = udev->u2_params.sel; -+ - /* The U2 timeout is encoded in 256us intervals */ - timeout_ns = DIV_ROUND_UP_ULL(timeout_ns, 256 * 1000); - /* If the necessary timeout value is bigger than what we can set in the -diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c -index 327d4f7baaf7c..89d659cef5c63 100644 ---- a/drivers/usb/musb/musb_dsps.c -+++ b/drivers/usb/musb/musb_dsps.c -@@ -890,23 +890,22 @@ static int dsps_probe(struct platform_device *pdev) - if (!glue->usbss_base) - return -ENXIO; - -- if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) { -- ret = dsps_setup_optional_vbus_irq(pdev, glue); -- if (ret) -- goto err_iounmap; -- } -- - platform_set_drvdata(pdev, glue); - pm_runtime_enable(&pdev->dev); - ret = dsps_create_musb_pdev(glue, pdev); - if (ret) - goto err; - -+ if (usb_get_dr_mode(&pdev->dev) == USB_DR_MODE_PERIPHERAL) { -+ ret = dsps_setup_optional_vbus_irq(pdev, glue); -+ if (ret) -+ goto err; -+ } -+ - return 0; - - err: - pm_runtime_disable(&pdev->dev); --err_iounmap: - iounmap(glue->usbss_base); - return ret; - } -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 98636fbf71882..170abb06a8a4d 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -455,8 +455,14 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - vhci_hcd->port_status[rhport] &= ~(1 << USB_PORT_FEAT_RESET); - vhci_hcd->re_timeout = 0; - -+ /* -+ * A few drivers do usb reset during probe when -+ * the device could be in VDEV_ST_USED state -+ */ - if (vhci_hcd->vdev[rhport].ud.status == -- VDEV_ST_NOTASSIGNED) { -+ VDEV_ST_NOTASSIGNED || -+ vhci_hcd->vdev[rhport].ud.status == -+ VDEV_ST_USED) { - usbip_dbg_vhci_rh( - " enable rhport %d (status %u)\n", - rhport, -@@ -952,8 +958,32 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev) - spin_lock(&vdev->priv_lock); - - list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) { -+ struct urb *urb; -+ -+ /* give back urb of unsent unlink request */ - pr_info("unlink cleanup tx %lu\n", unlink->unlink_seqnum); -+ -+ urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum); -+ if (!urb) { -+ list_del(&unlink->list); -+ kfree(unlink); -+ continue; -+ } -+ -+ urb->status = -ENODEV; -+ -+ usb_hcd_unlink_urb_from_ep(hcd, urb); -+ - list_del(&unlink->list); -+ -+ spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vhci->lock, flags); -+ -+ usb_hcd_giveback_urb(hcd, urb, urb->status); -+ -+ spin_lock_irqsave(&vhci->lock, flags); -+ spin_lock(&vdev->priv_lock); -+ - kfree(unlink); - } - -diff --git a/drivers/vfio/Kconfig b/drivers/vfio/Kconfig -index 503ed2f3fbb5e..65743de8aad11 100644 ---- a/drivers/vfio/Kconfig -+++ b/drivers/vfio/Kconfig -@@ -29,7 +29,7 @@ menuconfig VFIO - - If you don't know what to do here, say N. - --menuconfig VFIO_NOIOMMU -+config VFIO_NOIOMMU - bool "VFIO No-IOMMU support" - depends on VFIO - help -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index 48e574ae60330..cec9173aac6f5 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -466,7 +466,7 @@ static void vhost_tx_batch(struct vhost_net *net, - .num = nvq->batched_xdp, - .ptr = nvq->xdp, - }; -- int err; -+ int i, err; - - if (nvq->batched_xdp == 0) - goto signal_used; -@@ -475,6 +475,15 @@ static void vhost_tx_batch(struct vhost_net *net, - err = sock->ops->sendmsg(sock, msghdr, 0); - if (unlikely(err < 0)) { - vq_err(&nvq->vq, "Fail to batch sending packets\n"); -+ -+ /* free pages owned by XDP; since this is an unlikely error path, -+ * keep it simple and avoid more complex bulk update for the -+ * used pages -+ */ -+ for (i = 0; i < nvq->batched_xdp; ++i) -+ put_page(virt_to_head_page(nvq->xdp[i].data)); -+ nvq->batched_xdp = 0; -+ nvq->done_idx = 0; - return; - } - -diff --git a/drivers/video/fbdev/asiliantfb.c b/drivers/video/fbdev/asiliantfb.c -index ea31054a28ca8..c1d6e63362259 100644 ---- a/drivers/video/fbdev/asiliantfb.c -+++ b/drivers/video/fbdev/asiliantfb.c -@@ -227,6 +227,9 @@ static int asiliantfb_check_var(struct fb_var_screeninfo *var, - { - unsigned long Ftarget, ratio, remainder; - -+ if (!var->pixclock) -+ return -EINVAL; -+ - ratio = 1000000 / var->pixclock; - remainder = 1000000 % var->pixclock; - Ftarget = 1000000 * ratio + (1000000 * remainder) / var->pixclock; -diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c -index a7bd9f25911b5..74bf26b527b91 100644 ---- a/drivers/video/fbdev/kyro/fbdev.c -+++ b/drivers/video/fbdev/kyro/fbdev.c -@@ -372,6 +372,11 @@ static int kyro_dev_overlay_viewport_set(u32 x, u32 y, u32 ulWidth, u32 ulHeight - /* probably haven't called CreateOverlay yet */ - return -EINVAL; - -+ if (ulWidth == 0 || ulWidth == 0xffffffff || -+ ulHeight == 0 || ulHeight == 0xffffffff || -+ (x < 2 && ulWidth + 2 == 0)) -+ return -EINVAL; -+ - /* Stop Ramdac Output */ - DisableRamdacOutput(deviceInfo.pSTGReg); - -@@ -394,6 +399,9 @@ static int kyrofb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) - { - struct kyrofb_info *par = info->par; - -+ if (!var->pixclock) -+ return -EINVAL; -+ - if (var->bits_per_pixel != 16 && var->bits_per_pixel != 32) { - printk(KERN_WARNING "kyrofb: depth not supported: %u\n", var->bits_per_pixel); - return -EINVAL; -diff --git a/drivers/video/fbdev/riva/fbdev.c b/drivers/video/fbdev/riva/fbdev.c -index ca593a3e41d74..51c9d9508c0b0 100644 ---- a/drivers/video/fbdev/riva/fbdev.c -+++ b/drivers/video/fbdev/riva/fbdev.c -@@ -1088,6 +1088,9 @@ static int rivafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) - int mode_valid = 0; - - NVTRACE_ENTER(); -+ if (!var->pixclock) -+ return -EINVAL; -+ - switch (var->bits_per_pixel) { - case 1 ... 8: - var->red.offset = var->green.offset = var->blue.offset = 0; -diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c -index dacd67dca43fe..946ae198b3449 100644 ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -2894,6 +2894,29 @@ int open_ctree(struct super_block *sb, - */ - fs_info->compress_type = BTRFS_COMPRESS_ZLIB; - -+ /* -+ * Flag our filesystem as having big metadata blocks if they are bigger -+ * than the page size -+ */ -+ if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) { -+ if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA)) -+ btrfs_info(fs_info, -+ "flagging fs with big metadata feature"); -+ features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA; -+ } -+ -+ /* Set up fs_info before parsing mount options */ -+ nodesize = btrfs_super_nodesize(disk_super); -+ sectorsize = btrfs_super_sectorsize(disk_super); -+ stripesize = sectorsize; -+ fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids)); -+ fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids)); -+ -+ /* Cache block sizes */ -+ fs_info->nodesize = nodesize; -+ fs_info->sectorsize = sectorsize; -+ fs_info->stripesize = stripesize; -+ - ret = btrfs_parse_options(fs_info, options, sb->s_flags); - if (ret) { - err = ret; -@@ -2920,28 +2943,6 @@ int open_ctree(struct super_block *sb, - if (features & BTRFS_FEATURE_INCOMPAT_SKINNY_METADATA) - btrfs_info(fs_info, "has skinny extents"); - -- /* -- * flag our filesystem as having big metadata blocks if -- * they are bigger than the page size -- */ -- if (btrfs_super_nodesize(disk_super) > PAGE_SIZE) { -- if (!(features & BTRFS_FEATURE_INCOMPAT_BIG_METADATA)) -- btrfs_info(fs_info, -- "flagging fs with big metadata feature"); -- features |= BTRFS_FEATURE_INCOMPAT_BIG_METADATA; -- } -- -- nodesize = btrfs_super_nodesize(disk_super); -- sectorsize = btrfs_super_sectorsize(disk_super); -- stripesize = sectorsize; -- fs_info->dirty_metadata_batch = nodesize * (1 + ilog2(nr_cpu_ids)); -- fs_info->delalloc_batch = sectorsize * 512 * (1 + ilog2(nr_cpu_ids)); -- -- /* Cache block sizes */ -- fs_info->nodesize = nodesize; -- fs_info->sectorsize = sectorsize; -- fs_info->stripesize = stripesize; -- - /* - * mixed block groups end up with duplicate but slightly offset - * extent buffers for the same range. It leads to corruptions -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 33b8fedab6c67..b859ed50cf46c 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -1200,11 +1200,6 @@ static noinline void async_cow_submit(struct btrfs_work *work) - nr_pages = (async_chunk->end - async_chunk->start + PAGE_SIZE) >> - PAGE_SHIFT; - -- /* atomic_sub_return implies a barrier */ -- if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) < -- 5 * SZ_1M) -- cond_wake_up_nomb(&fs_info->async_submit_wait); -- - /* - * ->inode could be NULL if async_chunk_start has failed to compress, - * in which case we don't have anything to submit, yet we need to -@@ -1213,6 +1208,11 @@ static noinline void async_cow_submit(struct btrfs_work *work) - */ - if (async_chunk->inode) - submit_compressed_extents(async_chunk); -+ -+ /* atomic_sub_return implies a barrier */ -+ if (atomic_sub_return(nr_pages, &fs_info->async_delalloc_pages) < -+ 5 * SZ_1M) -+ cond_wake_up_nomb(&fs_info->async_submit_wait); - } - - static noinline void async_cow_free(struct btrfs_work *work) -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index 5412361d0c270..8ea4b3da85d1a 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -719,7 +719,9 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans, - */ - ret = btrfs_lookup_data_extent(fs_info, ins.objectid, - ins.offset); -- if (ret == 0) { -+ if (ret < 0) { -+ goto out; -+ } else if (ret == 0) { - btrfs_init_generic_ref(&ref, - BTRFS_ADD_DELAYED_REF, - ins.objectid, ins.offset, 0); -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index e882c790292f9..8deee49a6b3fa 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -1311,6 +1311,9 @@ static void btrfs_close_one_device(struct btrfs_device *device) - fs_devices->rw_devices--; - } - -+ if (device->devid == BTRFS_DEV_REPLACE_DEVID) -+ clear_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state); -+ - if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)) - fs_devices->missing_devices--; - -diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c -index 85bd644f9773b..30f841a880acd 100644 ---- a/fs/cifs/sess.c -+++ b/fs/cifs/sess.c -@@ -610,7 +610,7 @@ sess_alloc_buffer(struct sess_data *sess_data, int wct) - return 0; - - out_free_smb_buf: -- kfree(smb_buf); -+ cifs_small_buf_release(smb_buf); - sess_data->iov[0].iov_base = NULL; - sess_data->iov[0].iov_len = 0; - sess_data->buf0_type = CIFS_NO_BUFFER; -diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c -index a57219c51c01a..f7d27cbbeb860 100644 ---- a/fs/f2fs/checkpoint.c -+++ b/fs/f2fs/checkpoint.c -@@ -583,7 +583,7 @@ int f2fs_acquire_orphan_inode(struct f2fs_sb_info *sbi) - - if (time_to_inject(sbi, FAULT_ORPHAN)) { - spin_unlock(&im->ino_lock); -- f2fs_show_injection_info(FAULT_ORPHAN); -+ f2fs_show_injection_info(sbi, FAULT_ORPHAN); - return -ENOSPC; - } - -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index 64ee2a064e339..1679f9c0b63b3 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -167,9 +167,10 @@ static bool f2fs_bio_post_read_required(struct bio *bio) - - static void f2fs_read_end_io(struct bio *bio) - { -- if (time_to_inject(F2FS_P_SB(bio_first_page_all(bio)), -- FAULT_READ_IO)) { -- f2fs_show_injection_info(FAULT_READ_IO); -+ struct f2fs_sb_info *sbi = F2FS_P_SB(bio_first_page_all(bio)); -+ -+ if (time_to_inject(sbi, FAULT_READ_IO)) { -+ f2fs_show_injection_info(sbi, FAULT_READ_IO); - bio->bi_status = BLK_STS_IOERR; - } - -@@ -191,7 +192,7 @@ static void f2fs_write_end_io(struct bio *bio) - struct bvec_iter_all iter_all; - - if (time_to_inject(sbi, FAULT_WRITE_IO)) { -- f2fs_show_injection_info(FAULT_WRITE_IO); -+ f2fs_show_injection_info(sbi, FAULT_WRITE_IO); - bio->bi_status = BLK_STS_IOERR; - } - -@@ -1190,7 +1191,21 @@ next_dnode: - if (err) { - if (flag == F2FS_GET_BLOCK_BMAP) - map->m_pblk = 0; -+ - if (err == -ENOENT) { -+ /* -+ * There is one exceptional case that read_node_page() -+ * may return -ENOENT due to filesystem has been -+ * shutdown or cp_error, so force to convert error -+ * number to EIO for such case. -+ */ -+ if (map->m_may_create && -+ (is_sbi_flag_set(sbi, SBI_IS_SHUTDOWN) || -+ f2fs_cp_error(sbi))) { -+ err = -EIO; -+ goto unlock_out; -+ } -+ - err = 0; - if (map->m_next_pgofs) - *map->m_next_pgofs = -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index 78d041f9775a4..99c4a868d73b0 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -618,7 +618,7 @@ int f2fs_add_regular_entry(struct inode *dir, const struct qstr *new_name, - - start: - if (time_to_inject(F2FS_I_SB(dir), FAULT_DIR_DEPTH)) { -- f2fs_show_injection_info(FAULT_DIR_DEPTH); -+ f2fs_show_injection_info(F2FS_I_SB(dir), FAULT_DIR_DEPTH); - return -ENOSPC; - } - -@@ -892,6 +892,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, - struct f2fs_sb_info *sbi = F2FS_I_SB(d->inode); - struct blk_plug plug; - bool readdir_ra = sbi->readdir_ra == 1; -+ bool found_valid_dirent = false; - int err = 0; - - bit_pos = ((unsigned long)ctx->pos % d->max); -@@ -906,12 +907,15 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, - - de = &d->dentry[bit_pos]; - if (de->name_len == 0) { -+ if (found_valid_dirent || !bit_pos) { -+ printk_ratelimited( -+ "%sF2FS-fs (%s): invalid namelen(0), ino:%u, run fsck to fix.", -+ KERN_WARNING, sbi->sb->s_id, -+ le32_to_cpu(de->ino)); -+ set_sbi_flag(sbi, SBI_NEED_FSCK); -+ } - bit_pos++; - ctx->pos = start_pos + bit_pos; -- printk_ratelimited( -- "%s, invalid namelen(0), ino:%u, run fsck to fix.", -- KERN_WARNING, le32_to_cpu(de->ino)); -- set_sbi_flag(sbi, SBI_NEED_FSCK); - continue; - } - -@@ -954,6 +958,7 @@ int f2fs_fill_dentries(struct dir_context *ctx, struct f2fs_dentry_ptr *d, - f2fs_ra_node_page(sbi, le32_to_cpu(de->ino)); - - ctx->pos = start_pos + bit_pos; -+ found_valid_dirent = true; - } - out: - if (readdir_ra) -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 4ca3c2a0a0f5b..031a17bf52a24 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -1374,9 +1374,10 @@ struct f2fs_private_dio { - }; - - #ifdef CONFIG_F2FS_FAULT_INJECTION --#define f2fs_show_injection_info(type) \ -- printk_ratelimited("%sF2FS-fs : inject %s in %s of %pS\n", \ -- KERN_INFO, f2fs_fault_name[type], \ -+#define f2fs_show_injection_info(sbi, type) \ -+ printk_ratelimited("%sF2FS-fs (%s) : inject %s in %s of %pS\n", \ -+ KERN_INFO, sbi->sb->s_id, \ -+ f2fs_fault_name[type], \ - __func__, __builtin_return_address(0)) - static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type) - { -@@ -1396,7 +1397,7 @@ static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type) - return false; - } - #else --#define f2fs_show_injection_info(type) do { } while (0) -+#define f2fs_show_injection_info(sbi, type) do { } while (0) - static inline bool time_to_inject(struct f2fs_sb_info *sbi, int type) - { - return false; -@@ -1781,7 +1782,7 @@ static inline int inc_valid_block_count(struct f2fs_sb_info *sbi, - return ret; - - if (time_to_inject(sbi, FAULT_BLOCK)) { -- f2fs_show_injection_info(FAULT_BLOCK); -+ f2fs_show_injection_info(sbi, FAULT_BLOCK); - release = *count; - goto release_quota; - } -@@ -2033,7 +2034,7 @@ static inline int inc_valid_node_count(struct f2fs_sb_info *sbi, - } - - if (time_to_inject(sbi, FAULT_BLOCK)) { -- f2fs_show_injection_info(FAULT_BLOCK); -+ f2fs_show_injection_info(sbi, FAULT_BLOCK); - goto enospc; - } - -@@ -2148,7 +2149,8 @@ static inline struct page *f2fs_grab_cache_page(struct address_space *mapping, - return page; - - if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_ALLOC)) { -- f2fs_show_injection_info(FAULT_PAGE_ALLOC); -+ f2fs_show_injection_info(F2FS_M_SB(mapping), -+ FAULT_PAGE_ALLOC); - return NULL; - } - } -@@ -2163,7 +2165,7 @@ static inline struct page *f2fs_pagecache_get_page( - int fgp_flags, gfp_t gfp_mask) - { - if (time_to_inject(F2FS_M_SB(mapping), FAULT_PAGE_GET)) { -- f2fs_show_injection_info(FAULT_PAGE_GET); -+ f2fs_show_injection_info(F2FS_M_SB(mapping), FAULT_PAGE_GET); - return NULL; - } - -@@ -2232,7 +2234,7 @@ static inline struct bio *f2fs_bio_alloc(struct f2fs_sb_info *sbi, - return bio; - } - if (time_to_inject(sbi, FAULT_ALLOC_BIO)) { -- f2fs_show_injection_info(FAULT_ALLOC_BIO); -+ f2fs_show_injection_info(sbi, FAULT_ALLOC_BIO); - return NULL; - } - -@@ -2797,7 +2799,7 @@ static inline void *f2fs_kmalloc(struct f2fs_sb_info *sbi, - size_t size, gfp_t flags) - { - if (time_to_inject(sbi, FAULT_KMALLOC)) { -- f2fs_show_injection_info(FAULT_KMALLOC); -+ f2fs_show_injection_info(sbi, FAULT_KMALLOC); - return NULL; - } - -@@ -2814,7 +2816,7 @@ static inline void *f2fs_kvmalloc(struct f2fs_sb_info *sbi, - size_t size, gfp_t flags) - { - if (time_to_inject(sbi, FAULT_KVMALLOC)) { -- f2fs_show_injection_info(FAULT_KVMALLOC); -+ f2fs_show_injection_info(sbi, FAULT_KVMALLOC); - return NULL; - } - -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 6e58b2e62b189..516007bb1ced1 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -682,7 +682,7 @@ int f2fs_truncate(struct inode *inode) - trace_f2fs_truncate(inode); - - if (time_to_inject(F2FS_I_SB(inode), FAULT_TRUNCATE)) { -- f2fs_show_injection_info(FAULT_TRUNCATE); -+ f2fs_show_injection_info(F2FS_I_SB(inode), FAULT_TRUNCATE); - return -EIO; - } - -@@ -981,7 +981,6 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) - } - - if (pg_start < pg_end) { -- struct address_space *mapping = inode->i_mapping; - loff_t blk_start, blk_end; - struct f2fs_sb_info *sbi = F2FS_I_SB(inode); - -@@ -993,8 +992,7 @@ static int punch_hole(struct inode *inode, loff_t offset, loff_t len) - down_write(&F2FS_I(inode)->i_gc_rwsem[WRITE]); - down_write(&F2FS_I(inode)->i_mmap_sem); - -- truncate_inode_pages_range(mapping, blk_start, -- blk_end - 1); -+ truncate_pagecache_range(inode, blk_start, blk_end - 1); - - f2fs_lock_op(sbi); - ret = f2fs_truncate_hole(inode, pg_start, pg_end); -diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c -index a78aa5480454f..4b6c36208f552 100644 ---- a/fs/f2fs/gc.c -+++ b/fs/f2fs/gc.c -@@ -54,7 +54,7 @@ static int gc_thread_func(void *data) - } - - if (time_to_inject(sbi, FAULT_CHECKPOINT)) { -- f2fs_show_injection_info(FAULT_CHECKPOINT); -+ f2fs_show_injection_info(sbi, FAULT_CHECKPOINT); - f2fs_stop_checkpoint(sbi, false); - } - -@@ -1095,8 +1095,10 @@ next_step: - int err; - - if (S_ISREG(inode->i_mode)) { -- if (!down_write_trylock(&fi->i_gc_rwsem[READ])) -+ if (!down_write_trylock(&fi->i_gc_rwsem[READ])) { -+ sbi->skipped_gc_rwsem++; - continue; -+ } - if (!down_write_trylock( - &fi->i_gc_rwsem[WRITE])) { - sbi->skipped_gc_rwsem++; -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 386ad54c13c3a..502bd491336a8 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -681,7 +681,7 @@ retry: - err = f2fs_truncate(inode); - - if (time_to_inject(sbi, FAULT_EVICT_INODE)) { -- f2fs_show_injection_info(FAULT_EVICT_INODE); -+ f2fs_show_injection_info(sbi, FAULT_EVICT_INODE); - err = -EIO; - } - -diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c -index 48bb5d3c709db..4cb182c20eedd 100644 ---- a/fs/f2fs/node.c -+++ b/fs/f2fs/node.c -@@ -2406,7 +2406,7 @@ bool f2fs_alloc_nid(struct