From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.9 commit in: /
Date: Fri, 13 Apr 2018 22:21:39 +0000 (UTC) [thread overview]
Message-ID: <1523658091.023e91a8d84de0d3220fe6a0b5663abbf278dac8.mpagano@gentoo> (raw)
commit: 023e91a8d84de0d3220fe6a0b5663abbf278dac8
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Apr 13 22:21:31 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Apr 13 22:21:31 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=023e91a8
Linux patch 4.9.94
0000_README | 4 +
1093_linux-4.9.94.patch | 9365 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 9369 insertions(+)
diff --git a/0000_README b/0000_README
index 3036eb1..cfa6743 100644
--- a/0000_README
+++ b/0000_README
@@ -415,6 +415,10 @@ Patch: 1092_linux-4.9.93.patch
From: http://www.kernel.org
Desc: Linux 4.9.93
+Patch: 1093_linux-4.9.94.patch
+From: http://www.kernel.org
+Desc: Linux 4.9.94
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1093_linux-4.9.94.patch b/1093_linux-4.9.94.patch
new file mode 100644
index 0000000..adc2fe3
--- /dev/null
+++ b/1093_linux-4.9.94.patch
@@ -0,0 +1,9365 @@
+diff --git a/Documentation/devicetree/bindings/clock/amlogic,meson8b-clkc.txt b/Documentation/devicetree/bindings/clock/amlogic,meson8b-clkc.txt
+index 2b7b3fa588d7..606da38c0959 100644
+--- a/Documentation/devicetree/bindings/clock/amlogic,meson8b-clkc.txt
++++ b/Documentation/devicetree/bindings/clock/amlogic,meson8b-clkc.txt
+@@ -1,11 +1,14 @@
+-* Amlogic Meson8b Clock and Reset Unit
++* Amlogic Meson8, Meson8b and Meson8m2 Clock and Reset Unit
+
+-The Amlogic Meson8b clock controller generates and supplies clock to various
+-controllers within the SoC.
++The Amlogic Meson8 / Meson8b / Meson8m2 clock controller generates and
++supplies clock to various controllers within the SoC.
+
+ Required Properties:
+
+-- compatible: should be "amlogic,meson8b-clkc"
++- compatible: must be one of:
++ - "amlogic,meson8-clkc" for Meson8 (S802) SoCs
++ - "amlogic,meson8b-clkc" for Meson8 (S805) SoCs
++ - "amlogic,meson8m2-clkc" for Meson8m2 (S812) SoCs
+ - reg: it must be composed by two tuples:
+ 0) physical base address of the xtal register and length of memory
+ mapped region.
+diff --git a/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt b/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt
+index 4f7ae7555758..bda9d6fab6b4 100644
+--- a/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt
++++ b/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt
+@@ -47,10 +47,13 @@ Required properties:
+ Documentation/devicetree/bindings/media/video-interfaces.txt. The
+ first port should be the input endpoint, the second one the output
+
+- The output should have two endpoints. The first is the block
+- connected to the TCON channel 0 (usually a panel or a bridge), the
+- second the block connected to the TCON channel 1 (usually the TV
+- encoder)
++ The output may have multiple endpoints. The TCON has two channels,
++ usually with the first channel being used for the panels interfaces
++ (RGB, LVDS, etc.), and the second being used for the outputs that
++ require another controller (TV Encoder, HDMI, etc.). The endpoints
++ will take an extra property, allwinner,tcon-channel, to specify the
++ channel the endpoint is associated to. If that property is not
++ present, the endpoint number will be used as the channel number.
+
+ On SoCs other than the A33, there is one more clock required:
+ - 'tcon-ch1': The clock driving the TCON channel 1
+diff --git a/Makefile b/Makefile
+index f5cf4159fc20..02188cf8e9af 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 93
++SUBLEVEL = 94
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+
+diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts
+index 96d7eede412e..036c9bd9bf75 100644
+--- a/arch/arm/boot/dts/imx53-qsrb.dts
++++ b/arch/arm/boot/dts/imx53-qsrb.dts
+@@ -23,7 +23,7 @@
+ imx53-qsrb {
+ pinctrl_pmic: pmicgrp {
+ fsl,pins = <
+- MX53_PAD_CSI0_DAT5__GPIO5_23 0x1e4 /* IRQ */
++ MX53_PAD_CSI0_DAT5__GPIO5_23 0x1c4 /* IRQ */
+ >;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+index 2b9c2be436f9..47c955458a77 100644
+--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
+@@ -88,6 +88,7 @@
+ clocks = <&clks IMX6QDL_CLK_CKO>;
+ VDDA-supply = <®_2p5v>;
+ VDDIO-supply = <®_3p3v>;
++ lrclk-strength = <3>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 368e21934285..825f6eae3d1c 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -146,7 +146,7 @@
+ };
+
+ esdhc: esdhc@1560000 {
+- compatible = "fsl,esdhc";
++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc";
+ reg = <0x0 0x1560000 0x0 0x10000>;
+ interrupts = <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
+ clock-frequency = <0>;
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index b7a24af8f47b..4b7d97275c62 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -154,10 +154,10 @@
+
+ i2c_0: i2c@78b7000 {
+ compatible = "qcom,i2c-qup-v2.2.1";
+- reg = <0x78b7000 0x6000>;
++ reg = <0x78b7000 0x600>;
+ interrupts = <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&gcc GCC_BLSP1_AHB_CLK>,
+- <&gcc GCC_BLSP1_QUP2_I2C_APPS_CLK>;
++ <&gcc GCC_BLSP1_QUP1_I2C_APPS_CLK>;
+ clock-names = "iface", "core";
+ #address-cells = <1>;
+ #size-cells = <0>;
+diff --git a/arch/arm/boot/dts/r8a7740-armadillo800eva.dts b/arch/arm/boot/dts/r8a7740-armadillo800eva.dts
+index 7885075428bb..1788e186a512 100644
+--- a/arch/arm/boot/dts/r8a7740-armadillo800eva.dts
++++ b/arch/arm/boot/dts/r8a7740-armadillo800eva.dts
+@@ -266,7 +266,9 @@
+ lcd0_pins: lcd0 {
+ groups = "lcd0_data24_0", "lcd0_lclk_1", "lcd0_sync";
+ function = "lcd0";
++ };
+
++ lcd0_mux {
+ /* DBGMD/LCDC0/FSIA MUX */
+ gpio-hog;
+ gpios = <176 0>;
+diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi
+index 9e6bf0e311bb..2679dc80f831 100644
+--- a/arch/arm/boot/dts/rk322x.dtsi
++++ b/arch/arm/boot/dts/rk322x.dtsi
+@@ -617,9 +617,9 @@
+ <0 12 RK_FUNC_1 &pcfg_pull_none>,
+ <0 13 RK_FUNC_1 &pcfg_pull_none>,
+ <0 14 RK_FUNC_1 &pcfg_pull_none>,
+- <1 2 RK_FUNC_1 &pcfg_pull_none>,
+- <1 4 RK_FUNC_1 &pcfg_pull_none>,
+- <1 5 RK_FUNC_1 &pcfg_pull_none>;
++ <1 2 RK_FUNC_2 &pcfg_pull_none>,
++ <1 4 RK_FUNC_2 &pcfg_pull_none>,
++ <1 5 RK_FUNC_2 &pcfg_pull_none>;
+ };
+ };
+
+diff --git a/arch/arm/include/asm/xen/events.h b/arch/arm/include/asm/xen/events.h
+index 71e473d05fcc..620dc75362e5 100644
+--- a/arch/arm/include/asm/xen/events.h
++++ b/arch/arm/include/asm/xen/events.h
+@@ -16,7 +16,7 @@ static inline int xen_irqs_disabled(struct pt_regs *regs)
+ return raw_irqs_disabled_flags(regs->ARM_cpsr);
+ }
+
+-#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((ptr), \
++#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((long long*)(ptr),\
+ atomic64_t, \
+ counter), (val))
+
+diff --git a/arch/arm/kvm/hyp/switch.c b/arch/arm/kvm/hyp/switch.c
+index 624a510d31df..ebd2dd46adf7 100644
+--- a/arch/arm/kvm/hyp/switch.c
++++ b/arch/arm/kvm/hyp/switch.c
+@@ -237,8 +237,10 @@ void __hyp_text __noreturn __hyp_panic(int cause)
+
+ vcpu = (struct kvm_vcpu *)read_sysreg(HTPIDR);
+ host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context);
++ __timer_save_state(vcpu);
+ __deactivate_traps(vcpu);
+ __deactivate_vm(vcpu);
++ __banked_restore_state(host_ctxt);
+ __sysreg_restore_state(host_ctxt);
+ }
+
+diff --git a/arch/arm/mach-davinci/devices-da8xx.c b/arch/arm/mach-davinci/devices-da8xx.c
+index add3771d38f6..9a22d40602aa 100644
+--- a/arch/arm/mach-davinci/devices-da8xx.c
++++ b/arch/arm/mach-davinci/devices-da8xx.c
+@@ -821,6 +821,8 @@ static struct platform_device da8xx_dsp = {
+ .resource = da8xx_rproc_resources,
+ };
+
++static bool rproc_mem_inited __initdata;
++
+ #if IS_ENABLED(CONFIG_DA8XX_REMOTEPROC)
+
+ static phys_addr_t rproc_base __initdata;
+@@ -859,6 +861,8 @@ void __init da8xx_rproc_reserve_cma(void)
+ ret = dma_declare_contiguous(&da8xx_dsp.dev, rproc_size, rproc_base, 0);
+ if (ret)
+ pr_err("%s: dma_declare_contiguous failed %d\n", __func__, ret);
++ else
++ rproc_mem_inited = true;
+ }
+
+ #else
+@@ -873,6 +877,12 @@ int __init da8xx_register_rproc(void)
+ {
+ int ret;
+
++ if (!rproc_mem_inited) {
++ pr_warn("%s: memory not reserved for DSP, not registering DSP device\n",
++ __func__);
++ return -ENOMEM;
++ }
++
+ ret = platform_device_register(&da8xx_dsp);
+ if (ret)
+ pr_err("%s: can't register DSP device: %d\n", __func__, ret);
+diff --git a/arch/arm/mach-imx/cpu.c b/arch/arm/mach-imx/cpu.c
+index b3347d32349f..94906ed49392 100644
+--- a/arch/arm/mach-imx/cpu.c
++++ b/arch/arm/mach-imx/cpu.c
+@@ -131,6 +131,9 @@ struct device * __init imx_soc_device_init(void)
+ case MXC_CPU_IMX6UL:
+ soc_id = "i.MX6UL";
+ break;
++ case MXC_CPU_IMX6ULL:
++ soc_id = "i.MX6ULL";
++ break;
+ case MXC_CPU_IMX7D:
+ soc_id = "i.MX7D";
+ break;
+diff --git a/arch/arm/mach-imx/mxc.h b/arch/arm/mach-imx/mxc.h
+index 34f2ff62583c..e00d6260c3df 100644
+--- a/arch/arm/mach-imx/mxc.h
++++ b/arch/arm/mach-imx/mxc.h
+@@ -39,6 +39,7 @@
+ #define MXC_CPU_IMX6SX 0x62
+ #define MXC_CPU_IMX6Q 0x63
+ #define MXC_CPU_IMX6UL 0x64
++#define MXC_CPU_IMX6ULL 0x65
+ #define MXC_CPU_IMX7D 0x72
+
+ #define IMX_DDR_TYPE_LPDDR2 1
+@@ -73,6 +74,11 @@ static inline bool cpu_is_imx6ul(void)
+ return __mxc_cpu_type == MXC_CPU_IMX6UL;
+ }
+
++static inline bool cpu_is_imx6ull(void)
++{
++ return __mxc_cpu_type == MXC_CPU_IMX6ULL;
++}
++
+ static inline bool cpu_is_imx6q(void)
+ {
+ return __mxc_cpu_type == MXC_CPU_IMX6Q;
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index f2585cdd32c2..20dcb196b240 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -51,16 +51,16 @@
+ : "memory")
+
+ static inline int
+-futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
++futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
+ {
+ int op = (encoded_op >> 28) & 7;
+ int cmp = (encoded_op >> 24) & 15;
+- int oparg = (encoded_op << 8) >> 20;
+- int cmparg = (encoded_op << 20) >> 20;
++ int oparg = (int)(encoded_op << 8) >> 20;
++ int cmparg = (int)(encoded_op << 20) >> 20;
+ int oldval = 0, ret, tmp;
+
+ if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
+- oparg = 1 << oparg;
++ oparg = 1U << (oparg & 0x1f);
+
+ if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
+ return -EFAULT;
+diff --git a/arch/arm64/kernel/pci.c b/arch/arm64/kernel/pci.c
+index 409abc45bdb6..1b3eb67edefb 100644
+--- a/arch/arm64/kernel/pci.c
++++ b/arch/arm64/kernel/pci.c
+@@ -175,8 +175,10 @@ struct pci_bus *pci_acpi_scan_root(struct acpi_pci_root *root)
+ return NULL;
+
+ root_ops = kzalloc_node(sizeof(*root_ops), GFP_KERNEL, node);
+- if (!root_ops)
++ if (!root_ops) {
++ kfree(ri);
+ return NULL;
++ }
+
+ ri->cfg = pci_acpi_setup_ecam_mapping(root);
+ if (!ri->cfg) {
+diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
+index 57ae9d9ed9bb..199a23f058d5 100644
+--- a/arch/arm64/kernel/perf_event.c
++++ b/arch/arm64/kernel/perf_event.c
+@@ -871,15 +871,24 @@ static int armv8pmu_set_event_filter(struct hw_perf_event *event,
+
+ if (attr->exclude_idle)
+ return -EPERM;
+- if (is_kernel_in_hyp_mode() &&
+- attr->exclude_kernel != attr->exclude_hv)
+- return -EINVAL;
++
++ /*
++ * If we're running in hyp mode, then we *are* the hypervisor.
++ * Therefore we ignore exclude_hv in this configuration, since
++ * there's no hypervisor to sample anyway. This is consistent
++ * with other architectures (x86 and Power).
++ */
++ if (is_kernel_in_hyp_mode()) {
++ if (!attr->exclude_kernel)
++ config_base |= ARMV8_PMU_INCLUDE_EL2;
++ } else {
++ if (attr->exclude_kernel)
++ config_base |= ARMV8_PMU_EXCLUDE_EL1;
++ if (!attr->exclude_hv)
++ config_base |= ARMV8_PMU_INCLUDE_EL2;
++ }
+ if (attr->exclude_user)
+ config_base |= ARMV8_PMU_EXCLUDE_EL0;
+- if (!is_kernel_in_hyp_mode() && attr->exclude_kernel)
+- config_base |= ARMV8_PMU_EXCLUDE_EL1;
+- if (!attr->exclude_hv)
+- config_base |= ARMV8_PMU_INCLUDE_EL2;
+
+ /*
+ * Install the filter into config_base as this is used to
+diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
+index 0c848c18ca44..9174ba917d65 100644
+--- a/arch/arm64/kvm/hyp/switch.c
++++ b/arch/arm64/kvm/hyp/switch.c
+@@ -404,6 +404,7 @@ void __hyp_text __noreturn __hyp_panic(void)
+
+ vcpu = (struct kvm_vcpu *)read_sysreg(tpidr_el2);
+ host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context);
++ __timer_save_state(vcpu);
+ __deactivate_traps(vcpu);
+ __deactivate_vm(vcpu);
+ __sysreg_restore_host_state(host_ctxt);
+diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
+index 01c171723bb3..caf75abf6ae7 100644
+--- a/arch/arm64/mm/mmap.c
++++ b/arch/arm64/mm/mmap.c
+@@ -18,6 +18,7 @@
+
+ #include <linux/elf.h>
+ #include <linux/fs.h>
++#include <linux/memblock.h>
+ #include <linux/mm.h>
+ #include <linux/mman.h>
+ #include <linux/export.h>
+@@ -102,12 +103,18 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+ */
+ int valid_phys_addr_range(phys_addr_t addr, size_t size)
+ {
+- if (addr < PHYS_OFFSET)
+- return 0;
+- if (addr + size > __pa(high_memory - 1) + 1)
+- return 0;
+-
+- return 1;
++ /*
++ * Check whether addr is covered by a memory region without the
++ * MEMBLOCK_NOMAP attribute, and whether that region covers the
++ * entire range. In theory, this could lead to false negatives
++ * if the range is covered by distinct but adjacent memory regions
++ * that only differ in other attributes. However, few of such
++ * attributes have been defined, and it is debatable whether it
++ * follows that /dev/mem read() calls should be able traverse
++ * such boundaries.
