From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id ADCE71382C5 for ; Sun, 25 Mar 2018 13:42:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 9F817E0784; Sun, 25 Mar 2018 13:42:27 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 51037E0784 for ; Sun, 25 Mar 2018 13:42:27 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id BB66E335C72 for ; Sun, 25 Mar 2018 13:42:25 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id EDCA725B for ; Sun, 25 Mar 2018 13:42:23 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1521985333.ad6b31bbab0b7a93579803783ecf73504bd7f9d0.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.4 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1123_linux-4.4.124.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: ad6b31bbab0b7a93579803783ecf73504bd7f9d0 X-VCS-Branch: 4.4 Date: Sun, 25 Mar 2018 13:42:23 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: d93424b1-5bf0-4e7a-adae-2b02e6a3428b X-Archives-Hash: 2859b5b996377c0cc9e40264c465f4e3 commit: ad6b31bbab0b7a93579803783ecf73504bd7f9d0 Author: Mike Pagano gentoo org> AuthorDate: Sun Mar 25 13:42:13 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun Mar 25 13:42:13 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ad6b31bb Linux patch 4.4.124 0000_README | 4 + 1123_linux-4.4.124.patch | 3143 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3147 insertions(+) diff --git a/0000_README b/0000_README index 992f353..d9d85f6 100644 --- a/0000_README +++ b/0000_README @@ -535,6 +535,10 @@ Patch: 1122_linux-4.4.123.patch From: http://www.kernel.org Desc: Linux 4.4.123 +Patch: 1123_linux-4.4.124.patch +From: http://www.kernel.org +Desc: Linux 4.4.124 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1123_linux-4.4.124.patch b/1123_linux-4.4.124.patch new file mode 100644 index 0000000..ead63d6 --- /dev/null +++ b/1123_linux-4.4.124.patch @@ -0,0 +1,3143 @@ +diff --git a/Makefile b/Makefile +index cbcc04da790a..bbaf3fd0d1ef 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 123 ++SUBLEVEL = 124 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/alpha/kernel/console.c b/arch/alpha/kernel/console.c +index 6a61deed4a85..ab228ed45945 100644 +--- a/arch/alpha/kernel/console.c ++++ b/arch/alpha/kernel/console.c +@@ -20,6 +20,7 @@ + struct pci_controller *pci_vga_hose; + static struct resource alpha_vga = { + .name = "alpha-vga+", ++ .flags = IORESOURCE_IO, + .start = 0x3C0, + .end = 0x3DF + }; +diff --git a/arch/arm/kernel/ftrace.c b/arch/arm/kernel/ftrace.c +index 709ee1d6d4df..faa9a905826e 100644 +--- a/arch/arm/kernel/ftrace.c ++++ b/arch/arm/kernel/ftrace.c +@@ -29,11 +29,6 @@ + #endif + + #ifdef CONFIG_DYNAMIC_FTRACE +-#ifdef CONFIG_OLD_MCOUNT +-#define OLD_MCOUNT_ADDR ((unsigned long) mcount) +-#define OLD_FTRACE_ADDR ((unsigned long) ftrace_caller_old) +- +-#define OLD_NOP 0xe1a00000 /* mov r0, r0 */ + + static int __ftrace_modify_code(void *data) + { +@@ -51,6 +46,12 @@ void arch_ftrace_update_code(int command) + stop_machine(__ftrace_modify_code, &command, NULL); + } + ++#ifdef CONFIG_OLD_MCOUNT ++#define OLD_MCOUNT_ADDR ((unsigned long) mcount) ++#define OLD_FTRACE_ADDR ((unsigned long) ftrace_caller_old) ++ ++#define OLD_NOP 0xe1a00000 /* mov r0, r0 */ ++ + static unsigned long ftrace_nop_replace(struct dyn_ftrace *rec) + { + return rec->arch.old_mcount ? OLD_NOP : NOP; +diff --git a/arch/arm/mach-omap2/clockdomains7xx_data.c b/arch/arm/mach-omap2/clockdomains7xx_data.c +index 7581e036bda6..70e3b711e79c 100644 +--- a/arch/arm/mach-omap2/clockdomains7xx_data.c ++++ b/arch/arm/mach-omap2/clockdomains7xx_data.c +@@ -524,7 +524,7 @@ static struct clockdomain pcie_7xx_clkdm = { + .dep_bit = DRA7XX_PCIE_STATDEP_SHIFT, + .wkdep_srcs = pcie_wkup_sleep_deps, + .sleepdep_srcs = pcie_wkup_sleep_deps, +- .flags = CLKDM_CAN_HWSUP_SWSUP, ++ .flags = CLKDM_CAN_SWSUP, + }; + + static struct clockdomain atl_7xx_clkdm = { +diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c +index b15933c31b2f..36b2c94a8eb5 100644 +--- a/arch/ia64/kernel/module.c ++++ b/arch/ia64/kernel/module.c +@@ -153,7 +153,7 @@ slot (const struct insn *insn) + static int + apply_imm64 (struct module *mod, struct insn *insn, uint64_t val) + { +- if (slot(insn) != 2) { ++ if (slot(insn) != 1 && slot(insn) != 2) { + printk(KERN_ERR "%s: invalid slot number %d for IMM64\n", + mod->name, slot(insn)); + return 0; +@@ -165,7 +165,7 @@ apply_imm64 (struct module *mod, struct insn *insn, uint64_t val) + static int + apply_imm60 (struct module *mod, struct insn *insn, uint64_t val) + { +- if (slot(insn) != 2) { ++ if (slot(insn) != 1 && slot(insn) != 2) { + printk(KERN_ERR "%s: invalid slot number %d for IMM60\n", + mod->name, slot(insn)); + return 0; +diff --git a/arch/powerpc/kvm/book3s_64_mmu_host.c b/arch/powerpc/kvm/book3s_64_mmu_host.c +index 79ad35abd196..ddec22828673 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_host.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_host.c +@@ -177,12 +177,15 @@ map_again: + ret = ppc_md.hpte_insert(hpteg, vpn, hpaddr, rflags, vflags, + hpsize, hpsize, MMU_SEGSIZE_256M); + +- if (ret < 0) { ++ if (ret == -1) { + /* If we couldn't map a primary PTE, try a secondary */ + hash = ~hash; + vflags ^= HPTE_V_SECONDARY; + attempt++; + goto map_again; ++ } else if (ret < 0) { ++ r = -EIO; ++ goto out_unlock; + } else { + trace_kvm_book3s_64_mmu_map(rflags, hpteg, + vpn, hpaddr, orig_pte); +diff --git a/arch/powerpc/kvm/book3s_pr.c b/arch/powerpc/kvm/book3s_pr.c +index 64891b081ad5..81313844d81c 100644 +--- a/arch/powerpc/kvm/book3s_pr.c ++++ b/arch/powerpc/kvm/book3s_pr.c +@@ -625,7 +625,11 @@ int kvmppc_handle_pagefault(struct kvm_run *run, struct kvm_vcpu *vcpu, + kvmppc_mmu_unmap_page(vcpu, &pte); + } + /* The guest's PTE is not mapped yet. Map on the host */ +- kvmppc_mmu_map_page(vcpu, &pte, iswrite); ++ if (kvmppc_mmu_map_page(vcpu, &pte, iswrite) == -EIO) { ++ /* Exit KVM if mapping failed */ ++ run->exit_reason = KVM_EXIT_INTERNAL_ERROR; ++ return RESUME_HOST; ++ } + if (data) + vcpu->stat.sp_storage++; + else if (vcpu->arch.mmu.is_dcbz32(vcpu) && +diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c +index be22f5a2192e..4e3b8a587c88 100644 +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -418,6 +418,7 @@ struct legacy_pic default_legacy_pic = { + }; + + struct legacy_pic *legacy_pic = &default_legacy_pic; ++EXPORT_SYMBOL(legacy_pic); + + static int __init i8259A_init_ops(void) + { +diff --git a/drivers/acpi/pmic/intel_pmic_xpower.c b/drivers/acpi/pmic/intel_pmic_xpower.c +index 6a082d4de12c..24a793957bc0 100644 +--- a/drivers/acpi/pmic/intel_pmic_xpower.c ++++ b/drivers/acpi/pmic/intel_pmic_xpower.c +@@ -28,97 +28,97 @@ static struct pmic_table power_table[] = { + .address = 0x00, + .reg = 0x13, + .bit = 0x05, +- }, ++ }, /* ALD1 */ + { + .address = 0x04, + .reg = 0x13, + .bit = 0x06, +- }, ++ }, /* ALD2 */ + { + .address = 0x08, + .reg = 0x13, + .bit = 0x07, +- }, ++ }, /* ALD3 */ + { + .address = 0x0c, + .reg = 0x12, + .bit = 0x03, +- }, ++ }, /* DLD1 */ + { + .address = 0x10, + .reg = 0x12, + .bit = 0x04, +- }, ++ }, /* DLD2 */ + { + .address = 0x14, + .reg = 0x12, + .bit = 0x05, +- }, ++ }, /* DLD3 */ + { + .address = 0x18, + .reg = 0x12, + .bit = 0x06, +- }, ++ }, /* DLD4 */ + { + .address = 0x1c, + .reg = 0x12, + .bit = 0x00, +- }, ++ }, /* ELD1 */ + { + .address = 0x20, + .reg = 0x12, + .bit = 0x01, +- }, ++ }, /* ELD2 */ + { + .address = 0x24, + .reg = 0x12, + .bit = 0x02, +- }, ++ }, /* ELD3 */ + { + .address = 0x28, + .reg = 0x13, + .bit = 0x02, +- }, ++ }, /* FLD1 */ + { + .address = 0x2c, + .reg = 0x13, + .bit = 0x03, +- }, ++ }, /* FLD2 */ + { + .address = 0x30, + .reg = 0x13, + .bit = 0x04, +- }, ++ }, /* FLD3 */ + { +- .address = 0x38, ++ .address = 0x34, + .reg = 0x10, + .bit = 0x03, +- }, ++ }, /* BUC1 */ + { +- .address = 0x3c, ++ .address = 0x38, + .reg = 0x10, + .bit = 0x06, +- }, ++ }, /* BUC2 */ + { +- .address = 0x40, ++ .address = 0x3c, + .reg = 0x10, + .bit = 0x05, +- }, ++ }, /* BUC3 */ + { +- .address = 0x44, ++ .address = 0x40, + .reg = 0x10, + .bit = 0x04, +- }, ++ }, /* BUC4 */ + { +- .address = 0x48, ++ .address = 0x44, + .reg = 0x10, + .bit = 0x01, +- }, ++ }, /* BUC5 */ + { +- .address = 0x4c, ++ .address = 0x48, + .reg = 0x10, + .bit = 0x00 +- }, ++ }, /* BUC6 */ + }; + + /* TMP0 - TMP5 are the same, all from GPADC */ +diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c +index 11154a330f07..c9bf74982688 100644 +--- a/drivers/acpi/processor_driver.c ++++ b/drivers/acpi/processor_driver.c +@@ -259,6 +259,9 @@ static int __acpi_processor_start(struct acpi_device *device) + if (ACPI_SUCCESS(status)) + return 0; + ++ result = -ENODEV; ++ acpi_pss_perf_exit(pr, device); ++ + err_power_exit: + acpi_processor_power_exit(pr); + return result; +@@ -267,11 +270,16 @@ err_power_exit: + static int acpi_processor_start(struct device *dev) + { + struct acpi_device *device = ACPI_COMPANION(dev); ++ int ret; + + if (!device) + return -ENODEV; + +- return __acpi_processor_start(device); ++ /* Protect against concurrent CPU hotplug operations */ ++ get_online_cpus(); ++ ret = __acpi_processor_start(device); ++ put_online_cpus(); ++ return ret; + } + + static int acpi_processor_stop(struct device *dev) +diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c +index c72e64893d03..93d72413d844 100644 +--- a/drivers/acpi/processor_throttling.c ++++ b/drivers/acpi/processor_throttling.c +@@ -62,8 +62,8 @@ struct acpi_processor_throttling_arg { + #define THROTTLING_POSTCHANGE (2) + + static int acpi_processor_get_throttling(struct acpi_processor *pr); +-int acpi_processor_set_throttling(struct acpi_processor *pr, +- int state, bool force); ++static int __acpi_processor_set_throttling(struct acpi_processor *pr, ++ int state, bool force, bool direct); + + static int acpi_processor_update_tsd_coord(void) + { +@@ -891,7 +891,8 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr) + ACPI_DEBUG_PRINT((ACPI_DB_INFO, + "Invalid throttling state, reset\n")); + state = 0; +- ret = acpi_processor_set_throttling(pr, state, true); ++ ret = __acpi_processor_set_throttling(pr, state, true, ++ true); + if (ret) + return ret; + } +@@ -901,36 +902,31 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr) + return 0; + } + +-static int acpi_processor_get_throttling(struct acpi_processor *pr) ++static long __acpi_processor_get_throttling(void *data) + { +- cpumask_var_t saved_mask; +- int ret; ++ struct acpi_processor *pr = data; ++ ++ return pr->throttling.acpi_processor_get_throttling(pr); ++} + ++static int acpi_processor_get_throttling(struct acpi_processor *pr) ++{ + if (!pr) + return -EINVAL; + + if (!pr->flags.throttling) + return -ENODEV; + +- if (!alloc_cpumask_var(&saved_mask, GFP_KERNEL)) +- return -ENOMEM; +- + /* +- * Migrate task to the cpu pointed by pr. ++ * This is either called from the CPU hotplug callback of ++ * processor_driver or via the ACPI probe function. In the latter ++ * case the CPU is not guaranteed to be online. Both call sites are ++ * protected against CPU hotplug. + */ +- cpumask_copy(saved_mask, ¤t->cpus_allowed); +- /* FIXME: use work_on_cpu() */ +- if (set_cpus_allowed_ptr(current, cpumask_of(pr->id))) { +- /* Can't migrate to the target pr->id CPU. Exit */ +- free_cpumask_var(saved_mask); ++ if (!cpu_online(pr->id)) + return -ENODEV; +- } +- ret = pr->throttling.acpi_processor_get_throttling(pr); +- /* restore the previous state */ +- set_cpus_allowed_ptr(current, saved_mask); +- free_cpumask_var(saved_mask); + +- return ret; ++ return work_on_cpu(pr->id, __acpi_processor_get_throttling, pr); + } + + static int acpi_processor_get_fadt_info(struct acpi_processor *pr) +@@ -1080,8 +1076,15 @@ static long acpi_processor_throttling_fn(void *data) + arg->target_state, arg->force); + } + +-int acpi_processor_set_throttling(struct acpi_processor *pr, +- int state, bool force) ++static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct) ++{ ++ if (direct) ++ return fn(arg); ++ return work_on_cpu(cpu, fn, arg); ++} ++ ++static int __acpi_processor_set_throttling(struct acpi_processor *pr, ++ int state, bool force, bool direct) + { + int ret = 0; + unsigned int i; +@@ -1130,7 +1133,8 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + arg.pr = pr; + arg.target_state = state; + arg.force = force; +- ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, &arg); ++ ret = call_on_cpu(pr->id, acpi_processor_throttling_fn, &arg, ++ direct); + } else { + /* + * When the T-state coordination is SW_ALL or HW_ALL, +@@ -1163,8 +1167,8 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + arg.pr = match_pr; + arg.target_state = state; + arg.force = force; +- ret = work_on_cpu(pr->id, acpi_processor_throttling_fn, +- &arg); ++ ret = call_on_cpu(pr->id, acpi_processor_throttling_fn, ++ &arg, direct); + } + } + /* +@@ -1182,6 +1186,12 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, + return ret; + } + ++int acpi_processor_set_throttling(struct acpi_processor *pr, int state, ++ bool force) ++{ ++ return __acpi_processor_set_throttling(pr, state, force, false); ++} ++ + int acpi_processor_get_throttling_info(struct acpi_processor *pr) + { + int result = 0; +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 55d3d1da72de..9ba89315dae1 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -169,6 +169,25 @@ static bool mtip_check_surprise_removal(struct pci_dev *pdev) + return false; /* device present */ + } + ++/* we have to use runtime tag to setup command header */ ++static void mtip_init_cmd_header(struct request *rq) ++{ ++ struct driver_data *dd = rq->q->queuedata; ++ struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); ++ u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; ++ ++ /* Point the command headers at the command tables. */ ++ cmd->command_header = dd->port->command_list + ++ (sizeof(struct mtip_cmd_hdr) * rq->tag); ++ cmd->command_header_dma = dd->port->command_list_dma + ++ (sizeof(struct mtip_cmd_hdr) * rq->tag); ++ ++ if (host_cap_64) ++ cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); ++ ++ cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); ++} ++ + static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + { + struct request *rq; +@@ -180,6 +199,9 @@ static struct mtip_cmd *mtip_get_int_command(struct driver_data *dd) + if (IS_ERR(rq)) + return NULL; + ++ /* Internal cmd isn't submitted via .queue_rq */ ++ mtip_init_cmd_header(rq); ++ + return blk_mq_rq_to_pdu(rq); + } + +@@ -3818,6 +3840,8 @@ static int mtip_queue_rq(struct blk_mq_hw_ctx *hctx, + struct request *rq = bd->rq; + int ret; + ++ mtip_init_cmd_header(rq); ++ + if (unlikely(mtip_check_unal_depth(hctx, rq))) + return BLK_MQ_RQ_QUEUE_BUSY; + +@@ -3849,7 +3873,6 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + { + struct driver_data *dd = data; + struct mtip_cmd *cmd = blk_mq_rq_to_pdu(rq); +- u32 host_cap_64 = readl(dd->mmio + HOST_CAP) & HOST_CAP_64; + + /* + * For flush requests, request_idx starts at the end of the +@@ -3866,17 +3889,6 @@ static int mtip_init_cmd(void *data, struct request *rq, unsigned int hctx_idx, + + memset(cmd->command, 0, CMD_DMA_ALLOC_SZ); + +- /* Point the command headers at the command tables. */ +- cmd->command_header = dd->port->command_list + +- (sizeof(struct mtip_cmd_hdr) * request_idx); +- cmd->command_header_dma = dd->port->command_list_dma + +- (sizeof(struct mtip_cmd_hdr) * request_idx); +- +- if (host_cap_64) +- cmd->command_header->ctbau = __force_bit2int cpu_to_le32((cmd->command_dma >> 16) >> 16); +- +- cmd->command_header->ctba = __force_bit2int cpu_to_le32(cmd->command_dma & 0xFFFFFFFF); +- + sg_init_table(cmd->sg, MTIP_MAX_SG); + return 0; + } +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 71325e443e46..8a3bf0a8c31d 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -936,6 +936,9 @@ static int qca_setup(struct hci_uart *hu) + if (!ret) { + set_bit(STATE_IN_BAND_SLEEP_ENABLED, &qca->flags); + qca_debugfs_init(hdev); ++ } else if (ret == -ENOENT) { ++ /* No patch/nvm-config found, run with original fw/config */ ++ ret = 0; + } + + /* Setup bdaddr */ +diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c +index 40d400fe5bb7..4ada103945f0 100644 +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -515,7 +515,7 @@ static void panic_halt_ipmi_heartbeat(void) + msg.cmd = IPMI_WDOG_RESET_TIMER; + msg.data = NULL; + msg.data_len = 0; +- atomic_add(2, &panic_done_count); ++ atomic_add(1, &panic_done_count); + rv = ipmi_request_supply_msgs(watchdog_user, + (struct ipmi_addr *) &addr, + 0, +@@ -525,7 +525,7 @@ static void panic_halt_ipmi_heartbeat(void) + &panic_halt_heartbeat_recv_msg, + 1); + if (rv) +- atomic_sub(2, &panic_done_count); ++ atomic_sub(1, &panic_done_count); + } + + static struct ipmi_smi_msg panic_halt_smi_msg = { +@@ -549,12 +549,12 @@ static void panic_halt_ipmi_set_timeout(void) + /* Wait for the messages to be free. */ + while (atomic_read(&panic_done_count) != 0) + ipmi_poll_interface(watchdog_user); +- atomic_add(2, &panic_done_count); ++ atomic_add(1, &panic_done_count); + rv = i_ipmi_set_timeout(&panic_halt_smi_msg, + &panic_halt_recv_msg, + &send_heartbeat_now); + if (rv) { +- atomic_sub(2, &panic_done_count); ++ atomic_sub(1, &panic_done_count); + printk(KERN_WARNING PFX + "Unable to extend the watchdog timeout."); + } else { +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index aaa5fa95dede..36afc1a21699 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -1040,6 +1040,11 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) + break; + + recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len); ++ if (recd > num_bytes) { ++ total = -EFAULT; ++ break; ++ } ++ + memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd); + + dest += recd; +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index 286bd090a488..389a009b83f2 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -622,6 +622,11 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + if (!rc) { + data_len = be16_to_cpup( + (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]); ++ if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE + 1) { ++ rc = -EFAULT; ++ goto out; ++ } ++ + data = &buf.data[TPM_HEADER_SIZE + 6]; + + memcpy(payload->key, data, data_len - 1); +@@ -629,6 +634,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + payload->migratable = data[data_len - 1]; + } + ++out: + tpm_buf_destroy(&buf); + return rc; + } +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 7f13221aeb30..9dd93a209ef2 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -283,7 +283,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) + static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + int size = 0; +- int expected, status; ++ int status; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + size = -EIO; +@@ -298,7 +299,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + expected = be32_to_cpu(*(__be32 *) (buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < TPM_HEADER_SIZE) { + size = -EIO; + goto out; + } +diff --git a/drivers/clk/bcm/clk-ns2.c b/drivers/clk/bcm/clk-ns2.c +index a564e9248814..adc14145861a 100644 +--- a/drivers/clk/bcm/clk-ns2.c ++++ b/drivers/clk/bcm/clk-ns2.c +@@ -103,7 +103,7 @@ CLK_OF_DECLARE(ns2_genpll_src_clk, "brcm,ns2-genpll-scr", + + static const struct iproc_pll_ctrl genpll_sw = { + .flags = IPROC_CLK_AON | IPROC_CLK_PLL_SPLIT_STAT_CTRL, +- .aon = AON_VAL(0x0, 2, 9, 8), ++ .aon = AON_VAL(0x0, 1, 11, 10), + .reset = RESET_VAL(0x4, 2, 1), + .dig_filter = DF_VAL(0x0, 9, 3, 5, 4, 2, 3), + .ndiv_int = REG_VAL(0x8, 4, 10), +diff --git a/drivers/clk/clk-si5351.c b/drivers/clk/clk-si5351.c +index e346b223199d..a01ee9a3ed6d 100644 +--- a/drivers/clk/clk-si5351.c ++++ b/drivers/clk/clk-si5351.c +@@ -72,7 +72,7 @@ static const char * const si5351_input_names[] = { + "xtal", "clkin" + }; + static const char * const si5351_pll_names[] = { +- "plla", "pllb", "vxco" ++ "si5351_plla", "si5351_pllb", "si5351_vxco" + }; + static const char * const si5351_msynth_names[] = { + "ms0", "ms1", "ms2", "ms3", "ms4", "ms5", "ms6", "ms7" +diff --git a/drivers/cpufreq/sh-cpufreq.c b/drivers/cpufreq/sh-cpufreq.c +index 86628e22b2a3..719c3d9f07fb 100644 +--- a/drivers/cpufreq/sh-cpufreq.c ++++ b/drivers/cpufreq/sh-cpufreq.c +@@ -30,54 +30,63 @@ + + static DEFINE_PER_CPU(struct clk, sh_cpuclk); + ++struct cpufreq_target { ++ struct cpufreq_policy *policy; ++ unsigned int freq; ++}; ++ + static unsigned int sh_cpufreq_get(unsigned int cpu) + { + return (clk_get_rate(&per_cpu(sh_cpuclk, cpu)) + 500) / 1000; + } + +-/* +- * Here we notify other drivers of the proposed change and the final change. +- */ +-static int sh_cpufreq_target(struct cpufreq_policy *policy, +- unsigned int target_freq, +- unsigned int relation) ++static long __sh_cpufreq_target(void *arg) + { +- unsigned int cpu = policy->cpu; ++ struct cpufreq_target *target = arg; ++ struct cpufreq_policy *policy = target->policy; ++ int cpu = policy->cpu; + struct clk *cpuclk = &per_cpu(sh_cpuclk, cpu); +- cpumask_t cpus_allowed; + struct cpufreq_freqs freqs; + struct device *dev; + long freq; + +- cpus_allowed = current->cpus_allowed; +- set_cpus_allowed_ptr(current, cpumask_of(cpu)); +- +- BUG_ON(smp_processor_id() != cpu); ++ if (smp_processor_id() != cpu) ++ return -ENODEV; + + dev = get_cpu_device(cpu); + + /* Convert target_freq from kHz to Hz */ +- freq = clk_round_rate(cpuclk, target_freq * 1000); ++ freq = clk_round_rate(cpuclk, target->freq * 1000); + + if (freq < (policy->min * 1000) || freq > (policy->max * 1000)) + return -EINVAL; + +- dev_dbg(dev, "requested frequency %u Hz\n", target_freq * 1000); ++ dev_dbg(dev, "requested frequency %u Hz\n", target->freq * 1000); + + freqs.old = sh_cpufreq_get(cpu); + freqs.new = (freq + 500) / 1000; + freqs.flags = 0; + +- cpufreq_freq_transition_begin(policy, &freqs); +- set_cpus_allowed_ptr(current, &cpus_allowed); ++ cpufreq_freq_transition_begin(target->policy, &freqs); + clk_set_rate(cpuclk, freq); +- cpufreq_freq_transition_end(policy, &freqs, 0); ++ cpufreq_freq_transition_end(target->policy, &freqs, 0); + + dev_dbg(dev, "set frequency %lu Hz\n", freq); +- + return 0; + } + ++/* ++ * Here we notify other drivers of the proposed change and the final change. ++ */ ++static int sh_cpufreq_target(struct cpufreq_policy *policy, ++ unsigned int target_freq, ++ unsigned int relation) ++{ ++ struct cpufreq_target data = { .policy = policy, .freq = target_freq }; ++ ++ return work_on_cpu(policy->cpu, __sh_cpufreq_target, &data); ++} ++ + static int sh_cpufreq_verify(struct cpufreq_policy *policy) + { + struct clk *cpuclk = &per_cpu(sh_cpuclk, policy->cpu); +diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c +index 8100ede095d5..c7bd1c5315f4 100644 +--- a/drivers/dma/ti-dma-crossbar.c ++++ b/drivers/dma/ti-dma-crossbar.c +@@ -51,7 +51,15 @@ struct ti_am335x_xbar_map { + + static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val) + { +- writeb_relaxed(val, iomem + event); ++ /* ++ * TPCC_EVT_MUX_60_63 register layout is different than the ++ * rest, in the sense, that event 63 is mapped to lowest byte ++ * and event 60 is mapped to highest, handle it separately. ++ */ ++ if (event >= 60 && event <= 63) ++ writeb_relaxed(val, iomem + (63 - event % 4)); ++ else ++ writeb_relaxed(val, iomem + event); + } + + static void ti_am335x_xbar_free(struct device *dev, void *route_data) +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index c76cc853b08a..644faf3ae93a 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -89,14 +89,17 @@ static struct page **get_pages(struct drm_gem_object *obj) + return p; + } + ++ msm_obj->pages = p; ++ + msm_obj->sgt = drm_prime_pages_to_sg(p, npages); + if (IS_ERR(msm_obj->sgt)) { ++ void *ptr = ERR_CAST(msm_obj->sgt); ++ + dev_err(dev->dev, "failed to allocate sgt\n"); +- return ERR_CAST(msm_obj->sgt); ++ msm_obj->sgt = NULL; ++ return ptr; + } + +- msm_obj->pages = p; +- + /* For non-cached buffers, ensure the new pages are clean + * because display controller, GPU, etc. are not coherent: + */ +@@ -119,7 +122,10 @@ static void put_pages(struct drm_gem_object *obj) + if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) + dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, DMA_BIDIRECTIONAL); +- sg_free_table(msm_obj->sgt); ++ ++ if (msm_obj->sgt) ++ sg_free_table(msm_obj->sgt); ++ + kfree(msm_obj->sgt); + + if (use_pages(obj)) +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c +index 00de1bf81519..9dfc2471ea09 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -104,7 +104,7 @@ nouveau_display_scanoutpos_head(struct drm_crtc *crtc, int *vpos, int *hpos, + }; + struct nouveau_display *disp = nouveau_display(crtc->dev); + struct drm_vblank_crtc *vblank = &crtc->dev->vblank[drm_crtc_index(crtc)]; +- int ret, retry = 1; ++ int ret, retry = 20; + + do { + ret = nvif_mthd(&disp->disp, 0, &args, sizeof(args)); +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index