f2fs_sb_info *sbi, nid_t *nid) - struct free_nid *i = NULL; - retry: - if (time_to_inject(sbi, FAULT_ALLOC_NID)) { -- f2fs_show_injection_info(FAULT_ALLOC_NID); -+ f2fs_show_injection_info(sbi, FAULT_ALLOC_NID); - return false; - } - -diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c -index 5ba677f85533c..78c54bb7898df 100644 ---- a/fs/f2fs/segment.c -+++ b/fs/f2fs/segment.c -@@ -489,7 +489,7 @@ int f2fs_commit_inmem_pages(struct inode *inode) - void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need) - { - if (time_to_inject(sbi, FAULT_CHECKPOINT)) { -- f2fs_show_injection_info(FAULT_CHECKPOINT); -+ f2fs_show_injection_info(sbi, FAULT_CHECKPOINT); - f2fs_stop_checkpoint(sbi, false); - } - -@@ -1017,8 +1017,9 @@ static void __remove_discard_cmd(struct f2fs_sb_info *sbi, - - if (dc->error) - printk_ratelimited( -- "%sF2FS-fs: Issue discard(%u, %u, %u) failed, ret: %d", -- KERN_INFO, dc->lstart, dc->start, dc->len, dc->error); -+ "%sF2FS-fs (%s): Issue discard(%u, %u, %u) failed, ret: %d", -+ KERN_INFO, sbi->sb->s_id, -+ dc->lstart, dc->start, dc->len, dc->error); - __detach_discard_cmd(dcc, dc); - } - -@@ -1158,7 +1159,7 @@ static int __submit_discard_cmd(struct f2fs_sb_info *sbi, - dc->len += len; - - if (time_to_inject(sbi, FAULT_DISCARD)) { -- f2fs_show_injection_info(FAULT_DISCARD); -+ f2fs_show_injection_info(sbi, FAULT_DISCARD); - err = -EIO; - goto submit; - } -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 6d904dc9bd199..41bf656658ba8 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1994,6 +1994,33 @@ static int f2fs_enable_quotas(struct super_block *sb) - return 0; - } - -+static int f2fs_quota_sync_file(struct f2fs_sb_info *sbi, int type) -+{ -+ struct quota_info *dqopt = sb_dqopt(sbi->sb); -+ struct address_space *mapping = dqopt->files[type]->i_mapping; -+ int ret = 0; -+ -+ ret = dquot_writeback_dquots(sbi->sb, type); -+ if (ret) -+ goto out; -+ -+ ret = filemap_fdatawrite(mapping); -+ if (ret) -+ goto out; -+ -+ /* if we are using journalled quota */ -+ if (is_journalled_quota(sbi)) -+ goto out; -+ -+ ret = filemap_fdatawait(mapping); -+ -+ truncate_inode_pages(&dqopt->files[type]->i_data, 0); -+out: -+ if (ret) -+ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); -+ return ret; -+} -+ - int f2fs_quota_sync(struct super_block *sb, int type) - { - struct f2fs_sb_info *sbi = F2FS_SB(sb); -@@ -2001,57 +2028,42 @@ int f2fs_quota_sync(struct super_block *sb, int type) - int cnt; - int ret; - -- /* -- * do_quotactl -- * f2fs_quota_sync -- * down_read(quota_sem) -- * dquot_writeback_dquots() -- * f2fs_dquot_commit -- * block_operation -- * down_read(quota_sem) -- */ -- f2fs_lock_op(sbi); -- -- down_read(&sbi->quota_sem); -- ret = dquot_writeback_dquots(sb, type); -- if (ret) -- goto out; -- - /* - * Now when everything is written we can discard the pagecache so - * that userspace sees the changes. - */ - for (cnt = 0; cnt < MAXQUOTAS; cnt++) { -- struct address_space *mapping; - - if (type != -1 && cnt != type) - continue; -- if (!sb_has_quota_active(sb, cnt)) -- continue; - -- mapping = dqopt->files[cnt]->i_mapping; -+ if (!sb_has_quota_active(sb, type)) -+ return 0; - -- ret = filemap_fdatawrite(mapping); -- if (ret) -- goto out; -+ inode_lock(dqopt->files[cnt]); - -- /* if we are using journalled quota */ -- if (is_journalled_quota(sbi)) -- continue; -+ /* -+ * do_quotactl -+ * f2fs_quota_sync -+ * down_read(quota_sem) -+ * dquot_writeback_dquots() -+ * f2fs_dquot_commit -+ * block_operation -+ * down_read(quota_sem) -+ */ -+ f2fs_lock_op(sbi); -+ down_read(&sbi->quota_sem); - -- ret = filemap_fdatawait(mapping); -- if (ret) -- set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR); -+ ret = f2fs_quota_sync_file(sbi, cnt); -+ -+ up_read(&sbi->quota_sem); -+ f2fs_unlock_op(sbi); - -- inode_lock(dqopt->files[cnt]); -- truncate_inode_pages(&dqopt->files[cnt]->i_data, 0); - inode_unlock(dqopt->files[cnt]); -+ -+ if (ret) -+ break; - } --out: -- if (ret) -- set_sbi_flag(F2FS_SB(sb), SBI_QUOTA_NEED_REPAIR); -- up_read(&sbi->quota_sem); -- f2fs_unlock_op(sbi); - return ret; - } - -diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c -index 0ce39658a6200..44a426c8ea01e 100644 ---- a/fs/fscache/cookie.c -+++ b/fs/fscache/cookie.c -@@ -74,10 +74,8 @@ void fscache_free_cookie(struct fscache_cookie *cookie) - static int fscache_set_key(struct fscache_cookie *cookie, - const void *index_key, size_t index_key_len) - { -- unsigned long long h; - u32 *buf; - int bufs; -- int i; - - bufs = DIV_ROUND_UP(index_key_len, sizeof(*buf)); - -@@ -91,17 +89,7 @@ static int fscache_set_key(struct fscache_cookie *cookie, - } - - memcpy(buf, index_key, index_key_len); -- -- /* Calculate a hash and combine this with the length in the first word -- * or first half word -- */ -- h = (unsigned long)cookie->parent; -- h += index_key_len + cookie->type; -- -- for (i = 0; i < bufs; i++) -- h += buf[i]; -- -- cookie->key_hash = h ^ (h >> 32); -+ cookie->key_hash = fscache_hash(0, buf, bufs); - return 0; - } - -diff --git a/fs/fscache/internal.h b/fs/fscache/internal.h -index 9616af3768e11..d09d4e69c818e 100644 ---- a/fs/fscache/internal.h -+++ b/fs/fscache/internal.h -@@ -97,6 +97,8 @@ extern struct workqueue_struct *fscache_object_wq; - extern struct workqueue_struct *fscache_op_wq; - DECLARE_PER_CPU(wait_queue_head_t, fscache_object_cong_wait); - -+extern unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n); -+ - static inline bool fscache_object_congested(void) - { - return workqueue_congested(WORK_CPU_UNBOUND, fscache_object_wq); -diff --git a/fs/fscache/main.c b/fs/fscache/main.c -index 59c2494efda34..3aa3756c71761 100644 ---- a/fs/fscache/main.c -+++ b/fs/fscache/main.c -@@ -94,6 +94,45 @@ static struct ctl_table fscache_sysctls_root[] = { - }; - #endif - -+/* -+ * Mixing scores (in bits) for (7,20): -+ * Input delta: 1-bit 2-bit -+ * 1 round: 330.3 9201.6 -+ * 2 rounds: 1246.4 25475.4 -+ * 3 rounds: 1907.1 31295.1 -+ * 4 rounds: 2042.3 31718.6 -+ * Perfect: 2048 31744 -+ * (32*64) (32*31/2 * 64) -+ */ -+#define HASH_MIX(x, y, a) \ -+ ( x ^= (a), \ -+ y ^= x, x = rol32(x, 7),\ -+ x += y, y = rol32(y,20),\ -+ y *= 9 ) -+ -+static inline unsigned int fold_hash(unsigned long x, unsigned long y) -+{ -+ /* Use arch-optimized multiply if one exists */ -+ return __hash_32(y ^ __hash_32(x)); -+} -+ -+/* -+ * Generate a hash. This is derived from full_name_hash(), but we want to be -+ * sure it is arch independent and that it doesn't change as bits of the -+ * computed hash value might appear on disk. The caller also guarantees that -+ * the hashed data will be a series of aligned 32-bit words. -+ */ -+unsigned int fscache_hash(unsigned int salt, unsigned int *data, unsigned int n) -+{ -+ unsigned int a, x = 0, y = salt; -+ -+ for (; n; n--) { -+ a = *data++; -+ HASH_MIX(x, y, a); -+ } -+ return fold_hash(x, y); -+} -+ - /* - * initialise the fs caching module - */ -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 16aa55b73ccf5..7205a89fbb5f3 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -282,10 +282,10 @@ void fuse_request_end(struct fuse_conn *fc, struct fuse_req *req) - - /* - * test_and_set_bit() implies smp_mb() between bit -- * changing and below intr_entry check. Pairs with -+ * changing and below FR_INTERRUPTED check. Pairs with - * smp_mb() from queue_interrupt(). - */ -- if (!list_empty(&req->intr_entry)) { -+ if (test_bit(FR_INTERRUPTED, &req->flags)) { - spin_lock(&fiq->lock); - list_del_init(&req->intr_entry); - spin_unlock(&fiq->lock); -diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c -index 72dec177b3494..94c290a333a0a 100644 ---- a/fs/gfs2/lock_dlm.c -+++ b/fs/gfs2/lock_dlm.c -@@ -292,6 +292,11 @@ static void gdlm_put_lock(struct gfs2_glock *gl) - gfs2_sbstats_inc(gl, GFS2_LKS_DCOUNT); - gfs2_update_request_times(gl); - -+ /* don't want to call dlm if we've unmounted the lock protocol */ -+ if (test_bit(DFL_UNMOUNT, &ls->ls_recover_flags)) { -+ gfs2_glock_free(gl); -+ return; -+ } - /* don't want to skip dlm_unlock writing the lvb when lock has one */ - - if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) && -diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c -index 498cb70c2c0d0..273a81971ed57 100644 ---- a/fs/lockd/svclock.c -+++ b/fs/lockd/svclock.c -@@ -395,28 +395,10 @@ nlmsvc_release_lockowner(struct nlm_lock *lock) - nlmsvc_put_lockowner(lock->fl.fl_owner); - } - --static void nlmsvc_locks_copy_lock(struct file_lock *new, struct file_lock *fl) --{ -- struct nlm_lockowner *nlm_lo = (struct nlm_lockowner *)fl->fl_owner; -- new->fl_owner = nlmsvc_get_lockowner(nlm_lo); --} -- --static void nlmsvc_locks_release_private(struct file_lock *fl) --{ -- nlmsvc_put_lockowner((struct nlm_lockowner *)fl->fl_owner); --} -- --static const struct file_lock_operations nlmsvc_lock_ops = { -- .fl_copy_lock = nlmsvc_locks_copy_lock, -- .fl_release_private = nlmsvc_locks_release_private, --}; -- - void nlmsvc_locks_init_private(struct file_lock *fl, struct nlm_host *host, - pid_t pid) - { - fl->fl_owner = nlmsvc_find_lockowner(host, pid); -- if (fl->fl_owner != NULL) -- fl->fl_ops = &nlmsvc_lock_ops; - } - - /* -@@ -788,9 +770,21 @@ nlmsvc_notify_blocked(struct file_lock *fl) - printk(KERN_WARNING "lockd: notification for unknown block!\n"); - } - -+static fl_owner_t nlmsvc_get_owner(fl_owner_t owner) -+{ -+ return nlmsvc_get_lockowner(owner); -+} -+ -+static void nlmsvc_put_owner(fl_owner_t owner) -+{ -+ nlmsvc_put_lockowner(owner); -+} -+ - const struct lock_manager_operations nlmsvc_lock_operations = { - .lm_notify = nlmsvc_notify_blocked, - .lm_grant = nlmsvc_grant_deferred, -+ .lm_get_owner = nlmsvc_get_owner, -+ .lm_put_owner = nlmsvc_put_owner, - }; - - /* -diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c -index 6509ec3cb3730..073be36b0686c 100644 ---- a/fs/overlayfs/dir.c -+++ b/fs/overlayfs/dir.c -@@ -513,8 +513,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode, - goto out_cleanup; - } - err = ovl_instantiate(dentry, inode, newdentry, hardlink); -- if (err) -- goto out_cleanup; -+ if (err) { -+ ovl_cleanup(udir, newdentry); -+ dput(newdentry); -+ } - out_dput: - dput(upper); - out_unlock: -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index 2c807283115d7..ec57bbb6bb05c 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -32,11 +32,6 @@ int sysctl_unprivileged_userfaultfd __read_mostly = 1; - - static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly; - --enum userfaultfd_state { -- UFFD_STATE_WAIT_API, -- UFFD_STATE_RUNNING, --}; -- - /* - * Start with fault_pending_wqh and fault_wqh so they're more likely - * to be in the same cacheline. -@@ -68,8 +63,6 @@ struct userfaultfd_ctx { - unsigned int flags; - /* features requested from the userspace */ - unsigned int features; -- /* state machine */ -- enum userfaultfd_state state; - /* released */ - bool released; - /* memory mappings are changing because of non-cooperative event */ -@@ -103,6 +96,14 @@ struct userfaultfd_wake_range { - unsigned long len; - }; - -+/* internal indication that UFFD_API ioctl was successfully executed */ -+#define UFFD_FEATURE_INITIALIZED (1u << 31) -+ -+static bool userfaultfd_is_initialized(struct userfaultfd_ctx *ctx) -+{ -+ return ctx->features & UFFD_FEATURE_INITIALIZED; -+} -+ - static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode, - int wake_flags, void *key) - { -@@ -699,7 +700,6 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs) - - refcount_set(&ctx->refcount, 1); - ctx->flags = octx->flags; -- ctx->state = UFFD_STATE_RUNNING; - ctx->features = octx->features; - ctx->released = false; - ctx->mmap_changing = false; -@@ -980,38 +980,33 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait) - - poll_wait(file, &ctx->fd_wqh, wait); - -- switch (ctx->state) { -- case UFFD_STATE_WAIT_API: -+ if (!userfaultfd_is_initialized(ctx)) - return EPOLLERR; -- case UFFD_STATE_RUNNING: -- /* -- * poll() never guarantees that read won't block. -- * userfaults can be waken before they're read(). -- */ -- if (unlikely(!(file->f_flags & O_NONBLOCK))) -- return EPOLLERR; -- /* -- * lockless access to see if there are pending faults -- * __pollwait last action is the add_wait_queue but -- * the spin_unlock would allow the waitqueue_active to -- * pass above the actual list_add inside -- * add_wait_queue critical section. So use a full -- * memory barrier to serialize the list_add write of -- * add_wait_queue() with the waitqueue_active read -- * below. -- */ -- ret = 0; -- smp_mb(); -- if (waitqueue_active(&ctx->fault_pending_wqh)) -- ret = EPOLLIN; -- else if (waitqueue_active(&ctx->event_wqh)) -- ret = EPOLLIN; -- -- return ret; -- default: -- WARN_ON_ONCE(1); -+ -+ /* -+ * poll() never guarantees that read won't block. -+ * userfaults can be waken before they're read(). -+ */ -+ if (unlikely(!(file->f_flags & O_NONBLOCK))) - return EPOLLERR; -- } -+ /* -+ * lockless access to see if there are pending faults -+ * __pollwait last action is the add_wait_queue but -+ * the spin_unlock would allow the waitqueue_active to -+ * pass above the actual list_add inside -+ * add_wait_queue critical section. So use a full -+ * memory barrier to serialize the list_add write of -+ * add_wait_queue() with the waitqueue_active read -+ * below. -+ */ -+ ret = 0; -+ smp_mb(); -+ if (waitqueue_active(&ctx->fault_pending_wqh)) -+ ret = EPOLLIN; -+ else if (waitqueue_active(&ctx->event_wqh)) -+ ret = EPOLLIN; -+ -+ return ret; - } - - static const struct file_operations userfaultfd_fops; -@@ -1205,7 +1200,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf, - struct uffd_msg msg; - int no_wait = file->f_flags & O_NONBLOCK; - -- if (ctx->state == UFFD_STATE_WAIT_API) -+ if (!userfaultfd_is_initialized(ctx)) - return -EINVAL; - - for (;;) { -@@ -1807,9 +1802,10 @@ out: - static inline unsigned int uffd_ctx_features(__u64 user_features) - { - /* -- * For the current set of features the bits just coincide -+ * For the current set of features the bits just coincide. Set -+ * UFFD_FEATURE_INITIALIZED to mark the features as enabled. - */ -- return (unsigned int)user_features; -+ return (unsigned int)user_features | UFFD_FEATURE_INITIALIZED; - } - - /* -@@ -1822,12 +1818,10 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, - { - struct uffdio_api uffdio_api; - void __user *buf = (void __user *)arg; -+ unsigned int ctx_features; - int ret; - __u64 features; - -- ret = -EINVAL; -- if (ctx->state != UFFD_STATE_WAIT_API) -- goto out; - ret = -EFAULT; - if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api))) - goto out; -@@ -1844,9 +1838,13 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, - ret = -EFAULT; - if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api))) - goto out; -- ctx->state = UFFD_STATE_RUNNING; -+ - /* only enable the requested features for this uffd context */ -- ctx->features = uffd_ctx_features(features); -+ ctx_features = uffd_ctx_features(features); -+ ret = -EINVAL; -+ if (cmpxchg(&ctx->features, 0, ctx_features) != 0) -+ goto err_out; -+ - ret = 0; - out: - return ret; -@@ -1863,7 +1861,7 @@ static long userfaultfd_ioctl(struct file *file, unsigned cmd, - int ret = -EINVAL; - struct userfaultfd_ctx *ctx = file->private_data; - -- if (cmd != UFFDIO_API && ctx->state == UFFD_STATE_WAIT_API) -+ if (cmd != UFFDIO_API && !userfaultfd_is_initialized(ctx)) - return -EINVAL; - - switch(cmd) { -@@ -1964,7 +1962,6 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) - refcount_set(&ctx->refcount, 1); - ctx->flags = flags; - ctx->features = 0; -- ctx->state = UFFD_STATE_WAIT_API; - ctx->released = false; - ctx->mmap_changing = false; - ctx->mm = current->mm; -diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h -index 0588ef3bc6ff6..48722f2b8543b 100644 ---- a/include/crypto/public_key.h -+++ b/include/crypto/public_key.h -@@ -38,9 +38,9 @@ extern void public_key_free(struct public_key *key); - struct public_key_signature { - struct asymmetric_key_id *auth_ids[2]; - u8 *s; /* Signature */ -- u32 s_size; /* Number of bytes in signature */ - u8 *digest; -- u8 digest_size; /* Number of bytes in digest */ -+ u32 s_size; /* Number of bytes in signature */ -+ u32 digest_size; /* Number of bytes in digest */ - const char *pkey_algo; - const char *hash_algo; - const char *encoding; -diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h -index a0513c444446d..cef70d6e1657c 100644 ---- a/include/linux/hugetlb.h -+++ b/include/linux/hugetlb.h -@@ -542,6 +542,11 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h, - - void hugetlb_report_usage(struct seq_file *m, struct mm_struct *mm); - -+static inline void hugetlb_count_init(struct mm_struct *mm) -+{ -+ atomic_long_set(&mm->hugetlb_usage, 0); -+} -+ - static inline void hugetlb_count_add(long l, struct mm_struct *mm) - { - atomic_long_add(l, &mm->hugetlb_usage); -@@ -711,6 +716,10 @@ static inline spinlock_t *huge_pte_lockptr(struct hstate *h, - return &mm->page_table_lock; - } - -+static inline void hugetlb_count_init(struct mm_struct *mm) -+{ -+} -+ - static inline void hugetlb_report_usage(struct seq_file *f, struct mm_struct *m) - { - } -diff --git a/include/linux/list.h b/include/linux/list.h -index 85c92555e31f8..ce19c6b632a59 100644 ---- a/include/linux/list.h -+++ b/include/linux/list.h -@@ -567,6 +567,15 @@ static inline void list_splice_tail_init(struct list_head *list, - pos != (head); \ - pos = n, n = pos->prev) - -+/** -+ * list_entry_is_head - test if the entry points to the head of the list -+ * @pos: the type * to cursor -+ * @head: the head for your list. -+ * @member: the name of the list_head within the struct. -+ */ -+#define list_entry_is_head(pos, head, member) \ -+ (&pos->member == (head)) -+ - /** - * list_for_each_entry - iterate over list of given type - * @pos: the type * to use as a loop cursor. -@@ -575,7 +584,7 @@ static inline void list_splice_tail_init(struct list_head *list, - */ - #define list_for_each_entry(pos, head, member) \ - for (pos = list_first_entry(head, typeof(*pos), member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = list_next_entry(pos, member)) - - /** -@@ -586,7 +595,7 @@ static inline void list_splice_tail_init(struct list_head *list, - */ - #define list_for_each_entry_reverse(pos, head, member) \ - for (pos = list_last_entry(head, typeof(*pos), member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = list_prev_entry(pos, member)) - - /** -@@ -611,7 +620,7 @@ static inline void list_splice_tail_init(struct list_head *list, - */ - #define list_for_each_entry_continue(pos, head, member) \ - for (pos = list_next_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = list_next_entry(pos, member)) - - /** -@@ -625,7 +634,7 @@ static inline void list_splice_tail_init(struct list_head *list, - */ - #define list_for_each_entry_continue_reverse(pos, head, member) \ - for (pos = list_prev_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = list_prev_entry(pos, member)) - - /** -@@ -637,7 +646,7 @@ static inline void list_splice_tail_init(struct list_head *list, - * Iterate over list of given type, continuing from current position. - */ - #define list_for_each_entry_from(pos, head, member) \ -- for (; &pos->member != (head); \ -+ for (; !list_entry_is_head(pos, head, member); \ - pos = list_next_entry(pos, member)) - - /** -@@ -650,7 +659,7 @@ static inline void list_splice_tail_init(struct list_head *list, - * Iterate backwards over list of given type, continuing from current position. - */ - #define list_for_each_entry_from_reverse(pos, head, member) \ -- for (; &pos->member != (head); \ -+ for (; !list_entry_is_head(pos, head, member); \ - pos = list_prev_entry(pos, member)) - - /** -@@ -663,7 +672,7 @@ static inline void list_splice_tail_init(struct list_head *list, - #define list_for_each_entry_safe(pos, n, head, member) \ - for (pos = list_first_entry(head, typeof(*pos), member), \ - n = list_next_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = n, n = list_next_entry(n, member)) - - /** -@@ -679,7 +688,7 @@ static inline void list_splice_tail_init(struct list_head *list, - #define list_for_each_entry_safe_continue(pos, n, head, member) \ - for (pos = list_next_entry(pos, member), \ - n = list_next_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = n, n = list_next_entry(n, member)) - - /** -@@ -694,7 +703,7 @@ static inline void list_splice_tail_init(struct list_head *list, - */ - #define list_for_each_entry_safe_from(pos, n, head, member) \ - for (n = list_next_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = n, n = list_next_entry(n, member)) - - /** -@@ -710,7 +719,7 @@ static inline void list_splice_tail_init(struct list_head *list, - #define list_for_each_entry_safe_reverse(pos, n, head, member) \ - for (pos = list_last_entry(head, typeof(*pos), member), \ - n = list_prev_entry(pos, member); \ -- &pos->member != (head); \ -+ !list_entry_is_head(pos, head, member); \ - pos = n, n = list_prev_entry(n, member)) - - /** -diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h -index 451efd4499cc5..961e35c68e413 100644 ---- a/include/linux/memory_hotplug.h -+++ b/include/linux/memory_hotplug.h -@@ -358,6 +358,6 @@ extern struct page *sparse_decode_mem_map(unsigned long coded_mem_map, - unsigned long pnum); - extern bool allow_online_pfn_range(int nid, unsigned long pfn, unsigned long nr_pages, - int online_type); --extern struct zone *zone_for_pfn_range(int online_type, int nid, unsigned start_pfn, -- unsigned long nr_pages); -+extern struct zone *zone_for_pfn_range(int online_type, int nid, -+ unsigned long start_pfn, unsigned long nr_pages); - #endif /* __LINUX_MEMORY_HOTPLUG_H */ -diff --git a/include/linux/pci.h b/include/linux/pci.h -index 6a6a819c5b49b..9a937f8b27838 100644 ---- a/include/linux/pci.h -+++ b/include/linux/pci.h -@@ -1688,8 +1688,9 @@ static inline int pci_enable_device(struct pci_dev *dev) { return -EIO; } - static inline void pci_disable_device(struct pci_dev *dev) { } - static inline int pci_assign_resource(struct pci_dev *dev, int i) - { return -EBUSY; } --static inline int __pci_register_driver(struct pci_driver *drv, -- struct module *owner) -+static inline int __must_check __pci_register_driver(struct pci_driver *drv, -+ struct module *owner, -+ const char *mod_name) - { return 0; } - static inline int pci_register_driver(struct pci_driver *drv) - { return 0; } -diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h -index 0ad57693f3926..42588645478d9 100644 ---- a/include/linux/pci_ids.h -+++ b/include/linux/pci_ids.h -@@ -2476,7 +2476,8 @@ - #define PCI_VENDOR_ID_TDI 0x192E - #define PCI_DEVICE_ID_TDI_EHCI 0x0101 - --#define PCI_VENDOR_ID_FREESCALE 0x1957 -+#define PCI_VENDOR_ID_FREESCALE 0x1957 /* duplicate: NXP */ -+#define PCI_VENDOR_ID_NXP 0x1957 /* duplicate: FREESCALE */ - #define PCI_DEVICE_ID_MPC8308 0xc006 - #define PCI_DEVICE_ID_MPC8315E 0x00b4 - #define PCI_DEVICE_ID_MPC8315 0x00b5 -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 6493c98c86317..b04b5bd43f541 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -1887,7 +1887,7 @@ static inline void __skb_insert(struct sk_buff *newsk, - WRITE_ONCE(newsk->prev, prev); - WRITE_ONCE(next->prev, newsk); - WRITE_ONCE(prev->next, newsk); -- list->qlen++; -+ WRITE_ONCE(list->qlen, list->qlen + 1); - } - - static inline void __skb_queue_splice(const struct sk_buff_head *list, -diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h -index d7ef5b97174ce..3c6c4b1dbf1a4 100644 ---- a/include/linux/sunrpc/xprt.h -+++ b/include/linux/sunrpc/xprt.h -@@ -419,6 +419,7 @@ void xprt_unlock_connect(struct rpc_xprt *, void *); - #define XPRT_CONGESTED (9) - #define XPRT_CWND_WAIT (10) - #define XPRT_WRITE_SPACE (11) -+#define XPRT_SND_IS_COOKIE (12) - - static inline void xprt_set_connected(struct rpc_xprt *xprt) - { -diff --git a/include/uapi/linux/pkt_sched.h b/include/uapi/linux/pkt_sched.h -index edbbf4bfdd9e5..4a245d7a5c8d6 100644 ---- a/include/uapi/linux/pkt_sched.h -+++ b/include/uapi/linux/pkt_sched.h -@@ -807,6 +807,8 @@ struct tc_codel_xstats { - - /* FQ_CODEL */ - -+#define FQ_CODEL_QUANTUM_MAX (1 << 20) -+ - enum { - TCA_FQ_CODEL_UNSPEC, - TCA_FQ_CODEL_TARGET, -diff --git a/include/uapi/linux/serial_reg.h b/include/uapi/linux/serial_reg.h -index be07b5470f4bb..f51bc8f368134 100644 ---- a/include/uapi/linux/serial_reg.h -+++ b/include/uapi/linux/serial_reg.h -@@ -62,6 +62,7 @@ - * ST16C654: 8 16 56 60 8 16 32 56 PORT_16654 - * TI16C750: 1 16 32 56 xx xx xx xx PORT_16750 - * TI16C752: 8 16 56 60 8 16 32 56 -+ * OX16C950: 16 32 112 120 16 32 64 112 PORT_16C950 - * Tegra: 1 4 8 14 16 8 4 1 PORT_TEGRA - */ - #define UART_FCR_R_TRIG_00 0x00 -diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c -index cb6425e52bf7a..01e893cf9b9f7 100644 ---- a/kernel/dma/debug.c -+++ b/kernel/dma/debug.c -@@ -846,7 +846,7 @@ static int dump_show(struct seq_file *seq, void *v) - } - DEFINE_SHOW_ATTRIBUTE(dump); - --static void dma_debug_fs_init(void) -+static int __init dma_debug_fs_init(void) - { - struct dentry *dentry = debugfs_create_dir("dma-api", NULL); - -@@ -859,7 +859,10 @@ static void dma_debug_fs_init(void) - debugfs_create_u32("nr_total_entries", 0444, dentry, &nr_total_entries); - debugfs_create_file("driver_filter", 0644, dentry, NULL, &filter_fops); - debugfs_create_file("dump", 0444, dentry, NULL, &dump_fops); -+ -+ return 0; - } -+core_initcall_sync(dma_debug_fs_init); - - static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry) - { -@@ -944,8 +947,6 @@ static int dma_debug_init(void) - spin_lock_init(&dma_entry_hash[i].lock); - } - -- dma_debug_fs_init(); -- - nr_pages = DIV_ROUND_UP(nr_prealloc_entries, DMA_DEBUG_DYNAMIC_ENTRIES); - for (i = 0; i < nr_pages; ++i) - dma_debug_create_entries(GFP_KERNEL); -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 2f848123cdae8..1993a741d2dc5 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -9259,7 +9259,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event) - return; - - if (ifh->nr_file_filters) { -- mm = get_task_mm(event->ctx->task); -+ mm = get_task_mm(task); - if (!mm) - goto restart; - -diff --git a/kernel/fork.c b/kernel/fork.c -index 50f37d5afb32b..cf2cebd214b92 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1028,6 +1028,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, - mm->pmd_huge_pte = NULL; - #endif - mm_init_uprobes_state(mm); -+ hugetlb_count_init(mm); - - if (current->mm) { - mm->flags = current->mm->flags & MMF_INIT_MASK; -diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c -index a6a79f85c81a8..f26415341c752 100644 ---- a/kernel/pid_namespace.c -+++ b/kernel/pid_namespace.c -@@ -53,7 +53,8 @@ static struct kmem_cache *create_pid_cachep(unsigned int level) - mutex_lock(&pid_caches_mutex); - /* Name collision forces to do allocation under mutex. */ - if (!*pkc) -- *pkc = kmem_cache_create(name, len, 0, SLAB_HWCACHE_ALIGN, 0); -+ *pkc = kmem_cache_create(name, len, 0, -+ SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, 0); - mutex_unlock(&pid_caches_mutex); - /* current can fail, but someone else can succeed. */ - return READ_ONCE(*pkc); -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 233322c77b76c..5de084dab4fa6 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -646,7 +646,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk) - /* Register new event */ - ret = register_kprobe_event(tk); - if (ret) { -- pr_warn("Failed to register probe event(%d)\n", ret); -+ if (ret == -EEXIST) { -+ trace_probe_log_set_index(0); -+ trace_probe_log_err(0, EVENT_EXIST); -+ } else -+ pr_warn("Failed to register probe event(%d)\n", ret); - goto end; - } - -diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c -index f98d6d94cbbf7..23e85cb151346 100644 ---- a/kernel/trace/trace_probe.c -+++ b/kernel/trace/trace_probe.c -@@ -1029,11 +1029,36 @@ error: - return ret; - } - -+static struct trace_event_call * -+find_trace_event_call(const char *system, const char *event_name) -+{ -+ struct trace_event_call *tp_event; -+ const char *name; -+ -+ list_for_each_entry(tp_event, &ftrace_events, list) { -+ if (!tp_event->class->system || -+ strcmp(system, tp_event->class->system)) -+ continue; -+ name = trace_event_name(tp_event); -+ if (!name || strcmp(event_name, name)) -+ continue; -+ return tp_event; -+ } -+ -+ return NULL; -+} -+ - int trace_probe_register_event_call(struct trace_probe *tp) - { - struct trace_event_call *call = trace_probe_event_call(tp); - int ret; - -+ lockdep_assert_held(&event_mutex); -+ -+ if (find_trace_event_call(trace_probe_group_name(tp), -+ trace_probe_name(tp))) -+ return -EEXIST; -+ - ret = register_trace_event(&call->event); - if (!ret) - return -ENODEV; -diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h -index a0ff9e200ef6f..bab9e0dba9af2 100644 ---- a/kernel/trace/trace_probe.h -+++ b/kernel/trace/trace_probe.h -@@ -410,6 +410,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, - C(NO_EVENT_NAME, "Event name is not specified"), \ - C(EVENT_TOO_LONG, "Event name is too long"), \ - C(BAD_EVENT_NAME, "Event name must follow the same rules as C identifiers"), \ -+ C(EVENT_EXIST, "Given group/event name is already used by another event"), \ - C(RETVAL_ON_PROBE, "$retval is not available on probe"), \ - C(BAD_STACK_NUM, "Invalid stack number"), \ - C(BAD_ARG_NUM, "Invalid argument number"), \ -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index 5294843de6efd..b515db036becc 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -514,7 +514,11 @@ static int register_trace_uprobe(struct trace_uprobe *tu) - - ret = register_uprobe_event(tu); - if (ret) { -- pr_warn("Failed to register probe event(%d)\n", ret); -+ if (ret == -EEXIST) { -+ trace_probe_log_set_index(0); -+ trace_probe_log_err(0, EVENT_EXIST); -+ } else -+ pr_warn("Failed to register probe event(%d)\n", ret); - goto end; - } - -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 6aeb53b4e19f8..885d4792abdfc 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -5869,6 +5869,13 @@ static void __init wq_numa_init(void) - return; - } - -+ for_each_possible_cpu(cpu) { -+ if (WARN_ON(cpu_to_node(cpu) == NUMA_NO_NODE)) { -+ pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu); -+ return; -+ } -+ } -+ - wq_update_unbound_numa_attrs_buf = alloc_workqueue_attrs(); - BUG_ON(!wq_update_unbound_numa_attrs_buf); - -@@ -5886,11 +5893,6 @@ static void __init wq_numa_init(void) - - for_each_possible_cpu(cpu) { - node = cpu_to_node(cpu); -- if (WARN_ON(node == NUMA_NO_NODE)) { -- pr_warn("workqueue: NUMA node mapping not available for cpu%d, disabling NUMA support\n", cpu); -- /* happens iff arch is bonkers, let's just proceed */ -- return; -- } - cpumask_set_cpu(cpu, tbl[node]); - } - -diff --git a/lib/test_bpf.c b/lib/test_bpf.c -index 5ef3eccee27cb..3ae002ced4c7a 100644 ---- a/lib/test_bpf.c -+++ b/lib/test_bpf.c -@@ -4286,8 +4286,8 @@ static struct bpf_test tests[] = { - .u.insns_int = { - BPF_LD_IMM64(R0, 0), - BPF_LD_IMM64(R1, 0xffffffffffffffffLL), -- BPF_STX_MEM(BPF_W, R10, R1, -40), -- BPF_LDX_MEM(BPF_W, R0, R10, -40), -+ BPF_STX_MEM(BPF_DW, R10, R1, -40), -+ BPF_LDX_MEM(BPF_DW, R0, R10, -40), - BPF_EXIT_INSN(), - }, - INTERNAL, -@@ -6684,7 +6684,14 @@ static int run_one(const struct bpf_prog *fp, struct bpf_test *test) - u64 duration; - u32 ret; - -- if (test->test[i].data_size == 0 && -+ /* -+ * NOTE: Several sub-tests may be present, in which case -+ * a zero {data_size, result} tuple indicates the end of -+ * the sub-test array. The first test is always run, -+ * even if both data_size and result happen to be zero. -+ */ -+ if (i > 0 && -+ test->test[i].data_size == 0 && - test->test[i].result == 0) - break; - -diff --git a/lib/test_stackinit.c b/lib/test_stackinit.c -index 2d7d257a430e6..35d398b065e4f 100644 ---- a/lib/test_stackinit.c -+++ b/lib/test_stackinit.c -@@ -67,10 +67,10 @@ static bool range_contains(char *haystack_start, size_t haystack_size, - #define INIT_STRUCT_none /**/ - #define INIT_STRUCT_zero = { } - #define INIT_STRUCT_static_partial = { .two = 0, } --#define INIT_STRUCT_static_all = { .one = arg->one, \ -- .two = arg->two, \ -- .three = arg->three, \ -- .four = arg->four, \ -+#define INIT_STRUCT_static_all = { .one = 0, \ -+ .two = 0, \ -+ .three = 0, \ -+ .four = 0, \ - } - #define INIT_STRUCT_dynamic_partial = { .two = arg->two, } - #define INIT_STRUCT_dynamic_all = { .one = arg->one, \ -@@ -84,8 +84,7 @@ static bool range_contains(char *haystack_start, size_t haystack_size, - var.one = 0; \ - var.two = 0; \ - var.three = 0; \ -- memset(&var.four, 0, \ -- sizeof(var.four)) -+ var.four = 0 - - /* - * @name: unique string name for the test -@@ -208,18 +207,13 @@ struct test_small_hole { - unsigned long four; - }; - --/* Try to trigger unhandled padding in a structure. */ --struct test_aligned { -- u32 internal1; -- u64 internal2; --} __aligned(64); -- -+/* Trigger unhandled padding in a structure. */ - struct test_big_hole { - u8 one; - u8 two; - u8 three; - /* 61 byte padding hole here. */ -- struct test_aligned four; -+ u8 four __aligned(64); - } __aligned(64); - - struct test_trailing_hole { -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index 308beca3ffebc..bcc2686bd0a1b 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -775,8 +775,8 @@ static inline struct zone *default_zone_for_pfn(int nid, unsigned long start_pfn - return movable_node_enabled ? movable_zone : kernel_zone; - } - --struct zone * zone_for_pfn_range(int online_type, int nid, unsigned start_pfn, -- unsigned long nr_pages) -+struct zone *zone_for_pfn_range(int online_type, int nid, -+ unsigned long start_pfn, unsigned long nr_pages) - { - if (online_type == MMOP_ONLINE_KERNEL) - return default_kernel_zone_for_pfn(nid, start_pfn, nr_pages); -diff --git a/mm/vmscan.c b/mm/vmscan.c -index fad9be4703ece..de94881eaa927 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -2513,7 +2513,7 @@ out: - cgroup_size = max(cgroup_size, protection); - - scan = lruvec_size - lruvec_size * protection / -- cgroup_size; -+ (cgroup_size + 1); - - /* - * Minimally target SWAP_CLUSTER_MAX pages to keep -diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c -index 3963eb11c3fbd..44e6c74ed4288 100644 ---- a/net/9p/trans_xen.c -+++ b/net/9p/trans_xen.c -@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xen_9pfs_dataring *ring, RING_IDX size) - - static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req) - { -- struct xen_9pfs_front_priv *priv = NULL; -+ struct xen_9pfs_front_priv *priv; - RING_IDX cons, prod, masked_cons, masked_prod; - unsigned long flags; - u32 size = p9_req->tc.size; -@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_client *client, struct p9_req_t *p9_req) - break; - } - read_unlock(&xen_9pfs_lock); -- if (!priv || priv->client != client) -+ if (list_entry_is_head(priv, &xen_9pfs_devs, list)) - return -EINVAL; - - num = p9_req->tc.tag % priv->num_rings; -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index e8e7f108b0161..31469ff084cd3 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -4202,6 +4202,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, - - switch (ev->status) { - case 0x00: -+ /* The synchronous connection complete event should only be -+ * sent once per new connection. Receiving a successful -+ * complete event when the connection status is already -+ * BT_CONNECTED means that the device is misbehaving and sent -+ * multiple complete event packets for the same new connection. -+ * -+ * Registering the device more than once can corrupt kernel -+ * memory, hence upon detecting this invalid event, we report -+ * an error and ignore the packet. -+ */ -+ if (conn->state == BT_CONNECTED) { -+ bt_dev_err(hdev, "Ignoring connect complete event for existing connection"); -+ goto unlock; -+ } -+ - conn->handle = __le16_to_cpu(ev->handle); - conn->state = BT_CONNECTED; - conn->type = ev->link_type; -@@ -4905,9 +4920,64 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, - } - #endif - -+static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr, -+ u8 bdaddr_type, bdaddr_t *local_rpa) -+{ -+ if (conn->out) { -+ conn->dst_type = bdaddr_type; -+ conn->resp_addr_type = bdaddr_type; -+ bacpy(&conn->resp_addr, bdaddr); -+ -+ /* Check if the controller has set a Local RPA then it must be -+ * used instead or hdev->rpa. -+ */ -+ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) { -+ conn->init_addr_type = ADDR_LE_DEV_RANDOM; -+ bacpy(&conn->init_addr, local_rpa); -+ } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) { -+ conn->init_addr_type = ADDR_LE_DEV_RANDOM; -+ bacpy(&conn->init_addr, &conn->hdev->rpa); -+ } else { -+ hci_copy_identity_address(conn->hdev, &conn->init_addr, -+ &conn->init_addr_type); -+ } -+ } else { -+ conn->resp_addr_type = conn->hdev->adv_addr_type; -+ /* Check if the controller has set a Local RPA then it must be -+ * used instead or hdev->rpa. -+ */ -+ if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) { -+ conn->resp_addr_type = ADDR_LE_DEV_RANDOM; -+ bacpy(&conn->resp_addr, local_rpa); -+ } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) { -+ /* In case of ext adv, resp_addr will be updated in -+ * Adv Terminated event. -+ */ -+ if (!ext_adv_capable(conn->hdev)) -+ bacpy(&conn->resp_addr, -+ &conn->hdev->random_addr); -+ } else { -+ bacpy(&conn->resp_addr, &conn->hdev->bdaddr); -+ } -+ -+ conn->init_addr_type = bdaddr_type; -+ bacpy(&conn->init_addr, bdaddr); -+ -+ /* For incoming connections, set the default minimum -+ * and maximum connection interval. They will be used -+ * to check if the parameters are in range and if not -+ * trigger the connection update procedure. -+ */ -+ conn->le_conn_min_interval = conn->hdev->le_conn_min_interval; -+ conn->le_conn_max_interval = conn->hdev->le_conn_max_interval; -+ } -+} -+ - static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, -- bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle, -- u16 