++ */
++ return memblock_is_region_memory(addr, size) &&
++ memblock_is_map_memory(addr);
+ }
+
+ /*
+diff --git a/arch/mips/include/asm/kprobes.h b/arch/mips/include/asm/kprobes.h
+index daba1f9a4f79..174aedce3167 100644
+--- a/arch/mips/include/asm/kprobes.h
++++ b/arch/mips/include/asm/kprobes.h
+@@ -40,7 +40,8 @@ typedef union mips_instruction kprobe_opcode_t;
+
+ #define flush_insn_slot(p) \
+ do { \
+- flush_icache_range((unsigned long)p->addr, \
++ if (p->addr) \
++ flush_icache_range((unsigned long)p->addr, \
+ (unsigned long)p->addr + \
+ (MAX_INSN_SIZE * sizeof(kprobe_opcode_t))); \
+ } while (0)
+diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
+index d21f3da7bdb6..c0be540e83cb 100644
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,6 +18,10 @@
+
+ #include <asm-generic/pgtable-nopmd.h>
+
++#ifdef CONFIG_HIGHMEM
++#include <asm/highmem.h>
++#endif
++
+ extern int temp_tlb_entry;
+
+ /*
+@@ -61,7 +65,8 @@ extern int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
+
+ #define VMALLOC_START MAP_BASE
+
+-#define PKMAP_BASE (0xfe000000UL)
++#define PKMAP_END ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1))
++#define PKMAP_BASE (PKMAP_END - PAGE_SIZE * LAST_PKMAP)
+
+ #ifdef CONFIG_HIGHMEM
+ # define VMALLOC_END (PKMAP_BASE-2*PAGE_SIZE)
+diff --git a/arch/mips/mm/pgtable-32.c b/arch/mips/mm/pgtable-32.c
+index adc6911ba748..b19a3c506b1e 100644
+--- a/arch/mips/mm/pgtable-32.c
++++ b/arch/mips/mm/pgtable-32.c
+@@ -51,15 +51,15 @@ void __init pagetable_init(void)
+ /*
+ * Fixed mappings:
+ */
+- vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
+- fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base);
++ vaddr = __fix_to_virt(__end_of_fixed_addresses - 1);
++ fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base);
+
+ #ifdef CONFIG_HIGHMEM
+ /*
+ * Permanent kmaps:
+ */
+ vaddr = PKMAP_BASE;
+- fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
++ fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base);
+
+ pgd = swapper_pg_dir + __pgd_offset(vaddr);
+ pud = pud_offset(pgd, vaddr);
+diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
+index cd4ffd86765f..bb9073a2b2ae 100644
+--- a/arch/powerpc/include/asm/module.h
++++ b/arch/powerpc/include/asm/module.h
+@@ -14,6 +14,10 @@
+ #include <asm-generic/module.h>
+
+
++#ifdef CC_USING_MPROFILE_KERNEL
++#define MODULE_ARCH_VERMAGIC "mprofile-kernel"
++#endif
++
+ #ifndef __powerpc64__
+ /*
+ * Thanks to Paul M for explaining this.
+diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
+index 56398e7e6100..71c69883125a 100644
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -132,7 +132,19 @@ extern long long virt_phys_offset;
+ #define virt_to_pfn(kaddr) (__pa(kaddr) >> PAGE_SHIFT)
+ #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr))
+ #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT)
++
++#ifdef CONFIG_PPC_BOOK3S_64
++/*
++ * On hash the vmalloc and other regions alias to the kernel region when passed
++ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can
++ * return true for some vmalloc addresses, which is incorrect. So explicitly
++ * check that the address is in the kernel region.
++ */
++#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \
++ pfn_valid(virt_to_pfn(kaddr)))
++#else
+ #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr))
++#endif
+
+ /*
+ * On Book-E parts we need __va to parse the device tree and we can't
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index f1d7e996e673..ab7b661b6da3 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -719,12 +719,20 @@ static int __init get_freq(char *name, int cells, unsigned long *val)
+ static void start_cpu_decrementer(void)
+ {
+ #if defined(CONFIG_BOOKE) || defined(CONFIG_40x)
++ unsigned int tcr;
++
+ /* Clear any pending timer interrupts */
+ mtspr(SPRN_TSR, TSR_ENW | TSR_WIS | TSR_DIS | TSR_FIS);
+
+- /* Enable decrementer interrupt */
+- mtspr(SPRN_TCR, TCR_DIE);
+-#endif /* defined(CONFIG_BOOKE) || defined(CONFIG_40x) */
++ tcr = mfspr(SPRN_TCR);
++ /*
++ * The watchdog may have already been enabled by u-boot. So leave
++ * TRC[WP] (Watchdog Period) alone.
++ */
++ tcr &= TCR_WP_MASK; /* Clear all bits except for TCR[WP] */
++ tcr |= TCR_DIE; /* Enable decrementer */
++ mtspr(SPRN_TCR, tcr);
++#endif
+ }
+
+ void __init generic_calibrate_decr(void)
+diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c
+index 02176fd52f84..286a3b051ff6 100644
+--- a/arch/powerpc/kvm/book3s_pr_papr.c
++++ b/arch/powerpc/kvm/book3s_pr_papr.c
+@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
+ pteg_addr = get_pteg_addr(vcpu, pte_index);
+
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg));
++ ret = H_FUNCTION;
++ if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)))
++ goto done;
+ hpte = pteg;
+
+ ret = H_PTEG_FULL;
+@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
+ hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6));
+ hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7));
+ pteg_addr += i * HPTE_SIZE;
+- copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE);
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE))
++ goto done;
+ kvmppc_set_gpr(vcpu, 4, pte_index | i);
+ ret = H_SUCCESS;
+
+@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
+
+ pteg = get_pteg_addr(vcpu, pte_index);
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
++ goto done;
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
+ ((flags & H_ANDCOND) && (pte[0] & avpn) != 0))
+ goto done;
+
+- copy_to_user((void __user *)pteg, &v, sizeof(v));
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg, &v, sizeof(v)))
++ goto done;
+
+ rb = compute_tlbie_rb(pte[0], pte[1], pte_index);
+ vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
+@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
+ }
+
+ pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) {
++ ret = H_FUNCTION;
++ break;
++ }
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
+ tsh |= H_BULK_REMOVE_NOT_FOUND;
+ } else {
+ /* Splat the pteg in (userland) hpt */
+- copy_to_user((void __user *)pteg, &v, sizeof(v));
++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) {
++ ret = H_FUNCTION;
++ break;
++ }
+
+ rb = compute_tlbie_rb(pte[0], pte[1],
+ tsh & H_BULK_REMOVE_PTEX);
+@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
+
+ pteg = get_pteg_addr(vcpu, pte_index);
+ mutex_lock(&vcpu->kvm->arch.hpt_mutex);
+- copy_from_user(pte, (void __user *)pteg, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
++ goto done;
+ pte[0] = be64_to_cpu((__force __be64)pte[0]);
+ pte[1] = be64_to_cpu((__force __be64)pte[1]);
+
+@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
+ vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
+ pte[0] = (__force u64)cpu_to_be64(pte[0]);
+ pte[1] = (__force u64)cpu_to_be64(pte[1]);
+- copy_to_user((void __user *)pteg, pte, sizeof(pte));
++ ret = H_FUNCTION;
++ if (copy_to_user((void __user *)pteg, pte, sizeof(pte)))
++ goto done;
+ ret = H_SUCCESS;
+
+ done:
+diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
+index 85c85eb3e245..b4abf9d5d9e1 100644
+--- a/arch/powerpc/platforms/cell/spufs/coredump.c
++++ b/arch/powerpc/platforms/cell/spufs/coredump.c
+@@ -175,6 +175,8 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
+ skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
+ if (!dump_skip(cprm, skip))
+ goto Eio;
++
++ rc = 0;
+ out:
+ free_page((unsigned long)buf);
+ return rc;
+diff --git a/arch/powerpc/sysdev/mpc8xx_pic.c b/arch/powerpc/sysdev/mpc8xx_pic.c
+index 3e828b20c21e..2842f9d63d21 100644
+--- a/arch/powerpc/sysdev/mpc8xx_pic.c
++++ b/arch/powerpc/sysdev/mpc8xx_pic.c
+@@ -79,7 +79,7 @@ unsigned int mpc8xx_get_irq(void)
+ irq = in_be32(&siu_reg->sc_sivec) >> 26;
+
+ if (irq == PIC_VEC_SPURRIOUS)
+- irq = 0;
++ return 0;
+
+ return irq_linear_revmap(mpc8xx_pic_host, irq);
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 3667d20e997f..115bda280d50 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -31,8 +31,14 @@ SECTIONS
+ {
+ . = 0x00000000;
+ .text : {
+- _text = .; /* Text and read-only data */
++ /* Text and read-only data */
+ HEAD_TEXT
++ /*
++ * E.g. perf doesn't like symbols starting at address zero,
++ * therefore skip the initial PSW and channel program located
++ * at address zero and let _text start at 0x200.
++ */
++ _text = 0x200;
+ TEXT_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
+index 59d503866431..9cc600b2d68c 100644
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channel *lp, void *buf, unsigned int size)
+
+ lp->rcv_nxt = p->seqid;
+
++ /*
++ * If this is a control-only packet, there is nothing
++ * else to do but advance the rx queue since the packet
++ * was already processed above.
++ */
+ if (!(p->type & LDC_DATA)) {
+ new = rx_advance(lp, new);
+- goto no_data;
++ break;
+ }
+ if (p->stype & (LDC_ACK | LDC_NACK)) {
+ err = data_ack_nack(lp, p);
+diff --git a/arch/x86/boot/compressed/error.h b/arch/x86/boot/compressed/error.h
+index 2e59dac07f9e..d732e608e3af 100644
+--- a/arch/x86/boot/compressed/error.h
++++ b/arch/x86/boot/compressed/error.h
+@@ -1,7 +1,9 @@
+ #ifndef BOOT_COMPRESSED_ERROR_H
+ #define BOOT_COMPRESSED_ERROR_H
+
++#include <linux/compiler.h>
++
+ void warn(char *m);
+-void error(char *m);
++void error(char *m) __noreturn;
+
+ #endif /* BOOT_COMPRESSED_ERROR_H */
+diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h
+index f35f246a26bf..8d8c24f3a963 100644
+--- a/arch/x86/include/asm/asm.h
++++ b/arch/x86/include/asm/asm.h
+@@ -34,6 +34,7 @@
+ #define _ASM_ADD __ASM_SIZE(add)
+ #define _ASM_SUB __ASM_SIZE(sub)
+ #define _ASM_XADD __ASM_SIZE(xadd)
++#define _ASM_MUL __ASM_SIZE(mul)
+
+ #define _ASM_AX __ASM_REG(ax)
+ #define _ASM_BX __ASM_REG(bx)
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index d07a9390023e..bbfb03eccb7f 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -366,6 +366,8 @@ static int __init tsc_setup(char *str)
+ tsc_clocksource_reliable = 1;
+ if (!strncmp(str, "noirqtime", 9))
+ no_sched_irq_time = 1;
++ if (!strcmp(str, "unstable"))
++ mark_tsc_unstable("boot parameter");
+ return 1;
+ }
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index b24b3c6d686e..5c3d416fff17 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1363,8 +1363,10 @@ EXPORT_SYMBOL_GPL(kvm_lapic_hv_timer_in_use);
+
+ static void cancel_hv_tscdeadline(struct kvm_lapic *apic)
+ {
++ preempt_disable();
+ kvm_x86_ops->cancel_hv_timer(apic->vcpu);
+ apic->lapic_timer.hv_timer_in_use = false;
++ preempt_enable();
+ }
+
+ void kvm_lapic_expired_hv_timer(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 8c99f2fbae80..aaa93b4b0380 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1879,6 +1879,7 @@ static void svm_get_segment(struct kvm_vcpu *vcpu,
+ */
+ if (var->unusable)
+ var->db = 0;
++ /* This is symmetric with svm_set_segment() */
+ var->dpl = to_svm(vcpu)->vmcb->save.cpl;
+ break;
+ }
+@@ -2024,18 +2025,14 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
+ s->base = var->base;
+ s->limit = var->limit;
+ s->selector = var->selector;
+- if (var->unusable)
+- s->attrib = 0;
+- else {
+- s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
+- s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
+- s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
+- s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT;
+- s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
+- s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
+- s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
+- s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
+- }
++ s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK);
++ s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT;
++ s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT;
++ s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT;
++ s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT;
++ s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT;
++ s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT;
++ s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT;
+
+ /*
+ * This is always accurate, except if SYSRET returned to a segment
+@@ -2044,7 +2041,8 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
+ * would entail passing the CPL to userspace and back.
+ */
+ if (seg == VCPU_SREG_SS)
+- svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3;
++ /* This is symmetric with svm_get_segment() */
++ svm->vmcb->save.cpl = (var->dpl & 3);
+
+ mark_dirty(svm->vmcb, VMCB_SEG);
+ }
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 7ed422e2641b..b978aeccda78 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7924,11 +7924,13 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
+ {
+ unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION);
+ int cr = exit_qualification & 15;
+- int reg = (exit_qualification >> 8) & 15;
+- unsigned long val = kvm_register_readl(vcpu, reg);
++ int reg;
++ unsigned long val;
+
+ switch ((exit_qualification >> 4) & 3) {
+ case 0: /* mov to cr */
++ reg = (exit_qualification >> 8) & 15;
++ val = kvm_register_readl(vcpu, reg);
+ switch (cr) {
+ case 0:
+ if (vmcs12->cr0_guest_host_mask &
+@@ -7983,6 +7985,7 @@ static bool nested_vmx_exit_handled_cr(struct kvm_vcpu *vcpu,
+ * lmsw can change bits 1..3 of cr0, and only set bit 0 of
+ * cr0. Other attempted changes are ignored, with no exit.