f516b5891932..083db3f5181f 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -288,7 +288,12 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + msecs_to_jiffies(100))) { + dev_err(dmm->dev, "timed out waiting for done\n"); + ret = -ETIMEDOUT; ++ goto cleanup; + } ++ ++ /* Check the engine status before continue */ ++ ret = wait_status(engine, DMM_PATSTATUS_READY | ++ DMM_PATSTATUS_VALID | DMM_PATSTATUS_DONE); + } + + cleanup: +diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c +index a38af68cf326..0a0628d11c0b 100644 +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -976,7 +976,7 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev) + goto drop; + /* Pad to 32-bits - FIXME: Revisit*/ + if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3))) +- goto drop; ++ goto inc_dropped; + + /* + * Modem sends Phonet messages over SSI with its own endianess... +@@ -1028,8 +1028,9 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev) + drop2: + hsi_free_msg(msg); + drop: +- dev->stats.tx_dropped++; + dev_kfree_skb(skb); ++inc_dropped: ++ dev->stats.tx_dropped++; + + return 0; + } +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 7214efd10db5..22e10b7d505d 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -45,8 +45,11 @@ + #define TPIU_ITATBCTR0 0xef8 + + /** register definition **/ ++/* FFSR - 0x300 */ ++#define FFSR_FT_STOPPED BIT(1) + /* FFCR - 0x304 */ + #define FFCR_FON_MAN BIT(6) ++#define FFCR_STOP_FI BIT(12) + + /** + * @base: memory mapped base address for this component. +@@ -85,10 +88,14 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + { + CS_UNLOCK(drvdata->base); + +- /* Clear formatter controle reg. */ +- writel_relaxed(0x0, drvdata->base + TPIU_FFCR); ++ /* Clear formatter and stop on flush */ ++ writel_relaxed(FFCR_STOP_FI, drvdata->base + TPIU_FFCR); + /* Generate manual flush */ +- writel_relaxed(FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ /* Wait for flush to complete */ ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ /* Wait for formatter to stop */ ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c +index dfc98df7b1b6..7aa7b9cb6203 100644 +--- a/drivers/i2c/busses/i2c-scmi.c ++++ b/drivers/i2c/busses/i2c-scmi.c +@@ -18,6 +18,9 @@ + #define ACPI_SMBUS_HC_CLASS "smbus" + #define ACPI_SMBUS_HC_DEVICE_NAME "cmi" + ++/* SMBUS HID definition as supported by Microsoft Windows */ ++#define ACPI_SMBUS_MS_HID "SMB0001" ++ + ACPI_MODULE_NAME("smbus_cmi"); + + struct smbus_methods_t { +@@ -51,6 +54,7 @@ static const struct smbus_methods_t ibm_smbus_methods = { + static const struct acpi_device_id acpi_smbus_cmi_ids[] = { + {"SMBUS01", (kernel_ulong_t)&smbus_methods}, + {ACPI_SMBUS_IBM_HID, (kernel_ulong_t)&ibm_smbus_methods}, ++ {ACPI_SMBUS_MS_HID, (kernel_ulong_t)&smbus_methods}, + {"", 0} + }; + MODULE_DEVICE_TABLE(acpi, acpi_smbus_cmi_ids); +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 197a08b4e2f3..84ab20c6b389 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -628,6 +628,8 @@ static const struct iio_trigger_ops st_accel_trigger_ops = { + int st_accel_common_probe(struct iio_dev *indio_dev) + { + struct st_sensor_data *adata = iio_priv(indio_dev); ++ struct st_sensors_platform_data *pdata = ++ (struct st_sensors_platform_data *)adata->dev->platform_data; + int irq = adata->get_irq_data_ready(indio_dev); + int err; + +@@ -652,9 +654,8 @@ int st_accel_common_probe(struct iio_dev *indio_dev) + &adata->sensor_settings->fs.fs_avl[0]; + adata->odr = adata->sensor_settings->odr.odr_avl[0].hz; + +- if (!adata->dev->platform_data) +- adata->dev->platform_data = +- (struct st_sensors_platform_data *)&default_accel_pdata; ++ if (!pdata) ++ pdata = (struct st_sensors_platform_data *)&default_accel_pdata; + + err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data); + if (err < 0) +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index 5056bd68573f..270eeac928bc 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -436,6 +436,8 @@ static const struct iio_trigger_ops st_press_trigger_ops = { + int st_press_common_probe(struct iio_dev *indio_dev) + { + struct st_sensor_data *press_data = iio_priv(indio_dev); ++ struct st_sensors_platform_data *pdata = ++ (struct st_sensors_platform_data *)press_data->dev->platform_data; + int irq = press_data->get_irq_data_ready(indio_dev); + int err; + +@@ -464,10 +466,8 @@ int st_press_common_probe(struct iio_dev *indio_dev) + press_data->odr = press_data->sensor_settings->odr.odr_avl[0].hz; + + /* Some devices don't support a data ready pin. */ +- if (!press_data->dev->platform_data && +- press_data->sensor_settings->drdy_irq.addr) +- press_data->dev->platform_data = +- (struct st_sensors_platform_data *)&default_press_pdata; ++ if (!pdata && press_data->sensor_settings->drdy_irq.addr) ++ pdata = (struct st_sensors_platform_data *)&default_press_pdata; + + err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data); + if (err < 0) +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index b6c9a370a38b..d57a78ec7425 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3743,6 +3743,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + struct cma_multicast *mc; + int ret; + ++ if (!id->device) ++ return -EINVAL; ++ + id_priv = container_of(id, struct rdma_id_private, id); + if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) && + !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED)) +@@ -4007,7 +4010,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb) + RDMA_NL_RDMA_CM_ATTR_SRC_ADDR)) + goto out; + if (ibnl_put_attr(skb, nlh, +- rdma_addr_size(cma_src_addr(id_priv)), ++ rdma_addr_size(cma_dst_addr(id_priv)), + cma_dst_addr(id_priv), + RDMA_NL_RDMA_CM_ATTR_DST_ADDR)) + goto out; +diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c +index fb43a242847b..8d7d110d0721 100644 +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -663,6 +663,7 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid) + } + skb_num++; + spin_lock_irqsave(&iwpm_mapinfo_lock, flags); ++ ret = -EINVAL; + for (i = 0; i < IWPM_MAPINFO_HASH_SIZE; i++) { + hlist_for_each_entry(map_info, &iwpm_hash_bucket[i], + hlist_node) { +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 0ae337bec4f2..6790ebb366dd 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -354,7 +354,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, + return -EINVAL; + } + +- ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->nmap, dst, length, ++ ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->npages, dst, length, + offset + ib_umem_offset(umem)); + + if (ret < 0) +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index b7a73f1a8beb..3eb967521917 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -2436,9 +2436,13 @@ ssize_t ib_uverbs_destroy_qp(struct ib_uverbs_file *file, + + static void *alloc_wr(size_t wr_size, __u32 num_sge) + { ++ if (num_sge >= (U32_MAX - ALIGN(wr_size, sizeof (struct ib_sge))) / ++ sizeof (struct ib_sge)) ++ return NULL; ++ + return kmalloc(ALIGN(wr_size, sizeof (struct ib_sge)) + + num_sge * sizeof (struct ib_sge), GFP_KERNEL); +-}; ++} + + ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file, + struct ib_device *ib_dev, +@@ -2665,6 +2669,13 @@ static struct ib_recv_wr *ib_uverbs_unmarshall_recv(const char __user *buf, + goto err; + } + ++ if (user_wr->num_sge >= ++ (U32_MAX - ALIGN(sizeof *next, sizeof (struct ib_sge))) / ++ sizeof (struct ib_sge)) { ++ ret = -EINVAL; ++ goto err; ++ } ++ + next = kmalloc(ALIGN(sizeof *next, sizeof (struct ib_sge)) + + user_wr->num_sge * sizeof (struct ib_sge), + GFP_KERNEL); +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 5a2a0b5db938..67c4c73343d4 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -1041,7 +1041,7 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) + /* need to protect from a race on closing the vma as part of + * mlx4_ib_vma_close(). + */ +- down_read(&owning_mm->mmap_sem); ++ down_write(&owning_mm->mmap_sem); + for (i = 0; i < HW_BAR_COUNT; i++) { + vma = context->hw_bar_info[i].vma; + if (!vma) +@@ -1055,11 +1055,13 @@ static void mlx4_ib_disassociate_ucontext(struct ib_ucontext *ibcontext) + BUG_ON(1); + } + ++ context->hw_bar_info[i].vma->vm_flags &= ++ ~(VM_SHARED | VM_MAYSHARE); + /* context going to be destroyed, should not access ops any more */ + context->hw_bar_info[i].vma->vm_ops = NULL; + } + +- up_read(&owning_mm->mmap_sem); ++ up_write(&owning_mm->mmap_sem); + mmput(owning_mm); + put_task_struct(owning_process); + } +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +index 86c303a620c1..748b63b86cbc 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +@@ -834,7 +834,7 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev) + + dev->reset_stats.type = OCRDMA_RESET_STATS; + dev->reset_stats.dev = dev; +- if (!debugfs_create_file("reset_stats", S_IRUSR, dev->dir, ++ if (!debugfs_create_file("reset_stats", 0200, dev->dir, + &dev->reset_stats, &ocrdma_dbg_ops)) + goto err; + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index d3f0a384faad..f6b06729f4ea 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -945,6 +945,19 @@ static inline int update_parent_pkey(struct ipoib_dev_priv *priv) + */ + priv->dev->broadcast[8] = priv->pkey >> 8; + priv->dev->broadcast[9] = priv->pkey & 0xff; ++ ++ /* ++ * Update the broadcast address in the priv->broadcast object, ++ * in case it already exists, otherwise no one will do that. ++ */ ++ if (priv->broadcast) { ++ spin_lock_irq(&priv->lock); ++ memcpy(priv->broadcast->mcmember.mgid.raw, ++ priv->dev->broadcast + 4, ++ sizeof(union ib_gid)); ++ spin_unlock_irq(&priv->lock); ++ } ++ + return 0; + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 5c653669e736..37b42447045d 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -724,6 +724,22 @@ static void path_rec_completion(int status, + spin_lock_irqsave(&priv->lock, flags); + + if (!IS_ERR_OR_NULL(ah)) { ++ /* ++ * pathrec.dgid is used as the database key from the LLADDR, ++ * it must remain unchanged even if the SA returns a different ++ * GID to use in the AH. ++ */ ++ if (memcmp(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid))) { ++ ipoib_dbg( ++ priv, ++ "%s got PathRec for gid %pI6 while asked for %pI6\n", ++ dev->name, pathrec->dgid.raw, ++ path->pathrec.dgid.raw); ++ memcpy(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid)); ++ } ++ + path->pathrec = *pathrec; + + old_ah = path->ah; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 8bf48165f32c..21e688d55da6 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -473,6 +473,9 @@ static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast) + !