interval, u16 latency, u16 supervision_timeout) -+ bdaddr_t *bdaddr, u8 bdaddr_type, -+ bdaddr_t *local_rpa, u8 role, u16 handle, -+ u16 interval, u16 latency, -+ u16 supervision_timeout) - { - struct hci_conn_params *params; - struct hci_conn *conn; -@@ -4955,32 +5025,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, - cancel_delayed_work(&conn->le_conn_timeout); - } - -- if (!conn->out) { -- /* Set the responder (our side) address type based on -- * the advertising address type. -- */ -- conn->resp_addr_type = hdev->adv_addr_type; -- if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) { -- /* In case of ext adv, resp_addr will be updated in -- * Adv Terminated event. -- */ -- if (!ext_adv_capable(hdev)) -- bacpy(&conn->resp_addr, &hdev->random_addr); -- } else { -- bacpy(&conn->resp_addr, &hdev->bdaddr); -- } -- -- conn->init_addr_type = bdaddr_type; -- bacpy(&conn->init_addr, bdaddr); -- -- /* For incoming connections, set the default minimum -- * and maximum connection interval. They will be used -- * to check if the parameters are in range and if not -- * trigger the connection update procedure. -- */ -- conn->le_conn_min_interval = hdev->le_conn_min_interval; -- conn->le_conn_max_interval = hdev->le_conn_max_interval; -- } -+ le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa); - - /* Lookup the identity address from the stored connection - * address and address type. -@@ -5074,7 +5119,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) - BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); - - le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, -- ev->role, le16_to_cpu(ev->handle), -+ NULL, ev->role, le16_to_cpu(ev->handle), - le16_to_cpu(ev->interval), - le16_to_cpu(ev->latency), - le16_to_cpu(ev->supervision_timeout)); -@@ -5088,7 +5133,7 @@ static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, - BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); - - le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type, -- ev->role, le16_to_cpu(ev->handle), -+ &ev->local_rpa, ev->role, le16_to_cpu(ev->handle), - le16_to_cpu(ev->interval), - le16_to_cpu(ev->latency), - le16_to_cpu(ev->supervision_timeout)); -@@ -5119,7 +5164,8 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb) - if (conn) { - struct adv_info *adv_instance; - -- if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM) -+ if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM || -+ bacmp(&conn->resp_addr, BDADDR_ANY)) - return; - - if (!hdev->cur_adv_instance) { -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 1b7540cb8e5c4..1915943bb646a 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -48,6 +48,8 @@ struct sco_conn { - spinlock_t lock; - struct sock *sk; - -+ struct delayed_work timeout_work; -+ - unsigned int mtu; - }; - -@@ -73,9 +75,20 @@ struct sco_pinfo { - #define SCO_CONN_TIMEOUT (HZ * 40) - #define SCO_DISCONN_TIMEOUT (HZ * 2) - --static void sco_sock_timeout(struct timer_list *t) -+static void sco_sock_timeout(struct work_struct *work) - { -- struct sock *sk = from_timer(sk, t, sk_timer); -+ struct sco_conn *conn = container_of(work, struct sco_conn, -+ timeout_work.work); -+ struct sock *sk; -+ -+ sco_conn_lock(conn); -+ sk = conn->sk; -+ if (sk) -+ sock_hold(sk); -+ sco_conn_unlock(conn); -+ -+ if (!sk) -+ return; - - BT_DBG("sock %p state %d", sk, sk->sk_state); - -@@ -89,14 +102,21 @@ static void sco_sock_timeout(struct timer_list *t) - - static void sco_sock_set_timer(struct sock *sk, long timeout) - { -+ if (!sco_pi(sk)->conn) -+ return; -+ - BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); -- sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout); -+ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); -+ schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout); - } - - static void sco_sock_clear_timer(struct sock *sk) - { -+ if (!sco_pi(sk)->conn) -+ return; -+ - BT_DBG("sock %p state %d", sk, sk->sk_state); -- sk_stop_timer(sk, &sk->sk_timer); -+ cancel_delayed_work(&sco_pi(sk)->conn->timeout_work); - } - - /* ---- SCO connections ---- */ -@@ -176,6 +196,9 @@ static void sco_conn_del(struct hci_conn *hcon, int err) - sco_chan_del(sk, err); - bh_unlock_sock(sk); - sock_put(sk); -+ -+ /* Ensure no more work items will run before freeing conn. */ -+ cancel_delayed_work_sync(&conn->timeout_work); - } - - hcon->sco_data = NULL; -@@ -190,6 +213,8 @@ static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, - sco_pi(sk)->conn = conn; - conn->sk = sk; - -+ INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout); -+ - if (parent) - bt_accept_enqueue(parent, sk, true); - } -@@ -209,44 +234,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, - return err; - } - --static int sco_connect(struct sock *sk) -+static int sco_connect(struct hci_dev *hdev, struct sock *sk) - { - struct sco_conn *conn; - struct hci_conn *hcon; -- struct hci_dev *hdev; - int err, type; - - BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst); - -- hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR); -- if (!hdev) -- return -EHOSTUNREACH; -- -- hci_dev_lock(hdev); -- - if (lmp_esco_capable(hdev) && !disable_esco) - type = ESCO_LINK; - else - type = SCO_LINK; - - if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT && -- (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) { -- err = -EOPNOTSUPP; -- goto done; -- } -+ (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) -+ return -EOPNOTSUPP; - - hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst, - sco_pi(sk)->setting); -- if (IS_ERR(hcon)) { -- err = PTR_ERR(hcon); -- goto done; -- } -+ if (IS_ERR(hcon)) -+ return PTR_ERR(hcon); - - conn = sco_conn_add(hcon); - if (!conn) { - hci_conn_drop(hcon); -- err = -ENOMEM; -- goto done; -+ return -ENOMEM; - } - - /* Update source addr of the socket */ -@@ -254,7 +267,7 @@ static int sco_connect(struct sock *sk) - - err = sco_chan_add(conn, sk, NULL); - if (err) -- goto done; -+ return err; - - if (hcon->state == BT_CONNECTED) { - sco_sock_clear_timer(sk); -@@ -264,9 +277,6 @@ static int sco_connect(struct sock *sk) - sco_sock_set_timer(sk, sk->sk_sndtimeo); - } - --done: -- hci_dev_unlock(hdev); -- hci_dev_put(hdev); - return err; - } - -@@ -484,8 +494,6 @@ static struct sock *sco_sock_alloc(struct net *net, struct socket *sock, - - sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT; - -- timer_setup(&sk->sk_timer, sco_sock_timeout, 0); -- - bt_sock_link(&sco_sk_list, sk); - return sk; - } -@@ -550,6 +558,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen - { - struct sockaddr_sco *sa = (struct sockaddr_sco *) addr; - struct sock *sk = sock->sk; -+ struct hci_dev *hdev; - int err; - - BT_DBG("sk %p", sk); -@@ -564,12 +573,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen - if (sk->sk_type != SOCK_SEQPACKET) - return -EINVAL; - -+ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR); -+ if (!hdev) -+ return -EHOSTUNREACH; -+ hci_dev_lock(hdev); -+ - lock_sock(sk); - - /* Set destination address and psm */ - bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); - -- err = sco_connect(sk); -+ err = sco_connect(hdev, sk); -+ hci_dev_unlock(hdev); -+ hci_dev_put(hdev); - if (err) - goto done; - -diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c -index a566289628522..910f164dd20cb 100644 ---- a/net/caif/chnl_net.c -+++ b/net/caif/chnl_net.c -@@ -53,20 +53,6 @@ struct chnl_net { - enum caif_states state; - }; - --static void robust_list_del(struct list_head *delete_node) --{ -- struct list_head *list_node; -- struct list_head *n; -- ASSERT_RTNL(); -- list_for_each_safe(list_node, n, &chnl_net_list) { -- if (list_node == delete_node) { -- list_del(list_node); -- return; -- } -- } -- WARN_ON(1); --} -- - static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt) - { - struct sk_buff *skb; -@@ -368,6 +354,7 @@ static int chnl_net_init(struct net_device *dev) - ASSERT_RTNL(); - priv = netdev_priv(dev); - strncpy(priv->name, dev->name, sizeof(priv->name)); -+ INIT_LIST_HEAD(&priv->list_field); - return 0; - } - -@@ -376,7 +363,7 @@ static void chnl_net_uninit(struct net_device *dev) - struct chnl_net *priv; - ASSERT_RTNL(); - priv = netdev_priv(dev); -- robust_list_del(&priv->list_field); -+ list_del_init(&priv->list_field); - } - - static const struct net_device_ops netdev_ops = { -@@ -541,7 +528,7 @@ static void __exit chnl_exit_module(void) - rtnl_lock(); - list_for_each_safe(list_node, _tmp, &chnl_net_list) { - dev = list_entry(list_node, struct chnl_net, list_field); -- list_del(list_node); -+ list_del_init(list_node); - delete_device(dev); - } - rtnl_unlock(); -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 96957a7c732fa..b740a74f06f22 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -1025,8 +1025,10 @@ proto_again: - FLOW_DISSECTOR_KEY_IPV4_ADDRS, - target_container); - -- memcpy(&key_addrs->v4addrs, &iph->saddr, -- sizeof(key_addrs->v4addrs)); -+ memcpy(&key_addrs->v4addrs.src, &iph->saddr, -+ sizeof(key_addrs->v4addrs.src)); -+ memcpy(&key_addrs->v4addrs.dst, &iph->daddr, -+ sizeof(key_addrs->v4addrs.dst)); - key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; - } - -@@ -1070,8 +1072,10 @@ proto_again: - FLOW_DISSECTOR_KEY_IPV6_ADDRS, - target_container); - -- memcpy(&key_addrs->v6addrs, &iph->saddr, -- sizeof(key_addrs->v6addrs)); -+ memcpy(&key_addrs->v6addrs.src, &iph->saddr, -+ sizeof(key_addrs->v6addrs.src)); -+ memcpy(&key_addrs->v6addrs.dst, &iph->daddr, -+ sizeof(key_addrs->v6addrs.dst)); - key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; - } - -diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c -index 25187528c308a..1f352d669c944 100644 ---- a/net/dccp/minisocks.c -+++ b/net/dccp/minisocks.c -@@ -94,6 +94,8 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, - newdp->dccps_role = DCCP_ROLE_SERVER; - newdp->dccps_hc_rx_ackvec = NULL; - newdp->dccps_service_list = NULL; -+ newdp->dccps_hc_rx_ccid = NULL; -+ newdp->dccps_hc_tx_ccid = NULL; - newdp->dccps_service = dreq->dreq_service; - newdp->dccps_timestamp_echo = dreq->dreq_timestamp_echo; - newdp->dccps_timestamp_time = dreq->dreq_timestamp_time; -diff --git a/net/dsa/slave.c b/net/dsa/slave.c -index 75b4cd4bcafb9..59759ceb426ac 100644 ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -1327,13 +1327,11 @@ static int dsa_slave_phy_setup(struct net_device *slave_dev) - * use the switch internal MDIO bus instead - */ - ret = dsa_slave_phy_connect(slave_dev, dp->index); -- if (ret) { -- netdev_err(slave_dev, -- "failed to connect to port %d: %d\n", -- dp->index, ret); -- phylink_destroy(dp->pl); -- return ret; -- } -+ } -+ if (ret) { -+ netdev_err(slave_dev, "failed to connect to PHY: %pe\n", -+ ERR_PTR(ret)); -+ phylink_destroy(dp->pl); - } - - return ret; -diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c -index fd8298b8b1c52..c4989e5903e43 100644 ---- a/net/ipv4/ip_gre.c -+++ b/net/ipv4/ip_gre.c -@@ -446,8 +446,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, - - static int gre_handle_offloads(struct sk_buff *skb, bool csum) - { -- if (csum && skb_checksum_start(skb) < skb->data) -- return -EINVAL; - return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); - } - -@@ -605,15 +603,20 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, - } - - if (dev->header_ops) { -+ const int pull_len = tunnel->hlen + sizeof(struct iphdr); -+ - if (skb_cow_head(skb, 0)) - goto free_skb; - - tnl_params = (const struct iphdr *)skb->data; - -+ if (pull_len > skb_transport_offset(skb)) -+ goto free_skb; -+ - /* Pull skb since ip_tunnel_xmit() needs skb->data pointing - * to gre header. - */ -- skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); -+ skb_pull(skb, pull_len); - skb_reset_mac_header(skb); - } else { - if (skb_cow_head(skb, dev->needed_headroom)) -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index f52bc9c22e5b8..0ec529d77a56e 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -446,8 +446,9 @@ static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4) - { - BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) != - offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr)); -- memcpy(&iph->saddr, &fl4->saddr, -- sizeof(fl4->saddr) + sizeof(fl4->daddr)); -+ -+ iph->saddr = fl4->saddr; -+ iph->daddr = fl4->daddr; - } - - /* Note: skb->sk can be different from sk, in case of tunnels */ -diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c -index f5f4369c131c9..858bb10d8341e 100644 ---- a/net/ipv4/nexthop.c -+++ b/net/ipv4/nexthop.c -@@ -1183,6 +1183,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh, - .fc_gw4 = cfg->gw.ipv4, - .fc_gw_family = cfg->gw.ipv4 ? AF_INET : 0, - .fc_flags = cfg->nh_flags, -+ .fc_nlinfo = cfg->nlinfo, - .fc_encap = cfg->nh_encap, - .fc_encap_type = cfg->nh_encap_type, - }; -@@ -1218,6 +1219,7 @@ static int nh_create_ipv6(struct net *net, struct nexthop *nh, - .fc_ifindex = cfg->nh_ifindex, - .fc_gateway = cfg->gw.ipv6, - .fc_flags = cfg->nh_flags, -+ .fc_nlinfo = cfg->nlinfo, - .fc_encap = cfg->nh_encap, - .fc_encap_type = cfg->nh_encap_type, - }; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 8af4fefe371f2..a5ec77a5ad6f5 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -379,8 +379,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, - return NULL; - } - -- if (syn_data && -- tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD)) -+ if (tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD)) - goto fastopen; - - if (foc->len == 0) { -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index a1768ded2d545..c0fcfa2964686 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1209,7 +1209,7 @@ static u8 tcp_sacktag_one(struct sock *sk, - if (dup_sack && (sacked & TCPCB_RETRANS)) { - if (tp->undo_marker && tp->undo_retrans > 0 && - after(end_seq, tp->undo_marker)) -- tp->undo_retrans--; -+ tp->undo_retrans = max_t(int, 0, tp->undo_retrans - pcount); - if ((sacked & TCPCB_SACKED_ACKED) && - before(start_seq, state->reord)) - state->reord = start_seq; -diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c -index b9df879c48d3f..69c021704abd7 100644 ---- a/net/ipv6/netfilter/nf_socket_ipv6.c -+++ b/net/ipv6/netfilter/nf_socket_ipv6.c -@@ -99,7 +99,7 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, - { - __be16 uninitialized_var(dport), uninitialized_var(sport); - const struct in6_addr *daddr = NULL, *saddr = NULL; -- struct ipv6hdr *iph = ipv6_hdr(skb); -+ struct ipv6hdr *iph = ipv6_hdr(skb), ipv6_var; - struct sk_buff *data_skb = NULL; - int doff = 0; - int thoff = 0, tproto; -@@ -129,8 +129,6 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, - thoff + sizeof(*hp); - - } else if (tproto == IPPROTO_ICMPV6) { -- struct ipv6hdr ipv6_var; -- - if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr, - &sport, &dport, &ipv6_var)) - return NULL; -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index 95805a6331be2..421b2c89ce12a 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -886,8 +886,10 @@ static int l2tp_udp_recv_core(struct l2tp_tunnel *tunnel, struct sk_buff *skb) - } - - if (tunnel->version == L2TP_HDR_VER_3 && -- l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) -+ l2tp_v3_ensure_opt_in_linear(session, skb, &ptr, &optr)) { -+ l2tp_session_dec_refcount(session); - goto error; -+ } - - l2tp_recv_common(session, skb, ptr, optr, hdrflags, length); - l2tp_session_dec_refcount(session); -diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index 6f576306a4d74..ddc001ad90555 100644 ---- a/net/mac80211/iface.c -+++ b/net/mac80211/iface.c -@@ -1875,9 +1875,16 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name, - - netdev_set_default_ethtool_ops(ndev, &ieee80211_ethtool_ops); - -- /* MTU range: 256 - 2304 */ -+ /* MTU range is normally 256 - 2304, where the upper limit is -+ * the maximum MSDU size. Monitor interfaces send and receive -+ * MPDU and A-MSDU frames which may be much larger so we do -+ * not impose an upper limit in that case. -+ */ - ndev->min_mtu = 256; -- ndev->max_mtu = local->hw.max_mtu; -+ if (type == NL80211_IFTYPE_MONITOR) -+ ndev->max_mtu = 0; -+ else -+ ndev->max_mtu = local->hw.max_mtu; - - ret = register_netdevice(ndev); - if (ret) { -diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c -index 8cd3daf0e3db6..1778e4e8ce247 100644 ---- a/net/netlabel/netlabel_cipso_v4.c -+++ b/net/netlabel/netlabel_cipso_v4.c -@@ -144,8 +144,8 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, - return -ENOMEM; - doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); - if (doi_def->map.std == NULL) { -- ret_val = -ENOMEM; -- goto add_std_failure; -+ kfree(doi_def); -+ return -ENOMEM; - } - doi_def->type = CIPSO_V4_MAP_TRANS; - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 9d993b4cf1aff..acc76a738cfd8 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2521,13 +2521,15 @@ int nlmsg_notify(struct sock *sk, struct sk_buff *skb, u32 portid, - /* errors reported via destination sk->sk_err, but propagate - * delivery errors if NETLINK_BROADCAST_ERROR flag is set */ - err = nlmsg_multicast(sk, skb, exclude_portid, group, flags); -+ if (err == -ESRCH) -+ err = 0; - } - - if (report) { - int err2; - - err2 = nlmsg_unicast(sk, skb, portid); -- if (!err || err == -ESRCH) -+ if (!err) - err = err2; - } - -diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c -index 76d72c3f52eda..86fb2f953bd5b 100644 ---- a/net/sched/sch_fq_codel.c -+++ b/net/sched/sch_fq_codel.c -@@ -370,6 +370,7 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, - { - struct fq_codel_sched_data *q = qdisc_priv(sch); - struct nlattr *tb[TCA_FQ_CODEL_MAX + 1]; -+ u32 quantum = 0; - int err; - - if (!opt) -@@ -387,6 +388,13 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, - q->flows_cnt > 65536) - return -EINVAL; - } -+ if (tb[TCA_FQ_CODEL_QUANTUM]) { -+ quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM])); -+ if (quantum > FQ_CODEL_QUANTUM_MAX) { -+ NL_SET_ERR_MSG(extack, "Invalid quantum"); -+ return -EINVAL; -+ } -+ } - sch_tree_lock(sch); - - if (tb[TCA_FQ_CODEL_TARGET]) { -@@ -413,8 +421,8 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, - if (tb[TCA_FQ_CODEL_ECN]) - q->cparams.ecn = !!nla_get_u32(tb[TCA_FQ_CODEL_ECN]); - -- if (tb[TCA_FQ_CODEL_QUANTUM]) -- q->quantum = max(256U, nla_get_u32(tb[TCA_FQ_CODEL_QUANTUM])); -+ if (quantum) -+ q->quantum = quantum; - - if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE]) - q->drop_batch_size = max(1U, nla_get_u32(tb[TCA_FQ_CODEL_DROP_BATCH_SIZE])); -diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c -index a4de4853c79de..da9ed0613eb7b 100644 ---- a/net/sched/sch_taprio.c -+++ b/net/sched/sch_taprio.c -@@ -1503,7 +1503,9 @@ static int taprio_change(struct Qdisc *sch, struct nlattr *opt, - taprio_set_picos_per_byte(dev, q); - - if (mqprio) { -- netdev_set_num_tc(dev, mqprio->num_tc); -+ err = netdev_set_num_tc(dev, mqprio->num_tc); -+ if (err) -+ goto free_sched; - for (i = 0; i < mqprio->num_tc; i++) - netdev_set_tc_queue(dev, i, - mqprio->count[i], -diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index d5470c7fe8792..c0016473a255a 100644 ---- a/net/sunrpc/auth_gss/svcauth_gss.c -+++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -1937,7 +1937,7 @@ gss_svc_init_net(struct net *net) - goto out2; - return 0; - out2: -- destroy_use_gss_proxy_proc_entry(net); -+ rsi_cache_destroy_net(net); - out1: - rsc_cache_destroy_net(net); - return rv; -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 639837b3a5d90..3653898f465ff 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -729,9 +729,9 @@ void xprt_force_disconnect(struct rpc_xprt *xprt) - /* Try to schedule an autoclose RPC call */ - if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0) - queue_work(xprtiod_workqueue, &xprt->task_cleanup); -- else if (xprt->snd_task) -+ else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state)) - rpc_wake_up_queued_task_set_status(&xprt->pending, -- xprt->snd_task, -ENOTCONN); -+ xprt->snd_task, -ENOTCONN); - spin_unlock(&xprt->transport_lock); - } - EXPORT_SYMBOL_GPL(xprt_force_disconnect); -@@ -820,6 +820,7 @@ bool xprt_lock_connect(struct rpc_xprt *xprt, - goto out; - if (xprt->snd_task != task) - goto out; -+ set_bit(XPRT_SND_IS_COOKIE, &xprt->state); - xprt->snd_task = cookie; - ret = true; - out: -@@ -835,6 +836,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie) - if (!test_bit(XPRT_LOCKED, &xprt->state)) - goto out; - xprt->snd_task =NULL; -+ clear_bit(XPRT_SND_IS_COOKIE, &xprt->state); - xprt->ops->release_xprt(xprt, NULL); - xprt_schedule_autodisconnect(xprt); - out: -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index a5922ce9109cf..fbbac9ba2862f 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -1756,6 +1756,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, - bool connected = !tipc_sk_type_connectionless(sk); - struct tipc_sock *tsk = tipc_sk(sk); - int rc, err, hlen, dlen, copy; -+ struct tipc_skb_cb *skb_cb; - struct sk_buff_head xmitq; - struct tipc_msg *hdr; - struct sk_buff *skb; -@@ -1779,6 +1780,7 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, - if (unlikely(rc)) - goto exit; - skb = skb_peek(&sk->sk_receive_queue); -+ skb_cb = TIPC_SKB_CB(skb); - hdr = buf_msg(skb); - dlen = msg_data_sz(hdr); - hlen = msg_hdr_sz(hdr); -@@ -1798,18 +1800,33 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, - - /* Capture data if non-error msg, otherwise just set return value */ - if (likely(!err)) { -- copy = min_t(int, dlen, buflen); -- if (unlikely(copy != dlen)) -- m->msg_flags |= MSG_TRUNC; -- rc = skb_copy_datagram_msg(skb, hlen, m, copy); -+ int offset = skb_cb->bytes_read; -+ -+ copy = min_t(int, dlen - offset, buflen); -+ rc = skb_copy_datagram_msg(skb, hlen + offset, m, copy); -+ if (unlikely(rc)) -+ goto exit; -+ if (unlikely(offset + copy < dlen)) { -+ if (flags & MSG_EOR) { -+ if (!(flags & MSG_PEEK)) -+ skb_cb->bytes_read = offset + copy; -+ } else { -+ m->msg_flags |= MSG_TRUNC; -+ skb_cb->bytes_read = 0; -+ } -+ } else { -+ if (flags & MSG_EOR) -+ m->msg_flags |= MSG_EOR; -+ skb_cb->bytes_read = 0; -+ } - } else { - copy = 0; - rc = 0; -- if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control) -+ if (err != TIPC_CONN_SHUTDOWN && connected && !m->msg_control) { - rc = -ECONNRESET; -+ goto exit; -+ } - } -- if (unlikely(rc)) -- goto exit; - - /* Mark message as group event if applicable */ - if (unlikely(grp_evt)) { -@@ -1832,6 +1849,9 @@ static int tipc_recvmsg(struct socket *sock, struct msghdr *m, - tipc_node_distr_xmit(sock_net(sk), &xmitq); - } - -+ if (skb_cb->bytes_read) -+ goto exit; -+ - tsk_advance_rx_queue(sk); - - if (likely(!connected)) -@@ -2255,7 +2275,7 @@ static int tipc_sk_backlog_rcv(struct sock *sk, struct sk_buff *skb) - static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, - u32 dport, struct sk_buff_head *xmitq) - { -- unsigned long time_limit = jiffies + 2; -+ unsigned long time_limit = jiffies + usecs_to_jiffies(20000); - struct sk_buff *skb; - unsigned int lim; - atomic_t *dcnt; -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 52ee3a9bb7093..3098710c9c344 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -2734,7 +2734,7 @@ static __poll_t unix_dgram_poll(struct file *file, struct socket *sock, - - other = unix_peer(sk); - if (other && unix_peer(other) != sk && -- unix_recvq_full(other) && -+ unix_recvq_full_lockless(other) && - unix_dgram_peer_wake_me(sk, other)) - writable = 0; - -diff --git a/samples/bpf/test_override_return.sh b/samples/bpf/test_override_return.sh -index e68b9ee6814b8..35db26f736b9d 100755 ---- a/samples/bpf/test_override_return.sh -+++ b/samples/bpf/test_override_return.sh -@@ -1,5 +1,6 @@ - #!/bin/bash - -+rm -r tmpmnt - rm -f testfile.img - dd if=/dev/zero of=testfile.img bs=1M seek=1000 count=1 - DEVICE=$(losetup --show -f testfile.img) -diff --git a/samples/bpf/tracex7_user.c b/samples/bpf/tracex7_user.c -index ea6dae78f0dff..2ed13e9f3fcb0 100644 ---- a/samples/bpf/tracex7_user.c -+++ b/samples/bpf/tracex7_user.c -@@ -13,6 +13,11 @@ int main(int argc, char **argv) - char command[256]; - int ret; - -+ if (!argv[1]) { -+ fprintf(stderr, "ERROR: Run with the btrfs device argument!\n"); -+ return 0; -+ } -+ - snprintf(filename, sizeof(filename), "%s_kern.o", argv[0]); - - if (load_bpf_file(filename)) { -diff --git a/scripts/gen_ksymdeps.sh b/scripts/gen_ksymdeps.sh -index 1324986e1362c..725e8c9c1b53f 100755 ---- a/scripts/gen_ksymdeps.sh -+++ b/scripts/gen_ksymdeps.sh -@@ -4,7 +4,13 @@ - set -e - - # List of exported symbols --ksyms=$($NM $1 | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) -+# -+# If the object has no symbol, $NM warns 'no symbols'. -+# Suppress the stderr. -+# TODO: -+# Use -q instead of 2>/dev/null when we upgrade the minimum version of -+# binutils to 2.37, llvm to 13.0.0. -+ksyms=$($NM $1 2>/dev/null | sed -n 's/.*__ksym_marker_\(.*\)/\1/p' | tr A-Z a-z) - - if [ -z "$ksyms" ]; then - exit 0 -diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c -index 38ac3da4e791e..beeba1a9be170 100644 ---- a/security/smack/smack_access.c -+++ b/security/smack/smack_access.c -@@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED; - int smk_access_entry(char *subject_label, char *object_label, - struct list_head *rule_list) - { -- int may = -ENOENT; - struct smack_rule *srp; - - list_for_each_entry_rcu(srp, rule_list, list) { - if (srp->smk_object->smk_known == object_label && - srp->smk_subject->smk_known == subject_label) { -- may = srp->smk_access; -- break; -+ int may = srp->smk_access; -+ /* -+ * MAY_WRITE implies MAY_LOCK. -+ */ -+ if ((may & MAY_WRITE) == MAY_WRITE) -+ may |= MAY_LOCK; -+ return may; - } - } - -- /* -- * MAY_WRITE implies MAY_LOCK. -- */ -- if ((may & MAY_WRITE) == MAY_WRITE) -- may |= MAY_LOCK; -- return may; -+ return -ENOENT; - } - - /** -diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig -index 71f2d42188c46..51e75b7819682 100644 ---- a/sound/soc/atmel/Kconfig -+++ b/sound/soc/atmel/Kconfig -@@ -11,7 +11,6 @@ if SND_ATMEL_SOC - - config SND_ATMEL_SOC_PDC - bool -- depends on HAS_DMA - - config SND_ATMEL_SOC_DMA - bool -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index c67b86e2d0c0a..7830d014d9247 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -284,9 +284,6 @@ static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = { - static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { - {"Headphone", NULL, "Platform Clock"}, - {"Headset Mic", NULL, "Platform Clock"}, -- {"Internal Mic", NULL, "Platform Clock"}, -- {"Speaker", NULL, "Platform Clock"}, -- - {"Headset Mic", NULL, "MICBIAS1"}, - {"IN2P", NULL, "Headset Mic"}, - {"Headphone", NULL, "HPOL"}, -@@ -294,19 +291,23 @@ static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = { - }; - - static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = { -+ {"Internal Mic", NULL, "Platform Clock"}, - {"DMIC1", NULL, "Internal Mic"}, - }; - - static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic2_map[] = { -+ {"Internal Mic", NULL, "Platform Clock"}, - {"DMIC2", NULL, "Internal Mic"}, - }; - - static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = { -+ {"Internal Mic", NULL, "Platform Clock"}, - {"Internal Mic", NULL, "MICBIAS1"}, - {"IN1P", NULL, "Internal Mic"}, - }; - - static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = { -+ {"Internal Mic", NULL, "Platform Clock"}, - {"Internal Mic", NULL, "MICBIAS1"}, - {"IN3P", NULL, "Internal Mic"}, - }; -@@ -348,6 +349,7 @@ static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = { - }; - - static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { -+ {"Speaker", NULL, "Platform Clock"}, - {"Speaker", NULL, "SPOLP"}, - {"Speaker", NULL, "SPOLN"}, - {"Speaker", NULL, "SPORP"}, -@@ -355,6 +357,7 @@ static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = { - }; - - static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = { -+ {"Speaker", NULL, "Platform Clock"}, - {"Speaker", NULL, "SPOLP"}, - {"Speaker", NULL, "SPOLN"}, - }; -diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c -index 476ef1897961d..79c6cf2c14bfb 100644 ---- a/sound/soc/intel/skylake/skl-messages.c -+++ b/sound/soc/intel/skylake/skl-messages.c -@@ -802,9 +802,12 @@ static u16 skl_get_module_param_size(struct skl_dev *skl, - - case SKL_MODULE_TYPE_BASE_OUTFMT: - case SKL_MODULE_TYPE_MIC_SELECT: -- case SKL_MODULE_TYPE_KPB: - return sizeof(struct skl_base_outfmt_cfg); - -+ case SKL_MODULE_TYPE_MIXER: -+ case SKL_MODULE_TYPE_KPB: -+ return sizeof(struct skl_base_cfg); -+ - default: - /* - * return only base cfg when no specific module type is -@@ -857,10 +860,14 @@ static int skl_set_module_format(struct skl_dev *skl, - - case SKL_MODULE_TYPE_BASE_OUTFMT: - case SKL_MODULE_TYPE_MIC_SELECT: -- case SKL_MODULE_TYPE_KPB: - skl_set_base_outfmt_format(skl, module_config, *param_data); - break; - -+ case SKL_MODULE_TYPE_MIXER: -+ case SKL_MODULE_TYPE_KPB: -+ skl_set_base_module_format(skl, module_config, *param_data); -+ break; -+ - default: - skl_set_base_module_format(skl, module_config, *param_data); - break; -diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c -index 7f287424af9b7..439dd4ba690c4 100644 ---- a/sound/soc/intel/skylake/skl-pcm.c -+++ b/sound/soc/intel/skylake/skl-pcm.c -@@ -1333,21 +1333,6 @@ static int skl_get_module_info(struct skl_dev *skl, - return -EIO; - } - -- list_for_each_entry(module, &skl->uuid_list, list) { -- if (guid_equal(uuid_mod, &module->uuid)) { -- mconfig->id.module_id = module->id; -- if (mconfig->module) -- mconfig->module->loadable = module->is_loadable; -- ret = 0; -- break; -- } -- } -- -- if (ret) -- return ret; -- -- uuid_mod = &module->uuid; -- ret = -EIO; - for (i = 0; i < skl->nr_modules; i++) { - skl_module = skl->modules[i]; - uuid_tplg = &skl_module->uuid; -@@ -1357,10 +1342,18 @@ static int skl_get_module_info(struct skl_dev *skl, - break; - } - } -+ - if (skl->nr_modules && ret) - return ret; - -+ ret = -EIO; - list_for_each_entry(module, &skl->uuid_list, list) { -+ if (guid_equal(uuid_mod, &module->uuid)) { -+ mconfig->id.module_id = module->id; -+ mconfig->module->loadable = module->is_loadable; -+ ret = 0; -+ } -+ - for (i = 0; i < MAX_IN_QUEUE; i++) { - pin_id = &mconfig->m_in_pin[i].id; - if (guid_equal(&pin_id->mod_uuid, &module->uuid)) -@@ -1374,7 +1367,7 @@ static int skl_get_module_info(struct skl_dev *skl, - } - } - -- return 0; -+ return ret; - } - - static int skl_populate_modules(struct skl_dev *skl) -diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c -index 61c984f10d8e6..086c90e095770 100644 ---- a/sound/soc/rockchip/rockchip_i2s.c -+++ b/sound/soc/rockchip/rockchip_i2s.c -@@ -186,7 +186,9 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai, - { - struct rk_i2s_dev *i2s = to_info(cpu_dai); - unsigned int mask = 0, val = 0; -+ int ret = 0; - -+ pm_runtime_get_sync(cpu_dai->dev); - mask = I2S_CKR_MSS_MASK; - switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) { - case SND_SOC_DAIFMT_CBS_CFS: -@@ -199,7 +201,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai, - i2s->is_master_mode = false; - break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_pm_put; - } - - regmap_update_bits(i2s->regmap, I2S_CKR, mask, val); -@@ -213,7 +216,8 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai, - val = I2S_CKR_CKP_POS; - break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_pm_put; - } - - regmap_update_bits(i2s->regmap, I2S_CKR, mask, val); -@@ -229,14 +233,15 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai, - case SND_SOC_DAIFMT_I2S: - val = I2S_TXCR_IBM_NORMAL; - break; -- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */ -- val = I2S_TXCR_TFS_PCM; -- break; -- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */ -+ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */ - val = I2S_TXCR_TFS_PCM | I2S_TXCR_PBM_MODE(1); - break; -+ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */ -+ val = I2S_TXCR_TFS_PCM; -+ break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_pm_put; - } - - regmap_update_bits(i2s->regmap, I2S_TXCR, mask, val); -@@ -252,19 +257,23 @@ static int rockchip_i2s_set_fmt(struct snd_soc_dai *cpu_dai, - case SND_SOC_DAIFMT_I2S: - val = I2S_RXCR_IBM_NORMAL; - break; -- case SND_SOC_DAIFMT_DSP_A: /* PCM no delay mode */ -- val = I2S_RXCR_TFS_PCM; -- break; -- case SND_SOC_DAIFMT_DSP_B: /* PCM delay 1 mode */ -+ case SND_SOC_DAIFMT_DSP_A: /* PCM delay 1 bit mode */ - val = I2S_RXCR_TFS_PCM | I2S_RXCR_PBM_MODE(1); - break; -+ case SND_SOC_DAIFMT_DSP_B: /* PCM no delay mode */ -+ val = I2S_RXCR_TFS_PCM; -+ break; - default: -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_pm_put; - } - - regmap_update_bits(i2s->regmap, I2S_RXCR, mask, val); - -- return 0; -+err_pm_put: -+ pm_runtime_put(cpu_dai->dev); -+ -+ return ret; - } - - static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream, -diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config -index 9832affd5d54b..c75c9b03d6e77 100644 ---- a/tools/perf/Makefile.config -+++ b/tools/perf/Makefile.config -@@ -118,10 +118,10 @@ FEATURE_CHECK_LDFLAGS-libunwind = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS) - FEATURE_CHECK_CFLAGS-libunwind-debug-frame = $(LIBUNWIND_CFLAGS) - FEATURE_CHECK_LDFLAGS-libunwind-debug-frame = $(LIBUNWIND_LDFLAGS) $(LIBUNWIND_LIBS) - --FEATURE_CHECK_LDFLAGS-libunwind-arm = -lunwind -lunwind-arm --FEATURE_CHECK_LDFLAGS-libunwind-aarch64 = -lunwind -lunwind-aarch64 --FEATURE_CHECK_LDFLAGS-libunwind-x86 = -lunwind -llzma -lunwind-x86 --FEATURE_CHECK_LDFLAGS-libunwind-x86_64 = -lunwind -llzma -lunwind-x86_64 -+FEATURE_CHECK_LDFLAGS-libunwind-arm += -lunwind -lunwind-arm -+FEATURE_CHECK_LDFLAGS-libunwind-aarch64 += -lunwind -lunwind-aarch64 -+FEATURE_CHECK_LDFLAGS-libunwind-x86 += -lunwind -llzma -lunwind-x86 -+FEATURE_CHECK_LDFLAGS-libunwind-x86_64 += -lunwind -llzma -lunwind-x86_64 - - FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto - -diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c -index 767fe1bfd922c..8c3addc2e9e1e 100644 ---- a/tools/perf/util/machine.c -+++ b/tools/perf/util/machine.c -@@ -2020,6 +2020,7 @@ static int add_callchain_ip(struct thread *thread, - - al.filtered = 0; - al.sym = NULL; -+ al.srcline = NULL; - if (!cpumode) { - thread__find_cpumode_addr_location(thread, ip, &al); - } else { -diff --git a/tools/testing/selftests/bpf/progs/xdp_tx.c b/tools/testing/selftests/bpf/progs/xdp_tx.c -index 57912e7c94b0a..9ed477776eca8 100644 ---- a/tools/testing/selftests/bpf/progs/xdp_tx.c -+++ b/tools/testing/selftests/bpf/progs/xdp_tx.c -@@ -3,7 +3,7 @@ - #include - #include "bpf_helpers.h" - --SEC("tx") -+SEC("xdp") - int xdp_tx(struct xdp_md *xdp) - { - return XDP_TX; -diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c -index 1c4219ceced2f..45c7a55f0b8b5 100644 ---- a/tools/testing/selftests/bpf/test_maps.c -+++ b/tools/testing/selftests/bpf/test_maps.c -@@ -972,7 +972,7 @@ static void test_sockmap(unsigned int tasks, void *data) - - FD_ZERO(&w); - FD_SET(sfd[3], &w); -- to.tv_sec = 1; -+ to.tv_sec = 30; - to.tv_usec = 0; - s = select(sfd[3] + 1, &w, NULL, NULL, &to); - if (s == -1) { -diff --git a/tools/testing/selftests/bpf/test_xdp_veth.sh b/tools/testing/selftests/bpf/test_xdp_veth.sh -index ba8ffcdaac302..995278e684b6e 100755 ---- a/tools/testing/selftests/bpf/test_xdp_veth.sh -+++ b/tools/testing/selftests/bpf/test_xdp_veth.sh -@@ -108,7 +108,7 @@ ip link set dev veth2 xdp pinned $BPF_DIR/progs/redirect_map_1 - ip link set dev veth3 xdp pinned $BPF_DIR/progs/redirect_map_2 - - ip -n ns1 link set dev veth11 xdp obj xdp_dummy.o sec xdp_dummy --ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec tx -+ip -n ns2 link set dev veth22 xdp obj xdp_tx.o sec xdp - ip -n ns3 link set dev veth33 xdp obj xdp_dummy.o sec xdp_dummy - - trap cleanup EXIT -diff --git a/tools/thermal/tmon/Makefile b/tools/thermal/tmon/Makefile -index 59e417ec3e134..25d7f8f37cfd6 100644 ---- a/tools/thermal/tmon/Makefile -+++ b/tools/thermal/tmon/Makefile -@@ -10,7 +10,7 @@ override CFLAGS+= $(call cc-option,-O3,-O1) ${WARNFLAGS} - # Add "-fstack-protector" only if toolchain supports it. - override CFLAGS+= $(call cc-option,-fstack-protector-strong) - CC?= $(CROSS_COMPILE)gcc --PKG_CONFIG?= pkg-config -+PKG_CONFIG?