+ */
++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f;
+ if (vmcs12->cr0_guest_host_mask & 0xe &
+ (val ^ vmcs12->cr0_read_shadow))
+ return true;
+@@ -10661,8 +10664,7 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12,
+ vmcs12->guest_pdptr3 = vmcs_read64(GUEST_PDPTR3);
+ }
+
+- if (nested_cpu_has_ept(vmcs12))
+- vmcs12->guest_linear_address = vmcs_readl(GUEST_LINEAR_ADDRESS);
++ vmcs12->guest_linear_address = vmcs_readl(GUEST_LINEAR_ADDRESS);
+
+ if (nested_cpu_has_vid(vmcs12))
+ vmcs12->guest_intr_status = vmcs_read16(GUEST_INTR_STATUS);
+diff --git a/arch/x86/lib/csum-copy_64.S b/arch/x86/lib/csum-copy_64.S
+index 7e48807b2fa1..45a53dfe1859 100644
+--- a/arch/x86/lib/csum-copy_64.S
++++ b/arch/x86/lib/csum-copy_64.S
+@@ -55,7 +55,7 @@ ENTRY(csum_partial_copy_generic)
+ movq %r12, 3*8(%rsp)
+ movq %r14, 4*8(%rsp)
+ movq %r13, 5*8(%rsp)
+- movq %rbp, 6*8(%rsp)
++ movq %r15, 6*8(%rsp)
+
+ movq %r8, (%rsp)
+ movq %r9, 1*8(%rsp)
+@@ -74,7 +74,7 @@ ENTRY(csum_partial_copy_generic)
+ /* main loop. clear in 64 byte blocks */
+ /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */
+ /* r11: temp3, rdx: temp4, r12 loopcnt */
+- /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */
++ /* r10: temp5, r15: temp6, r14 temp7, r13 temp8 */
+ .p2align 4
+ .Lloop:
+ source
+@@ -89,7 +89,7 @@ ENTRY(csum_partial_copy_generic)
+ source
+ movq 32(%rdi), %r10
+ source
+- movq 40(%rdi), %rbp
++ movq 40(%rdi), %r15
+ source
+ movq 48(%rdi), %r14
+ source
+@@ -103,7 +103,7 @@ ENTRY(csum_partial_copy_generic)
+ adcq %r11, %rax
+ adcq %rdx, %rax
+ adcq %r10, %rax
+- adcq %rbp, %rax
++ adcq %r15, %rax
+ adcq %r14, %rax
+ adcq %r13, %rax
+
+@@ -121,7 +121,7 @@ ENTRY(csum_partial_copy_generic)
+ dest
+ movq %r10, 32(%rsi)
+ dest
+- movq %rbp, 40(%rsi)
++ movq %r15, 40(%rsi)
+ dest
+ movq %r14, 48(%rsi)
+ dest
+@@ -203,7 +203,7 @@ ENTRY(csum_partial_copy_generic)
+ movq 3*8(%rsp), %r12
+ movq 4*8(%rsp), %r14
+ movq 5*8(%rsp), %r13
+- movq 6*8(%rsp), %rbp
++ movq 6*8(%rsp), %r15
+ addq $7*8, %rsp
+ ret
+
+diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c
+index 121f59c6ee54..0c7fe444dcdd 100644
+--- a/arch/x86/lib/kaslr.c
++++ b/arch/x86/lib/kaslr.c
+@@ -5,6 +5,7 @@
+ * kernel starts. This file is included in the compressed kernel and
+ * normally linked in the regular.
+ */
++#include <asm/asm.h>
+ #include <asm/kaslr.h>
+ #include <asm/msr.h>
+ #include <asm/archrandom.h>
+@@ -79,7 +80,7 @@ unsigned long kaslr_get_random_long(const char *purpose)
+ }
+
+ /* Circular multiply for better bit diffusion */
+- asm("mul %3"
++ asm(_ASM_MUL "%3"
+ : "=a" (random), "=d" (raw)
+ : "a" (random), "rm" (mix_const));
+ random += raw;
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 274dfc481849..a0e85f2aff7d 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -832,9 +832,11 @@ static void __init kexec_enter_virtual_mode(void)
+
+ /*
+ * We don't do virtual mode, since we don't do runtime services, on
+- * non-native EFI
++ * non-native EFI. With efi=old_map, we don't do runtime services in
++ * kexec kernel because in the initial boot something else might
++ * have been mapped at these virtual addresses.
+ */
+- if (!efi_is_native()) {
++ if (!efi_is_native() || efi_enabled(EFI_OLD_MEMMAP)) {
+ efi_memmap_unmap();
+ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ return;
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 63f72f00c72e..80dedde0de73 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *bio)
+ if (!bio_is_rw(bio))
+ return false;
+
++ if (!bio_sectors(bio))
++ return false;
++
+ /* Already protected? */
+ if (bio_integrity(bio))
+ return false;
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index c6572ffc1e87..5ca4e4cd8cba 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1265,13 +1265,13 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
+
+ blk_queue_bounce(q, &bio);
+
++ blk_queue_split(q, &bio, q->bio_split);
++
+ if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) {
+ bio_io_error(bio);
+ return BLK_QC_T_NONE;
+ }
+
+- blk_queue_split(q, &bio, q->bio_split);
+-
+ if (!is_flush_fua && !blk_queue_nomerges(q) &&
+ blk_attempt_plug_merge(q, bio, &request_count, &same_queue_rq))
+ return BLK_QC_T_NONE;
+@@ -1592,7 +1592,8 @@ static void blk_mq_exit_hctx(struct request_queue *q,
+ {
+ unsigned flush_start_tag = set->queue_depth;
+
+- blk_mq_tag_idle(hctx);
++ if (blk_mq_hw_queue_mapped(hctx))
++ blk_mq_tag_idle(hctx);
+
+ if (set->ops->exit_request)
+ set->ops->exit_request(set->driver_data,
+@@ -1907,6 +1908,9 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
+ struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
+
+ blk_mq_sysfs_unregister(q);
++
++ /* protect against switching io scheduler */
++ mutex_lock(&q->sysfs_lock);
+ for (i = 0; i < set->nr_hw_queues; i++) {
+ int node;
+
+@@ -1956,6 +1960,7 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
+ }
+ }
+ q->nr_hw_queues = i;
++ mutex_unlock(&q->sysfs_lock);
+ blk_mq_sysfs_register(q);
+ }
+
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index a2437c006640..298c05f8b5e3 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -321,8 +321,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
+
+ if (info) {
+ struct partition_meta_info *pinfo = alloc_part_info(disk);
+- if (!pinfo)
++ if (!pinfo) {
++ err = -ENOMEM;
+ goto out_free_stats;
++ }
+ memcpy(pinfo, info, sizeof(*info));
+ p->info = pinfo;
+ }
+diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c
+index 029f7051f2be..ce2df8c9c583 100644
+--- a/crypto/asymmetric_keys/x509_cert_parser.c
++++ b/crypto/asymmetric_keys/x509_cert_parser.c
+@@ -102,6 +102,7 @@ struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
+ }
+ }
+
++ ret = -ENOMEM;
+ cert->pub->key = kmemdup(ctx->key, ctx->key_size, GFP_KERNEL);
+ if (!cert->pub->key)
+ goto error_decode;
+diff --git a/crypto/async_tx/async_pq.c b/crypto/async_tx/async_pq.c
+index f83de99d7d71..56bd612927ab 100644
+--- a/crypto/async_tx/async_pq.c
++++ b/crypto/async_tx/async_pq.c
+@@ -62,9 +62,6 @@ do_async_gen_syndrome(struct dma_chan *chan,
+ dma_addr_t dma_dest[2];
+ int src_off = 0;
+
+- if (submit->flags & ASYNC_TX_FENCE)
+- dma_flags |= DMA_PREP_FENCE;
+-
+ while (src_cnt > 0) {
+ submit->flags = flags_orig;
+ pq_src_cnt = min(src_cnt, dma_maxpq(dma, dma_flags));
+@@ -83,6 +80,8 @@ do_async_gen_syndrome(struct dma_chan *chan,
+ if (cb_fn_orig)
+ dma_flags |= DMA_PREP_INTERRUPT;
+ }
++ if (submit->flags & ASYNC_TX_FENCE)
++ dma_flags |= DMA_PREP_FENCE;
+
+ /* Drivers force forward progress in case they can not provide
+ * a descriptor
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index c5557d070954..94e04c9de12b 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -87,8 +87,8 @@ MODULE_PARM_DESC(report_key_events,
+ static bool device_id_scheme = false;
+ module_param(device_id_scheme, bool, 0444);
+
+-static bool only_lcd = false;
+-module_param(only_lcd, bool, 0444);
++static int only_lcd = -1;
++module_param(only_lcd, int, 0444);
+
+ static int register_count;
+ static DEFINE_MUTEX(register_count_mutex);
+@@ -2082,6 +2082,16 @@ int acpi_video_register(void)
+ goto leave;
+ }
+
++ /*
++ * We're seeing a lot of bogus backlight interfaces on newer machines
++ * without a LCD such as desktops, servers and HDMI sticks. Checking
++ * the lcd flag fixes this, so enable this on any machines which are
++ * win8 ready (where we also prefer the native backlight driver, so
++ * normally the acpi_video code should not register there anyways).
++ */
++ if (only_lcd == -1)
++ only_lcd = acpi_osi_is_win8();
++
+ dmi_check_system(video_dmi_table);
+
+ ret = acpi_bus_register_driver(&acpi_video_bus);
+diff --git a/drivers/acpi/acpica/evxfevnt.c b/drivers/acpi/acpica/evxfevnt.c
+index 9179e9abe3db..35a2d9ea0654 100644
+--- a/drivers/acpi/acpica/evxfevnt.c
++++ b/drivers/acpi/acpica/evxfevnt.c
+@@ -180,6 +180,12 @@ acpi_status acpi_enable_event(u32 event, u32 flags)
+
+ ACPI_FUNCTION_TRACE(acpi_enable_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
+@@ -237,6 +243,12 @@ acpi_status acpi_disable_event(u32 event, u32 flags)
+
+ ACPI_FUNCTION_TRACE(acpi_disable_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
+@@ -290,6 +302,12 @@ acpi_status acpi_clear_event(u32 event)
+
+ ACPI_FUNCTION_TRACE(acpi_clear_event);
+
++ /* If Hardware Reduced flag is set, there are no fixed events */
++
++ if (acpi_gbl_reduced_hardware) {
++ return_ACPI_STATUS(AE_OK);
++ }
++
+ /* Decode the Fixed Event */
+
+ if (event > ACPI_EVENT_MAX) {
+diff --git a/drivers/acpi/acpica/psobject.c b/drivers/acpi/acpica/psobject.c
+index db0e90342e82..ac2e8dfdf74e 100644
+--- a/drivers/acpi/acpica/psobject.c
++++ b/drivers/acpi/acpica/psobject.c
+@@ -121,6 +121,9 @@ static acpi_status acpi_ps_get_aml_opcode(struct acpi_walk_state *walk_state)
+ (u32)(aml_offset +
+ sizeof(struct acpi_table_header)));
+
++ ACPI_ERROR((AE_INFO,
++ "Aborting disassembly, AML byte code is corrupt"));
++
+ /* Dump the context surrounding the invalid opcode */
+
+ acpi_ut_dump_buffer(((u8 *)walk_state->parser_state.
+@@ -129,6 +132,14 @@ static acpi_status acpi_ps_get_aml_opcode(struct acpi_walk_state *walk_state)
+ sizeof(struct acpi_table_header) -
+ 16));
+ acpi_os_printf(" */\n");
++
++ /*
++ * Just abort the disassembly, cannot continue because the
++ * parser is essentially lost. The disassembler can then
++ * randomly fail because an ill-constructed parse tree
++ * can result.
++ */
++ return_ACPI_STATUS(AE_AML_BAD_OPCODE);
+ #endif
+ }
+
+@@ -293,6 +304,9 @@ acpi_ps_create_op(struct acpi_walk_state *walk_state,
+ if (status == AE_CTRL_PARSE_CONTINUE) {
+ return_ACPI_STATUS(AE_CTRL_PARSE_CONTINUE);
+ }
++ if (ACPI_FAILURE(status)) {
++ return_ACPI_STATUS(status);
++ }
+
+ /* Create Op structure and append to parent's argument list */
+
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index c3bcb7f5986e..307b3e28f34c 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -1518,7 +1518,7 @@ static int acpi_ec_setup(struct acpi_ec *ec, bool handle_events)
+ }
+
+ acpi_handle_info(ec->handle,
+- "GPE=0x%lx, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n",
++ "GPE=0x%x, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n",
+ ec->gpe, ec->command_addr, ec->data_addr);
+ return ret;
+ }
+diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
+index 6c7dd7af789e..dd70d6c2bca0 100644
+--- a/drivers/acpi/ec_sys.c
++++ b/drivers/acpi/ec_sys.c
+@@ -128,7 +128,7 @@ static int acpi_ec_add_debugfs(struct acpi_ec *ec, unsigned int ec_device_count)
+ return -ENOMEM;
+ }
+
+- if (!debugfs_create_x32("gpe", 0444, dev_dir, (u32 *)&first_ec->gpe))
++ if (!debugfs_create_x32("gpe", 0444, dev_dir, &first_ec->gpe))
+ goto error;
+ if (!debugfs_create_bool("use_global_lock", 0444, dev_dir,
+ &first_ec->global_lock))
+diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h
+index 08b3ca0ead69..b012e94b7d9f 100644
+--- a/drivers/acpi/internal.h
++++ b/drivers/acpi/internal.h
+@@ -158,7 +158,7 @@ static inline void acpi_early_processor_osc(void) {}
+ -------------------------------------------------------------------------- */
+ struct acpi_ec {
+ acpi_handle handle;
+- unsigned long gpe;
++ u32 gpe;
+ unsigned long command_addr;
+ unsigned long data_addr;
+ bool global_lock;
+diff --git a/drivers/ata/libahci_platform.c b/drivers/ata/libahci_platform.c
+index aaa761b9081c..cd2eab6aa92e 100644
+--- a/drivers/ata/libahci_platform.c
++++ b/drivers/ata/libahci_platform.c
+@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platform_device *pdev,
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+- dev_err(dev, "no irq\n");
+- return -EINVAL;
++ if (irq != -EPROBE_DEFER)
++ dev_err(dev, "no irq\n");
++ return irq;
+ }
+
+ hpriv->irq = irq;
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 68bfcef24701..dc318b9100c2 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -612,6 +612,9 @@ static int loop_switch(struct loop_device *lo, struct file *file)
+ */
+ static int loop_flush(struct loop_device *lo)
+ {
++ /* loop not yet configured, no running thread, nothing to flush */
++ if (lo->lo_state != Lo_bound)
++ return 0;
+ return loop_switch(lo, NULL);
+ }
+
+diff --git a/drivers/bus/brcmstb_gisb.c b/drivers/bus/brcmstb_gisb.c
+index 72fe0a5a8bf3..017c37b9c7c1 100644
+--- a/drivers/bus/brcmstb_gisb.c
++++ b/drivers/bus/brcmstb_gisb.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2014 Broadcom Corporation
++ * Copyright (C) 2014-2017 Broadcom
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+@@ -37,8 +37,6 @@
+ #define ARB_ERR_CAP_CLEAR (1 << 0)
+ #define ARB_ERR_CAP_STATUS_TIMEOUT (1 << 12)
+ #define ARB_ERR_CAP_STATUS_TEA (1 << 11)
+-#define ARB_ERR_CAP_STATUS_BS_SHIFT (1 << 2)
+-#define ARB_ERR_CAP_STATUS_BS_MASK 0x3c
+ #define ARB_ERR_CAP_STATUS_WRITE (1 << 1)
+ #define ARB_ERR_CAP_STATUS_VALID (1 << 0)
+
+@@ -47,7 +45,6 @@ enum {
+ ARB_ERR_CAP_CLR,
+ ARB_ERR_CAP_HI_ADDR,
+ ARB_ERR_CAP_ADDR,
+- ARB_ERR_CAP_DATA,
+ ARB_ERR_CAP_STATUS,
+ ARB_ERR_CAP_MASTER,
+ };
+@@ -57,7 +54,6 @@ static const int gisb_offsets_bcm7038[] = {
+ [ARB_ERR_CAP_CLR] = 0x0c4,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x0c8,
+- [ARB_ERR_CAP_DATA] = 0x0cc,
+ [ARB_ERR_CAP_STATUS] = 0x0d0,
+ [ARB_ERR_CAP_MASTER] = -1,
+ };
+@@ -67,7 +63,6 @@ static const int gisb_offsets_bcm7400[] = {
+ [ARB_ERR_CAP_CLR] = 0x0c8,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x0cc,
+- [ARB_ERR_CAP_DATA] = 0x0d0,
+ [ARB_ERR_CAP_STATUS] = 0x0d4,
+ [ARB_ERR_CAP_MASTER] = 0x0d8,
+ };
+@@ -77,7 +72,6 @@ static const int gisb_offsets_bcm7435[] = {
+ [ARB_ERR_CAP_CLR] = 0x168,
+ [ARB_ERR_CAP_HI_ADDR] = -1,
+ [ARB_ERR_CAP_ADDR] = 0x16c,
+- [ARB_ERR_CAP_DATA] = 0x170,
+ [ARB_ERR_CAP_STATUS] = 0x174,
+ [ARB_ERR_CAP_MASTER] = 0x178,
+ };
+@@ -87,7 +81,6 @@ static const int gisb_offsets_bcm7445[] = {
+ [ARB_ERR_CAP_CLR] = 0x7e4,
+ [ARB_ERR_CAP_HI_ADDR] = 0x7e8,
+ [ARB_ERR_CAP_ADDR] = 0x7ec,
+- [ARB_ERR_CAP_DATA] = 0x7f0,
+ [ARB_ERR_CAP_STATUS] = 0x7f4,
+ [ARB_ERR_CAP_MASTER] = 0x7f8,
+ };