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)) + return -EINVAL; + ++ init_completion(&mcast->done); ++ set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); ++ + ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw); + + rec.mgid = mcast->mcmember.mgid; +@@ -631,8 +634,6 @@ void ipoib_mcast_join_task(struct work_struct *work) + if (mcast->backoff == 1 || + time_after_eq(jiffies, mcast->delay_until)) { + /* Found the next unjoined group */ +- init_completion(&mcast->done); +- set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); + if (ipoib_mcast_join(dev, mcast)) { + spin_unlock_irq(&priv->lock); + return; +@@ -652,11 +653,9 @@ out: + queue_delayed_work(priv->wq, &priv->mcast_task, + delay_until - jiffies); + } +- if (mcast) { +- init_completion(&mcast->done); +- set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags); ++ if (mcast) + ipoib_mcast_join(dev, mcast); +- } ++ + spin_unlock_irq(&priv->lock); + } + +diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c +index 603fc2fadf05..12b20840fb74 100644 +--- a/drivers/input/misc/twl4030-pwrbutton.c ++++ b/drivers/input/misc/twl4030-pwrbutton.c +@@ -70,7 +70,7 @@ static int twl4030_pwrbutton_probe(struct platform_device *pdev) + pwr->phys = "twl4030_pwrbutton/input0"; + pwr->dev.parent = &pdev->dev; + +- err = devm_request_threaded_irq(&pwr->dev, irq, NULL, powerbutton_irq, ++ err = devm_request_threaded_irq(&pdev->dev, irq, NULL, powerbutton_irq, + IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING | + IRQF_ONESHOT, + "twl4030_pwrbutton", pwr); +diff --git a/drivers/input/touchscreen/ar1021_i2c.c b/drivers/input/touchscreen/ar1021_i2c.c +index 71b5a634cf6d..e7bb155911d0 100644 +--- a/drivers/input/touchscreen/ar1021_i2c.c ++++ b/drivers/input/touchscreen/ar1021_i2c.c +@@ -152,7 +152,7 @@ static int __maybe_unused ar1021_i2c_resume(struct device *dev) + static SIMPLE_DEV_PM_OPS(ar1021_i2c_pm, ar1021_i2c_suspend, ar1021_i2c_resume); + + static const struct i2c_device_id ar1021_i2c_id[] = { +- { "MICROCHIP_AR1021_I2C", 0 }, ++ { "ar1021", 0 }, + { }, + }; + MODULE_DEVICE_TABLE(i2c, ar1021_i2c_id); +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index f929879ecae6..a7d516f973dd 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -127,6 +127,7 @@ int intel_svm_enable_prq(struct intel_iommu *iommu) + pr_err("IOMMU: %s: Failed to request IRQ for page request queue\n", + iommu->name); + dmar_free_hwirq(irq); ++ iommu->pr_irq = 0; + goto err; + } + dmar_writeq(iommu->reg + DMAR_PQH_REG, 0ULL); +@@ -142,9 +143,11 @@ int intel_svm_finish_prq(struct intel_iommu *iommu) + dmar_writeq(iommu->reg + DMAR_PQT_REG, 0ULL); + dmar_writeq(iommu->reg + DMAR_PQA_REG, 0ULL); + +- free_irq(iommu->pr_irq, iommu); +- dmar_free_hwirq(iommu->pr_irq); +- iommu->pr_irq = 0; ++ if (iommu->pr_irq) { ++ free_irq(iommu->pr_irq, iommu); ++ dmar_free_hwirq(iommu->pr_irq); ++ iommu->pr_irq = 0; ++ } + + free_pages((unsigned long)iommu->prq, PRQ_ORDER); + iommu->prq = NULL; +diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c +index 3dc5b65f3990..b98d38f95237 100644 +--- a/drivers/iommu/omap-iommu.c ++++ b/drivers/iommu/omap-iommu.c +@@ -1295,6 +1295,7 @@ static int __init omap_iommu_init(void) + const unsigned long flags = SLAB_HWCACHE_ALIGN; + size_t align = 1 << 10; /* L2 pagetable alignement */ + struct device_node *np; ++ int ret; + + np = of_find_matching_node(NULL, omap_iommu_of_match); + if (!np) +@@ -1308,11 +1309,25 @@ static int __init omap_iommu_init(void) + return -ENOMEM; + iopte_cachep = p; + +- bus_set_iommu(&platform_bus_type, &omap_iommu_ops); +- + omap_iommu_debugfs_init(); + +- return platform_driver_register(&omap_iommu_driver); ++ ret = platform_driver_register(&omap_iommu_driver); ++ if (ret) { ++ pr_err("%s: failed to register driver\n", __func__); ++ goto fail_driver; ++ } ++ ++ ret = bus_set_iommu(&platform_bus_type, &omap_iommu_ops); ++ if (ret) ++ goto fail_bus; ++ ++ return 0; ++ ++fail_bus: ++ platform_driver_unregister(&omap_iommu_driver); ++fail_driver: ++ kmem_cache_destroy(iopte_cachep); ++ return ret; + } + subsys_initcall(omap_iommu_init); + /* must be ready before omap3isp is probed */ +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index a8a86d450d76..3a0d557146c7 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2698,6 +2698,11 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) + list_add(&r10_bio->retry_list, &conf->bio_end_io_list); + conf->nr_queued++; + spin_unlock_irq(&conf->device_lock); ++ /* ++ * In case freeze_array() is waiting for condition ++ * nr_pending == nr_queued + extra to be true. ++ */ ++ wake_up(&conf->wait_barrier); + md_wakeup_thread(conf->mddev->thread); + } else { + if (test_bit(R10BIO_WriteError, +@@ -4039,6 +4044,7 @@ static int raid10_start_reshape(struct mddev *mddev) + diff = 0; + if (first || diff < min_offset_diff) + min_offset_diff = diff; ++ first = 0; + } + } + +diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c +index fb66184dc9b6..77cf211e842e 100644 +--- a/drivers/media/dvb-core/dvb_ca_en50221.c ++++ b/drivers/media/dvb-core/dvb_ca_en50221.c +@@ -750,6 +750,29 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * b + goto exit; + } + ++ /* ++ * It may need some time for the CAM to settle down, or there might ++ * be a race condition between the CAM, writing HC and our last ++ * check for DA. This happens, if the CAM asserts DA, just after ++ * checking DA before we are setting HC. In this case it might be ++ * a bug in the CAM to keep the FR bit, the lower layer/HW ++ * communication requires a longer timeout or the CAM needs more ++ * time internally. But this happens in reality! ++ * We need to read the status from the HW again and do the same ++ * we did for the previous check for DA ++ */ ++ status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS); ++ if (status < 0) ++ goto exit; ++ ++ if (status & (STATUSREG_DA | STATUSREG_RE)) { ++ if (status & STATUSREG_DA) ++ dvb_ca_en50221_thread_wakeup(ca); ++ ++ status = -EAGAIN; ++ goto exit; ++ } ++ + /* send the amount of data */ + if ((status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_SIZE_HIGH, bytes_write >> 8)) != 0) + goto exit; +diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c +index 821a8f481507..9d6270591858 100644 +--- a/drivers/media/dvb-frontends/si2168.c ++++ b/drivers/media/dvb-frontends/si2168.c +@@ -14,6 +14,8 @@ + * GNU General Public License for more details. + */ + ++#include ++ + #include "si2168_priv.h" + + static const struct dvb_frontend_ops si2168_ops; +@@ -420,6 +422,7 @@ static int si2168_init(struct dvb_frontend *fe) + if (ret) + goto err; + ++ udelay(100); + memcpy(cmd.args, "\x85", 1); + cmd.wlen = 1; + cmd.rlen = 1; +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index 8aa726651630..90fcccc05b56 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -422,8 +422,7 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + bt878_num); + if (bt878_num >= BT878_MAX) { + printk(KERN_ERR "bt878: Too many devices inserted\n"); +- result = -ENOMEM; +- goto fail0; ++ return -ENOMEM; + } + if (pci_enable_device(dev)) + return -EIO; +diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +index 8490a65ae1c6..a43404cad3e3 100644 +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei) + static void channel_swdemux_tsklet(unsigned long data) + { + struct channel_info *channel = (struct channel_info *)data; +- struct c8sectpfei *fei = channel->fei; ++ struct c8sectpfei *fei; + unsigned long wp, rp; + int pos, num_packets, n, size; + u8 *buf; +@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data) + if (unlikely(!channel || !channel->irec)) + return; + ++ fei = channel->fei; ++ + wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0)); + rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0)); + +diff --git a/drivers/mfd/palmas.c b/drivers/mfd/palmas.c +index 8f8bacb67a15..a6b5259ffbdd 100644 +--- a/drivers/mfd/palmas.c ++++ b/drivers/mfd/palmas.c +@@ -430,6 +430,20 @@ static void palmas_power_off(void) + { + unsigned int addr; + int ret, slave; ++ struct device_node *np = palmas_dev->dev->of_node; ++ ++ if (of_property_read_bool(np, "ti,palmas-override-powerhold")) { ++ addr = PALMAS_BASE_TO_REG(PALMAS_PU_PD_OD_BASE, ++ PALMAS_PRIMARY_SECONDARY_PAD2); ++ slave = PALMAS_BASE_TO_SLAVE(PALMAS_PU_PD_OD_BASE); ++ ++ ret = regmap_update_bits(palmas_dev->regmap[slave], addr, ++ PALMAS_PRIMARY_SECONDARY_PAD2_GPIO_7_MASK, 0); ++ if (ret) ++ dev_err(palmas_dev->dev, ++ "Unable to write PRIMARY_SECONDARY_PAD2 %d\n", ++ ret); ++ } + + if (!palmas_dev) + return; +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 5f7d10ba498a..299a83f1ad38 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2791,6 +2791,14 @@ int mmc_pm_notify(struct notifier_block *notify_block, + if (!err) + break; + ++ if (!mmc_card_is_removable(host)) { ++ dev_warn(mmc_dev(host), ++ "pre_suspend failed for non-removable host: " ++ "%d\n", err); ++ /* Avoid removing non-removable hosts */ ++ break; ++ } ++ + /* Calling bus_ops->remove() with a claimed host can deadlock */ + host->bus_ops->remove(host); + mmc_claim_host(host); +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index 7fb0753abe30..6b814d7d6560 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -1776,8 +1776,8 @@ static int omap_hsmmc_configure_wake_irq(struct omap_hsmmc_host *host) + */ + if (host->pdata->controller_flags & OMAP_HSMMC_SWAKEUP_MISSING) { + struct pinctrl *p = devm_pinctrl_get(host->dev); +- if (!p) { +- ret = -ENODEV; ++ if (IS_ERR(p)) { ++ ret = PTR_ERR(p); + goto err_free_irq; + } + if (IS_ERR(pinctrl_lookup_state(p, PINCTRL_STATE_DEFAULT))) { +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 83b1226471c1..ac66c61d9433 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -418,6 +418,20 @@ static void esdhc_of_set_clock(struct sdhci_host *host, unsigned int clock) + if (esdhc->vendor_ver < VENDOR_V_23) + pre_div = 2; + ++ /* ++ * Limit SD clock to 167MHz for ls1046a according to its datasheet ++ */ ++ if (clock > 167000000 && ++ of_find_compatible_node(NULL, NULL, "fsl,ls1046a-esdhc")) ++ clock = 167000000; ++ ++ /* ++ * Limit SD clock to 125MHz for ls1012a according to its datasheet ++ */ ++ if (clock > 125000000 && ++ of_find_compatible_node(NULL, NULL, "fsl,ls1012a-esdhc")) ++ clock = 125000000; ++ + /* Workaround to reduce the clock frequency for p1010 esdhc */ + if (of_find_compatible_node(NULL, NULL, "fsl,p1010-esdhc")) { + if (clock > 20000000) +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 74bece5897c9..d1103d612d8b 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2044,6 +2044,7 @@ static void bnx2x_set_rx_buf_size(struct bnx2x *bp) + ETH_OVREHEAD + + mtu + + BNX2X_FW_RX_ALIGN_END; ++ fp->rx_buf_size = SKB_DATA_ALIGN(fp->rx_buf_size); + /* Note : rx_buf_size doesn't take into account NET_SKB_PAD */ + if (fp->rx_buf_size + NET_SKB_PAD <= PAGE_SIZE) + fp->rx_frag_size = fp->rx_buf_size + NET_SKB_PAD; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index b8517b00e706..a20bd8362712 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -648,7 +648,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data) + + static int hns_gmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ARRAY_SIZE(g_gmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index 67f33f185a44..6634aef0e841 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -384,7 +384,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) + + int hns_ppe_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ETH_PPE_STATIC_NUM; + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index 4db32c62f062..1d5b18d7a1d7 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -807,7 +807,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data) + */ + int hns_rcb_get_ring_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return HNS_RING_STATIC_REG_NUM; + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c +index 802d55457f19..b1a27aef4425 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c +@@ -776,7 +776,7 @@ static void hns_xgmac_get_strings(u32 stringset, u8 *data) + */ + static int hns_xgmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS) ++ if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) + return ARRAY_SIZE(g_xgmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 5205f1ebe381..e356e9187e84 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3526,6 +3526,12 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca) + + switch (hw->mac.type) { + case e1000_pch2lan: ++ /* Stable 96MHz frequency */ ++ incperiod = INCPERIOD_96MHz; ++ incvalue = INCVALUE_96MHz; ++ shift = INCVALUE_SHIFT_96MHz; ++ adapter->cc.shift = shift + INCPERIOD_SHIFT_96MHz; ++ break; + case e1000_pch_lpt: + if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { + /* Stable 96MHz frequency */ +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 7327b729ba2e..ffa6885acfc8 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -127,6 +127,8 @@ static int qlcnic_sriov_virtid_fn(struct qlcnic_adapter *adapter, int vf_id) + return 0; + + pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_SRIOV); ++ if (!pos) ++ return 0; + pci_read_config_word(dev, pos + PCI_SRIOV_VF_OFFSET, &offset); + pci_read_config_word(dev, pos + PCI_SRIOV_VF_STRIDE, &stride); + +diff --git a/drivers/net/wan/pc300too.c b/drivers/net/wan/pc300too.c +index db363856e0b5..2b064998915f 100644 +--- a/drivers/net/wan/pc300too.c ++++ b/drivers/net/wan/pc300too.c +@@ -347,6 +347,7 @@ static int pc300_pci_init_one(struct pci_dev *pdev, + card->rambase == NULL) { + pr_err("ioremap() failed\n"); + pc300_pci_remove_one(pdev); ++ return -ENOMEM; + } + + /* PLX PCI 9050 workaround for local configuration register read bug */ +diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c +index 06ea6cc9e30a..62077bda8dde 100644 +--- a/drivers/net/wireless/ath/regd.c ++++ b/drivers/net/wireless/ath/regd.c +@@ -254,8 +254,12 @@ bool ath_is_49ghz_allowed(u16 regdomain) + EXPORT_SYMBOL(ath_is_49ghz_allowed); + + /* Frequency is one where radar detection is required */ +-static bool ath_is_radar_freq(u16 center_freq) ++static bool ath_is_radar_freq(u16 center_freq, ++ struct ath_regulatory *reg) ++ + { ++ if (reg->country_code == CTRY_INDIA) ++ return (center_freq >= 5500 && center_freq <= 5700); + return (center_freq >= 5260 && center_freq <= 5700); + } + +@@ -306,7 +310,7 @@ __ath_reg_apply_beaconing_flags(struct wiphy *wiphy, + enum nl80211_reg_initiator initiator, + struct ieee80211_channel *ch) + { +- if (ath_is_radar_freq(ch->center_freq) || ++ if (ath_is_radar_freq(ch->center_freq, reg) || + (ch->flags & IEEE80211_CHAN_RADAR)) + return; + +@@ -395,8 +399,9 @@ ath_reg_apply_ir_flags(struct wiphy *wiphy, + } + } + +-/* Always apply Radar/DFS rules on freq range 5260 MHz - 5700 MHz */ +-static void ath_reg_apply_radar_flags(struct wiphy *wiphy) ++/* Always apply Radar/DFS rules on freq range 5500 MHz - 5700 MHz */ ++static void ath_reg_apply_radar_flags(struct wiphy *wiphy, ++ struct ath_regulatory *reg) + { + struct ieee80211_supported_band *sband; + struct ieee80211_channel *ch; +@@ -409,7 +414,7 @@ static void ath_reg_apply_radar_flags(struct wiphy *wiphy) + + for (i = 0; i < sband->n_channels; i++) { + ch = &sband->channels[i]; +- if (!ath_is_radar_freq(ch->center_freq)) ++ if (!ath_is_radar_freq(ch->center_freq, reg)) + continue; + /* We always enable radar detection/DFS on this + * frequency range. Additionally we also apply on +@@ -505,7 +510,7 @@ void ath_reg_notifier_apply(struct wiphy *wiphy, + struct ath_common *common = container_of(reg, struct ath_common, + regulatory); + /* We always apply this */ +- ath_reg_apply_radar_flags(wiphy); ++ ath_reg_apply_radar_flags(wiphy, reg); + + /* + * This would happen when we have sent a custom regulatory request +@@ -653,7 +658,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg, + } + + wiphy_apply_custom_regulatory(wiphy, regd); +- ath_reg_apply_radar_flags(wiphy); ++ ath_reg_apply_radar_flags(wiphy, reg); + ath_reg_apply_world_flags(wiphy, NL80211_REGDOM_SET_BY_DRIVER, reg); + return 0; + } +diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c b/drivers/net/wireless/mediatek/mt7601u/mcu.c +index fbb1986eda3c..686b1b5dd394 100644 +--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c ++++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c +@@ -66,8 +66,10 @@ mt7601u_mcu_msg_alloc(struct mt7601u_dev *dev, const void *data, int len) + WARN_ON(len % 4); /* if length is not divisible by 4 we need to pad */ + + skb = alloc_skb(len + MT_DMA_HDR_LEN + 4, GFP_KERNEL); +- skb_reserve(skb, MT_DMA_HDR_LEN); +- memcpy(skb_put(skb, len), data, len); ++ if (skb) { ++ skb_reserve(skb, MT_DMA_HDR_LEN); ++ memcpy(skb_put(skb, len), data, len); ++ } + + return skb; + } +@@ -170,6 +172,8 @@ static int mt7601u_mcu_function_select(struct mt7601u_dev *dev, + }; + + skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); ++ if (!skb) ++ return -ENOMEM; + return mt7601u_mcu_msg_send(dev, skb, CMD_FUN_SET_OP, func == 5); + } + +@@ -205,6 +209,8 @@ mt7601u_mcu_calibrate(struct mt7601u_dev *dev, enum mcu_calibrate cal, u32 val) + }; + + skb = mt7601u_mcu_msg_alloc(dev, &msg, sizeof(msg)); ++ if (!skb) ++ return -ENOMEM; + return mt7601u_mcu_msg_send(dev, skb, CMD_CALIBRATION_OP, true); + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index c48b7e8ee0d6..b51815eccdb3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1572,7 +1572,14 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw) + dev_kfree_skb_irq(skb); + ring->idx = (ring->idx + 1) % ring->entries; + } ++ ++ if (rtlpriv->use_new_trx_flow) { ++ rtlpci->tx_ring[i].cur_tx_rp = 0; ++ rtlpci->tx_ring[i].cur_tx_wp = 0; ++ } ++ + ring->idx = 0; ++ ring->entries = rtlpci->txringcount[i]; + } + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index a13d1f2b5912..259590013382 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -3425,6 +3425,10 @@ static int rndis_wlan_bind(struct usbnet *usbdev, struct usb_interface *intf) + + /* because rndis_command() sleeps we need to use workqueue */ + priv->workqueue = create_singlethread_workqueue("rndis_wlan"); ++ if (!priv->workqueue) { ++ wiphy_free(wiphy); ++ return -ENOMEM; ++ } + INIT_WORK(&priv->work, rndis_wlan_worker); + INIT_DELAYED_WORK(&priv->dev_poller_work, rndis_device_poller); + INIT_DELAYED_WORK(&priv->scan_work, rndis_get_scan_results); +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 2686a4450dfc..f4639a9f1e48 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -979,19 +979,16 @@ struct pinctrl_state *pinctrl_lookup_state(struct pinctrl *p, + EXPORT_SYMBOL_GPL(pinctrl_lookup_state); + + /** +- * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * pinctrl_commit_state() - select/activate/program a pinctrl state to HW + * @p: the pinctrl handle for the device that requests configuration + * @state: the state handle to select/activate/program + */ +-int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++static int pinctrl_commit_state(struct pinctrl *p, struct pinctrl_state *state) + { + struct pinctrl_setting *setting, *setting2; + struct pinctrl_state *old_state = p->state; + int ret; + +- if (p->state == state) +- return 0; +- + if (p->state) { + /* + * For each pinmux setting in the old state, forget SW's record +@@ -1055,6 +1052,19 @@ unapply_new_state: + + return ret; + } ++ ++/** ++ * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * @p: the pinctrl handle for the device that requests configuration ++ * @state: the state handle to select/activate/program ++ */ ++int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++{ ++ if (p->state == state) ++ return 0; ++ ++ return pinctrl_commit_state(p, state); ++} + EXPORT_SYMBOL_GPL(pinctrl_select_state); + + static void devm_pinctrl_release(struct device *dev, void *res) +@@ -1223,7 +1233,7 @@ void pinctrl_unregister_map(struct pinctrl_map const *map) + int pinctrl_force_sleep(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_sleep)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_sleep); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_sleep); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_sleep); +@@ -1235,7 +1245,7 @@ EXPORT_SYMBOL_GPL(pinctrl_force_sleep); + int pinctrl_force_default(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_default)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_default); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_default); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_default); +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index 92430f781eb7..a0b8c8a8c323 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -59,12 +59,14 @@ static int send_command(struct cros_ec_device *ec_dev, + struct cros_ec_command *msg) + { + int ret; ++ int (*xfer_fxn)(struct cros_ec_device *ec, struct cros_ec_command *msg); + + if (ec_dev->proto_version > 2) +- ret = ec_dev->pkt_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->pkt_xfer; + else +- ret = ec_dev->cmd_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->cmd_xfer; + ++ ret = (*xfer_fxn)(ec_dev, msg); + if (msg->result == EC_RES_IN_PROGRESS) { + int i; + struct cros_ec_command *status_msg; +@@ -87,7 +89,7 @@ static int send_command(struct cros_ec_device *ec_dev, + for (i = 0; i < EC_COMMAND_RETRIES; i++) { + usleep_range(10000, 11000); + +- ret = ec_dev->cmd_xfer(ec_dev, status_msg); ++ ret = (*xfer_fxn)(ec_dev, status_msg); + if (ret < 0) + break; + +diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c +index f3baf9973989..24f1630a8b3f 100644 +--- a/drivers/platform/chrome/cros_ec_sysfs.c ++++ b/drivers/platform/chrome/cros_ec_sysfs.c +@@ -187,7 +187,7 @@ static ssize_t show_ec_version(struct device *dev, + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: EC error %d\n", msg->result); + else { +- msg->data[sizeof(msg->data) - 1] = '\0'; ++ msg->data[EC_HOST_PARAM_SIZE - 1] = '\0'; + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: %s\n", msg->data); + } +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index a3661cc44f86..0e0403e024c5 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -99,6 +99,15 @@ static const struct dmi_system_id asus_quirks[] = { + */ + .driver_data = &quirk_asus_wapf4, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X302UA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X302UA"), ++ }, ++ .driver_data = &quirk_asus_wapf4, ++ }, + { + .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X401U", +diff --git a/drivers/power/pda_power.c b/drivers/power/pda_power.c +index dfe1ee89f7c7..922a86787c5c 100644 +--- a/drivers/power/pda_power.c ++++ b/drivers/power/pda_power.c +@@ -30,9 +30,9 @@ static inline unsigned int get_irq_flags(struct resource *res) + static struct device *dev; + static struct pda_power_pdata *pdata; + static struct resource *ac_irq, *usb_irq; +-static struct timer_list charger_timer; +-static struct timer_list supply_timer; +-static struct timer_list polling_timer; ++static struct delayed_work charger_work; ++static struct delayed_work polling_work; ++static struct delayed_work supply_work; + static int polling; + static struct power_supply *pda_psy_ac, *pda_psy_usb; + +@@ -140,7 +140,7 @@ static void update_charger(void) + } + } + +-static void supply_timer_func(unsigned long unused) ++static void supply_work_func(struct work_struct *work) + { + if (ac_status == PDA_PSY_TO_CHANGE) { + ac_status = new_ac_status; +@@ -161,11 +161,12 @@ static void psy_changed(void) + * Okay, charger set. Now wait a bit before notifying supplicants, + * charge power should stabilize. + */ +- mod_timer(&supply_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_charger)); ++ cancel_delayed_work(&supply_work); ++ schedule_delayed_work(&supply_work, ++ msecs_to_jiffies(pdata->wait_for_charger)); + } + +-static void charger_timer_func(unsigned long unused) ++static void charger_work_func(struct work_struct *work) + { + update_status(); + psy_changed(); +@@ -184,13 +185,14 @@ static irqreturn_t power_changed_isr(int irq, void *power_supply) + * Wait a bit before reading ac/usb line status and setting charger, + * because ac/usb status readings may lag from irq. + */ +- mod_timer(&charger_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_status)); ++ cancel_delayed_work(&charger_work); ++ schedule_delayed_work(&charger_work, ++ msecs_to_jiffies(pdata->wait_for_status)); + + return IRQ_HANDLED; + } + +-static void polling_timer_func(unsigned long unused) ++static void polling_work_func(struct work_struct *work) + { + int changed = 0; + +@@ -211,8 +213,9 @@ static void polling_timer_func(unsigned long unused) + if (changed) + psy_changed(); + +- mod_timer(&polling_timer, +- jiffies + msecs_to_jiffies(pdata->polling_interval)); ++ cancel_delayed_work(&polling_work); ++ schedule_delayed_work(&polling_work, ++ msecs_to_jiffies(pdata->polling_interval)); + } + + #if IS_ENABLED(CONFIG_USB_PHY) +@@ -250,8 +253,9 @@ static int otg_handle_notification(struct notifier_block *nb, + * Wait a bit before reading ac/usb line status and setting charger, + * because ac/usb status readings may lag from irq. + */ +- mod_timer(&charger_timer, +- jiffies + msecs_to_jiffies(pdata->wait_for_status)); ++ cancel_delayed_work(&charger_work); ++ schedule_delayed_work(&charger_work, ++ msecs_to_jiffies(pdata->wait_for_status)); + + return NOTIFY_OK; + } +@@ -300,8 +304,8 @@ static int pda_power_probe(struct platform_device *pdev) + if (!pdata->ac_max_uA) + pdata->ac_max_uA = 500000; + +- setup_timer(&charger_timer, charger_timer_func, 0); +- setup_timer(&supply_timer, supply_timer_func, 0); ++ INIT_DELAYED_WORK(&charger_work, charger_work_func); ++ INIT_DELAYED_WORK(&supply_work, supply_work_func); + + ac_irq = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "ac"); + usb_irq = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "usb"); +@@ -385,9 +389,10 @@ static int pda_power_probe(struct platform_device *pdev) + + if (polling) { + dev_dbg(dev, "will poll for status\n"); +- setup_timer(&polling_timer, polling_timer_func, 0); +- mod_timer(&polling_timer, +- jiffies + msecs_to_jiffies(pdata->polling_interval)); ++ INIT_DELAYED_WORK(&polling_work, polling_work_func); ++ cancel_delayed_work(&polling_work); ++ schedule_delayed_work(&polling_work, ++ msecs_to_jiffies(pdata->polling_interval)); + } + + if (ac_irq || usb_irq) +@@ -433,9 +438,9 @@ static int pda_power_remove(struct platform_device *pdev) + free_irq(ac_irq->start, pda_psy_ac); + + if (polling) +- del_timer_sync(&polling_timer); +- del_timer_sync(&charger_timer); +- del_timer_sync(&supply_timer); ++ cancel_delayed_work_sync(&polling_work); ++ cancel_delayed_work_sync(&charger_work); ++ cancel_delayed_work_sync(&supply_work); + + if (pdata->is_usb_online) + power_supply_unregister(pda_psy_usb); +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index 2e481b9e8ea5..60a5e0c63a13 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -97,30 +97,26 @@ static s32 scaled_ppm_to_ppb(long ppm) + + /* posix clock implementation */ + +-static int ptp_clock_getres(struct posix_clock *pc, struct timespec *tp) ++static int ptp_clock_getres(struct posix_clock *pc, struct timespec64 *tp) + { + tp->tv_sec = 0; + tp->tv_nsec = 1; + return 0; + } + +-static int ptp_clock_settime(struct posix_clock *pc, const struct timespec *tp) ++static int ptp_clock_settime(struct posix_clock *pc, const struct timespec64 *tp) + { + struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +- struct timespec64 ts = timespec_to_timespec64(*tp); + +- return ptp->info->settime64(ptp->info, &ts); ++ return ptp->info->settime64(ptp->info, tp); + } + +-static int ptp_clock_gettime(struct posix_clock *pc, struct timespec *tp) ++static int ptp_clock_gettime(struct posix_clock *pc, struct timespec64 *tp) + { + struct ptp_clock *ptp = container_of(pc, struct ptp_clock, clock); +- struct timespec64 ts; + int err; + +- err = ptp->info->gettime64(ptp->info, &ts); +- if (!err) +- *tp = timespec64_to_timespec(ts); ++ err = ptp->info->gettime64(ptp->info, tp); + return err; + } + +@@ -133,7 +129,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx) + ops = ptp->info; + + if (tx->modes & ADJ_SETOFFSET) { +- struct timespec ts; ++ struct timespec64 ts; + ktime_t kt; + s64 delta; + +@@ -146,7 +142,7 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct timex *tx) + if ((unsigned long) ts.tv_nsec >= NSEC_PER_SEC) + return -EINVAL; + +- kt = timespec_to_ktime(ts); ++ kt = timespec64_to_ktime(ts); + delta = ktime_to_ns(kt); + err = ops->adjtime(ops, delta); + } else if (tx->modes & ADJ_FREQUENCY) { +diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c +index 3a6d0290c54c..c5e272ea4372 100644 +--- a/drivers/regulator/anatop-regulator.c ++++ b/drivers/regulator/anatop-regulator.c +@@ -296,6 +296,11 @@ static int anatop_regulator_probe(struct platform_device *pdev) + if (!sreg->sel && !strcmp(sreg->name, "vddpu")) + sreg->sel = 22; + ++ /* set the default voltage of the pcie phy to be 1.100v */ ++ if (!sreg->sel && rdesc->name && ++ !strcmp(rdesc->name, "vddpcie")) ++ sreg->sel = 0x10; ++ + if (!sreg->bypass && !sreg->sel) { + dev_err(&pdev->dev, "Failed to read a valid default voltage selector.\n"); + return -EINVAL; +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 8f7034ba7d9e..86015b393dd5 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -41,6 +41,9 @@ + #include + #include + #include ++#ifdef CONFIG_X86 ++#include ++#endif + + /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */ + #include +@@ -1058,17 +1061,23 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { + cmos_wake_setup(&pnp->dev); + +- if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) ++ if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { ++ unsigned int irq = 0; ++#ifdef CONFIG_X86 + /* Some machines contain a PNP entry for the RTC, but + * don't define the IRQ. It should always be safe to +- * hardcode it in these cases ++ * hardcode it on systems with a legacy PIC. + */ ++ if (nr_legacy_irqs()) ++ irq = 8; ++#endif + return cmos_do_probe(&pnp->dev, +- pnp_get_resource(pnp, IORESOURCE_IO, 0), 8); +- else ++ pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); ++ } else { + return cmos_do_probe(&pnp->dev, + pnp_get_resource(pnp, IORESOURCE_IO, 0), + pnp_irq(pnp, 0)); ++ } + } + + static void __exit cmos_pnp_remove(struct pnp_dev *pnp) +diff --git a/drivers/rtc/rtc-ds1374.c b/drivers/rtc/rtc-ds1374.c +index 3b3049c8c9e0..c0eb113588ff 100644 +--- a/drivers/rtc/rtc-ds1374.c ++++ b/drivers/rtc/rtc-ds1374.c +@@ -527,6 +527,10 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + if (get_user(new_margin, (int __user *)arg)) + return -EFAULT; + ++ /* the hardware's tick rate is 4096 Hz, so ++ * the counter value needs to be scaled accordingly ++ */ ++ new_margin <<= 12; + if (new_margin < 1 || new_margin > 16777216) + return -EINVAL; + +@@ -535,7 +539,8 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + ds1374_wdt_ping(); + /* fallthrough */ + case WDIOC_GETTIMEOUT: +- return put_user(wdt_margin, (int __user *)arg); ++ /* when returning ... inverse is true */ ++ return put_user((wdt_margin >> 12), (int __user *)arg); + case WDIOC_SETOPTIONS: + if (copy_from_user(&options, (int __user *)arg, sizeof(int))) + return -EFAULT; +@@ -543,14 +548,15 @@ static long ds1374_wdt_ioctl(struct file *file, unsigned int cmd, + if (options & WDIOS_DISABLECARD) { + pr_info("disable watchdog\n"); + ds1374_wdt_disable(); ++ return 0; + } + + if (options & WDIOS_ENABLECARD) { + pr_info("enable watchdog\n"); + ds1374_wdt_settimeout(wdt_margin); + ds1374_wdt_ping(); ++ return 0; + } +- + return -EINVAL; + } + return -ENOTTY; +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 8379fbbc60db..ef43847153ea 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -13493,6 +13493,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + case LPFC_Q_CREATE_VERSION_1: + bf_set(lpfc_mbx_wq_create_wqe_count, &wq_create->u.request_1, + wq->entry_count); ++ bf_set(lpfc_mbox_hdr_version, &shdr->request, ++ LPFC_Q_CREATE_VERSION_1); ++ + switch (wq->entry_size) { + default: + case 64: +diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c +index 14c0334f41e4..26c67c42985c 100644 +--- a/drivers/scsi/mac_esp.c ++++ b/drivers/scsi/mac_esp.c +@@ -55,6 +55,7 @@ struct mac_esp_priv { + int error; + }; + static struct esp *esp_chips[2]; ++static DEFINE_SPINLOCK(esp_chips_lock); + + #define MAC_ESP_GET_PRIV(esp) ((struct mac_esp_priv *) \ + platform_get_drvdata((struct platform_device *) \ +@@ -562,15 +563,18 @@ static int esp_mac_probe(struct platform_device *dev) + } + + host->irq = IRQ_MAC_SCSI; +- esp_chips[dev->id] = esp; +- mb(); +- if (esp_chips[!dev->id] == NULL) { +- err = request_irq(host->irq, mac_scsi_esp_intr, 0, "ESP", NULL); +- if (err < 0) { +- esp_chips[dev->id] = NULL; +- goto fail_free_priv; +- } ++ ++ /* The request_irq() call is intended to succeed for the first device ++ * and fail for the second device. ++ */ ++ err = request_irq(host->irq, mac_scsi_esp_intr, 0, "ESP", NULL); ++ spin_lock(&esp_chips_lock); ++ if (err < 0 && esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); ++ goto fail_free_priv; + } ++ esp_chips[dev->id] = esp; ++ spin_unlock(&esp_chips_lock); + + err = scsi_esp_register(esp, &dev->dev); + if (err) +@@ -579,8 +583,13 @@ static int esp_mac_probe(struct platform_device *dev) + return 0; + + fail_free_irq: +- if (esp_chips[!dev->id] == NULL) ++ spin_lock(&esp_chips_lock); ++ esp_chips[dev->id] = NULL; ++ if (esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); + free_irq(host->irq, esp); ++ } else ++ spin_unlock(&esp_chips_lock); + fail_free_priv: + kfree(mep); + fail_free_command_block: +@@ -599,9 +608,13 @@ static int esp_mac_remove(struct platform_device *dev) + + scsi_esp_unregister(esp); + ++ spin_lock(&esp_chips_lock); + esp_chips[dev->id] = NULL; +- if (!(esp_chips[0] || esp_chips[1])) ++ if (esp_chips[!dev->id] == NULL) { ++ spin_unlock(&esp_chips_lock); + free_irq(irq, NULL); ++ } else ++ spin_unlock(&esp_chips_lock); + + kfree(mep); + +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 03a2aadf0d3c..578fae4d474f 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + + #define VIRTIO_SCSI_MEMPOOL_SZ 64 +@@ -704,6 +705,28 @@ static int virtscsi_device_reset(struct scsi_cmnd *sc) + return virtscsi_tmf(vscsi, cmd); + } + ++static int virtscsi_device_alloc(struct scsi_device *sdevice) ++{ ++ /* ++ * Passed through SCSI targets (e.g. with qemu's 'scsi-block') ++ * may have transfer limits which come from the host SCSI ++ * controller or something on the host side other than the ++ * target itself. ++ * ++ * To make this work properly, the hypervisor can adjust the ++ * target's VPD information to advertise these limits. But ++ * for that to work, the guest has to look at the VPD pages, ++ * which we won't do by default if it is an SPC-2 device, even ++ * if it does actually support it. ++ * ++ * So, set the blist to always try to read the VPD pages. ++ */ ++ sdevice->sdev_bflags = BLIST_TRY_VPD_PAGES; ++ ++ return 0; ++} ++ ++ + /** + * virtscsi_change_queue_depth() - Change a virtscsi target's queue depth + * @sdev: Virtscsi target whose queue depth to change +@@ -775,6 +798,7 @@ static struct scsi_host_template virtscsi_host_template_single = { + .change_queue_depth = virtscsi_change_queue_depth, + .eh_abort_handler = virtscsi_abort, + .eh_device_reset_handler = virtscsi_device_reset, ++ .slave_alloc = virtscsi_device_alloc, + + .can_queue = 1024, + .dma_boundary = UINT_MAX, +diff --git a/drivers/spi/spi-dw-mmio.c b/drivers/spi/spi-dw-mmio.c +index a6d7029a85ac..581df3ebfc88 100644 +--- a/drivers/spi/spi-dw-mmio.c ++++ b/drivers/spi/spi-dw-mmio.c +@@ -120,8 +120,8 @@ static int dw_spi_mmio_remove(struct platform_device *pdev) + { + struct dw_spi_mmio *dwsmmio = platform_get_drvdata(pdev); + +- clk_disable_unprepare(dwsmmio->clk); + dw_spi_remove_host(&dwsmmio->dws); ++ clk_disable_unprepare(dwsmmio->clk); + + return 0; + } +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index f5b5bec6f3c1..013b33760639 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -703,16 +703,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + size_t pgstart, pgend; + int ret = -EINVAL; + ++ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) ++ return -EFAULT; ++ + mutex_lock(&ashmem_mutex); + + if (unlikely(!asma->file)) + goto out_unlock; + +- if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { +- ret = -EFAULT; +- goto out_unlock; +- } +- + /* per custom, you can pass zero for len to mean "everything onward" */ + if (!pin.len) + pin.len = PAGE_ALIGN(asma->size) - pin.offset; +diff --git a/drivers/staging/unisys/visorhba/visorhba_main.c b/drivers/staging/unisys/visorhba/visorhba_main.c +index c119f20dfd44..3f2ccf9d7358 100644 +--- a/drivers/staging/unisys/visorhba/visorhba_main.c ++++ b/drivers/staging/unisys/visorhba/visorhba_main.c +@@ -792,7 +792,7 @@ static void + do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + { + struct scsi_device *scsidev; +- unsigned char buf[36]; ++ unsigned char *buf; + struct scatterlist *sg; + unsigned int i; + char *this_page; +@@ -807,6 +807,10 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + if (cmdrsp->scsi.no_disk_result == 0) + return; + ++ buf = kzalloc(sizeof(char) * 36, GFP_KERNEL); ++ if (!buf) ++ return; ++ + /* Linux scsi code wants a device at Lun 0 + * to issue report luns, but we don't want + * a disk there so we'll present a processor +@@ -820,6 +824,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + if (scsi_sg_count(scsicmd) == 0) { + memcpy(scsi_sglist(scsicmd), buf, + cmdrsp->scsi.bufflen); ++ kfree(buf); + return; + } + +@@ -831,6 +836,7 @@ do_scsi_nolinuxstat(struct uiscmdrsp *cmdrsp, struct scsi_cmnd *scsicmd) + memcpy(this_page, buf + bufind, sg[i].length); + kunmap_atomic(this_page_orig); + } ++ kfree(buf); + } else { + devdata = (struct visorhba_devdata *)scsidev->host->hostdata; + for_each_vdisk_match(vdisk, devdata, scsidev) { +diff --git a/drivers/staging/wilc1000/linux_mon.c b/drivers/staging/wilc1000/linux_mon.c +index 450af1b77f99..b2092c5ec7f3 100644 +--- a/drivers/staging/wilc1000/linux_mon.c ++++ b/drivers/staging/wilc1000/linux_mon.c +@@ -251,6 +251,8 @@ static netdev_tx_t WILC_WFI_mon_xmit(struct sk_buff *skb, + + if (skb->data[0] == 0xc0 && (!