= $(CROSS_COMPILE)pkg-config - - override CFLAGS+=-D VERSION=\"$(VERSION)\" - LDFLAGS+= -diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c -index 4af85605730e4..f7150fbeeb55e 100644 ---- a/virt/kvm/arm/arm.c -+++ b/virt/kvm/arm/arm.c -@@ -1141,6 +1141,14 @@ long kvm_arch_vcpu_ioctl(struct file *filp, - if (copy_from_user(®, argp, sizeof(reg))) - break; - -+ /* -+ * We could owe a reset due to PSCI. Handle the pending reset -+ * here to ensure userspace register accesses are ordered after -+ * the reset. -+ */ -+ if (kvm_check_request(KVM_REQ_VCPU_RESET, vcpu)) -+ kvm_reset_vcpu(vcpu); -+ - if (ioctl == KVM_SET_ONE_REG) - r = kvm_arm_set_reg(vcpu, ®); - else diff --git a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.148-149.patch b/patch/kernel/archive/odroidxu4-5.4/patch-5.4.148-149.patch deleted file mode 100644 index 50a8c8eacf..0000000000 --- a/patch/kernel/archive/odroidxu4-5.4/patch-5.4.148-149.patch +++ /dev/null @@ -1,1792 +0,0 @@ -diff --git a/Makefile b/Makefile -index b84706c6d6248..1834f47fbaf61 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,7 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0 - VERSION = 5 - PATCHLEVEL = 4 --SUBLEVEL = 148 -+SUBLEVEL = 149 - EXTRAVERSION = - NAME = Kleptomaniac Octopus - -diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h -index 18b0197f23848..15bd9af13497f 100644 ---- a/arch/arm/include/asm/ftrace.h -+++ b/arch/arm/include/asm/ftrace.h -@@ -16,6 +16,9 @@ extern void __gnu_mcount_nc(void); - - #ifdef CONFIG_DYNAMIC_FTRACE - struct dyn_arch_ftrace { -+#ifdef CONFIG_ARM_MODULE_PLTS -+ struct module *mod; -+#endif - }; - - static inline unsigned long ftrace_call_adjust(unsigned long addr) -diff --git a/arch/arm/include/asm/insn.h b/arch/arm/include/asm/insn.h -index f20e08ac85aeb..5475cbf9fb6b4 100644 ---- a/arch/arm/include/asm/insn.h -+++ b/arch/arm/include/asm/insn.h -@@ -13,18 +13,18 @@ arm_gen_nop(void) - } - - unsigned long --__arm_gen_branch(unsigned long pc, unsigned long addr, bool link); -+__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn); - - static inline unsigned long - arm_gen_branch(unsigned long pc, unsigned long addr) - { -- return __arm_gen_branch(pc, addr, false); -+ return __arm_gen_branch(pc, addr, false, true); - } - - static inline unsigned long --arm_gen_branch_link(unsigned long pc, unsigned long addr) -+arm_gen_branch_link(unsigned long pc, unsigned long addr, bool warn) - { -- return __arm_gen_branch(pc, addr, true); -+ return __arm_gen_branch(pc, addr, true, warn); - } - - #endif -diff --git a/arch/arm/include/asm/module.h b/arch/arm/include/asm/module.h -index 182163b55546c..961fedbd810ec 100644 ---- a/arch/arm/include/asm/module.h -+++ b/arch/arm/include/asm/module.h -@@ -19,8 +19,18 @@ enum { - }; - #endif - -+#define PLT_ENT_STRIDE L1_CACHE_BYTES -+#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) -+#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) -+ -+struct plt_entries { -+ u32 ldr[PLT_ENT_COUNT]; -+ u32 lit[PLT_ENT_COUNT]; -+}; -+ - struct mod_plt_sec { - struct elf32_shdr *plt; -+ struct plt_entries *plt_ent; - int plt_count; - }; - -diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c -index bda949fd84e8b..12b6da56f88dd 100644 ---- a/arch/arm/kernel/ftrace.c -+++ b/arch/arm/kernel/ftrace.c -@@ -71,9 +71,10 @@ int ftrace_arch_code_modify_post_process(void) - return 0; - } - --static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr) -+static unsigned long ftrace_call_replace(unsigned long pc, unsigned long addr, -+ bool warn) - { -- return arm_gen_branch_link(pc, addr); -+ return arm_gen_branch_link(pc, addr, warn); - } - - static int ftrace_modify_code(unsigned long pc, unsigned long old, -@@ -112,14 +113,14 @@ int ftrace_update_ftrace_func(ftrace_func_t func) - int ret; - - pc = (unsigned long)&ftrace_call; -- new = ftrace_call_replace(pc, (unsigned long)func); -+ new = ftrace_call_replace(pc, (unsigned long)func, true); - - ret = ftrace_modify_code(pc, 0, new, false); - - #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS - if (!ret) { - pc = (unsigned long)&ftrace_regs_call; -- new = ftrace_call_replace(pc, (unsigned long)func); -+ new = ftrace_call_replace(pc, (unsigned long)func, true); - - ret = ftrace_modify_code(pc, 0, new, false); - } -@@ -132,10 +133,22 @@ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr) - { - unsigned long new, old; - unsigned long ip = rec->ip; -+ unsigned long aaddr = adjust_address(rec, addr); -+ struct module *mod = NULL; -+ -+#ifdef CONFIG_ARM_MODULE_PLTS -+ mod = rec->arch.mod; -+#endif - - old = ftrace_nop_replace(rec); - -- new = ftrace_call_replace(ip, adjust_address(rec, addr)); -+ new = ftrace_call_replace(ip, aaddr, !mod); -+#ifdef CONFIG_ARM_MODULE_PLTS -+ if (!new && mod) { -+ aaddr = get_module_plt(mod, ip, aaddr); -+ new = ftrace_call_replace(ip, aaddr, true); -+ } -+#endif - - return ftrace_modify_code(rec->ip, old, new, true); - } -@@ -148,9 +161,9 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, - unsigned long new, old; - unsigned long ip = rec->ip; - -- old = ftrace_call_replace(ip, adjust_address(rec, old_addr)); -+ old = ftrace_call_replace(ip, adjust_address(rec, old_addr), true); - -- new = ftrace_call_replace(ip, adjust_address(rec, addr)); -+ new = ftrace_call_replace(ip, adjust_address(rec, addr), true); - - return ftrace_modify_code(rec->ip, old, new, true); - } -@@ -160,12 +173,29 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr, - int ftrace_make_nop(struct module *mod, - struct dyn_ftrace *rec, unsigned long addr) - { -+ unsigned long aaddr = adjust_address(rec, addr); - unsigned long ip = rec->ip; - unsigned long old; - unsigned long new; - int ret; - -- old = ftrace_call_replace(ip, adjust_address(rec, addr)); -+#ifdef CONFIG_ARM_MODULE_PLTS -+ /* mod is only supplied during module loading */ -+ if (!mod) -+ mod = rec->arch.mod; -+ else -+ rec->arch.mod = mod; -+#endif -+ -+ old = ftrace_call_replace(ip, aaddr, -+ !IS_ENABLED(CONFIG_ARM_MODULE_PLTS) || !mod); -+#ifdef CONFIG_ARM_MODULE_PLTS -+ if (!old && mod) { -+ aaddr = get_module_plt(mod, ip, aaddr); -+ old = ftrace_call_replace(ip, aaddr, true); -+ } -+#endif -+ - new = ftrace_nop_replace(rec); - ret = ftrace_modify_code(ip, old, new, true); - -diff --git a/arch/arm/kernel/insn.c b/arch/arm/kernel/insn.c -index 2e844b70386b3..db0acbb7d7a02 100644 ---- a/arch/arm/kernel/insn.c -+++ b/arch/arm/kernel/insn.c -@@ -3,8 +3,9 @@ - #include - #include - --static unsigned long --__arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) -+static unsigned long __arm_gen_branch_thumb2(unsigned long pc, -+ unsigned long addr, bool link, -+ bool warn) - { - unsigned long s, j1, j2, i1, i2, imm10, imm11; - unsigned long first, second; -@@ -12,7 +13,7 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) - - offset = (long)addr - (long)(pc + 4); - if (offset < -16777216 || offset > 16777214) { -- WARN_ON_ONCE(1); -+ WARN_ON_ONCE(warn); - return 0; - } - -@@ -33,8 +34,8 @@ __arm_gen_branch_thumb2(unsigned long pc, unsigned long addr, bool link) - return __opcode_thumb32_compose(first, second); - } - --static unsigned long --__arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) -+static unsigned long __arm_gen_branch_arm(unsigned long pc, unsigned long addr, -+ bool link, bool warn) - { - unsigned long opcode = 0xea000000; - long offset; -@@ -44,7 +45,7 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) - - offset = (long)addr - (long)(pc + 8); - if (unlikely(offset < -33554432 || offset > 33554428)) { -- WARN_ON_ONCE(1); -+ WARN_ON_ONCE(warn); - return 0; - } - -@@ -54,10 +55,10 @@ __arm_gen_branch_arm(unsigned long pc, unsigned long addr, bool link) - } - - unsigned long --__arm_gen_branch(unsigned long pc, unsigned long addr, bool link) -+__arm_gen_branch(unsigned long pc, unsigned long addr, bool link, bool warn) - { - if (IS_ENABLED(CONFIG_THUMB2_KERNEL)) -- return __arm_gen_branch_thumb2(pc, addr, link); -+ return __arm_gen_branch_thumb2(pc, addr, link, warn); - else -- return __arm_gen_branch_arm(pc, addr, link); -+ return __arm_gen_branch_arm(pc, addr, link, warn); - } -diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c -index b647741c0ab06..d1c2d3bd55b64 100644 ---- a/arch/arm/kernel/module-plts.c -+++ b/arch/arm/kernel/module-plts.c -@@ -4,6 +4,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -11,10 +12,6 @@ - #include - #include - --#define PLT_ENT_STRIDE L1_CACHE_BYTES --#define PLT_ENT_COUNT (PLT_ENT_STRIDE / sizeof(u32)) --#define PLT_ENT_SIZE (sizeof(struct plt_entries) / PLT_ENT_COUNT) -- - #ifdef CONFIG_THUMB2_KERNEL - #define PLT_ENT_LDR __opcode_to_mem_thumb32(0xf8dff000 | \ - (PLT_ENT_STRIDE - 4)) -@@ -23,9 +20,11 @@ - (PLT_ENT_STRIDE - 8)) - #endif - --struct plt_entries { -- u32 ldr[PLT_ENT_COUNT]; -- u32 lit[PLT_ENT_COUNT]; -+static const u32 fixed_plts[] = { -+#ifdef CONFIG_DYNAMIC_FTRACE -+ FTRACE_ADDR, -+ MCOUNT_ADDR, -+#endif - }; - - static bool in_init(const struct module *mod, unsigned long loc) -@@ -33,14 +32,40 @@ static bool in_init(const struct module *mod, unsigned long loc) - return loc - (u32)mod->init_layout.base < mod->init_layout.size; - } - -+static void prealloc_fixed(struct mod_plt_sec *pltsec, struct plt_entries *plt) -+{ -+ int i; -+ -+ if (!ARRAY_SIZE(fixed_plts) || pltsec->plt_count) -+ return; -+ pltsec->plt_count = ARRAY_SIZE(fixed_plts); -+ -+ for (i = 0; i < ARRAY_SIZE(plt->ldr); ++i) -+ plt->ldr[i] = PLT_ENT_LDR; -+ -+ BUILD_BUG_ON(sizeof(fixed_plts) > sizeof(plt->lit)); -+ memcpy(plt->lit, fixed_plts, sizeof(fixed_plts)); -+} -+ - u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val) - { - struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core : - &mod->arch.init; -+ struct plt_entries *plt; -+ int idx; -+ -+ /* cache the address, ELF header is available only during module load */ -+ if (!pltsec->plt_ent) -+ pltsec->plt_ent = (struct plt_entries *)pltsec->plt->sh_addr; -+ plt = pltsec->plt_ent; - -- struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr; -- int idx = 0; -+ prealloc_fixed(pltsec, plt); -+ -+ for (idx = 0; idx < ARRAY_SIZE(fixed_plts); ++idx) -+ if (plt->lit[idx] == val) -+ return (u32)&plt->ldr[idx]; - -+ idx = 0; - /* - * Look for an existing entry pointing to 'val'. Given that the - * relocations are sorted, this will be the last entry we allocated. -@@ -188,8 +213,8 @@ static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base, - int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - char *secstrings, struct module *mod) - { -- unsigned long core_plts = 0; -- unsigned long init_plts = 0; -+ unsigned long core_plts = ARRAY_SIZE(fixed_plts); -+ unsigned long init_plts = ARRAY_SIZE(fixed_plts); - Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum; - Elf32_Sym *syms = NULL; - -@@ -244,6 +269,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE, - sizeof(struct plt_entries)); - mod->arch.core.plt_count = 0; -+ mod->arch.core.plt_ent = NULL; - - mod->arch.init.plt->sh_type = SHT_NOBITS; - mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC; -@@ -251,6 +277,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs, - mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE, - sizeof(struct plt_entries)); - mod->arch.init.plt_count = 0; -+ mod->arch.init.plt_ent = NULL; - - pr_debug("%s: plt=%x, init.plt=%x\n", __func__, - mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size); -diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c -index 0804a6af4a3b7..5a3641b5ec2cd 100644 ---- a/arch/arm/mm/init.c -+++ b/arch/arm/mm/init.c -@@ -469,7 +469,11 @@ static void __init free_highpages(void) - void __init mem_init(void) - { - #ifdef CONFIG_ARM_LPAE -- swiotlb_init(1); -+ if (swiotlb_force == SWIOTLB_FORCE || -+ max_pfn > arm_dma_pfn_limit) -+ swiotlb_init(1); -+ else -+ swiotlb_force = SWIOTLB_NO_FORCE; - #endif - - set_max_mapnr(pfn_to_page(max_pfn) - mem_map); -diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c -index 7fa6828bb488a..587543c6c51cb 100644 ---- a/arch/arm64/kernel/cacheinfo.c -+++ b/arch/arm64/kernel/cacheinfo.c -@@ -43,7 +43,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, - this_leaf->type = type; - } - --static int __init_cache_level(unsigned int cpu) -+int init_cache_level(unsigned int cpu) - { - unsigned int ctype, level, leaves, fw_level; - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); -@@ -78,7 +78,7 @@ static int __init_cache_level(unsigned int cpu) - return 0; - } - --static int __populate_cache_leaves(unsigned int cpu) -+int populate_cache_leaves(unsigned int cpu) - { - unsigned int level, idx; - enum cache_type type; -@@ -97,6 +97,3 @@ static int __populate_cache_leaves(unsigned int cpu) - } - return 0; - } -- --DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level) --DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves) -diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c -index 47312c5294102..529dab855aac9 100644 ---- a/arch/mips/kernel/cacheinfo.c -+++ b/arch/mips/kernel/cacheinfo.c -@@ -17,7 +17,7 @@ do { \ - leaf++; \ - } while (0) - --static int __init_cache_level(unsigned int cpu) -+int init_cache_level(unsigned int cpu) - { - struct cpuinfo_mips *c = ¤t_cpu_data; - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); -@@ -69,7 +69,7 @@ static void fill_cpumask_cluster(int cpu, cpumask_t *cpu_map) - cpumask_set_cpu(cpu1, cpu_map); - } - --static int __populate_cache_leaves(unsigned int cpu) -+int populate_cache_leaves(unsigned int cpu) - { - struct cpuinfo_mips *c = ¤t_cpu_data; - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); -@@ -98,6 +98,3 @@ static int __populate_cache_leaves(unsigned int cpu) - - return 0; - } -- --DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level) --DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves) -diff --git a/arch/riscv/kernel/cacheinfo.c b/arch/riscv/kernel/cacheinfo.c -index 4c90c07d8c39d..d930bd073b7b2 100644 ---- a/arch/riscv/kernel/cacheinfo.c -+++ b/arch/riscv/kernel/cacheinfo.c -@@ -16,7 +16,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, - this_leaf->type = type; - } - --static int __init_cache_level(unsigned int cpu) -+int init_cache_level(unsigned int cpu) - { - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct device_node *np = of_cpu_device_node_get(cpu); -@@ -58,7 +58,7 @@ static int __init_cache_level(unsigned int cpu) - return 0; - } - --static int __populate_cache_leaves(unsigned int cpu) -+int populate_cache_leaves(unsigned int cpu) - { - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf = this_cpu_ci->info_list; -@@ -95,6 +95,3 @@ static int __populate_cache_leaves(unsigned int cpu) - - return 0; - } -- --DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level) --DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves) -diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c -index 020a2c514d961..921f0fc12f1fa 100644 ---- a/arch/s390/pci/pci_mmio.c -+++ b/arch/s390/pci/pci_mmio.c -@@ -128,7 +128,7 @@ static long get_pfn(unsigned long user_addr, unsigned long access, - down_read(¤t->mm->mmap_sem); - ret = -EINVAL; - vma = find_vma(current->mm, user_addr); -- if (!vma) -+ if (!vma || user_addr < vma->vm_start) - goto out; - ret = -EACCES; - if (!(vma->vm_flags & access)) -diff --git a/arch/um/drivers/virtio_uml.c b/arch/um/drivers/virtio_uml.c -index 18618af3835f9..936e17eab3360 100644 ---- a/arch/um/drivers/virtio_uml.c -+++ b/arch/um/drivers/virtio_uml.c -@@ -994,7 +994,7 @@ static int virtio_uml_probe(struct platform_device *pdev) - rc = os_connect_socket(pdata->socket_path); - } while (rc == -EINTR); - if (rc < 0) -- return rc; -+ goto error_free; - vu_dev->sock = rc; - - rc = vhost_user_init(vu_dev); -@@ -1010,6 +1010,8 @@ static int virtio_uml_probe(struct platform_device *pdev) - - error_init: - os_close_file(vu_dev->sock); -+error_free: -+ kfree(vu_dev); - return rc; - } - -diff --git a/arch/x86/kernel/cpu/cacheinfo.c b/arch/x86/kernel/cpu/cacheinfo.c -index 30f33b75209a1..cae566567e15e 100644 ---- a/arch/x86/kernel/cpu/cacheinfo.c -+++ b/arch/x86/kernel/cpu/cacheinfo.c -@@ -985,7 +985,7 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, - this_leaf->priv = base->nb; - } - --static int __init_cache_level(unsigned int cpu) -+int init_cache_level(unsigned int cpu) - { - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - -@@ -1014,7 +1014,7 @@ static void get_cache_id(int cpu, struct _cpuid4_info_regs *id4_regs) - id4_regs->id = c->apicid >> index_msb; - } - --static int __populate_cache_leaves(unsigned int cpu) -+int populate_cache_leaves(unsigned int cpu) - { - unsigned int idx, ret; - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); -@@ -1033,6 +1033,3 @@ static int __populate_cache_leaves(unsigned int cpu) - - return 0; - } -- --DEFINE_SMP_CALL_CACHE_FUNCTION(init_cache_level) --DEFINE_SMP_CALL_CACHE_FUNCTION(populate_cache_leaves) -diff --git a/block/blk-throttle.c b/block/blk-throttle.c -index 18f773e52dfb1..bd870f9ae4586 100644 ---- a/block/blk-throttle.c -+++ b/block/blk-throttle.c -@@ -2414,6 +2414,7 @@ int blk_throtl_init(struct request_queue *q) - void blk_throtl_exit(struct request_queue *q) - { - BUG_ON(!q->td); -+ del_timer_sync(&q->td->service_queue.pending_timer); - throtl_shutdown_wq(q); - blkcg_deactivate_policy(q, &blkcg_policy_throtl); - free_percpu(q->td->latency_buckets[READ]); -diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c -index 6b347d9920cc2..47e43c9498257 100644 ---- a/drivers/acpi/pci_mcfg.c -+++ b/drivers/acpi/pci_mcfg.c -@@ -142,6 +142,26 @@ static struct mcfg_fixup mcfg_quirks[] = { - XGENE_V2_ECAM_MCFG(4, 0), - XGENE_V2_ECAM_MCFG(4, 1), - XGENE_V2_ECAM_MCFG(4, 2), -+ -+#define ALTRA_ECAM_QUIRK(rev, seg) \ -+ { "Ampere", "Altra ", rev, seg, MCFG_BUS_ANY, &pci_32b_read_ops } -+ -+ ALTRA_ECAM_QUIRK(1, 0), -+ ALTRA_ECAM_QUIRK(1, 1), -+ ALTRA_ECAM_QUIRK(1, 2), -+ ALTRA_ECAM_QUIRK(1, 3), -+ ALTRA_ECAM_QUIRK(1, 4), -+ ALTRA_ECAM_QUIRK(1, 5), -+ ALTRA_ECAM_QUIRK(1, 6), -+ ALTRA_ECAM_QUIRK(1, 7), -+ ALTRA_ECAM_QUIRK(1, 8), -+ ALTRA_ECAM_QUIRK(1, 9), -+ ALTRA_ECAM_QUIRK(1, 10), -+ ALTRA_ECAM_QUIRK(1, 11), -+ ALTRA_ECAM_QUIRK(1, 12), -+ ALTRA_ECAM_QUIRK(1, 13), -+ ALTRA_ECAM_QUIRK(1, 14), -+ ALTRA_ECAM_QUIRK(1, 15), - }; - - static char mcfg_oem_id[ACPI_OEM_ID_SIZE]; -diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig -index a32d0d7152475..1322461f1f3c5 100644 ---- a/drivers/dma/Kconfig -+++ b/drivers/dma/Kconfig -@@ -276,7 +276,7 @@ config INTEL_IDMA64 - - config INTEL_IOATDMA - tristate "Intel I/OAT DMA support" -- depends on PCI && X86_64 -+ depends on PCI && X86_64 && !UML - select DMA_ENGINE - select DMA_ENGINE_RAID - select DCA -diff --git a/drivers/dma/acpi-dma.c b/drivers/dma/acpi-dma.c -index dcbcb712de6e8..731f453ecb51f 100644 ---- a/drivers/dma/acpi-dma.c -+++ b/drivers/dma/acpi-dma.c -@@ -70,10 +70,14 @@ static int acpi_dma_parse_resource_group(const struct acpi_csrt_group *grp, - - si = (const struct acpi_csrt_shared_info *)&grp[1]; - -- /* Match device by MMIO and IRQ */ -+ /* Match device by MMIO */ - if (si->mmio_base_low != lower_32_bits(mem) || -- si->mmio_base_high != upper_32_bits(mem) || -- si->gsi_interrupt != irq) -+ si->mmio_base_high != upper_32_bits(mem)) -+ return 0; -+ -+ /* Match device by Linux vIRQ */ -+ ret = acpi_register_gsi(NULL, si->gsi_interrupt, si->interrupt_mode, si->interrupt_polarity); -+ if (ret != irq) - return 0; - - dev_dbg(&adev->dev, "matches with %.4s%04X (rev %u)\n", -diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c -index 8546ad0347208..b966115bfad1d 100644 ---- a/drivers/dma/sprd-dma.c -+++ b/drivers/dma/sprd-dma.c -@@ -1230,6 +1230,7 @@ static const struct of_device_id sprd_dma_match[] = { - { .compatible = "sprd,sc9860-dma", }, - {}, - }; -+MODULE_DEVICE_TABLE(of, sprd_dma_match); - - static int __maybe_unused sprd_dma_runtime_suspend(struct device *dev) - { -diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c -index ce18bca45ff27..7729b8d22553e 100644 ---- a/drivers/dma/xilinx/xilinx_dma.c -+++ b/drivers/dma/xilinx/xilinx_dma.c -@@ -2703,7 +2703,7 @@ static int xilinx_dma_probe(struct platform_device *pdev) - xdev->ext_addr = false; - - /* Set the dma mask bits */ -- dma_set_mask(xdev->dev, DMA_BIT_MASK(addr_width)); -+ dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width)); - - /* Initialize the DMA engine */ - xdev->common.dev = &pdev->dev; -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c -index b0ece71aefdee..ce774579c89d1 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/ctrl.c -@@ -57,7 +57,7 @@ nvkm_control_mthd_pstate_info(struct nvkm_control *ctrl, void *data, u32 size) - args->v0.count = 0; - args->v0.ustate_ac = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE; - args->v0.ustate_dc = NVIF_CONTROL_PSTATE_INFO_V0_USTATE_DISABLE; -- args->v0.pwrsrc = -ENOSYS; -+ args->v0.pwrsrc = -ENODEV; - args->v0.pstate = NVIF_CONTROL_PSTATE_INFO_V0_PSTATE_UNKNOWN; - } - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 10d28be73f456..4e7cfd3bfcd2e 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -1987,6 +1987,8 @@ static void stmmac_tx_err(struct stmmac_priv *priv, u32 chan) - tx_q->cur_tx = 0; - tx_q->mss = 0; - netdev_tx_reset_queue(netdev_get_tx_queue(priv->dev, chan)); -+ stmmac_init_tx_chan(priv, priv->ioaddr, priv->plat->dma_cfg, -+ tx_q->dma_tx_phy, chan); - stmmac_start_tx_dma(priv, chan); - - priv->dev->stats.tx_errors++; -diff --git a/drivers/net/phy/phy-c45.c b/drivers/net/phy/phy-c45.c -index a1caeee122361..bceb0dcdecbd6 100644 ---- a/drivers/net/phy/phy-c45.c -+++ b/drivers/net/phy/phy-c45.c -@@ -239,9 +239,10 @@ int genphy_c45_read_link(struct phy_device *phydev) - - /* The link state is latched low so that momentary link - * drops can be detected. Do not double-read the status -- * in polling mode to detect such short link drops. -+ * in polling mode to detect such short link drops except -+ * the link was already down. - */ -- if (!phy_polling_mode(phydev)) { -+ if (!phy_polling_mode(phydev) || !phydev->link) { - val = phy_read_mmd(phydev, devad, MDIO_STAT1); - if (val < 0) - return val; -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 9d0a306f05623..35ade5d21de51 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1766,9 +1766,10 @@ int genphy_update_link(struct phy_device *phydev) - - /* The link state is latched low so that momentary link - * drops can be detected. Do not double-read the status -- * in polling mode to detect such short link drops. -+ * in polling mode to detect such short link drops except -+ * the link was already down. - */ -- if (!phy_polling_mode(phydev)) { -+ if (!phy_polling_mode(phydev) || !phydev->link) { - status = phy_read(phydev, MII_BMSR); - if (status < 0) - return status; -diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c -index 2f1cac89ddf5c..544287e9f449b 100644 ---- a/drivers/parisc/dino.c -+++ b/drivers/parisc/dino.c -@@ -156,15 +156,6 @@ static inline struct dino_device *DINO_DEV(struct pci_hba_data *hba) - return container_of(hba, struct dino_device, hba); - } - --/* Check if PCI device is behind a Card-mode Dino. */ --static int pci_dev_is_behind_card_dino(struct pci_dev *dev) --{ -- struct dino_device *dino_dev; -- -- dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge)); -- return is_card_dino(&dino_dev->hba.dev->id); --} -- - /* - * Dino Configuration Space Accessor Functions - */ -@@ -447,6 +438,15 @@ static void quirk_cirrus_cardbus(struct pci_dev *dev) - DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_CIRRUS, PCI_DEVICE_ID_CIRRUS_6832, quirk_cirrus_cardbus ); - - #ifdef CONFIG_TULIP -+/* Check if PCI device is behind a Card-mode Dino. */ -+static int pci_dev_is_behind_card_dino(struct pci_dev *dev) -+{ -+ struct dino_device *dino_dev; -+ -+ dino_dev = DINO_DEV(parisc_walk_tree(dev->bus->bridge)); -+ return is_card_dino(&dino_dev->hba.dev->id); -+} -+ - static void pci_fixup_tulip(struct pci_dev *dev) - { - if (!pci_dev_is_behind_card_dino(dev)) -diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c -index 0538348ed843f..18753fd218a31 100644 ---- a/drivers/pci/controller/pci-aardvark.c -+++ b/drivers/pci/controller/pci-aardvark.c -@@ -188,6 +188,8 @@ - - #define MSI_IRQ_NUM 32 - -+#define CFG_RD_CRS_VAL 0xffff0001 -+ - struct advk_pcie { - struct platform_device *pdev; - void __iomem *base; -@@ -365,7 +367,7 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) - advk_writel(pcie, reg, PCIE_CORE_CMD_STATUS_REG); - } - --static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val) -+static int advk_pcie_check_pio_status(struct advk_pcie *pcie, bool allow_crs, u32 *val) - { - struct device *dev = &pcie->pdev->dev; - u32 reg; -@@ -407,9 +409,30 @@ static int advk_pcie_check_pio_status(struct advk_pcie *pcie, u32 *val) - strcomp_status = "UR"; - break; - case PIO_COMPLETION_STATUS_CRS: -+ if (allow_crs && val) { -+ /* PCIe r4.0, sec 2.3.2, says: -+ * If CRS Software Visibility is enabled: -+ * For a Configuration Read Request that includes both -+ * bytes of the Vendor ID field of a device Function's -+ * Configuration Space Header, the Root Complex must -+ * complete the Request to the host by returning a -+ * read-data value of 0001h for the Vendor ID field and -+ * all '1's for any additional bytes included in the -+ * request. -+ * -+ * So CRS in this case is not an error status. -+ */ -+ *val = CFG_RD_CRS_VAL; -+ strcomp_status = NULL; -+ break; -+ } - /* PCIe r4.0, sec 2.3.2, says: - * If CRS Software Visibility is not enabled, the Root Complex - * must re-issue the Configuration Request as a new Request. -+ * If CRS Software Visibility is enabled: For a Configuration -+ * Write Request or for any other Configuration Read Request, -+ * the Root Complex must re-issue the Configuration Request as -+ * a new Request. - * A Root Complex implementation may choose to limit the number - * of Configuration Request/CRS Completion Status loops before - * determining that something is wrong with the target of the -@@ -478,6 +501,7 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, - case PCI_EXP_RTCTL: { - u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG); - *value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE; -+ *value |= PCI_EXP_RTCAP_CRSVIS << 16; - return PCI_BRIDGE_EMUL_HANDLED; - } - -@@ -559,6 +583,7 @@ static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = { - static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) - { - struct pci_bridge_emul *bridge = &pcie->bridge; -+ int ret; - - bridge->conf.vendor = advk_readl(pcie, PCIE_CORE_DEV_ID_REG) & 0xffff; - bridge->conf.device = advk_readl(pcie, PCIE_CORE_DEV_ID_REG) >> 16; -@@ -580,7 +605,15 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) - bridge->data = pcie; - bridge->ops = &advk_pci_bridge_emul_ops; - -- return pci_bridge_emul_init(bridge, 0); -+ /* PCIe config space can be initialized after pci_bridge_emul_init() */ -+ ret = pci_bridge_emul_init(bridge, 0); -+ if (ret < 0) -+ return ret; -+ -+ /* Indicates supports for Completion Retry Status */ -+ bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS); -+ -+ return 0; - } - - static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus, -@@ -625,6 +658,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - int where, int size, u32 *val) - { - struct advk_pcie *pcie = bus->sysdata; -+ bool allow_crs; - u32 reg; - int ret; - -@@ -637,7 +671,24 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - return pci_bridge_emul_conf_read(&pcie->bridge, where, - size, val); - -+ /* -+ * Completion Retry Status is possible to return only when reading all -+ * 4 bytes from PCI_VENDOR_ID and PCI_DEVICE_ID registers at once and -+ * CRSSVE flag on Root Bridge is enabled. -+ */ -+ allow_crs = (where == PCI_VENDOR_ID) && (size == 4) && -+ (le16_to_cpu(pcie->bridge.pcie_conf.rootctl) & -+ PCI_EXP_RTCTL_CRSSVE); -+ - if (advk_pcie_pio_is_running(pcie)) { -+ /* -+ * If it is possible return Completion Retry Status so caller -+ * tries to issue the request again instead of failing. -+ */ -+ if (allow_crs) { -+ *val = CFG_RD_CRS_VAL; -+ return PCIBIOS_SUCCESSFUL; -+ } - *val = 0xffffffff; - return PCIBIOS_SET_FAILED; - } -@@ -664,11 +715,21 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, - advk_writel(pcie, 1, PIO_START); - - ret = advk_pcie_wait_pio(pcie); -- if (ret < 0) -+ if (ret < 0) { -+ /* -+ * If it is possible return Completion Retry Status so caller -+ * tries to issue the request again instead of failing. -+ */ -+ if (allow_crs) { -+ *val = CFG_RD_CRS_VAL; -+ return PCIBIOS_SUCCESSFUL; -+ } -+ *val = 0xffffffff; - return PCIBIOS_SET_FAILED; -+ } - - /* Check PIO status and get the read result */ -- ret = advk_pcie_check_pio_status(pcie, val); -+ ret = advk_pcie_check_pio_status(pcie, allow_crs, val); - if (ret < 0) { - *val = 0xffffffff; - return PCIBIOS_SET_FAILED; -@@ -737,7 +798,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, - if (ret < 0) - return PCIBIOS_SET_FAILED; - -- ret = advk_pcie_check_pio_status(pcie, NULL); -+ ret = advk_pcie_check_pio_status(pcie, false, NULL); - if (ret < 0) - return PCIBIOS_SET_FAILED; - -diff --git a/drivers/pci/ecam.c b/drivers/pci/ecam.c -index 1a81af0ba961a..9765d2eb79d21 100644 ---- a/drivers/pci/ecam.c -+++ b/drivers/pci/ecam.c -@@ -164,4 +164,14 @@ struct pci_ecam_ops pci_32b_ops = { - .write = pci_generic_config_write32, - } - }; -+ -+/* ECAM ops for 32-bit read only (non-compliant) */ -+struct pci_ecam_ops pci_32b_read_ops = { -+ .bus_shift = 20, -+ .pci_ops = { -+ .map_bus = pci_ecam_map_bus, -+ .read = pci_generic_config_read32, -+ .write = pci_generic_config_write, -+ } -+}; - #endif -diff --git a/drivers/pci/pci-bridge-emul.c b/drivers/pci/pci-bridge-emul.c -index d3b6b9a056185..06c800595e036 100644 ---- a/drivers/pci/pci-bridge-emul.c -+++ b/drivers/pci/pci-bridge-emul.c -@@ -270,10 +270,10 @@ static const struct pci_bridge_reg_behavior pcie_cap_regs_behavior[] = { - int pci_bridge_emul_init(struct pci_bridge_emul *bridge, - unsigned int flags) - { -- bridge->conf.class_revision |= PCI_CLASS_BRIDGE_PCI << 16; -+ bridge->conf.class_revision |= cpu_to_le32(PCI_CLASS_BRIDGE_PCI << 16); - bridge->conf.header_type = PCI_HEADER_TYPE_BRIDGE; - bridge->conf.cache_line_size = 0x10; -- bridge->conf.status = PCI_STATUS_CAP_LIST; -+ bridge->conf.status = cpu_to_le16(PCI_STATUS_CAP_LIST); - bridge->pci_regs_behavior = kmemdup(pci_regs_behavior, - sizeof(pci_regs_behavior), - GFP_KERNEL); -@@ -284,8 +284,9 @@ int pci_bridge_emul_init(struct pci_bridge_emul *bridge, - bridge->conf.capabilities_pointer = PCI_CAP_PCIE_START; - bridge->pcie_conf.cap_id = PCI_CAP_ID_EXP; - /* Set PCIe v2, root port, slot support */ -- bridge->pcie_conf.cap = PCI_EXP_TYPE_ROOT_PORT << 4 | 2 | -- PCI_EXP_FLAGS_SLOT; -+ bridge->pcie_conf.cap = -+ cpu_to_le16(PCI_EXP_TYPE_ROOT_PORT << 4 | 2 | -+ PCI_EXP_FLAGS_SLOT); - bridge->pcie_cap_regs_behavior = - kmemdup(pcie_cap_regs_behavior, - sizeof(pcie_cap_regs_behavior), -@@ -327,7 +328,7 @@ int pci_bridge_emul_conf_read(struct pci_bridge_emul *bridge, int where, - int reg = where & ~3; - pci_bridge_emul_read_status_t (*read_op)(struct pci_bridge_emul *bridge, - int reg, u32 *value); -- u32 *cfgspace; -+ __le32 *cfgspace; - const struct pci_bridge_reg_behavior *behavior; - - if (bridge->has_pcie && reg >= PCI_CAP_PCIE_END) { -@@ -343,11 +344,11 @@ int pci_bridge_emul_conf_read(struct pci_bridge_emul *bridge, int where, - if (bridge->has_pcie && reg >= PCI_CAP_PCIE_START) { - reg -= PCI_CAP_PCIE_START; - read_op = bridge->ops->read_pcie; -- cfgspace = (u32 *) &bridge->pcie_conf; -+ cfgspace = (__le32 *) &bridge->pcie_conf; - behavior = bridge->pcie_cap_regs_behavior; - } else { - read_op = bridge->ops->read_base; -- cfgspace = (u32 *) &bridge->conf; -+ cfgspace = (__le32 *) &bridge->conf; - behavior = bridge->pci_regs_behavior; - } - -@@ -357,7 +358,7 @@ int pci_bridge_emul_conf_read(struct pci_bridge_emul *bridge, int where, - ret = PCI_BRIDGE_EMUL_NOT_HANDLED; - - if (ret == PCI_BRIDGE_EMUL_NOT_HANDLED) -- *value = cfgspace[reg / 4]; -+ *value = le32_to_cpu(cfgspace[reg / 4]); - - /* - * Make sure we never return any reserved bit with a value -@@ -387,7 +388,7 @@ int pci_bridge_emul_conf_write(struct pci_bridge_emul *bridge, int where, - int mask, ret, old, new, shift; - void (*write_op)(struct pci_bridge_emul *bridge, int reg, - u32 old, u32 new, u32 mask); -- u32 *cfgspace; -+ __le32 *cfgspace; - const struct pci_bridge_reg_behavior *behavior; - - if (bridge->has_pcie && reg >= PCI_CAP_PCIE_END) -@@ -414,11 +415,11 @@ int pci_bridge_emul_conf_write(struct pci_bridge_emul *bridge, int where, - if (bridge->has_pcie && reg >= PCI_CAP_PCIE_START) { - reg -= PCI_CAP_PCIE_START; - write_op = bridge->ops->write_pcie; -- cfgspace = (u32 *) &bridge->pcie_conf; -+ cfgspace = (__le32 *) &bridge->pcie_conf; - behavior = bridge->pcie_cap_regs_behavior; - } else { - write_op = bridge->ops->write_base; -- cfgspace = (u32 *) &bridge->conf; -+ cfgspace = (__le32 *) &bridge->conf; - behavior = bridge->pci_regs_behavior; - } - -@@ -431,7 +432,7 @@ int pci_bridge_emul_conf_write(struct pci_bridge_emul *bridge, int where, - /* Clear the W1C bits */ - new &= ~((value << shift) & (behavior[reg / 4].w1c & mask)); - -- cfgspace[reg / 4] = new; -+ cfgspace[reg / 4] = cpu_to_le32(new); - - if (write_op) - write_op(bridge, reg, old, new, mask); -diff --git a/drivers/pci/pci-bridge-emul.h b/drivers/pci/pci-bridge-emul.h -index e65b1b79899d0..49bbd37ee318a 100644 ---- a/drivers/pci/pci-bridge-emul.h -+++ b/drivers/pci/pci-bridge-emul.h -@@ -6,65 +6,65 @@ - - /* PCI configuration space of a PCI-to-PCI bridge. */ - struct pci_bridge_emul_conf { -- u16 vendor; -- u16 device; -- u16 command; -- u16 status; -- u32 class_revision; -+ __le16 vendor; -+ __le16 device; -+ __le16 command; -+ __le16 status; -+ __le32 class_revision; - u8 cache_line_size; - u8 latency_timer; - u8 header_type; - u8 bist; -- u32 bar[2]; -+ __le32 bar[2]; - u8 primary_bus; - u8 secondary_bus; - u8 subordinate_bus; - u8 secondary_latency_timer; - u8 iobase; - u8 iolimit; -- u16 secondary_status; -- u16 membase; -- u16 memlimit; -- u16 pref_mem_base; -- u16 pref_mem_limit; -- u32 prefbaseupper; -- u32 preflimitupper; -- u16 iobaseupper; -- u16 iolimitupper; -+ __le16 secondary_status; -+ __le16 membase; -+ __le16 memlimit; -+ __le16 pref_mem_base; -+ __le16 pref_mem_limit; -+ __le32 prefbaseupper; -+ __le32 preflimitupper; -+ __le16 iobaseupper; -+ __le16 iolimitupper; - u8 capabilities_pointer; - u8 reserve[3]; -- u32 romaddr; -+ __le32 romaddr; - u8 intline; - u8 intpin; -- u16 bridgectrl; -+ __le16 bridgectrl; - }; - - /* PCI configuration space of the PCIe capabilities */ - struct pci_bridge_emul_pcie_conf { - u8 cap_id; - u8 next; -- u16 cap; -- u32 devcap; -- u16 devctl; -- u16 devsta; -- u32 lnkcap; -- u16 lnkctl; -- u16 lnksta; -- u32 slotcap; -- u16 slotctl; -- u16 slotsta; -- u16 rootctl; -- u16 rsvd; -- u32 rootsta; -- u32 devcap2; -- u16 devctl2; -- u16 devsta2; -- u32 lnkcap2; -- u16 lnkctl2; -- u16 lnksta2; -- u32 slotcap2; -- u16 slotctl2; -- u16 slotsta2; -+ __le16 cap; -+ __le32 devcap; -+ __le16 devctl; -+ __le16 devsta; -+ __le32 lnkcap; -+ __le16 lnkctl; -+ __le16 lnksta; -+ __le32 slotcap; -+ __le16 slotctl; -+ __le16 slotsta; -+ __le16 rootctl; -+ __le16 rootcap; -+ __le32 rootsta; -+ __le32 devcap2; -+ __le16 devctl2; -+ __le16 devsta2; -+ __le32 lnkcap2; -+ __le16 lnkctl2; -+ __le16 lnksta2; -+ __le32 slotcap2; -+ __le16 slotctl2; -+ __le16 slotsta2; - }; - - struct pci_bridge_emul; -diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c -index 22c002e685b34..37f9b688661d4 100644 ---- a/drivers/pwm/pwm-img.c -+++ b/drivers/pwm/pwm-img.c -@@ -329,23 +329,7 @@ err_pm_disable: - static int img_pwm_remove(struct platform_device *pdev) - { - struct img_pwm_chip *pwm_chip = platform_get_drvdata(pdev); -- u32 val; -- unsigned int i; -- int ret; -- -- ret = pm_runtime_get_sync(&pdev->dev); -- if (ret < 0) { -- pm_runtime_put(&pdev->dev); -- return ret; -- } -- -- for (i = 0; i < pwm_chip->chip.npwm; i++) { -- val = img_pwm_readl(pwm_chip, PWM_CTRL_CFG); -- val &= ~BIT(i); -- img_pwm_writel(pwm_chip, PWM_CTRL_CFG, val); -- } - -- pm_runtime_put(&pdev->dev); - pm_runtime_disable(&pdev->dev); - if (!pm_runtime_status_suspended(&pdev->dev)) - img_pwm_runtime_suspend(&pdev->dev); -diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c -index 710d9a207d2b0..522f862eca526 100644 ---- a/drivers/pwm/pwm-lpc32xx.c -+++ b/drivers/pwm/pwm-lpc32xx.c -@@ -120,17 +120,17 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev) - lpc32xx->chip.npwm = 1; - lpc32xx->chip.base = -1; - -+ /* If PWM is disabled, configure the output to the default value */ -+ val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); -+ val &= ~PWM_PIN_LEVEL; -+ writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); -+ - ret = pwmchip_add(&lpc32xx->chip); - if (ret < 0) { - dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret); - return ret; - } - -- /* When PWM is disable, configure the output to the default value */ -- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); -- val &= ~PWM_PIN_LEVEL; -- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); -- - platform_set_drvdata(pdev, lpc32xx); - - return 0; -diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c -index 6ad6aad215cf1..8c0af705c5ae9 100644 ---- a/drivers/pwm/pwm-rockchip.c -+++ b/drivers/pwm/pwm-rockchip.c -@@ -383,20 +383,6 @@ static int rockchip_pwm_remove(struct platform_device *pdev) - { - struct rockchip_pwm_chip *pc = platform_get_drvdata(pdev); - -- /* -- * Disable the PWM clk before unpreparing it if the PWM device is still -- * running. This should only happen when the last PWM user left it -- * enabled, or when nobody requested a PWM that was previously enabled -- * by the bootloader. -- * -- * FIXME: Maybe the core should disable all PWM devices in -- * pwmchip_remove(). In this case we'd only have to call -- * clk_unprepare() after pwmchip_remove(). -- * -- */ -- if (pwm_is_enabled(pc->chip.pwms)) -- clk_disable(pc->clk); -- - clk_unprepare(pc->pclk); - clk_unprepare(pc->clk); - -diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c -index 67fca62524dc2..05bb1f95a7739 100644 ---- a/drivers/pwm/pwm-stm32-lp.c -+++ b/drivers/pwm/pwm-stm32-lp.c -@@ -225,8 +225,6 @@ static int stm32_pwm_lp_remove(struct platform_device *pdev) - { - struct stm32_pwm_lp *priv = platform_get_drvdata(pdev); - -- pwm_disable(&priv->chip.pwms[0]); -- - return pwmchip_remove(&priv->chip); - } - -diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig -index 9ae7ce3f50696..0ad8d84aeb339 100644 ---- a/drivers/rtc/Kconfig -+++ b/drivers/rtc/Kconfig -@@ -625,6 +625,7 @@ config RTC_DRV_FM3130 - - config RTC_DRV_RX8010 - tristate "Epson RX8010SJ" -+ select REGMAP_I2C - help - If you say yes here you get support for the Epson RX8010SJ RTC - chip. -diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c -index 66cd43f963c9a..e739d1979c877 100644 ---- a/drivers/staging/rtl8192u/r8192U_core.c -+++ b/drivers/staging/rtl8192u/r8192U_core.c -@@ -4338,7 +4338,7 @@ static void TranslateRxSignalStuff819xUsb(struct sk_buff *skb, - bpacket_match_bssid = (type != IEEE80211_FTYPE_CTL) && - (ether_addr_equal(priv->ieee80211->current_network.bssid, (fc & IEEE80211_FCTL_TODS) ? hdr->addr1 : (fc & IEEE80211_FCTL_FROMDS) ? hdr->addr2 : hdr->addr3)) - && (!pstats->bHwError) && (!pstats->bCRC) && (!pstats->bICV); -- bpacket_toself = bpacket_match_bssid & -+ bpacket_toself = bpacket_match_bssid && - (ether_addr_equal(praddr, priv->ieee80211->dev->dev_addr)); - - if (WLAN_FC_GET_FRAMETYPE(fc) == IEEE80211_STYPE_BEACON) -diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c -index fb2c55123a99e..059e3d1610c98 100644 ---- a/drivers/thermal/samsung/exynos_tmu.c -+++ b/drivers/thermal/samsung/exynos_tmu.c -@@ -1070,6 +1070,7 @@ static int exynos_tmu_probe(struct platform_device *pdev) - data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk"); - if (IS_ERR(data->sclk)) { - dev_err(&pdev->dev, "Failed to get sclk\n"); -+ ret = PTR_ERR(data->sclk); - goto err_clk; - } else { - ret = clk_prepare_enable(data->sclk); -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 6f013d7f5bd0f..404b80dc06b87 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -2070,7 +2070,7 @@ static void restore_cur(struct vc_data *vc) - - enum { ESnormal, ESesc, ESsquare, ESgetpars, ESfunckey, - EShash, ESsetG0, ESsetG1, ESpercent, EScsiignore, ESnonstd, -- ESpalette, ESosc }; -+ ESpalette, ESosc, ESapc, ESpm, ESdcs }; - - /* console_lock is held (except via vc_init()) */ - static void reset_terminal(struct vc_data *vc, int do_clear) -@@ -2124,20 +2124,28 @@ static void reset_terminal(struct vc_data *vc, int do_clear) - csi_J(vc, 2); - } - -+/* is this state an ANSI control string? */ -+static bool ansi_control_string(unsigned int state) -+{ -+ if (state == ESosc || state == ESapc || state == ESpm || state == ESdcs) -+ return true; -+ return false; -+} -+ - /* console_lock is held */ - static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) - { - /* - * Control characters can be used in the _middle_ -- * of an escape sequence. -+ * of an escape sequence, aside from ANSI control strings. - */ -- if (vc->vc_state == ESosc && c>=8 && c<=13) /* ... except for OSC */ -+ if (ansi_control_string(vc->vc_state) && c >= 8 && c <= 13) - return; - switch (c) { - case 0: - return; - case 7: -- if (vc->vc_state == ESosc) -+ if (ansi_control_string(vc->vc_state)) - vc->vc_state = ESnormal; - else if (vc->vc_bell_duration) - kd_mksound(vc->vc_bell_pitch, vc->vc_bell_duration); -@@ -2196,6 +2204,12 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) - case ']': - vc->vc_state = ESnonstd; - return; -+ case '_': -+ vc->vc_state = ESapc; -+ return; -+ case '^': -+ vc->vc_state = ESpm; -+ return; - case '%': - vc->vc_state = ESpercent; - return; -@@ -2212,6 +2226,9 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) - case 'H': - vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31)); - return; -+ case 'P': -+ vc->vc_state = ESdcs; -+ return; - case 'Z': - respond_ID(tty); - return; -@@ -2531,8 +2548,14 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) - vc->vc_translate = set_translate(vc->vc_G1_charset, vc); - vc->vc_state = ESnormal; - return; -+ case ESapc: -+ return; - case ESosc: - return; -+ case ESpm: -+ return; -+ case ESdcs: -+ return; - default: - vc->vc_state = ESnormal; - } -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 8deee49a6b3fa..f302bbb93f32c 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -742,6 +742,8 @@ static int btrfs_free_stale_devices(const char *path, - struct btrfs_device *device, *tmp_device; - int ret = 0; - -+ lockdep_assert_held(&uuid_mutex); -+ - if (path) - ret = -ENOENT; - -@@ -1181,11 +1183,12 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig) - struct btrfs_device *orig_dev; - int ret = 0; - -+ lockdep_assert_held(&uuid_mutex); -+ - fs_devices = alloc_fs_devices(orig->fsid, NULL); - if (IS_ERR(fs_devices)) - return fs_devices; - -- mutex_lock(&orig->device_list_mutex); - fs_devices->total_devices = orig->total_devices; - - list_for_each_entry(orig_dev, &orig->devices, dev_list) { -@@ -1217,10 +1220,8 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig) - device->fs_devices = fs_devices; - fs_devices->num_devices++; - } -- mutex_unlock(&orig->device_list_mutex); - return fs_devices; - error: -- mutex_unlock(&orig->device_list_mutex); - free_fs_devices(fs_devices); - return ERR_PTR(ret); - } -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index a49bf1fbaea82..0fad044a5752b 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -1775,6 +1775,8 @@ static u64 __mark_caps_flushing(struct inode *inode, - * try to invalidate mapping pages without blocking. - */ - static int try_nonblocking_invalidate(struct inode *inode) -+ __releases(ci->i_ceph_lock) -+ __acquires(ci->i_ceph_lock) - { - struct ceph_inode_info *ci = ceph_inode(inode); - u32 invalidating_gen = ci->i_rdcache_gen; -diff --git a/fs/ceph/file.c b/fs/ceph/file.c -index a10711a6337af..34785a203461d 100644 ---- a/fs/ceph/file.c -+++ b/fs/ceph/file.c -@@ -1469,32 +1469,26 @@ retry_snap: - goto out; - } - -- err = file_remove_privs(file); -- if (err) -+ down_read(&osdc->lock); -+ map_flags = osdc->osdmap->flags; -+ pool_flags = ceph_pg_pool_flags(osdc->osdmap, ci->i_layout.pool_id); -+ up_read(&osdc->lock); -+ if ((map_flags & CEPH_OSDMAP_FULL) || -+ (pool_flags & CEPH_POOL_FLAG_FULL)) { -+ err = -ENOSPC; - goto out; -+ } - -- err = file_update_time(file); -+ err = file_remove_privs(file); - if (err) - goto out; - -- inode_inc_iversion_raw(inode); -- - if (ci->i_inline_version != CEPH_INLINE_NONE) { - err = ceph_uninline_data(file, NULL); - if (err < 0) - goto out; - } - -- down_read(&osdc->lock); -- map_flags = osdc->osdmap->flags; -- pool_flags = ceph_pg_pool_flags(osdc->osdmap, ci->i_layout.pool_id); -- up_read(&osdc->lock); -- if ((map_flags & CEPH_OSDMAP_FULL) || -- (pool_flags & CEPH_POOL_FLAG_FULL)) { -- err = -ENOSPC; -- goto out; -- } -- - dout("aio_write %p %llx.%llx %llu~%zd getting caps. i_size %llu\n", - inode, ceph_vinop(inode), pos, count, i_size_read(inode)); - if (fi->fmode & CEPH_FILE_MODE_LAZY) -@@ -1507,6 +1501,12 @@ retry_snap: - if (err < 0) - goto out; - -+ err = file_update_time(file); -+ if (err) -+ goto out_caps; -+ -+ inode_inc_iversion_raw(inode); -+ - dout("aio_write %p %llx.%llx %llu~%zd got cap refs on %s\n", - inode, ceph_vinop(inode), pos, count, ceph_cap_string(got)); - -@@ -1590,6 +1590,8 @@ retry_snap: - } - - goto out_unlocked; -+out_caps: -+ ceph_put_cap_refs(ci, got); - out: - if (direct_lock) - ceph_end_io_direct(inode); -diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c -index c6c8a33c81d5e..28a2db3b1787f 100644 ---- a/fs/nilfs2/sysfs.c -+++ b/fs/nilfs2/sysfs.c -@@ -64,11 +64,9 @@ static const struct sysfs_ops nilfs_##name##_attr_ops = { \ - #define NILFS_DEV_INT_GROUP_TYPE(name, parent_name) \ - static void nilfs_##name##_attr_release(struct kobject *kobj) \ - { \ -- struct nilfs_sysfs_##parent_name##_subgroups *subgroups; \ -- struct the_nilfs *nilfs = container_of(kobj->parent, \ -- struct the_nilfs, \ -- ns_##parent_name##_kobj); \ -- subgroups = nilfs->ns_##parent_name##_subgroups; \ -+ struct nilfs_sysfs_##parent_name##_subgroups *subgroups = container_of(kobj, \ -+ struct nilfs_sysfs_##parent_name##_subgroups, \ -+ sg_##name##_kobj); \ - complete(&subgroups->sg_##name##_kobj_unregister); \ - } \ - static struct kobj_type nilfs_##name##_ktype = { \ -@@ -94,12 +92,12 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \ - err = kobject_init_and_add(kobj, &nilfs_##name##_ktype, parent, \ - #name); \ - if (err) \ -- return err; \ -- return 0; \ -+ kobject_put(kobj); \ -+ return err; \ - } \ - static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \ - { \ -- kobject_del(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \ -+ kobject_put(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \ - } - - /************************************************************************ -@@ -210,14 +208,14 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root) - } - - if (err) -- return err; -+ kobject_put(&root->snapshot_kobj); - -- return 0; -+ return err; - } - - void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root) - { -- kobject_del(&root->snapshot_kobj); -+ kobject_put(&root->snapshot_kobj); - } - - /************************************************************************ -@@ -1000,7 +998,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb) - err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL, - "%s", sb->s_id); - if (err) -- goto free_dev_subgroups; -+ goto cleanup_dev_kobject; - - err = nilfs_sysfs_create_mounted_snapshots_group(nilfs); - if (err) -@@ -1037,9 +1035,7 @@ delete_mounted_snapshots_group: - nilfs_sysfs_delete_mounted_snapshots_group(nilfs); - - cleanup_dev_kobject: -- kobject_del(&nilfs->ns_dev_kobj); -- --free_dev_subgroups: -+ kobject_put(&nilfs->ns_dev_kobj); - kfree(nilfs->ns_dev_subgroups); - - failed_create_device_group: -diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c -index 484785cdf96e2..931870768556c 100644 ---- a/fs/nilfs2/the_nilfs.c -+++ b/fs/nilfs2/the_nilfs.c -@@ -797,14 +797,13 @@ nilfs_find_or_create_root(struct the_nilfs *nilfs, __u64 cno) - - void nilfs_put_root(struct nilfs_root *root) - { -- if (refcount_dec_and_test(&root->count)) { -- struct the_nilfs *nilfs = root->nilfs; -+ struct the_nilfs *nilfs = root->nilfs; - -- nilfs_sysfs_delete_snapshot_group(root); -- -- spin_lock(&nilfs->ns_cptree_lock); -+ if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) { - rb_erase(&root->rb_node, &nilfs->ns_cptree); - spin_unlock(&nilfs->ns_cptree_lock); -+ -+ nilfs_sysfs_delete_snapshot_group(root); - iput(root->ifile); - - kfree(root); -diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h -index 46b92cd61d0c8..c8c71eea237d6 100644 ---- a/include/linux/cacheinfo.h -+++ b/include/linux/cacheinfo.h -@@ -78,24 +78,6 @@ struct cpu_cacheinfo { - bool cpu_map_populated; - }; - --/* -- * Helpers to make sure "func" is executed on the cpu whose cache -- * attributes are being detected -- */ --#define DEFINE_SMP_CALL_CACHE_FUNCTION(func) \ --static inline void _##func(void *ret) \ --{ \ -- int cpu = smp_processor_id(); \ -- *(int *)ret = __##func(cpu); \ --} \ -- \ --int func(unsigned int cpu) \ --{ \ -- int ret; \ -- smp_call_function_single(cpu, _##func, &ret, true); \ -- return ret; \ --} -- - struct cpu_cacheinfo *get_cpu_cacheinfo(unsigned int cpu); - int init_cache_level(unsigned int cpu); - int populate_cache_leaves(unsigned int cpu); -diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index a1ff6b76aa8cd..19e8344c51a8c 100644 ---- a/include/linux/kvm_host.h -+++ b/include/linux/kvm_host.h -@@ -266,7 +266,8 @@ struct kvm_vcpu { - struct preempt_notifier preempt_notifier; - #endif - int cpu; -- int vcpu_id; -+ int vcpu_id; /* id given by userspace at creation */ -+ int vcpu_idx; /* index in kvm->vcpus array */ - int srcu_idx; - int mode; - u64 requests; -@@ -571,13 +572,7 @@ static inline struct kvm_vcpu *kvm_get_vcpu_by_id(struct kvm *kvm, int id) - - static inline int kvm_vcpu_get_idx(struct kvm_vcpu *vcpu) - { -- struct kvm_vcpu *tmp; -- int idx; -- -- kvm_for_each_vcpu(idx, tmp, vcpu->kvm) -- if (tmp == vcpu) -- return idx; -- BUG(); -+ return vcpu->vcpu_idx; - } - - #define kvm_for_each_memslot(memslot, slots) \ -diff --git a/include/linux/pci-ecam.h b/include/linux/pci-ecam.h -index a73164c85e78b..75456a66024a9 100644 ---- a/include/linux/pci-ecam.h -+++ b/include/linux/pci-ecam.h -@@ -51,6 +51,7 @@ extern struct pci_ecam_ops pci_generic_ecam_ops; - - #if defined(CONFIG_ACPI) && defined(CONFIG_PCI_QUIRKS) - extern struct pci_ecam_ops pci_32b_ops; /* 32-bit accesses only */ -+extern struct pci_ecam_ops pci_32b_read_ops; /* 32-bit read only */ - extern struct pci_ecam_ops hisi_pcie_ops; /* HiSilicon */ - extern struct pci_ecam_ops thunder_pem_ecam_ops; /* Cavium ThunderX 1.x & 2.x */ - extern struct pci_ecam_ops pci_thunder_ecam_ops; /* Cavium ThunderX 1.x */ -diff --git a/include/linux/thermal.h b/include/linux/thermal.h -index e45659c759209..a41378bdf27c7 100644 ---- a/include/linux/thermal.h -+++ b/include/linux/thermal.h -@@ -501,12 +501,13 @@ static inline void thermal_zone_device_update(struct thermal_zone_device *tz, - static inline void thermal_zone_set_trips(struct thermal_zone_device *tz) - { } - static inline struct thermal_cooling_device * --thermal_cooling_device_register(char *type, void *devdata, -+thermal_cooling_device_register(const char *type, void *devdata, - const struct thermal_cooling_device_ops *ops) - { return ERR_PTR(-ENODEV); } - static inline struct thermal_cooling_device * - thermal_of_cooling_device_register(struct device_node *np, -- char *type, void *devdata, const struct thermal_cooling_device_ops *ops) -+ const char *type, void *devdata, -+ const struct thermal_cooling_device_ops *ops) - { return ERR_PTR(-ENODEV); } - static inline struct thermal_cooling_device * - devm_thermal_of_cooling_device_register(struct device *dev, -diff --git a/kernel/profile.c b/kernel/profile.c -index af7c94bf5fa1d..e97e42aaf2023 100644 ---- a/kernel/profile.c -+++ b/kernel/profile.c -@@ -41,7 +41,8 @@ struct profile_hit { - #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ) - - static atomic_t *prof_buffer; --static unsigned long prof_len, prof_shift; -+static unsigned long prof_len; -+static unsigned short int prof_shift; - - int prof_on __read_mostly; - EXPORT_SYMBOL_GPL(prof_on); -@@ -67,8 +68,8 @@ int profile_setup(char *str) - if (str[strlen(sleepstr)] == ',') - str += strlen(sleepstr) + 1; - if (get_option(&str, &par)) -- prof_shift = par; -- pr_info("kernel sleep profiling enabled (shift: %ld)\n", -+ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); -+ pr_info("kernel sleep profiling enabled (shift: %u)\n", - prof_shift); - #else - pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n"); -@@ -78,21 +79,21 @@ int profile_setup(char *str) - if (str[strlen(schedstr)] == ',') - str += strlen(schedstr) + 1; - if (get_option(&str, &par)) -- prof_shift = par; -- pr_info("kernel schedule profiling enabled (shift: %ld)\n", -+ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); -+ pr_info("kernel schedule profiling enabled (shift: %u)\n", - prof_shift); - } else if (!strncmp(str, kvmstr, strlen(kvmstr))) { - prof_on = KVM_PROFILING; - if (str[strlen(kvmstr)] == ',') - str += strlen(kvmstr) + 1; - if (get_option(&str, &par)) -- prof_shift = par; -- pr_info("kernel KVM profiling enabled (shift: %ld)\n", -+ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); -+ pr_info("kernel KVM profiling enabled (shift: %u)\n", - prof_shift); - } else if (get_option(&str, &par)) { -- prof_shift = par; -+ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); - prof_on = CPU_PROFILING; -- pr_info("kernel profiling enabled (shift: %ld)\n", -+ pr_info("kernel profiling enabled (shift: %u)\n", - prof_shift); - } - return 1; -@@ -468,7 +469,7 @@ read_profile(struct file *file, char __user *buf, size_t count, loff_t *ppos) - unsigned long p = *ppos; - ssize_t read; - char *pnt; -- unsigned int sample_step = 1 << prof_shift; -+ unsigned long sample_step = 1UL << prof_shift; - - profile_flip_buffers(); - if (p >= (prof_len+1)*sizeof(unsigned int)) -diff --git a/kernel/sys.c b/kernel/sys.c -index 3459a5ce0da01..b075fe84eb5a5 100644 ---- a/kernel/sys.c -+++ b/kernel/sys.c -@@ -1927,13 +1927,6 @@ static int validate_prctl_map_addr(struct prctl_mm_map *prctl_map) - - error = -EINVAL; - -- /* -- * @brk should be after @end_data in traditional maps. -- */ -- if (prctl_map->start_brk <= prctl_map->end_data || -- prctl_map->brk <= prctl_map->end_data) -- goto out; -- - /* - * Neither we should allow to override limits if they set. - */ -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index ee00c6c8a373e..a846f03901dbd 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -868,7 +868,6 @@ config HARDLOCKUP_DETECTOR - depends on HAVE_HARDLOCKUP_DETECTOR_PERF || HAVE_HARDLOCKUP_DETECTOR_ARCH - select LOCKUP_DETECTOR - select HARDLOCKUP_DETECTOR_PERF if HAVE_HARDLOCKUP_DETECTOR_PERF -- select HARDLOCKUP_DETECTOR_ARCH if HAVE_HARDLOCKUP_DETECTOR_ARCH - help - Say Y here to enable the kernel to act as a watchdog to detect - hard lockups. -diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c -index a3cd90a74012b..f582351d84ecb 100644 ---- a/net/9p/trans_virtio.c -+++ b/net/9p/trans_virtio.c -@@ -605,7 +605,7 @@ static int p9_virtio_probe(struct virtio_device *vdev) - chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL); - if (!chan->vc_wq) { - err = -ENOMEM; -- goto out_free_tag; -+ goto out_remove_file; - } - init_waitqueue_head(chan->vc_wq); - chan->ring_bufs_avail = 1; -@@ -623,6 +623,8 @@ static int p9_virtio_probe(struct virtio_device *vdev) - - return 0; - -+out_remove_file: -+ sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr); - out_free_tag: - kfree(tag); - out_free_vq: -diff --git a/net/sctp/input.c b/net/sctp/input.c -index db4f917aafd90..2aca37717ed1e 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -1168,6 +1168,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( - union sctp_addr_param *param; - union sctp_addr paddr; - -+ if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr)) -+ return NULL; -+ - /* Skip over the ADDIP header and find the Address parameter */ - param = (union sctp_addr_param *)(asconf + 1); - -diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c -index 38ca7ce8a44ed..000aa62281f46 100644 ---- a/net/sctp/sm_make_chunk.c -+++ b/net/sctp/sm_make_chunk.c -@@ -2157,9 +2157,16 @@ static enum sctp_ierror sctp_verify_param(struct net *net, - break; - - case SCTP_PARAM_SET_PRIMARY: -- if (ep->asconf_enable) -- break; -- goto unhandled; -+ if (!ep->asconf_enable) -+ goto unhandled; -+ -+ if (ntohs(param.p->length) < sizeof(struct sctp_addip_param) + -+ sizeof(struct sctp_paramhdr)) { -+ sctp_process_inv_paramlength(asoc, param.p, -+ chunk, err_chunk); -+ retval = SCTP_IERROR_ABORT; -+ } -+ break; - - case SCTP_PARAM_HOST_NAME_ADDRESS: - /* Tell the peer, we won't support this param. */ -diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c -index 47e4f2d91df75..7a8813677950f 100644 ---- a/security/apparmor/apparmorfs.c -+++ b/security/apparmor/apparmorfs.c -@@ -1960,9 +1960,6 @@ fail2: - return error; - } - -- --#define list_entry_is_head(pos, head, member) (&pos->member == (head)) -- - /** - * __next_ns - find the next namespace to list - * @root: root namespace to stop search at (NOT NULL) -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index fc48298649c6c..77f84cbca7406 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -2864,7 +2864,8 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id) - goto unlock_vcpu_destroy; - } - -- BUG_ON(kvm->vcpus[atomic_read(&kvm->online_vcpus)]); -+ vcpu->vcpu_idx = atomic_read(&kvm->online_vcpus); -+ BUG_ON(kvm->vcpus[vcpu->vcpu_idx]); - - /* Now it's all set up, let userspace reach it */ - kvm_get_kvm(kvm); -@@ -2874,7 +2875,7 @@ static int kvm_vm_ioctl_create_vcpu(struct kvm *kvm, u32 id) - goto unlock_vcpu_destroy; - } - -- kvm->vcpus[atomic_read(&kvm->online_vcpus)] = vcpu; -+ kvm->vcpus[vcpu->vcpu_idx] = vcpu; - - /* - * Pairs with smp_rmb() in kvm_get_vcpu. Write kvm->vcpus