+@@ -109,9 +102,13 @@ static u32 gisb_read(struct brcmstb_gisb_arb_device *gdev, int reg)
+ {
+ int offset = gdev->gisb_offsets[reg];
+
+- /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */
+- if (offset == -1)
+- return 1;
++ if (offset < 0) {
++ /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */
++ if (reg == ARB_ERR_CAP_MASTER)
++ return 1;
++ else
++ return 0;
++ }
+
+ if (gdev->big_endian)
+ return ioread32be(gdev->base + offset);
+@@ -119,6 +116,16 @@ static u32 gisb_read(struct brcmstb_gisb_arb_device *gdev, int reg)
+ return ioread32(gdev->base + offset);
+ }
+
++static u64 gisb_read_address(struct brcmstb_gisb_arb_device *gdev)
++{
++ u64 value;
++
++ value = gisb_read(gdev, ARB_ERR_CAP_ADDR);
++ value |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32;
++
++ return value;
++}
++
+ static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg)
+ {
+ int offset = gdev->gisb_offsets[reg];
+@@ -127,9 +134,9 @@ static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg)
+ return;
+
+ if (gdev->big_endian)
+- iowrite32be(val, gdev->base + reg);
++ iowrite32be(val, gdev->base + offset);
+ else
+- iowrite32(val, gdev->base + reg);
++ iowrite32(val, gdev->base + offset);
+ }
+
+ static ssize_t gisb_arb_get_timeout(struct device *dev,
+@@ -185,7 +192,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev,
+ const char *reason)
+ {
+ u32 cap_status;
+- unsigned long arb_addr;
++ u64 arb_addr;
+ u32 master;
+ const char *m_name;
+ char m_fmt[11];
+@@ -197,10 +204,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev,
+ return 1;
+
+ /* Read the address and master */
+- arb_addr = gisb_read(gdev, ARB_ERR_CAP_ADDR) & 0xffffffff;
+-#if (IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT))
+- arb_addr |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32;
+-#endif
++ arb_addr = gisb_read_address(gdev);
+ master = gisb_read(gdev, ARB_ERR_CAP_MASTER);
+
+ m_name = brcmstb_gisb_master_to_str(gdev, master);
+@@ -209,7 +213,7 @@ static int brcmstb_gisb_arb_decode_addr(struct brcmstb_gisb_arb_device *gdev,
+ m_name = m_fmt;
+ }
+
+- pr_crit("%s: %s at 0x%lx [%c %s], core: %s\n",
++ pr_crit("%s: %s at 0x%llx [%c %s], core: %s\n",
+ __func__, reason, arb_addr,
+ cap_status & ARB_ERR_CAP_STATUS_WRITE ? 'W' : 'R',
+ cap_status & ARB_ERR_CAP_STATUS_TIMEOUT ? "timeout" : "",
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 510fc104bcdc..f11c1c7e84c6 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -409,6 +409,7 @@ static void start_event_fetch(struct ssif_info *ssif_info, unsigned long *flags)
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+ ssif_info->ssif_state = SSIF_NORMAL;
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+
+@@ -431,6 +432,7 @@ static void start_recv_msg_fetch(struct ssif_info *ssif_info,
+ msg = ipmi_alloc_smi_msg();
+ if (!msg) {
+ ssif_info->ssif_state = SSIF_NORMAL;
++ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 08d1dd58c0d2..0c23ced255cb 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1115,12 +1115,16 @@ static void add_interrupt_bench(cycles_t start)
+ static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs)
+ {
+ __u32 *ptr = (__u32 *) regs;
++ unsigned int idx;
+
+ if (regs == NULL)
+ return 0;
+- if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32))
+- f->reg_idx = 0;
+- return *(ptr + f->reg_idx++);
++ idx = READ_ONCE(f->reg_idx);
++ if (idx >= sizeof(struct pt_regs) / sizeof(__u32))
++ idx = 0;
++ ptr += idx++;
++ WRITE_ONCE(f->reg_idx, idx);
++ return *ptr;
+ }
+
+ void add_interrupt_randomness(int irq, int irq_flags)
+diff --git a/drivers/clk/at91/clk-generated.c b/drivers/clk/at91/clk-generated.c
+index 4e1cd5aa69d8..07c8f701e51c 100644
+--- a/drivers/clk/at91/clk-generated.c
++++ b/drivers/clk/at91/clk-generated.c
+@@ -260,13 +260,13 @@ at91_clk_register_generated(struct regmap *regmap, spinlock_t *lock,
+ gck->lock = lock;
+ gck->range = *range;
+
++ clk_generated_startup(gck);
+ hw = &gck->hw;
+ ret = clk_hw_register(NULL, &gck->hw);
+ if (ret) {
+ kfree(gck);
+ hw = ERR_PTR(ret);
+- } else
+- clk_generated_startup(gck);
++ }
+
+ return hw;
+ }
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 674785d968a3..f02900922bbe 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -106,7 +106,7 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+
+ rc = clk_set_rate(clk, rate);
+ if (rc < 0)
+- pr_err("clk: couldn't set %s clk rate to %d (%d), current rate: %ld\n",
++ pr_err("clk: couldn't set %s clk rate to %u (%d), current rate: %lu\n",
+ __clk_get_name(clk), rate, rc,
+ clk_get_rate(clk));
+ clk_put(clk);
+diff --git a/drivers/clk/clk-scpi.c b/drivers/clk/clk-scpi.c
+index 96d37175d0ad..8ad458b5ad6e 100644
+--- a/drivers/clk/clk-scpi.c
++++ b/drivers/clk/clk-scpi.c
+@@ -71,15 +71,15 @@ static const struct clk_ops scpi_clk_ops = {
+ };
+
+ /* find closest match to given frequency in OPP table */
+-static int __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate)
++static long __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate)
+ {
+ int idx;
+- u32 fmin = 0, fmax = ~0, ftmp;
++ unsigned long fmin = 0, fmax = ~0, ftmp;
+ const struct scpi_opp *opp = clk->info->opps;
+
+ for (idx = 0; idx < clk->info->count; idx++, opp++) {
+ ftmp = opp->freq;
+- if (ftmp >= (u32)rate) {
++ if (ftmp >= rate) {
+ if (ftmp <= fmax)
+ fmax = ftmp;
+ break;
+diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig
+index 2f29ee1a4d00..5588f75a8414 100644
+--- a/drivers/clk/meson/Kconfig
++++ b/drivers/clk/meson/Kconfig
+@@ -7,9 +7,9 @@ config COMMON_CLK_MESON8B
+ bool
+ depends on COMMON_CLK_AMLOGIC
+ help
+- Support for the clock controller on AmLogic S805 devices, aka
+- meson8b. Say Y if you want peripherals and CPU frequency scaling to
+- work.
++ Support for the clock controller on AmLogic S802 (Meson8),
++ S805 (Meson8b) and S812 (Meson8m2) devices. Say Y if you
++ want peripherals and CPU frequency scaling to work.
+
+ config COMMON_CLK_GXBB
+ bool
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 3f1be46cbb33..70567958b86a 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -1,5 +1,6 @@
+ /*
+- * AmLogic S805 / Meson8b Clock Controller Driver
++ * AmLogic S802 (Meson8) / S805 (Meson8b) / S812 (Meson8m2) Clock Controller
++ * Driver
+ *
+ * Copyright (c) 2015 Endless Mobile, Inc.
+ * Author: Carlo Caione <carlo@endlessm.com>
+@@ -661,7 +662,9 @@ static int meson8b_clkc_probe(struct platform_device *pdev)
+ }
+
+ static const struct of_device_id meson8b_clkc_match_table[] = {
++ { .compatible = "amlogic,meson8-clkc" },
+ { .compatible = "amlogic,meson8b-clkc" },
++ { .compatible = "amlogic,meson8m2-clkc" },
+ { }
+ };
+
+diff --git a/drivers/clk/renesas/clk-rcar-gen2.c b/drivers/clk/renesas/clk-rcar-gen2.c
+index 00e6aba4b9c0..c55d5fe116d6 100644
+--- a/drivers/clk/renesas/clk-rcar-gen2.c
++++ b/drivers/clk/renesas/clk-rcar-gen2.c
+@@ -271,11 +271,14 @@ struct cpg_pll_config {
+ unsigned int extal_div;
+ unsigned int pll1_mult;
+ unsigned int pll3_mult;
++ unsigned int pll0_mult; /* For R-Car V2H and E2 only */
+ };
+
+ static const struct cpg_pll_config cpg_pll_configs[8] __initconst = {
+- { 1, 208, 106 }, { 1, 208, 88 }, { 1, 156, 80 }, { 1, 156, 66 },
+- { 2, 240, 122 }, { 2, 240, 102 }, { 2, 208, 106 }, { 2, 208, 88 },
++ { 1, 208, 106, 200 }, { 1, 208, 88, 200 },
++ { 1, 156, 80, 150 }, { 1, 156, 66, 150 },
++ { 2, 240, 122, 230 }, { 2, 240, 102, 230 },
++ { 2, 208, 106, 200 }, { 2, 208, 88, 200 },
+ };
+
+ /* SDHI divisors */
+@@ -297,6 +300,12 @@ static const struct clk_div_table cpg_sd01_div_table[] = {
+
+ static u32 cpg_mode __initdata;
+
++static const char * const pll0_mult_match[] = {
++ "renesas,r8a7792-cpg-clocks",
++ "renesas,r8a7794-cpg-clocks",
++ NULL
++};
++
+ static struct clk * __init
+ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
+ const struct cpg_pll_config *config,
+@@ -317,9 +326,15 @@ rcar_gen2_cpg_register_clock(struct device_node *np, struct rcar_gen2_cpg *cpg,
+ * clock implementation and we currently have no need to change
+ * the multiplier value.
+ */
+- u32 value = clk_readl(cpg->reg + CPG_PLL0CR);
++ if (of_device_compatible_match(np, pll0_mult_match)) {
++ /* R-Car V2H and E2 do not have PLL0CR */
++ mult = config->pll0_mult;
++ div = 3;
++ } else {
++ u32 value = clk_readl(cpg->reg + CPG_PLL0CR);
++ mult = ((value >> 24) & ((1 << 7) - 1)) + 1;
++ }
+ parent_name = "main";
+- mult = ((value >> 24) & ((1 << 7) - 1)) + 1;
+ } else if (!strcmp(name, "pll1")) {
+ parent_name = "main";
+ mult = config->pll1_mult / 2;
+diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c
+index a5c111b67f37..ea11a33e7fff 100644
+--- a/drivers/cpuidle/dt_idle_states.c
++++ b/drivers/cpuidle/dt_idle_states.c
+@@ -174,8 +174,10 @@ int dt_init_idle_driver(struct cpuidle_driver *drv,
+ if (!state_node)
+ break;
+
+- if (!of_device_is_available(state_node))
++ if (!of_device_is_available(state_node)) {
++ of_node_put(state_node);
+ continue;
++ }
+
+ if (!idle_state_valid(state_node, i, cpumask)) {
+ pr_warn("%s idle state not valid, bailing out\n",
+diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
+index d0b16e5e4ee5..d8305ddf87d0 100644
+--- a/drivers/crypto/omap-sham.c
++++ b/drivers/crypto/omap-sham.c
+@@ -750,7 +750,10 @@ static int omap_sham_align_sgs(struct scatterlist *sg,
+ if (final)
+ new_len = DIV_ROUND_UP(new_len, bs) * bs;
+ else
+- new_len = new_len / bs * bs;
++ new_len = (new_len - 1) / bs * bs;
++
++ if (nbytes != new_len)
++ list_ok = false;
+
+ while (nbytes > 0 && sg_tmp) {
+ n++;
+@@ -846,6 +849,8 @@ static int omap_sham_prepare_request(struct ahash_request *req, bool update)
+ xmit_len = DIV_ROUND_UP(xmit_len, bs) * bs;
+ else
+ xmit_len = xmit_len / bs * bs;
++ } else if (!final) {
++ xmit_len -= bs;
+ }
+
+ hash_later = rctx->total - xmit_len;
+@@ -873,14 +878,21 @@ static int omap_sham_prepare_request(struct ahash_request *req, bool update)
+ }
+
+ if (hash_later) {
+- if (req->nbytes) {
+- scatterwalk_map_and_copy(rctx->buffer, req->src,
+- req->nbytes - hash_later,
+- hash_later, 0);
+- } else {
++ int offset = 0;
++
++ if (hash_later > req->nbytes) {
+ memcpy(rctx->buffer, rctx->buffer + xmit_len,
+- hash_later);
++ hash_later - req->nbytes);
++ offset = hash_later - req->nbytes;
+ }
++
++ if (req->nbytes) {
++ scatterwalk_map_and_copy(rctx->buffer + offset,
++ req->src,
++ offset + req->nbytes -
++ hash_later, hash_later, 0);
++ }
++
+ rctx->bufcnt = hash_later;
+ } else {
+ rctx->bufcnt = 0;
+@@ -1130,7 +1142,7 @@ static int omap_sham_handle_queue(struct omap_sham_dev *dd,
+ ctx = ahash_request_ctx(req);
+
+ err = omap_sham_prepare_request(req, ctx->op == OP_UPDATE);
+- if (err)
++ if (err || !ctx->total)
+ goto err1;
+
+ dev_dbg(dd->dev, "handling new req, op: %lu, nbytes: %d\n",
+@@ -1189,11 +1201,10 @@ static int omap_sham_update(struct ahash_request *req)
+ if (!req->nbytes)
+ return 0;
+
+- if (ctx->total + req->nbytes < ctx->buflen) {
++ if (ctx->bufcnt + req->nbytes <= ctx->buflen) {
+ scatterwalk_map_and_copy(ctx->buffer + ctx->bufcnt, req->src,
+ 0, req->nbytes, 0);
+ ctx->bufcnt += req->nbytes;
+- ctx->total += req->nbytes;
+ return 0;
+ }
+
+diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
+index 9e5674c5a07b..db70cee71caa 100644
+--- a/drivers/devfreq/devfreq.c
++++ b/drivers/devfreq/devfreq.c
+@@ -943,7 +943,8 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr,
+ if (df->governor == governor) {
+ ret = 0;
+ goto out;
+- } else if (df->governor->immutable || governor->immutable) {
++ } else if ((df->governor && df->governor->immutable) ||
++ governor->immutable) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 21726a270fc4..b9c29720aeb1 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1755,19 +1755,26 @@ static int sdma_probe(struct platform_device *pdev)
+ if (IS_ERR(sdma->clk_ahb))
+ return PTR_ERR(sdma->clk_ahb);
+
+- clk_prepare(sdma->clk_ipg);
+- clk_prepare(sdma->clk_ahb);
++ ret = clk_prepare(sdma->clk_ipg);
++ if (ret)
++ return ret;
++
++ ret = clk_prepare(sdma->clk_ahb);
++ if (ret)
++ goto err_clk;
+
+ ret = devm_request_irq(&pdev->dev, irq, sdma_int_handler, 0, "sdma",
+ sdma);
+ if (ret)
+- return ret;
++ goto err_irq;
+
+ sdma->irq = irq;
+
+ sdma->script_addrs = kzalloc(sizeof(*sdma->script_addrs), GFP_KERNEL);
+- if (!sdma->script_addrs)
+- return -ENOMEM;
++ if (!sdma->script_addrs) {
++ ret = -ENOMEM;
++ goto err_irq;
++ }
+
+ /* initially no scripts available */
+ saddr_arr = (s32 *)sdma->script_addrs;
+@@ -1882,6 +1889,10 @@ static int sdma_probe(struct platform_device *pdev)
+ dma_async_device_unregister(&sdma->dma_device);
+ err_init:
+ kfree(sdma->script_addrs);
++err_irq:
++ clk_unprepare(sdma->clk_ahb);
++err_clk:
++ clk_unprepare(sdma->clk_ipg);
+ return ret;
+ }
+
+@@ -1893,6 +1904,8 @@ static int sdma_remove(struct platform_device *pdev)
+ devm_free_irq(&pdev->dev, sdma->irq, sdma);
+ dma_async_device_unregister(&sdma->dma_device);
+ kfree(sdma->script_addrs);
++ clk_unprepare(sdma->clk_ahb);
++ clk_unprepare(sdma->clk_ipg);
+ /* Kill the tasklet */
+ for (i = 0; i < MAX_DMA_CHANNELS; i++) {
+ struct sdma_channel *sdmac = &sdma->channel[i];
+diff --git a/drivers/edac/mv64x60_edac.c b/drivers/edac/mv64x60_edac.c
+index cb9b8577acbc..61c19b81ed81 100644
+--- a/drivers/edac/mv64x60_edac.c
++++ b/drivers/edac/mv64x60_edac.c
+@@ -759,7 +759,7 @@ static int mv64x60_mc_err_probe(struct platform_device *pdev)
+ /* Non-ECC RAM? */
+ printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__);
+ res = -ENODEV;
+- goto err2;
++ goto err;
+ }
+
+ edac_dbg(3, "init mci\n");
+diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
+index 7c446d118cd6..1d87b0718d3a 100644
+--- a/drivers/gpio/gpio-crystalcove.c
++++ b/drivers/gpio/gpio-crystalcove.c
+@@ -90,8 +90,18 @@ static inline int to_reg(int gpio, enum ctrl_register reg_type)
+ {
+ int reg;
+
+- if (gpio == 94)
+- return GPIOPANELCTL;
++ if (gpio >= CRYSTALCOVE_GPIO_NUM) {
++ /*
++ * Virtual GPIO called from ACPI, for now we only support
++ * the panel ctl.