(memcmp(broadcast, &skb->data[4], 6)))) { + skb2 = dev_alloc_skb(skb->len + sizeof(struct wilc_wfi_radiotap_cb_hdr)); ++ if (!skb2) ++ return -ENOMEM; + + memcpy(skb_put(skb2, skb->len), skb->data, skb->len); + +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index 2e35db7f4aac..c15af2fcf2ba 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -276,12 +276,11 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + else + ret = vfs_iter_read(fd, &iter, &pos); + +- kfree(bvec); +- + if (is_write) { + if (ret < 0 || ret != data_length) { + pr_err("%s() write returned %d\n", __func__, ret); +- return (ret < 0 ? ret : -EINVAL); ++ if (ret >= 0) ++ ret = -EINVAL; + } + } else { + /* +@@ -294,17 +293,29 @@ static int fd_do_rw(struct se_cmd *cmd, struct file *fd, + pr_err("%s() returned %d, expecting %u for " + "S_ISBLK\n", __func__, ret, + data_length); +- return (ret < 0 ? ret : -EINVAL); ++ if (ret >= 0) ++ ret = -EINVAL; + } + } else { + if (ret < 0) { + pr_err("%s() returned %d for non S_ISBLK\n", + __func__, ret); +- return ret; ++ } else if (ret != data_length) { ++ /* ++ * Short read case: ++ * Probably some one truncate file under us. ++ * We must explicitly zero sg-pages to prevent ++ * expose uninizialized pages to userspace. ++ */ ++ if (ret < data_length) ++ ret += iov_iter_zero(data_length - ret, &iter); ++ else ++ ret = -EINVAL; + } + } + } +- return 1; ++ kfree(bvec); ++ return ret; + } + + static sense_reason_t +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 1bb629ab8ecc..a638c1738547 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1694,6 +1694,8 @@ static void release_tty(struct tty_struct *tty, int idx) + if (tty->link) + tty->link->port->itty = NULL; + tty_buffer_cancel_work(tty->port); ++ if (tty->link) ++ tty_buffer_cancel_work(tty->link->port); + + tty_kref_put(tty->link); + tty_kref_put(tty); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 517f565b65d7..598ec7545e84 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -409,7 +409,10 @@ static const char *vgacon_startup(void) + vga_video_port_val = VGA_CRT_DM; + if ((screen_info.orig_video_ega_bx & 0xff) != 0x10) { + static struct resource ega_console_resource = +- { .name = "ega", .start = 0x3B0, .end = 0x3BF }; ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_EGAM; + vga_vram_size = 0x8000; + display_desc = "EGA+"; +@@ -417,9 +420,15 @@ static const char *vgacon_startup(void) + &ega_console_resource); + } else { + static struct resource mda1_console_resource = +- { .name = "mda", .start = 0x3B0, .end = 0x3BB }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BB }; + static struct resource mda2_console_resource = +- { .name = "mda", .start = 0x3BF, .end = 0x3BF }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3BF, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_MDA; + vga_vram_size = 0x2000; + display_desc = "*MDA"; +@@ -441,15 +450,21 @@ static const char *vgacon_startup(void) + vga_vram_size = 0x8000; + + if (!screen_info.orig_video_isVGA) { +- static struct resource ega_console_resource +- = { .name = "ega", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource ega_console_resource = ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_EGAC; + display_desc = "EGA"; + request_resource(&ioport_resource, + &ega_console_resource); + } else { +- static struct resource vga_console_resource +- = { .name = "vga+", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource vga_console_resource = ++ { .name = "vga+", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_VGAC; + display_desc = "VGA+"; + request_resource(&ioport_resource, +@@ -493,7 +508,10 @@ static const char *vgacon_startup(void) + } + } else { + static struct resource cga_console_resource = +- { .name = "cga", .start = 0x3D4, .end = 0x3D5 }; ++ { .name = "cga", ++ .flags = IORESOURCE_IO, ++ .start = 0x3D4, ++ .end = 0x3D5 }; + vga_video_type = VIDEO_TYPE_CGA; + vga_vram_size = 0x2000; + display_desc = "*CGA"; +diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c +index d0a4e2f79a57..d215faacce04 100644 +--- a/drivers/video/fbdev/sm501fb.c ++++ b/drivers/video/fbdev/sm501fb.c +@@ -1600,6 +1600,7 @@ static int sm501fb_start(struct sm501fb_info *info, + info->fbmem = ioremap(res->start, resource_size(res)); + if (info->fbmem == NULL) { + dev_err(dev, "cannot remap framebuffer\n"); ++ ret = -ENXIO; + goto err_mem_res; + } + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index 53326badfb61..2add8def83be 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1487,15 +1487,25 @@ static struct device_attribute fb_device_attrs[] = { + static int dlfb_select_std_channel(struct dlfb_data *dev) + { + int ret; +- u8 set_def_chn[] = { 0x57, 0xCD, 0xDC, 0xA7, ++ void *buf; ++ static const u8 set_def_chn[] = { ++ 0x57, 0xCD, 0xDC, 0xA7, + 0x1C, 0x88, 0x5E, 0x15, + 0x60, 0xFE, 0xC6, 0x97, + 0x16, 0x3D, 0x47, 0xF2 }; + ++ buf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL); ++ ++ if (!buf) ++ return -ENOMEM; ++ + ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), + NR_USB_REQUEST_CHANNEL, + (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0, +- set_def_chn, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); ++ buf, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); ++ ++ kfree(buf); ++ + return ret; + } + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index c5bbb5300658..19b56873b797 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5008,13 +5008,19 @@ static int is_extent_unchanged(struct send_ctx *sctx, + while (key.offset < ekey->offset + left_len) { + ei = btrfs_item_ptr(eb, slot, struct btrfs_file_extent_item); + right_type = btrfs_file_extent_type(eb, ei); +- if (right_type != BTRFS_FILE_EXTENT_REG) { ++ if (right_type != BTRFS_FILE_EXTENT_REG && ++ right_type != BTRFS_FILE_EXTENT_INLINE) { + ret = 0; + goto out; + } + + right_disknr = btrfs_file_extent_disk_bytenr(eb, ei); +- right_len = btrfs_file_extent_num_bytes(eb, ei); ++ if (right_type == BTRFS_FILE_EXTENT_INLINE) { ++ right_len = btrfs_file_extent_inline_len(eb, slot, ei); ++ right_len = PAGE_ALIGN(right_len); ++ } else { ++ right_len = btrfs_file_extent_num_bytes(eb, ei); ++ } + right_offset = btrfs_file_extent_offset(eb, ei); + right_gen = btrfs_file_extent_generation(eb, ei); + +@@ -5028,6 +5034,19 @@ static int is_extent_unchanged(struct send_ctx *sctx, + goto out; + } + ++ /* ++ * We just wanted to see if when we have an inline extent, what ++ * follows it is a regular extent (wanted to check the above ++ * condition for inline extents too). This should normally not ++ * happen but it's possible for example when we have an inline ++ * compressed extent representing data with a size matching ++ * the page size (currently the same as sector size). ++ */ ++ if (right_type == BTRFS_FILE_EXTENT_INLINE) { ++ ret = 0; ++ goto out; ++ } ++ + left_offset_fixed = left_offset; + if (key.offset < ekey->offset) { + /* Fix the right offset for 2a and 7. */ +diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c +index abae6dd2c6b9..cc88f4f0325e 100644 +--- a/fs/cifs/netmisc.c ++++ b/fs/cifs/netmisc.c +@@ -980,10 +980,10 @@ struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time, int offset) + cifs_dbg(VFS, "illegal hours %d\n", st->Hours); + days = sd->Day; + month = sd->Month; +- if ((days > 31) || (month > 12)) { ++ if (days < 1 || days > 31 || month < 1 || month > 12) { + cifs_dbg(VFS, "illegal date, month %d day: %d\n", month, days); +- if (month > 12) +- month = 12; ++ days = clamp(days, 1, 31); ++ month = clamp(month, 1, 12); + } + month -= 1; + days += total_days_of_prev_months[month]; +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index e88ffe1da045..a035d1a95882 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -344,13 +344,12 @@ void build_ntlmssp_negotiate_blob(unsigned char *pbuffer, + /* BB is NTLMV2 session security format easier to use here? */ + flags = NTLMSSP_NEGOTIATE_56 | NTLMSSP_REQUEST_TARGET | + NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | +- NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; +- if (ses->server->sign) { ++ NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | ++ NTLMSSP_NEGOTIATE_SEAL; ++ if (ses->server->sign) + flags |= NTLMSSP_NEGOTIATE_SIGN; +- if (!ses->server->session_estab || +- ses->ntlmssp->sesskey_per_smbsess) +- flags |= NTLMSSP_NEGOTIATE_KEY_XCH; +- } ++ if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) ++ flags |= NTLMSSP_NEGOTIATE_KEY_XCH; + + sec_blob->NegotiateFlags = cpu_to_le32(flags); + +@@ -407,13 +406,12 @@ int build_ntlmssp_auth_blob(unsigned char **pbuffer, + flags = NTLMSSP_NEGOTIATE_56 | + NTLMSSP_REQUEST_TARGET | NTLMSSP_NEGOTIATE_TARGET_INFO | + NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE | +- NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC; +- if (ses->server->sign) { ++ NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC | ++ NTLMSSP_NEGOTIATE_SEAL; ++ if (ses->server->sign) + flags |= NTLMSSP_NEGOTIATE_SIGN; +- if (!ses->server->session_estab || +- ses->ntlmssp->sesskey_per_smbsess) +- flags |= NTLMSSP_NEGOTIATE_KEY_XCH; +- } ++ if (!ses->server->session_estab || ses->ntlmssp->sesskey_per_smbsess) ++ flags |= NTLMSSP_NEGOTIATE_KEY_XCH; + + tmp = *pbuffer + sizeof(AUTHENTICATE_MESSAGE); + sec_blob->NegotiateFlags = cpu_to_le32(flags); +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 84614a5edb87..33b1bc21a120 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -832,10 +832,8 @@ ssetup_exit: + + if (!rc) { + mutex_lock(&server->srv_mutex); +- if (server->sign && server->ops->generate_signingkey) { ++ if (server->ops->generate_signingkey) { + rc = server->ops->generate_signingkey(ses); +- kfree(ses->auth_key.response); +- ses->auth_key.response = NULL; + if (rc) { + cifs_dbg(FYI, + "SMB3 session key generation failed\n"); +@@ -857,10 +855,6 @@ ssetup_exit: + } + + keygen_exit: +- if (!server->sign) { +- kfree(ses->auth_key.response); +- ses->auth_key.response = NULL; +- } + if (spnego_key) { + key_invalidate(spnego_key); + key_put(spnego_key); +@@ -1558,6 +1552,9 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + } else + iov[0].iov_len = get_rfc1002_length(req) + 4; + ++ /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ ++ if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO) ++ req->hdr.Flags |= SMB2_FLAGS_SIGNED; + + rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buftype, 0); + rsp = (struct smb2_ioctl_rsp *)iov[0].iov_base; +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 8ebfdd00044b..4bdc2fc86280 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -1273,8 +1273,10 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index) + mirror = &desc->pg_mirrors[midx]; + if (!list_empty(&mirror->pg_list)) { + prev = nfs_list_entry(mirror->pg_list.prev); +- if (index != prev->wb_index + 1) +- nfs_pageio_complete_mirror(desc, midx); ++ if (index != prev->wb_index + 1) { ++ nfs_pageio_complete(desc); ++ break; ++ } + } + } + } +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 209dbfc50cd4..bfbee8ddf978 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1245,14 +1245,14 @@ nfsd4_layoutget(struct svc_rqst *rqstp, + const struct nfsd4_layout_ops *ops; + struct nfs4_layout_stateid *ls; + __be32 nfserr; +- int accmode; ++ int accmode = NFSD_MAY_READ_IF_EXEC; + + switch (lgp->lg_seg.iomode) { + case IOMODE_READ: +- accmode = NFSD_MAY_READ; ++ accmode |= NFSD_MAY_READ; + break; + case IOMODE_RW: +- accmode = NFSD_MAY_READ | NFSD_MAY_WRITE; ++ accmode |= NFSD_MAY_READ | NFSD_MAY_WRITE; + break; + default: + dprintk("%s: invalid iomode %d\n", +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 91e0c5429b4d..17138a97f306 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -92,6 +92,12 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp, + err = follow_down(&path); + if (err < 0) + goto out; ++ if (path.mnt == exp->ex_path.mnt && path.dentry == dentry && ++ nfsd_mountpoint(dentry, exp) == 2) { ++ /* This is only a mountpoint in some other namespace */ ++ path_put(&path); ++ goto out; ++ } + + exp2 = rqst_exp_get_by_name(rqstp, &path); + if (IS_ERR(exp2)) { +@@ -165,16 +171,26 @@ static int nfsd_lookup_parent(struct svc_rqst *rqstp, struct dentry *dparent, st + /* + * For nfsd purposes, we treat V4ROOT exports as though there was an + * export at *every* directory. ++ * We return: ++ * '1' if this dentry *must* be an export point, ++ * '2' if it might be, if there is really a mount here, and ++ * '0' if there is no chance of an export point here. + */ + int nfsd_mountpoint(struct dentry *dentry, struct svc_export *exp) + { +- if (d_mountpoint(dentry)) ++ if (!d_inode(dentry)) ++ return 0; ++ if (exp->ex_flags & NFSEXP_V4ROOT) + return 1; + if (nfsd4_is_junction(dentry)) + return 1; +- if (!