++ */
++ switch (gpio) {
++ case 0x5e:
++ return GPIOPANELCTL;
++ default:
++ return -EOPNOTSUPP;
++ }
++ }
+
+ if (reg_type == CTRL_IN) {
+ if (gpio < 8)
+@@ -130,36 +140,36 @@ static void crystalcove_update_irq_ctrl(struct crystalcove_gpio *cg, int gpio)
+ static int crystalcove_gpio_dir_in(struct gpio_chip *chip, unsigned gpio)
+ {
+ struct crystalcove_gpio *cg = gpiochip_get_data(chip);
++ int reg = to_reg(gpio, CTRL_OUT);
+
+- if (gpio > CRYSTALCOVE_VGPIO_NUM)
++ if (reg < 0)
+ return 0;
+
+- return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
+- CTLO_INPUT_SET);
++ return regmap_write(cg->regmap, reg, CTLO_INPUT_SET);
+ }
+
+ static int crystalcove_gpio_dir_out(struct gpio_chip *chip, unsigned gpio,
+ int value)
+ {
+ struct crystalcove_gpio *cg = gpiochip_get_data(chip);
++ int reg = to_reg(gpio, CTRL_OUT);
+
+- if (gpio > CRYSTALCOVE_VGPIO_NUM)
++ if (reg < 0)
+ return 0;
+
+- return regmap_write(cg->regmap, to_reg(gpio, CTRL_OUT),
+- CTLO_OUTPUT_SET | value);
++ return regmap_write(cg->regmap, reg, CTLO_OUTPUT_SET | value);
+ }
+
+ static int crystalcove_gpio_get(struct gpio_chip *chip, unsigned gpio)
+ {
+ struct crystalcove_gpio *cg = gpiochip_get_data(chip);
+- int ret;
+ unsigned int val;
++ int ret, reg = to_reg(gpio, CTRL_IN);
+
+- if (gpio > CRYSTALCOVE_VGPIO_NUM)
++ if (reg < 0)
+ return 0;
+
+- ret = regmap_read(cg->regmap, to_reg(gpio, CTRL_IN), &val);
++ ret = regmap_read(cg->regmap, reg, &val);
+ if (ret)
+ return ret;
+
+@@ -170,14 +180,15 @@ static void crystalcove_gpio_set(struct gpio_chip *chip,
+ unsigned gpio, int value)
+ {
+ struct crystalcove_gpio *cg = gpiochip_get_data(chip);
++ int reg = to_reg(gpio, CTRL_OUT);
+
+- if (gpio > CRYSTALCOVE_VGPIO_NUM)
++ if (reg < 0)
+ return;
+
+ if (value)
+- regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 1);
++ regmap_update_bits(cg->regmap, reg, 1, 1);
+ else
+- regmap_update_bits(cg->regmap, to_reg(gpio, CTRL_OUT), 1, 0);
++ regmap_update_bits(cg->regmap, reg, 1, 0);
+ }
+
+ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
+@@ -185,6 +196,9 @@ static int crystalcove_irq_type(struct irq_data *data, unsigned type)
+ struct crystalcove_gpio *cg =
+ gpiochip_get_data(irq_data_get_irq_chip_data(data));
+
++ if (data->hwirq >= CRYSTALCOVE_GPIO_NUM)
++ return 0;
++
+ switch (type) {
+ case IRQ_TYPE_NONE:
+ cg->intcnt_value = CTLI_INTCNT_DIS;
+@@ -235,8 +249,10 @@ static void crystalcove_irq_unmask(struct irq_data *data)
+ struct crystalcove_gpio *cg =
+ gpiochip_get_data(irq_data_get_irq_chip_data(data));
+
+- cg->set_irq_mask = false;
+- cg->update |= UPDATE_IRQ_MASK;
++ if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
++ cg->set_irq_mask = false;
++ cg->update |= UPDATE_IRQ_MASK;
++ }
+ }
+
+ static void crystalcove_irq_mask(struct irq_data *data)
+@@ -244,8 +260,10 @@ static void crystalcove_irq_mask(struct irq_data *data)
+ struct crystalcove_gpio *cg =
+ gpiochip_get_data(irq_data_get_irq_chip_data(data));
+
+- cg->set_irq_mask = true;
+- cg->update |= UPDATE_IRQ_MASK;
++ if (data->hwirq < CRYSTALCOVE_GPIO_NUM) {
++ cg->set_irq_mask = true;
++ cg->update |= UPDATE_IRQ_MASK;
++ }
+ }
+
+ static struct irq_chip crystalcove_irqchip = {
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index f3c3680963b9..4f54ff45e09e 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3231,7 +3231,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev,
+ return desc;
+ }
+
+- status = gpiod_request(desc, con_id);
++ /* If a connection label was passed use that, else use the device name as label */
++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev));
+ if (status < 0)
+ return ERR_PTR(status);
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+index ef7c8de7060e..171480bb95d0 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c
+@@ -317,7 +317,8 @@ static struct kfd_process *create_process(const struct task_struct *thread)
+
+ /* init process apertures*/
+ process->is_32bit_user_mode = in_compat_syscall();
+- if (kfd_init_apertures(process) != 0)
++ err = kfd_init_apertures(process);
++ if (err != 0)
+ goto err_init_apretures;
+
+ return process;
+diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
+index 797d1f8340b9..7145127513c4 100644
+--- a/drivers/gpu/drm/msm/msm_gem.c
++++ b/drivers/gpu/drm/msm/msm_gem.c
+@@ -770,6 +770,8 @@ static int msm_gem_new_impl(struct drm_device *dev,
+ unsigned sz;
+ bool use_vram = false;
+
++ WARN_ON(!mutex_is_locked(&dev->struct_mutex));
++
+ switch (flags & MSM_BO_CACHE_MASK) {
+ case MSM_BO_UNCACHED:
+ case MSM_BO_CACHED:
+@@ -863,7 +865,11 @@ struct drm_gem_object *msm_gem_import(struct drm_device *dev,
+
+ size = PAGE_ALIGN(dmabuf->size);
+
++ /* Take mutex so we can modify the inactive list in msm_gem_new_impl */
++ mutex_lock(&dev->struct_mutex);
+ ret = msm_gem_new_impl(dev, size, MSM_BO_WC, dmabuf->resv, &obj);
++ mutex_unlock(&dev->struct_mutex);
++
+ if (ret)
+ goto fail;
+
+diff --git a/drivers/gpu/drm/omapdrm/omap_gem.c b/drivers/gpu/drm/omapdrm/omap_gem.c
+index 505dee0db973..ca91651be3d4 100644
+--- a/drivers/gpu/drm/omapdrm/omap_gem.c
++++ b/drivers/gpu/drm/omapdrm/omap_gem.c
+@@ -195,7 +195,7 @@ static void evict_entry(struct drm_gem_object *obj,
+ size_t size = PAGE_SIZE * n;
+ loff_t off = mmap_offset(obj) +
+ (entry->obj_pgoff << PAGE_SHIFT);
+- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE);
+
+ if (m > 1) {
+ int i;
+@@ -442,7 +442,7 @@ static int fault_2d(struct drm_gem_object *obj,
+ * into account in some of the math, so figure out virtual stride
+ * in pages
+ */
+- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE);
++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE);
+
+ /* We don't use vmf->pgoff since that has the fake offset: */
+ pgoff = ((unsigned long)vmf->virtual_address -
+diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
+index 9e77fc034e0a..aad2f4a2a0ef 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
+@@ -212,6 +212,11 @@ static const struct component_master_ops sun4i_drv_master_ops = {
+ .unbind = sun4i_drv_unbind,
+ };
+
++static bool sun4i_drv_node_is_connector(struct device_node *node)
++{
++ return of_device_is_compatible(node, "hdmi-connector");
++}
++
+ static bool sun4i_drv_node_is_frontend(struct device_node *node)
+ {
+ return of_device_is_compatible(node, "allwinner,sun5i-a13-display-frontend") ||
+@@ -252,6 +257,13 @@ static int sun4i_drv_add_endpoints(struct device *dev,
+ !of_device_is_available(node))
+ return 0;
+
++ /*
++ * The connectors will be the last nodes in our pipeline, we
++ * can just bail out.
++ */
++ if (sun4i_drv_node_is_connector(node))
++ return 0;
++
+ if (!sun4i_drv_node_is_frontend(node)) {
+ /* Add current component */
+ DRM_DEBUG_DRIVER("Adding component %s\n",
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index ab3016982466..b608cd463d4e 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -110,8 +110,8 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
+ &handle);
+
+ if (ret) {
+- state->bo_count = i - 1;
+- goto err;
++ state->bo_count = i;
++ goto err_delete_handle;
+ }
+ bo_state[i].handle = handle;
+ bo_state[i].paddr = vc4_bo->base.paddr;
+@@ -123,13 +123,16 @@ vc4_get_hang_state_ioctl(struct drm_device *dev, void *data,
+ state->bo_count * sizeof(*bo_state)))
+ ret = -EFAULT;
+
+- kfree(bo_state);
++err_delete_handle:
++ if (ret) {
++ for (i = 0; i < state->bo_count; i++)
++ drm_gem_handle_delete(file_priv, bo_state[i].handle);
++ }
+
+ err_free:
+-
+ vc4_free_hang_state(dev, kernel_state);
++ kfree(bo_state);
+
+-err:
+ return ret;
+ }
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
+index 865e7c262322..7d6da9b43dab 100644
+--- a/drivers/hid/i2c-hid/i2c-hid.c
++++ b/drivers/hid/i2c-hid/i2c-hid.c
+@@ -968,6 +968,15 @@ static int i2c_hid_acpi_pdata(struct i2c_client *client,
+ return ret < 0 && ret != -ENXIO ? ret : 0;
+ }
+
++static void i2c_hid_acpi_fix_up_power(struct device *dev)
++{
++ acpi_handle handle = ACPI_HANDLE(dev);
++ struct acpi_device *adev;
++
++ if (handle && acpi_bus_get_device(handle, &adev) == 0)
++ acpi_device_fix_up_power(adev);
++}
++
+ static const struct acpi_device_id i2c_hid_acpi_match[] = {
+ {"ACPI0C50", 0 },
+ {"PNP0C50", 0 },
+@@ -980,6 +989,8 @@ static inline int i2c_hid_acpi_pdata(struct i2c_client *client,
+ {
+ return -ENODEV;
+ }
++
++static inline void i2c_hid_acpi_fix_up_power(struct device *dev) {}
+ #endif
+
+ #ifdef CONFIG_OF
+@@ -1082,6 +1093,8 @@ static int i2c_hid_probe(struct i2c_client *client,
+ if (ret < 0)
+ goto err;
+
++ i2c_hid_acpi_fix_up_power(&client->dev);
++
+ pm_runtime_get_noresume(&client->dev);
+ pm_runtime_set_active(&client->dev);
+ pm_runtime_enable(&client->dev);
+diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
+index b24f1d3045f0..a629f7c130f0 100644
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -94,18 +94,20 @@ enum ina2xx_ids { ina219, ina226 };
+
+ struct ina2xx_config {
+ u16 config_default;
+- int calibration_factor;
++ int calibration_value;
+ int registers;
+ int shunt_div;
+ int bus_voltage_shift;
+ int bus_voltage_lsb; /* uV */
+- int power_lsb; /* uW */
++ int power_lsb_factor;
+ };
+
+ struct ina2xx_data {
+ const struct ina2xx_config *config;
+
+ long rshunt;
++ long current_lsb_uA;
++ long power_lsb_uW;
+ struct mutex config_lock;
+ struct regmap *regmap;
+
+@@ -115,21 +117,21 @@ struct ina2xx_data {
+ static const struct ina2xx_config ina2xx_config[] = {
+ [ina219] = {
+ .config_default = INA219_CONFIG_DEFAULT,
+- .calibration_factor = 40960000,
++ .calibration_value = 4096,
+ .registers = INA219_REGISTERS,
+ .shunt_div = 100,
+ .bus_voltage_shift = 3,
+ .bus_voltage_lsb = 4000,
+- .power_lsb = 20000,
++ .power_lsb_factor = 20,
+ },
+ [ina226] = {
+ .config_default = INA226_CONFIG_DEFAULT,
+- .calibration_factor = 5120000,
++ .calibration_value = 2048,
+ .registers = INA226_REGISTERS,
+ .shunt_div = 400,
+ .bus_voltage_shift = 0,
+ .bus_voltage_lsb = 1250,
+- .power_lsb = 25000,
++ .power_lsb_factor = 25,
+ },
+ };
+
+@@ -168,12 +170,16 @@ static u16 ina226_interval_to_reg(int interval)
+ return INA226_SHIFT_AVG(avg_bits);
+ }
+
++/*
++ * Calibration register is set to the best value, which eliminates
++ * truncation errors on calculating current register in hardware.
++ * According to datasheet (eq. 3) the best values are 2048 for
++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value.
++ */
+ static int ina2xx_calibrate(struct ina2xx_data *data)
+ {
+- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+- data->rshunt);
+-
+- return regmap_write(data->regmap, INA2XX_CALIBRATION, val);
++ return regmap_write(data->regmap, INA2XX_CALIBRATION,
++ data->config->calibration_value);
+ }
+
+ /*
+@@ -186,10 +192,6 @@ static int ina2xx_init(struct ina2xx_data *data)
+ if (ret < 0)
+ return ret;
+
+- /*
+- * Set current LSB to 1mA, shunt is in uOhms
+- * (equation 13 in datasheet).
+- */
+ return ina2xx_calibrate(data);
+ }
+
+@@ -267,15 +269,15 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg,
+ val = DIV_ROUND_CLOSEST(val, 1000);
+ break;
+ case INA2XX_POWER:
+- val = regval * data->config->power_lsb;
++ val = regval * data->power_lsb_uW;
+ break;
+ case INA2XX_CURRENT:
+- /* signed register, LSB=1mA (selected), in mA */
+- val = (s16)regval;
++ /* signed register, result in mA */
++ val = regval * data->current_lsb_uA;
++ val = DIV_ROUND_CLOSEST(val, 1000);
+ break;
+ case INA2XX_CALIBRATION:
+- val = DIV_ROUND_CLOSEST(data->config->calibration_factor,
+- regval);
++ val = regval;
+ break;
+ default:
+ /* programmer goofed */
+@@ -303,9 +305,32 @@ static ssize_t ina2xx_show_value(struct device *dev,
+ ina2xx_get_value(data, attr->index, regval));
+ }
+
+-static ssize_t ina2xx_set_shunt(struct device *dev,
+- struct device_attribute *da,
+- const char *buf, size_t count)
++/*
++ * In order to keep calibration register value fixed, the product
++ * of current_lsb and shunt_resistor should also be fixed and equal
++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order
++ * to keep the scale.
++ */
++static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
++{
++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000,
++ data->config->shunt_div);
++ if (val <= 0 || val > dividend)
++ return -EINVAL;
++
++ mutex_lock(&data->config_lock);
++ data->rshunt = val;
++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val);
++ data->power_lsb_uW = data->config->power_lsb_factor *
++ data->current_lsb_uA;
++ mutex_unlock(&data->config_lock);
++
++ return 0;
++}
++
++static ssize_t ina2xx_store_shunt(struct device *dev,
++ struct device_attribute *da,
++ const char *buf, size_t count)
+ {
+ unsigned long val;
+ int status;
+@@ -315,18 +340,9 @@ static ssize_t ina2xx_set_shunt(struct device *dev,
+ if (status < 0)
+ return status;
+
+- if (val == 0 ||
+- /* Values greater than the calibration factor make no sense. */
+- val > data->config->calibration_factor)
+- return -EINVAL;
+-
+- mutex_lock(&data->config_lock);
+- data->rshunt = val;
+- status = ina2xx_calibrate(data);
+- mutex_unlock(&data->config_lock);
++ status = ina2xx_set_shunt(data, val);
+ if (status < 0)
+ return status;
+-
+ return count;
+ }
+
+@@ -386,7 +402,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
+
+ /* shunt resistance */
+ static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+- ina2xx_show_value, ina2xx_set_shunt,
++ ina2xx_show_value, ina2xx_store_shunt,
+ INA2XX_CALIBRATION);
+
+ /* update interval (ina226 only) */
+@@ -441,10 +457,7 @@ static int ina2xx_probe(struct i2c_client *client,
+ val = INA2XX_RSHUNT_DEFAULT;
+ }
+
+- if (val <= 0 || val > data->config->calibration_factor)
+- return -ENODEV;
+-
+- data->rshunt = val;
++ ina2xx_set_shunt(data, val);
+
+ ina2xx_regmap_config.max_register = data->config->registers;
+
+diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
+index d8517d2a968c..864488793f09 100644
+--- a/drivers/hwtracing/coresight/coresight-tmc.c
++++ b/drivers/hwtracing/coresight/coresight-tmc.c
+@@ -362,6 +362,13 @@ static int tmc_probe(struct amba_device *adev, const struct amba_id *id)
+ desc.type = CORESIGHT_DEV_TYPE_SINK;
+ desc.subtype.sink_subtype = CORESIGHT_DEV_SUBTYPE_SINK_BUFFER;
+ desc.ops = &tmc_etr_cs_ops;
++ /*
++ * ETR configuration uses a 40-bit AXI master in place of
++ * the embedded SRAM of ETB/ETF.
++ */
++ ret = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40));
++ if (ret)
++ goto out;
+ } else {
+ desc.type = CORESIGHT_DEV_TYPE_LINKSINK;
+ desc.subtype.link_subtype = CORESIGHT_DEV_SUBTYPE_LINK_FIFO;
+diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
+index 7bf00a0beb6f..4383324ec01c 100644
+--- a/drivers/hwtracing/coresight/coresight.c
++++ b/drivers/hwtracing/coresight/coresight.c
+@@ -498,6 +498,9 @@ int coresight_enable(struct coresight_device *csdev)
+ {
+ int cpu, ret = 0;
+ struct list_head *path;
++ enum coresight_dev_subtype_source subtype;
++
++ subtype = csdev->subtype.source_subtype;
+
+ mutex_lock(&coresight_mutex);
+
+@@ -505,8 +508,16 @@ int coresight_enable(struct coresight_device *csdev)
+ if (ret)
+ goto out;
+
+- if (csdev->enable)
++ if (csdev->enable) {
++ /*
++ * There could be multiple applications driving the software
++ * source. So keep the refcount for each such user when the
++ * source is already enabled.
++ */
++ if (subtype == CORESIGHT_DEV_SUBTYPE_SOURCE_SOFTWARE)
++ atomic_inc(csdev->refcnt);
+ goto out;
++ }
+
+ path = coresight_build_path(csdev);
+ if (IS_ERR(path)) {
+@@ -523,7 +534,7 @@ int coresight_enable(struct coresight_device *csdev)
+ if (ret)
+ goto err_source;
+
+- switch (csdev->subtype.source_subtype) {
++ switch (subtype) {
+ case CORESIGHT_DEV_SUBTYPE_SOURCE_PROC:
+ /*
+ * When working from sysFS it is important to keep track
+diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
+index c6a90b4a9c62..91b10afc8c34 100644
+--- a/drivers/i2c/muxes/i2c-mux-reg.c
++++ b/drivers/i2c/muxes/i2c-mux-reg.c
+@@ -196,20 +196,25 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ mux->data.reg_size = resource_size(res);
+ mux->data.reg = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(mux->data.reg))
+- return PTR_ERR(mux->data.reg);
++ if (IS_ERR(mux->data.reg)) {
++ ret = PTR_ERR(mux->data.reg);
++ goto err_put_parent;
++ }
+ }
+
+ if (mux->data.reg_size != 4 && mux->data.reg_size != 2 &&
+ mux->data.reg_size != 1) {
+ dev_err(&pdev->dev, "Invalid register size\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto err_put_parent;
+ }
+
+ muxc = i2c_mux_alloc(parent, &pdev->dev, mux->data.n_values, 0, 0,
+ i2c_mux_reg_select, NULL);
+- if (!muxc)
+- return -ENOMEM;
++ if (!muxc) {
++ ret = -ENOMEM;
++ goto err_put_parent;
++ }
+ muxc->priv = mux;
+
+ platform_set_drvdata(pdev, muxc);
+@@ -235,6 +240,8 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
+
+ add_adapter_failed:
+ i2c_mux_del_adapters(muxc);
++err_put_parent:
++ i2c_put_adapter(parent);
+
+ return ret;
+ }
+diff --git a/drivers/iio/adc/hi8435.c b/drivers/iio/adc/hi8435.c
+index 678e8c7ea763..fec696ec3fd1 100644
+--- a/drivers/iio/adc/hi8435.c
++++ b/drivers/iio/adc/hi8435.c
+@@ -121,10 +121,21 @@ static int hi8435_write_event_config(struct iio_dev *idev,
+ enum iio_event_direction dir, int state)
+ {
+ struct hi8435_priv *priv = iio_priv(idev);
++ int ret;
++ u32 tmp;
++
++ if (state) {
++ ret = hi8435_readl(priv, HI8435_SO31_0_REG, &tmp);
++ if (ret < 0)
++ return ret;
++ if (tmp & BIT(chan->channel))
++ priv->event_prev_val |= BIT(chan->channel);
++ else
++ priv->event_prev_val &= ~BIT(chan->channel);
+
+- priv->event_scan_mask &= ~BIT(chan->channel);
+- if (state)
+ priv->event_scan_mask |= BIT(chan->channel);
++ } else
++ priv->event_scan_mask &= ~BIT(chan->channel);
+
+ return 0;
+ }
+@@ -442,13 +453,15 @@ static int hi8435_probe(struct spi_device *spi)
+ priv->spi = spi;
+
+ reset_gpio = devm_gpiod_get(&spi->dev, NULL, GPIOD_OUT_LOW);
+- if (IS_ERR(reset_gpio)) {
+- /* chip s/w reset if h/w reset failed */
++ if (!IS_ERR(reset_gpio)) {
++ /* need >=100ns low pulse to reset chip */
++ gpiod_set_raw_value_cansleep(reset_gpio, 0);
++ udelay(1);
++ gpiod_set_raw_value_cansleep(reset_gpio, 1);
++ } else {
++ /* s/w reset chip if h/w reset is not available */
+ hi8435_writeb(priv, HI8435_CTRL_REG, HI8435_CTRL_SRST);
+ hi8435_writeb(priv, HI8435_CTRL_REG, 0);
+- } else {
+- udelay(5);
+- gpiod_set_value(reset_gpio, 1);
+ }
+
+ spi_set_drvdata(spi, idev);
+diff --git a/drivers/iio/light/rpr0521.c b/drivers/iio/light/rpr0521.c
+index 7de0f397194b..d23cf7759ee7 100644
+--- a/drivers/iio/light/rpr0521.c
++++ b/drivers/iio/light/rpr0521.c
+@@ -510,13 +510,26 @@ static int rpr0521_probe(struct i2c_client *client,
+
+ ret = pm_runtime_set_active(&client->dev);
+ if (ret < 0)
+- return ret;
++ goto err_poweroff;
+
+ pm_runtime_enable(&client->dev);
+ pm_runtime_set_autosuspend_delay(&client->dev, RPR0521_SLEEP_DELAY_MS);
+ pm_runtime_use_autosuspend(&client->dev);
+
+- return iio_device_register(indio_dev);
++ ret = iio_device_register(indio_dev);
++ if (ret)
++ goto err_pm_disable;
++
++ return 0;
++
++err_pm_disable:
++ pm_runtime_disable(&client->dev);
++ pm_runtime_set_suspended(&client->dev);
++ pm_runtime_put_noidle(&client->dev);
++err_poweroff:
++ rpr0521_poweroff(data);
++
++ return ret;
+ }
+
+ static int rpr0521_remove(struct i2c_client *client)
+diff --git a/drivers/iio/magnetometer/st_magn_spi.c b/drivers/iio/magnetometer/st_magn_spi.c
+index 6325e7dc8e03..f3cb4dc05391 100644
+--- a/drivers/iio/magnetometer/st_magn_spi.c
++++ b/drivers/iio/magnetometer/st_magn_spi.c
+@@ -48,8 +48,6 @@ static int st_magn_spi_remove(struct spi_device *spi)
+ }
+
+ static const struct spi_device_id st_magn_id_table[] = {
+- { LSM303DLHC_MAGN_DEV_NAME },
+- { LSM303DLM_MAGN_DEV_NAME },
+ { LIS3MDL_MAGN_DEV_NAME },
+ { LSM303AGR_MAGN_DEV_NAME },
+ {},
+diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c
+index 19d2eb46fda6..2a4a62ebfd8d 100644
+--- a/drivers/iio/pressure/zpa2326.c
++++ b/drivers/iio/pressure/zpa2326.c
+@@ -871,12 +871,13 @@ static int zpa2326_wait_oneshot_completion(const struct iio_dev *indio_dev,
+ {
+ int ret;
+ unsigned int val;
++ long timeout;
+
+ zpa2326_dbg(indio_dev, "waiting for one shot completion interrupt");
+
+- ret = wait_for_completion_interruptible_timeout(
++ timeout = wait_for_completion_interruptible_timeout(
+ &private->data_ready, ZPA2326_CONVERSION_JIFFIES);
+- if (ret > 0)
++ if (timeout > 0)
+ /*
+ * Interrupt handler completed before timeout: return operation
+ * status.