(exp->ex_flags & NFSEXP_V4ROOT)) +- return 0; +- return d_inode(dentry) != NULL; ++ if (d_mountpoint(dentry)) ++ /* ++ * Might only be a mountpoint in a different namespace, ++ * but we need to check. ++ */ ++ return 2; ++ return 0; + } + + __be32 +diff --git a/include/linux/posix-clock.h b/include/linux/posix-clock.h +index 34c4498b800f..83b22ae9ae12 100644 +--- a/include/linux/posix-clock.h ++++ b/include/linux/posix-clock.h +@@ -59,23 +59,23 @@ struct posix_clock_operations { + + int (*clock_adjtime)(struct posix_clock *pc, struct timex *tx); + +- int (*clock_gettime)(struct posix_clock *pc, struct timespec *ts); ++ int (*clock_gettime)(struct posix_clock *pc, struct timespec64 *ts); + +- int (*clock_getres) (struct posix_clock *pc, struct timespec *ts); ++ int (*clock_getres) (struct posix_clock *pc, struct timespec64 *ts); + + int (*clock_settime)(struct posix_clock *pc, +- const struct timespec *ts); ++ const struct timespec64 *ts); + + int (*timer_create) (struct posix_clock *pc, struct k_itimer *kit); + + int (*timer_delete) (struct posix_clock *pc, struct k_itimer *kit); + + void (*timer_gettime)(struct posix_clock *pc, +- struct k_itimer *kit, struct itimerspec *tsp); ++ struct k_itimer *kit, struct itimerspec64 *tsp); + + int (*timer_settime)(struct posix_clock *pc, + struct k_itimer *kit, int flags, +- struct itimerspec *tsp, struct itimerspec *old); ++ struct itimerspec64 *tsp, struct itimerspec64 *old); + /* + * Optional character device methods: + */ +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index a079ed14f230..4889a8ab77ce 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1189,8 +1189,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) + * set the trigger type must match. Also all must + * agree on ONESHOT. + */ ++ unsigned int oldtype = irqd_get_trigger_type(&desc->irq_data); ++ + if (!((old->flags & new->flags) & IRQF_SHARED) || +- ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK) || ++ (oldtype != (new->flags & IRQF_TRIGGER_MASK)) || + ((old->flags ^ new->flags) & IRQF_ONESHOT)) + goto mismatch; + +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index 9cff0ab82b63..e24008c098c6 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -300,14 +300,17 @@ out: + static int pc_clock_gettime(clockid_t id, struct timespec *ts) + { + struct posix_clock_desc cd; ++ struct timespec64 ts64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.clock_gettime) +- err = cd.clk->ops.clock_gettime(cd.clk, ts); ++ if (cd.clk->ops.clock_gettime) { ++ err = cd.clk->ops.clock_gettime(cd.clk, &ts64); ++ *ts = timespec64_to_timespec(ts64); ++ } + else + err = -EOPNOTSUPP; + +@@ -319,14 +322,17 @@ static int pc_clock_gettime(clockid_t id, struct timespec *ts) + static int pc_clock_getres(clockid_t id, struct timespec *ts) + { + struct posix_clock_desc cd; ++ struct timespec64 ts64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.clock_getres) +- err = cd.clk->ops.clock_getres(cd.clk, ts); ++ if (cd.clk->ops.clock_getres) { ++ err = cd.clk->ops.clock_getres(cd.clk, &ts64); ++ *ts = timespec64_to_timespec(ts64); ++ } + else + err = -EOPNOTSUPP; + +@@ -337,6 +343,7 @@ static int pc_clock_getres(clockid_t id, struct timespec *ts) + + static int pc_clock_settime(clockid_t id, const struct timespec *ts) + { ++ struct timespec64 ts64 = timespec_to_timespec64(*ts); + struct posix_clock_desc cd; + int err; + +@@ -350,7 +357,7 @@ static int pc_clock_settime(clockid_t id, const struct timespec *ts) + } + + if (cd.clk->ops.clock_settime) +- err = cd.clk->ops.clock_settime(cd.clk, ts); ++ err = cd.clk->ops.clock_settime(cd.clk, &ts64); + else + err = -EOPNOTSUPP; + out: +@@ -403,29 +410,36 @@ static void pc_timer_gettime(struct k_itimer *kit, struct itimerspec *ts) + { + clockid_t id = kit->it_clock; + struct posix_clock_desc cd; ++ struct itimerspec64 ts64; + + if (get_clock_desc(id, &cd)) + return; + +- if (cd.clk->ops.timer_gettime) +- cd.clk->ops.timer_gettime(cd.clk, kit, ts); +- ++ if (cd.clk->ops.timer_gettime) { ++ cd.clk->ops.timer_gettime(cd.clk, kit, &ts64); ++ *ts = itimerspec64_to_itimerspec(&ts64); ++ } + put_clock_desc(&cd); + } + + static int pc_timer_settime(struct k_itimer *kit, int flags, + struct itimerspec *ts, struct itimerspec *old) + { ++ struct itimerspec64 ts64 = itimerspec_to_itimerspec64(ts); + clockid_t id = kit->it_clock; + struct posix_clock_desc cd; ++ struct itimerspec64 old64; + int err; + + err = get_clock_desc(id, &cd); + if (err) + return err; + +- if (cd.clk->ops.timer_settime) +- err = cd.clk->ops.timer_settime(cd.clk, kit, flags, ts, old); ++ if (cd.clk->ops.timer_settime) { ++ err = cd.clk->ops.timer_settime(cd.clk, kit, flags, &ts64, &old64); ++ if (old) ++ *old = itimerspec64_to_itimerspec(&old64); ++ } + else + err = -EOPNOTSUPP; + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 71290fb7d500..75433ed6714b 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5464,10 +5464,6 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb) + else + tp->pred_flags = 0; + +- if (!sock_flag(sk, SOCK_DEAD)) { +- sk->sk_state_change(sk); +- sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT); +- } + } + + static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack, +@@ -5531,6 +5527,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_fastopen_cookie foc = { .len = -1 }; + int saved_clamp = tp->rx_opt.mss_clamp; ++ bool fastopen_fail; + + tcp_parse_options(skb, &tp->rx_opt, 0, &foc); + if (tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr) +@@ -5633,10 +5630,15 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + + tcp_finish_connect(sk, skb); + +- if ((tp->syn_fastopen || tp->syn_data) && +- tcp_rcv_fastopen_synack(sk, skb, &foc)) +- return -1; ++ fastopen_fail = (tp->syn_fastopen || tp->syn_data) && ++ tcp_rcv_fastopen_synack(sk, skb, &foc); + ++ if (!sock_flag(sk, SOCK_DEAD)) { ++ sk->sk_state_change(sk); ++ sk_wake_async(sk, SOCK_WAKE_IO, POLL_OUT); ++ } ++ if (fastopen_fail) ++ return -1; + if (sk->sk_write_pending || + icsk->icsk_accept_queue.rskq_defer_accept || + icsk->icsk_ack.pingpong) { +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index d7105422bc63..e4b0fb2f06a3 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -614,6 +614,7 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; ++ struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -626,6 +627,25 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; ++ ++ if (p->flags & IP6_TNL_F_CAP_XMIT) { ++ int strict = (ipv6_addr_type(&p->raddr) & ++ (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); ++ struct rt6_info *rt = rt6_lookup(t->net, ++ &p->raddr, &p->laddr, ++ p->link, strict); ++ ++ if (rt) ++ tdev = rt->dst.dev; ++ ip6_rt_put(rt); ++ } ++ ++ if (!tdev && p->link) ++ tdev = __dev_get_by_index(t->net, p->link); ++ ++ if (tdev) ++ dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, ++ IPV6_MIN_MTU); + } + + /** +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 84afb9a77278..55810e4899f1 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1686,6 +1686,8 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, + case NETDEV_CHANGEADDR: + neigh_changeaddr(&nd_tbl, dev); + fib6_run_gc(0, net, false); ++ /* fallthrough */ ++ case NETDEV_UP: + idev = in6_dev_get(dev); + if (!idev) + break; +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index 5bad05e9af90..45fb1abdb265 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -194,6 +194,7 @@ static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb) + } + + if (ieee80211_is_action(mgmt->frame_control) && ++ !ieee80211_has_protected(mgmt->frame_control) && + mgmt->u.action.category == WLAN_CATEGORY_HT && + mgmt->u.action.u.ht_smps.action == WLAN_HT_ACTION_SMPS && + ieee80211_sdata_running(sdata)) { +diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c +index e7ac07e53b59..febcfac7e3df 100644 +--- a/net/netfilter/xt_CT.c ++++ b/net/netfilter/xt_CT.c +@@ -168,8 +168,10 @@ xt_ct_set_timeout(struct nf_conn *ct, const struct xt_tgchk_param *par, + goto err_put_timeout; + } + timeout_ext = nf_ct_timeout_ext_add(ct, timeout, GFP_ATOMIC); +- if (timeout_ext == NULL) ++ if (!timeout_ext) { + ret = -ENOMEM; ++ goto err_put_timeout; ++ } + + rcu_read_unlock(); + return ret; +@@ -201,6 +203,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, + struct xt_ct_target_info_v1 *info) + { + struct nf_conntrack_zone zone; ++ struct nf_conn_help *help; + struct nf_conn *ct; + int ret = -EOPNOTSUPP; + +@@ -249,7 +252,7 @@ static int xt_ct_tg_check(const struct xt_tgchk_param *par, + if (info->timeout[0]) { + ret = xt_ct_set_timeout(ct, par, info->timeout); + if (ret < 0) +- goto err3; ++ goto err4; + } + __set_bit(IPS_CONFIRMED_BIT, &ct->status); + nf_conntrack_get(&ct->ct_general); +@@ -257,6 +260,10 @@ out: + info->ct = ct; + return 0; + ++err4: ++ help = nfct_help(ct); ++ if (help) ++ module_put(help->helper->me); + err3: + nf_ct_tmpl_free(ct); + err2: +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 6a2507f24b0f..1829adb23505 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -361,10 +361,38 @@ ovs_ct_expect_find(struct net *net, const struct nf_conntrack_zone *zone, + u16 proto, const struct sk_buff *skb) + { + struct nf_conntrack_tuple tuple; ++ struct nf_conntrack_expect *exp; + + if (!nf_ct_get_tuplepr(skb, skb_network_offset(skb), proto, net, &tuple)) + return NULL; +- return __nf_ct_expect_find(net, zone, &tuple); ++ ++ exp = __nf_ct_expect_find(net, zone, &tuple); ++ if (exp) { ++ struct nf_conntrack_tuple_hash *h; ++ ++ /* Delete existing conntrack entry, if it clashes with the ++ * expectation. This can happen since conntrack ALGs do not ++ * check for clashes between (new) expectations and existing ++ * conntrack entries. nf_conntrack_in() will check the ++ * expectations only if a conntrack entry can not be found, ++ * which can lead to OVS finding the expectation (here) in the ++ * init direction, but which will not be removed by the ++ * nf_conntrack_in() call, if a matching conntrack entry is ++ * found instead. In this case all init direction packets ++ * would be reported as new related packets, while reply ++ * direction packets would be reported as un-related ++ * established packets. ++ */ ++ h = nf_conntrack_find_get(net, zone, &tuple); ++ if (h) { ++ struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); ++ ++ nf_ct_delete(ct, 0, 0); ++ nf_conntrack_put(&ct->ct_general); ++ } ++ } ++ ++ return exp; + } + + /* Determine whether skb->nfct is equal to the result of conntrack lookup. */ +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 11305a4baf7b..8e33360ae2e5 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6717,6 +6717,7 @@ enum { + ALC668_FIXUP_DELL_DISABLE_AAMIX, + ALC668_FIXUP_DELL_XPS13, + ALC662_FIXUP_ASUS_Nx50, ++ ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE, + ALC668_FIXUP_ASUS_Nx51, + }; + +@@ -6964,14 +6965,21 @@ static const struct hda_fixup alc662_fixups[] = { + .chained = true, + .chain_id = ALC662_FIXUP_BASS_1A + }, ++ [ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc_fixup_headset_mode_alc668, ++ .chain_id = ALC662_FIXUP_BASS_CHMAP ++ }, + [ALC668_FIXUP_ASUS_Nx51] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +- {0x1a, 0x90170151}, /* bass speaker */ ++ { 0x19, 0x03a1913d }, /* use as headphone mic, without its own jack detect */ ++ { 0x1a, 0x90170151 }, /* bass speaker */ ++ { 0x1b, 0x03a1113c }, /* use as headset mic, without its own jack detect */ + {} + }, + .chained = true, +- .chain_id = ALC662_FIXUP_BASS_CHMAP, ++ .chain_id = ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE, + }, + }; + +diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c +index b4844f78266f..f6c3be192cc9 100644 +--- a/sound/soc/intel/skylake/skl.c ++++ b/sound/soc/intel/skylake/skl.c +@@ -280,7 +280,7 @@ static int probe_codec(struct hdac_ext_bus *ebus, int addr) + struct hdac_bus *bus = ebus_to_hbus(ebus); + unsigned int cmd = (addr << 28) | (AC_NODE_ROOT << 20) | + (AC_VERB_PARAMETERS << 8) | AC_PAR_VENDOR_ID; +- unsigned int res; ++ unsigned int res = -1; + + mutex_lock(&bus->cmd_mutex); + snd_hdac_bus_send_cmd(bus, cmd); +diff --git a/tools/perf/tests/kmod-path.c b/tools/perf/tests/kmod-path.c +index 08c433b4bf4f..25e80c02230b 100644 +--- a/tools/perf/tests/kmod-path.c ++++ b/tools/perf/tests/kmod-path.c +@@ -60,6 +60,7 @@ int test__kmod_path__parse(void) + M("/xxxx/xxxx/x-x.ko", PERF_RECORD_MISC_KERNEL, true); + M("/xxxx/xxxx/x-x.ko", PERF_RECORD_MISC_USER, false); + ++#ifdef HAVE_ZLIB_SUPPORT + /* path alloc_name alloc_ext kmod comp name ext */ + T("/xxxx/xxxx/x.ko.gz", true , true , true, true, "[x]", "gz"); + T("/xxxx/xxxx/x.ko.gz", false , true , true, true, NULL , "gz"); +@@ -95,6 +96,7 @@ int test__kmod_path__parse(void) + M("x.ko.gz", PERF_RECORD_MISC_CPUMODE_UNKNOWN, true); + M("x.ko.gz", PERF_RECORD_MISC_KERNEL, true); + M("x.ko.gz", PERF_RECORD_MISC_USER, false); ++#endif + + /* path alloc_name alloc_ext kmod comp name ext */ + T("[test_module]", true , true , true, false, "[test_module]", NULL);