+@@ -886,13 +887,16 @@ static int zpa2326_wait_oneshot_completion(const struct iio_dev *indio_dev,
+ /* Clear all interrupts just to be sure. */
+ regmap_read(private->regmap, ZPA2326_INT_SOURCE_REG, &val);
+
+- if (!ret)
++ if (!timeout) {
+ /* Timed out. */
++ zpa2326_warn(indio_dev, "no one shot interrupt occurred (%ld)",
++ timeout);
+ ret = -ETIME;
+-
+- if (ret != -ERESTARTSYS)
+- zpa2326_warn(indio_dev, "no one shot interrupt occurred (%d)",
+- ret);
++ } else if (timeout < 0) {
++ zpa2326_warn(indio_dev,
++ "wait for one shot interrupt cancelled");
++ ret = -ERESTARTSYS;
++ }
+
+ return ret;
+ }
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 6512a555f7f8..dd18b74cd01d 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -488,6 +488,7 @@ static int _put_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
+
+ ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
+ release_ep_resources(ep);
++ kfree_skb(skb);
+ return 0;
+ }
+
+@@ -498,6 +499,7 @@ static int _put_pass_ep_safe(struct c4iw_dev *dev, struct sk_buff *skb)
+ ep = *((struct c4iw_ep **)(skb->cb + 2 * sizeof(void *)));
+ c4iw_put_ep(&ep->parent_ep->com);
+ release_ep_resources(ep);
++ kfree_skb(skb);
+ return 0;
+ }
+
+@@ -569,11 +571,13 @@ static void abort_arp_failure(void *handle, struct sk_buff *skb)
+
+ PDBG("%s rdev %p\n", __func__, rdev);
+ req->cmd = CPL_ABORT_NO_RST;
++ skb_get(skb);
+ ret = c4iw_ofld_send(rdev, skb);
+ if (ret) {
+ __state_set(&ep->com, DEAD);
+ queue_arp_failure_cpl(ep, skb, FAKE_CPL_PUT_EP_SAFE);
+- }
++ } else
++ kfree_skb(skb);
+ }
+
+ static int send_flowc(struct c4iw_ep *ep)
+diff --git a/drivers/infiniband/hw/hfi1/sysfs.c b/drivers/infiniband/hw/hfi1/sysfs.c
+index 919a5474e651..621b60ab74ee 100644
+--- a/drivers/infiniband/hw/hfi1/sysfs.c
++++ b/drivers/infiniband/hw/hfi1/sysfs.c
+@@ -196,7 +196,8 @@ static const struct sysfs_ops port_cc_sysfs_ops = {
+ };
+
+ static struct attribute *port_cc_default_attributes[] = {
+- &cc_prescan_attr.attr
++ &cc_prescan_attr.attr,
++ NULL
+ };
+
+ static struct kobj_type port_cc_ktype = {
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+index 2c4b4d072d6a..3b973cba8975 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+@@ -3644,8 +3644,10 @@ enum i40iw_status_code i40iw_config_fpm_values(struct i40iw_sc_dev *dev, u32 qp_
+ hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].cnt = 1;
+ hmc_info->hmc_obj[I40IW_HMC_IW_MR].cnt = mrwanted;
+
+- hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt = I40IW_MAX_WQ_ENTRIES * qpwanted;
+- hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt = 4 * I40IW_MAX_IRD_SIZE * qpwanted;
++ hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt =
++ roundup_pow_of_two(I40IW_MAX_WQ_ENTRIES * qpwanted);
++ hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt =
++ roundup_pow_of_two(2 * I40IW_MAX_IRD_SIZE * qpwanted);
+ hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].cnt =
+ hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt / hmc_fpm_misc->xf_block_size;
+ hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].cnt =
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
+index d1328a697750..8ce599e1639c 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
+@@ -86,6 +86,7 @@
+ #define RDMA_OPCODE_MASK 0x0f
+ #define RDMA_READ_REQ_OPCODE 1
+ #define Q2_BAD_FRAME_OFFSET 72
++#define Q2_FPSN_OFFSET 64
+ #define CQE_MAJOR_DRV 0x8000
+
+ #define I40IW_TERM_SENT 0x01
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c
+index c62d354f7810..3ed49146d73c 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c
+@@ -1320,7 +1320,7 @@ static void i40iw_ieq_handle_exception(struct i40iw_puda_rsrc *ieq,
+ u32 *hw_host_ctx = (u32 *)qp->hw_host_ctx;
+ u32 rcv_wnd = hw_host_ctx[23];
+ /* first partial seq # in q2 */
+- u32 fps = qp->q2_buf[16];
++ u32 fps = *(u32 *)(qp->q2_buf + Q2_FPSN_OFFSET);
+ struct list_head *rxlist = &pfpdu->rxlist;
+ struct list_head *plist;
+
+diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c
+index 6d9904a4a0ab..29dc5278d7be 100644
+--- a/drivers/infiniband/sw/rdmavt/cq.c
++++ b/drivers/infiniband/sw/rdmavt/cq.c
+@@ -197,7 +197,7 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev,
+ return ERR_PTR(-EINVAL);
+
+ /* Allocate the completion queue structure. */
+- cq = kzalloc(sizeof(*cq), GFP_KERNEL);
++ cq = kzalloc_node(sizeof(*cq), GFP_KERNEL, rdi->dparms.node);
+ if (!cq)
+ return ERR_PTR(-ENOMEM);
+
+@@ -213,7 +213,9 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev,
+ sz += sizeof(struct ib_uverbs_wc) * (entries + 1);
+ else
+ sz += sizeof(struct ib_wc) * (entries + 1);
+- wc = vmalloc_user(sz);
++ wc = udata ?
++ vmalloc_user(sz) :
++ vzalloc_node(sz, rdi->dparms.node);
+ if (!wc) {
+ ret = ERR_PTR(-ENOMEM);
+ goto bail_cq;
+@@ -368,7 +370,9 @@ int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
+ sz += sizeof(struct ib_uverbs_wc) * (cqe + 1);
+ else
+ sz += sizeof(struct ib_wc) * (cqe + 1);
+- wc = vmalloc_user(sz);
++ wc = udata ?
++ vmalloc_user(sz) :
++ vzalloc_node(sz, rdi->dparms.node);
+ if (!wc)
+ return -ENOMEM;
+
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index 29ab814693fc..876f438aa048 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2292,12 +2292,8 @@ static void srpt_queue_response(struct se_cmd *cmd)
+ }
+ spin_unlock_irqrestore(&ioctx->spinlock, flags);
+
+- if (unlikely(transport_check_aborted_status(&ioctx->cmd, false)
+- || WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) {
+- atomic_inc(&ch->req_lim_delta);
+- srpt_abort_cmd(ioctx);
++ if (unlikely(WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT)))
+ return;
+- }
+
+ /* For read commands, transfer the data to the initiator. */
+ if (ioctx->cmd.data_direction == DMA_FROM_DEVICE &&
+@@ -2670,7 +2666,8 @@ static void srpt_release_cmd(struct se_cmd *se_cmd)
+ struct srpt_rdma_ch *ch = ioctx->ch;
+ unsigned long flags;
+
+- WARN_ON(ioctx->state != SRPT_STATE_DONE);
++ WARN_ON_ONCE(ioctx->state != SRPT_STATE_DONE &&
++ !(ioctx->cmd.transport_state & CMD_T_ABORTED));
+
+ if (ioctx->n_rw_ctx) {
+ srpt_free_rw_ctxs(ch, ioctx);
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index c9d491bc85e0..3851d5715772 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1082,6 +1082,13 @@ static int elan_probe(struct i2c_client *client,
+ return error;
+ }
+
++ /* Make sure there is something at this address */
++ error = i2c_smbus_read_byte(client);
++ if (error < 0) {
++ dev_dbg(&client->dev, "nothing at this address: %d\n", error);
++ return -ENXIO;
++ }
++
+ /* Initialize the touchpad. */
+ error = elan_initialize(data);
+ if (error)
+diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
+index a679e56c44cd..765879dcaf85 100644
+--- a/drivers/input/mouse/elan_i2c_i2c.c
++++ b/drivers/input/mouse/elan_i2c_i2c.c
+@@ -557,7 +557,14 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
+ long ret;
+ int error;
+ int len;
+- u8 buffer[ETP_I2C_INF_LENGTH];
++ u8 buffer[ETP_I2C_REPORT_LEN];
++
++ len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
++ if (len != ETP_I2C_REPORT_LEN) {
++ error = len < 0 ? len : -EIO;
++ dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
++ error, len);
++ }
+
+ reinit_completion(completion);
+ enable_irq(client->irq);
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 59603a5728f7..c519c0b09568 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1711,6 +1711,17 @@ int elantech_init(struct psmouse *psmouse)
+ etd->samples[0], etd->samples[1], etd->samples[2]);
+ }
+
++ if (etd->samples[1] == 0x74 && etd->hw_version == 0x03) {
++ /*
++ * This module has a bug which makes absolute mode
++ * unusable, so let's abort so we'll be using standard
++ * PS/2 protocol.
++ */
++ psmouse_info(psmouse,
++ "absolute mode broken, forcing standard PS/2 protocol\n");
++ goto init_fail;
++ }
++
+ if (elantech_set_absolute_mode(psmouse)) {
+ psmouse_err(psmouse,
+ "failed to put touchpad into absolute mode.\n");
+diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c
+index 240b16f3ee97..5907fddcc966 100644
+--- a/drivers/input/touchscreen/goodix.c
++++ b/drivers/input/touchscreen/goodix.c
+@@ -778,8 +778,10 @@ static int __maybe_unused goodix_suspend(struct device *dev)
+ int error;
+
+ /* We need gpio pins to suspend/resume */
+- if (!ts->gpiod_int || !ts->gpiod_rst)
++ if (!ts->gpiod_int || !ts->gpiod_rst) {
++ disable_irq(client->irq);
+ return 0;
++ }
+
+ wait_for_completion(&ts->firmware_loading_complete);
+
+@@ -819,8 +821,10 @@ static int __maybe_unused goodix_resume(struct device *dev)
+ struct goodix_ts_data *ts = i2c_get_clientdata(client);
+ int error;
+
+- if (!ts->gpiod_int || !ts->gpiod_rst)
++ if (!ts->gpiod_int || !ts->gpiod_rst) {
++ enable_irq(client->irq);
+ return 0;
++ }
+
+ /*
+ * Exit sleep mode by outputting HIGH level to INT pin
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index fd4a78296b48..100c80e48190 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1250,6 +1250,10 @@ gic_acpi_parse_madt_gicc(struct acpi_subtable_header *header,
+ u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
+ void __iomem *redist_base;
+
++ /* GICC entry which has !ACPI_MADT_ENABLED is not unusable so skip */
++ if (!(gicc->flags & ACPI_MADT_ENABLED))
++ return 0;
++
+ redist_base = ioremap(gicc->gicr_base_address, size);
+ if (!redist_base)
+ return -ENOMEM;
+@@ -1299,6 +1303,13 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header,
+ if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
+ return 0;
+
++ /*
++ * It's perfectly valid firmware can pass disabled GICC entry, driver
++ * should not treat as errors, skip the entry instead of probe fail.
++ */
++ if (!(gicc->flags & ACPI_MADT_ENABLED))
++ return 0;
++
+ return -ENODEV;
+ }
+
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 03b79b061d24..05d87f60d929 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -105,10 +105,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
+ static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
+ u32 *mask, u32 *addr)
+ {
+- unsigned int ofst;
+-
+- hwirq -= RESERVED_IRQ_PER_MBIGEN_CHIP;
+- ofst = hwirq / 32 * 4;
++ unsigned int ofst = (hwirq / 32) * 4;
+
+ *mask = 1 << (hwirq % 32);
+ *addr = ofst + REG_MBIGEN_CLEAR_OFFSET;
+diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
+index 9cb4b621fbc3..b92a19a594a1 100644
+--- a/drivers/isdn/mISDN/stack.c
++++ b/drivers/isdn/mISDN/stack.c
+@@ -72,7 +72,7 @@ send_socklist(struct mISDN_sock_list *sl, struct sk_buff *skb)
+ if (sk->sk_state != MISDN_BOUND)
+ continue;
+ if (!cskb)
+- cskb = skb_copy(skb, GFP_KERNEL);
++ cskb = skb_copy(skb, GFP_ATOMIC);
+ if (!cskb) {
+ printk(KERN_WARNING "%s no skb\n", __func__);
+ break;
+diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
+index 840401ae9a4e..f6726484a8a1 100644
+--- a/drivers/leds/leds-pca955x.c
++++ b/drivers/leds/leds-pca955x.c
+@@ -266,7 +266,7 @@ static int pca955x_probe(struct i2c_client *client,
+ "slave address 0x%02x\n",
+ id->name, chip->bits, client->addr);
+
+- if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
++ if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+ return -EIO;
+
+ if (pdata) {
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 537903bf9add..d23337e8c4ee 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -512,15 +512,21 @@ struct open_bucket {
+
+ /*
+ * We keep multiple buckets open for writes, and try to segregate different
+- * write streams for better cache utilization: first we look for a bucket where
+- * the last write to it was sequential with the current write, and failing that
+- * we look for a bucket that was last used by the same task.
++ * write streams for better cache utilization: first we try to segregate flash
++ * only volume write streams from cached devices, secondly we look for a bucket
++ * where the last write to it was sequential with the current write, and
++ * failing that we look for a bucket that was last used by the same task.
+ *
+ * The ideas is if you've got multiple tasks pulling data into the cache at the
+ * same time, you'll get better cache utilization if you try to segregate their
+ * data and preserve locality.
+ *
+- * For example, say you've starting Firefox at the same time you're copying a
++ * For example, dirty sectors of flash only volume is not reclaimable, if their
++ * dirty sectors mixed with dirty sectors of cached device, such buckets will
++ * be marked as dirty and won't be reclaimed, though the dirty data of cached
++ * device have been written back to backend device.
++ *
++ * And say you've starting Firefox at the same time you're copying a
+ * bunch of files. Firefox will likely end up being fairly hot and stay in the
+ * cache awhile, but the data you copied might not be; if you wrote all that
+ * data to the same buckets it'd get invalidated at the same time.
+@@ -537,7 +543,10 @@ static struct open_bucket *pick_data_bucket(struct cache_set *c,
+ struct open_bucket *ret, *ret_task = NULL;
+
+ list_for_each_entry_reverse(ret, &c->data_buckets, list)
+- if (!bkey_cmp(&ret->key, search))
++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) !=
++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)]))
++ continue;
++ else if (!bkey_cmp(&ret->key, search))
+ goto found;
+ else if (ret->last_write_point == write_point)
+ ret_task = ret;
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c61341c84d2d..4af7cd423c71 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -892,6 +892,12 @@ static void cached_dev_detach_finish(struct work_struct *w)
+
+ mutex_lock(&bch_register_lock);
+
++ cancel_delayed_work_sync(&dc->writeback_rate_update);
++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) {
++ kthread_stop(dc->writeback_thread);
++ dc->writeback_thread = NULL;
++ }
++
+ memset(&dc->sb.set_uuid, 0, 16);
+ SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE);
+
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index ba7edcdd09ce..fcc2b5746a9f 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -1122,8 +1122,10 @@ static int add_new_disk(struct mddev *mddev, struct md_rdev *rdev)
+ cmsg.raid_slot = cpu_to_le32(rdev->desc_nr);
+ lock_comm(cinfo);
+ ret = __sendmsg(cinfo, &cmsg);
+- if (ret)
++ if (ret) {
++ unlock_comm(cinfo);
+ return ret;
++ }
+ cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE;
+ ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX);
+ cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 4493be50fc6a..86ba7851e881 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -110,8 +110,7 @@ static inline void unlock_device_hash_lock(struct r5conf *conf, int hash)
+ static inline void lock_all_device_hash_locks_irq(struct r5conf *conf)
+ {
+ int i;
+- local_irq_disable();
+- spin_lock(conf->hash_locks);
++ spin_lock_irq(conf->hash_locks);
+ for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
+ spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks);
+ spin_lock(&conf->device_lock);
+@@ -121,9 +120,9 @@ static inline void unlock_all_device_hash_locks_irq(struct r5conf *conf)
+ {
+ int i;
+ spin_unlock(&conf->device_lock);
+- for (i = NR_STRIPE_HASH_LOCKS; i; i--)
+- spin_unlock(conf->hash_locks + i - 1);
+- local_irq_enable();
++ for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--)
++ spin_unlock(conf->hash_locks + i);
++ spin_unlock_irq(conf->hash_locks);
+ }
+
+ /* bio's attached to a stripe+device for I/O are linked together in bi_sector
+@@ -732,12 +731,11 @@ static bool is_full_stripe_write(struct stripe_head *sh)
+
+ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
+ {
+- local_irq_disable();
+ if (sh1 > sh2) {
+- spin_lock(&sh2->stripe_lock);
++ spin_lock_irq(&sh2->stripe_lock);
+ spin_lock_nested(&sh1->stripe_lock, 1);
+ } else {
+- spin_lock(&sh1->stripe_lock);
++ spin_lock_irq(&sh1->stripe_lock);
+ spin_lock_nested(&sh2->stripe_lock, 1);
+ }
+ }
+@@ -745,8 +743,7 @@ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
+ static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
+ {
+ spin_unlock(&sh1->stripe_lock);
+- spin_unlock(&sh2->stripe_lock);
+- local_irq_enable();
++ spin_unlock_irq(&sh2->stripe_lock);
+ }
+
+ /* Only freshly new full stripe normal write stripe can be added to a batch list */
+diff --git a/drivers/media/i2c/cx25840/cx25840-core.c b/drivers/media/i2c/cx25840/cx25840-core.c
+index 142ae28803bb..d558ed3e59c6 100644
+--- a/drivers/media/i2c/cx25840/cx25840-core.c
++++ b/drivers/media/i2c/cx25840/cx25840-core.c
+@@ -420,11 +420,13 @@ static void cx25840_initialize(struct i2c_client *client)
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ /* 6. */
+ cx25840_write(client, 0x115, 0x8c);
+@@ -634,11 +636,13 @@ static void cx23885_initialize(struct i2c_client *client)
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ /* Call the cx23888 specific std setup func, we no longer rely on
+ * the generic cx24840 func.
+@@ -752,11 +756,13 @@ static void cx231xx_initialize(struct i2c_client *client)
+ INIT_WORK(&state->fw_work, cx25840_work_handler);
+ init_waitqueue_head(&state->fw_wait);
+ q = create_singlethread_workqueue("cx25840_fw");
+- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
+- queue_work(q, &state->fw_work);
+- schedule();
+- finish_wait(&state->fw_wait, &wait);
+- destroy_workqueue(q);
++ if (q) {
++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE);
++ queue_work(q, &state->fw_work);
++ schedule();
++ finish_wait(&state->fw_wait, &wait);
++ destroy_workqueue(q);
++ }
+
+ cx25840_std_setup(client);
+
+diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c
+index c12209c701d3..390d708c807a 100644
+--- a/drivers/media/platform/pxa_camera.c
++++ b/drivers/media/platform/pxa_camera.c
+@@ -2169,6 +2169,12 @@ static void pxa_camera_sensor_unbind(struct v4l2_async_notifier *notifier,
+ pxa_dma_stop_channels(pcdev);
+
+ pxa_camera_destroy_formats(pcdev);
++
++ if (pcdev->mclk_clk) {
++ v4l2_clk_unregister(pcdev->mclk_clk);
++ pcdev->mclk_clk = NULL;
++ }
++
+ video_unregister_device(&pcdev->vdev);
+ pcdev->sensor = NULL;
+
+@@ -2495,7 +2501,13 @@ static int pxa_camera_remove(struct platform_device *pdev)
+ dma_release_channel(pcdev->dma_chans[1]);
+ dma_release_channel(pcdev->dma_chans[2]);
+
+- v4l2_clk_unregister(pcdev->mclk_clk);
++ v4l2_async_notifier_unregister(&pcdev->notifier);
++
++ if (pcdev->mclk_clk) {
++ v4l2_clk_unregister(pcdev->mclk_clk);
++ pcdev->mclk_clk = NULL;
++ }
++
+ v4l2_device_unregister(&pcdev->v4l2_dev);
+
+ dev_info(&pdev->dev, "PXA Camera driver unloaded\n");
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index db525cdfac88..d9f88a4a96bd 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -1381,8 +1381,13 @@ static int mceusb_dev_probe(struct usb_interface *intf,
+ goto rc_dev_fail;
+
+ /* wire up inbound data handler */
+- usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
+- mceusb_dev_recv, ir, ep_in->bInterval);
++ if (usb_endpoint_xfer_int(ep_in))
++ usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
++ mceusb_dev_recv, ir, ep_in->bInterval);
++ else
++ usb_fill_bulk_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp,
++ mceusb_dev_recv, ir);
++
+ ir->urb_in->transfer_dma = ir->dma_in;
+ ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
+index 9ccf7f5e0e2e..4299ce06c25b 100644
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -334,6 +334,10 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory,
+ struct vb2_buffer *vb;
+ int ret;
+
++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */
++ num_buffers = min_t(unsigned int, num_buffers,
++ VB2_MAX_FRAME - q->num_buffers);
++
+ for (buffer = 0; buffer < num_buffers; ++buffer) {
+ /* Allocate videobuf buffer structures */
+ vb = kzalloc(q->buf_struct_size, GFP_KERNEL);
+diff --git a/drivers/misc/cxl/flash.c b/drivers/misc/cxl/flash.c
+index c63d61e17d56..381a9a166f93 100644
+--- a/drivers/misc/cxl/flash.c
++++ b/drivers/misc/cxl/flash.c
+@@ -401,8 +401,10 @@ static int device_open(struct inode *inode, struct file *file)
+ if (down_interruptible(&sem) != 0)
+ return -EPERM;
+
+- if (!(adapter = get_cxl_adapter(adapter_num)))
+- return -ENODEV;
++ if (!(adapter = get_cxl_adapter(adapter_num))) {
++ rc = -ENODEV;
++ goto err_unlock;
++ }
+
+ file->private_data = adapter;
+ continue_token = 0;
+@@ -446,6 +448,8 @@ static int device_open(struct inode *inode, struct file *file)
+ free_page((unsigned long) le);
+ err:
+ put_device(&adapter->dev);
++err_unlock:
++ up(&sem);
+
+ return rc;
+ }
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index f84a4275ca29..f735ab4ba84e 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -298,8 +298,11 @@ static void *qp_alloc_queue(u64 size, u32 flags)
+ size_t pas_size;
+ size_t vas_size;
+ size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if);
+- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
++ u64 num_pages;
+
++ if (size > SIZE_MAX - PAGE_SIZE)
++ return NULL;
++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+ if (num_pages >
+ (SIZE_MAX - queue_size) /
+ (sizeof(*queue->kernel_if->u.g.pas) +
+@@ -624,9 +627,12 @@ static struct vmci_queue *qp_host_alloc_queue(u64 size)
+ {
+ struct vmci_queue *queue;
+ size_t queue_page_size;
+- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
++ u64 num_pages;
+ const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if));
+
++ if (size > SIZE_MAX - PAGE_SIZE)
++ return NULL;
++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+ if (num_pages > (SIZE_MAX - queue_size) /
+ sizeof(*queue->kernel_if->u.h.page))
+ return NULL;
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index b0b9ceb0ab01..cfb794766fea 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -492,6 +492,8 @@ static int intel_mrfld_mmc_probe_slot(struct sdhci_pci_slot *slot)
+ slot->host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
+ break;
+ case INTEL_MRFLD_SDIO:
++ /* Advertise 2.0v for compatibility with the SDIO card's OCR */
++ slot->host->ocr_mask = MMC_VDD_20_21 | MMC_VDD_165_195;
+ slot->host->mmc->caps |= MMC_CAP_NONREMOVABLE |
+ MMC_CAP_POWER_OFF_CARD;
+ break;
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 7d275e72903a..44ea9d88651f 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1404,6 +1404,13 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
+ if (mode != MMC_POWER_OFF) {
+ switch (1 << vdd) {
+ case MMC_VDD_165_195:
++ /*
++ * Without a regulator, SDHCI does not support 2.0v
++ * so we only get here if the driver deliberately
++ * added the 2.0v range to ocr_avail. Map it to 1.8v
++ * for the purpose of turning on the power.
++ */
++ case MMC_VDD_20_21:
+ pwr = SDHCI_POWER_180;
+ break;
+ case MMC_VDD_29_30:
+diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+index 427039b77668..d9dab4275859 100644
+--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
+@@ -2047,18 +2047,20 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
+
+ ret = nand_boot_init(this);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+ ret = chip->scan_bbt(mtd);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret)
+- goto err_out;
++ goto err_nand_cleanup;
+ return 0;
+
++err_nand_cleanup:
++ nand_cleanup(chip);
+ err_out:
+- gpmi_nand_exit(this);
++ gpmi_free_dma_buffer(this);
+ return ret;
+ }
+
+diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
+index a3e86e52640a..5fb45161789c 100644
+--- a/drivers/mtd/nand/nand_base.c
++++ b/drivers/mtd/nand/nand_base.c
+@@ -4785,6 +4785,11 @@ int nand_scan_tail(struct mtd_info *mtd)
+ goto err_free;
+ }
+ ecc->total = ecc->steps * ecc->bytes;
++ if (ecc->total > mtd->oobsize) {
++ WARN(1, "Total number of ECC bytes exceeded oobsize\n");
++ ret = -EINVAL;
++ goto err_free;
++ }
+
+ /*
+ * The number of bytes available for a client to place data into
+diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c
+index 1cb3f7758fb6..766b2c385682 100644
+--- a/drivers/mtd/tests/oobtest.c
++++ b/drivers/mtd/tests/oobtest.c
+@@ -193,6 +193,9 @@ static int verify_eraseblock(int ebnum)
+ ops.datbuf = NULL;
+ ops.oobbuf = readbuf;
+ err = mtd_read_oob(mtd, addr, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err || ops.oobretlen != use_len) {
+ pr_err("error: readoob failed at %#llx\n",
+ (long long)addr);
+@@ -227,6 +230,9 @@ static int verify_eraseblock(int ebnum)
+ ops.datbuf = NULL;
+ ops.oobbuf = readbuf;
+ err = mtd_read_oob(mtd, addr, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err || ops.oobretlen != mtd->oobavail) {
+ pr_err("error: readoob failed at %#llx\n",
+ (long long)addr);
+@@ -286,6 +292,9 @@ static int verify_eraseblock_in_one_go(int ebnum)
+
+ /* read entire block's OOB at one go */
+ err = mtd_read_oob(mtd, addr, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err || ops.oobretlen != len) {
+ pr_err("error: readoob failed at %#llx\n",
+ (long long)addr);
+@@ -527,6 +536,9 @@ static int __init mtd_oobtest_init(void)
+ pr_info("attempting to start read past end of OOB\n");
+ pr_info("an error is expected...\n");
+ err = mtd_read_oob(mtd, addr0, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err) {
+ pr_info("error occurred as expected\n");
+ err = 0;
+@@ -571,6 +583,9 @@ static int __init mtd_oobtest_init(void)
+ pr_info("attempting to read past end of device\n");
+ pr_info("an error is expected...\n");
+ err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err) {
+ pr_info("error occurred as expected\n");
+ err = 0;
+@@ -615,6 +630,9 @@ static int __init mtd_oobtest_init(void)
+ pr_info("attempting to read past end of device\n");
+ pr_info("an error is expected...\n");
+ err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err) {
+ pr_info("error occurred as expected\n");
+ err = 0;
+@@ -684,6 +702,9 @@ static int __init mtd_oobtest_init(void)
+ ops.datbuf = NULL;
+ ops.oobbuf = readbuf;
+ err = mtd_read_oob(mtd, addr, &ops);
++ if (mtd_is_bitflip(err))
++ err = 0;
++
+ if (err)
+ goto out;
+ if (memcmpshow(addr, readbuf, writebuf,
+diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
+index c1f5c29e458e..b44c8d348e78 100644
+--- a/drivers/mtd/ubi/fastmap.c
++++ b/drivers/mtd/ubi/fastmap.c
+@@ -828,6 +828,24 @@ static int find_fm_anchor(struct ubi_attach_info *ai)
+ return ret;
+ }
+
++static struct ubi_ainf_peb *clone_aeb(struct ubi_attach_info *ai,
++ struct ubi_ainf_peb *old)
++{
++ struct ubi_ainf_peb *new;
++
++ new = ubi_alloc_aeb(ai, old->pnum, old->ec);
++ if (!new)
++ return NULL;
++
++ new->vol_id = old->vol_id;
++ new->sqnum = old->sqnum;
++ new->lnum = old->lnum;
++ new->scrub = old->scrub;
++ new->copy_flag = old->copy_flag;
++
++ return new;
++}
++
+ /**
+ * ubi_scan_fastmap - scan the fastmap.
+ * @ubi: UBI device object
+@@ -847,7 +865,7 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
+ struct ubi_vid_hdr *vh;
+ struct ubi_ec_hdr *ech;
+ struct ubi_fastmap_layout *fm;
+- struct ubi_ainf_peb *tmp_aeb, *aeb;
++ struct ubi_ainf_peb *aeb;
+ int i, used_blocks, pnum, fm_anchor, ret = 0;
+ size_t fm_size;
+ __be32 crc, tmp_crc;
+@@ -857,9 +875,16 @@ int ubi_scan_fastmap(struct ubi_device *ubi, struct ubi_attach_info *ai,
+ if (fm_anchor < 0)
+ return UBI_NO_FASTMAP;
+
+- /* Move all (possible) fastmap blocks into our new attach structure. */
+- list_for_each_entry_safe(aeb, tmp_aeb, &scan_ai->fastmap, u.list)
+- list_move_tail(&aeb->u.list, &ai->fastmap);
++ /* Copy all (possible) fastmap blocks into our new attach structure. */
++ list_for_each_entry(aeb, &scan_ai->fastmap, u.list) {
++ struct ubi_ainf_peb *new;
++
++ new = clone_aeb(ai, aeb);
++ if (!new)
++ return -ENOMEM;
++
++ list_add(&new->u.list, &ai->fastmap);
++ }
+
+ down_write(&ubi->fm_protect);
+ memset(ubi->fm_buf, 0, ubi->fm_size);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 4907c9b57565..513457a2a7bf 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1524,39 +1524,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ goto err_close;
+ }
+
+- /* If the mode uses primary, then the following is handled by
+- * bond_change_active_slave().
+- */
+- if (!bond_uses_primary(bond)) {
+- /* set promiscuity level to new slave */
+- if (bond_dev->flags & IFF_PROMISC) {
+- res = dev_set_promiscuity(slave_dev, 1);
+- if (res)
+- goto err_close;
+- }
+-
+- /* set allmulti level to new slave */
+- if (bond_dev->flags & IFF_ALLMULTI) {
+- res = dev_set_allmulti(slave_dev, 1);
+- if (res)
+- goto err_close;
+- }
+-
+- netif_addr_lock_bh(bond_dev);
+-
+- dev_mc_sync_multiple(slave_dev, bond_dev);
+- dev_uc_sync_multiple(slave_dev, bond_dev);
+-
+- netif_addr_unlock_bh(bond_dev);
+- }
+-
+- if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+- /* add lacpdu mc addr to mc list */
+- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
+-
+- dev_mc_add(slave_dev, lacpdu_multicast);
+- }
+-
+ res = vlan_vids_add_by_dev(slave_dev, bond_dev);
+ if (res) {
+ netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n",
+@@ -1719,6 +1686,40 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ goto err_upper_unlink;
+ }
+
++ /* If the mode uses primary, then the following is handled by
++ * bond_change_active_slave().
++ */
++ if (!bond_uses_primary(bond)) {
++ /* set promiscuity level to new slave */
++ if (bond_dev->flags & IFF_PROMISC) {
++ res = dev_set_promiscuity(slave_dev, 1);
++ if (res)
++ goto err_sysfs_del;
++ }
++
++ /* set allmulti level to new slave */
++ if (bond_dev->flags & IFF_ALLMULTI) {
++ res = dev_set_allmulti(slave_dev, 1);
++ if (res) {
++ if (bond_dev->flags & IFF_PROMISC)
++ dev_set_promiscuity(slave_dev, -1);
++ goto err_sysfs_del;
++ }
++ }
++
++ netif_addr_lock_bh(bond_dev);
++ dev_mc_sync_multiple(slave_dev, bond_dev);
++ dev_uc_sync_multiple(slave_dev, bond_dev);
++ netif_addr_unlock_bh(bond_dev);
++
++ if (BOND_MODE(bond) == BOND_MODE_8023AD) {
++ /* add lacpdu mc addr to mc list */
++ u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
++
++ dev_mc_add(slave_dev, lacpdu_multicast);
++ }
++ }
++
+ bond->slave_cnt++;
+ bond_compute_features(bond);
+ bond_set_carrier(bond);
+@@ -1742,6 +1743,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ return 0;
+
+ /* Undo stages on error */
++err_sysfs_del:
++ bond_sysfs_slave_del(new_slave);
++
+ err_upper_unlink:
+ bond_upper_dev_unlink(bond, new_slave);
+
+@@ -1749,9 +1753,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ netdev_rx_handler_unregister(slave_dev);
+
+ err_detach:
+- if (!bond_uses_primary(bond))
+- bond_hw_addr_flush(bond_dev, slave_dev);
+-
+ vlan_vids_del_by_dev(slave_dev, bond_dev);
+ if (rcu_access_pointer(bond->primary_slave) == new_slave)
+ RCU_INIT_POINTER(bond->primary_slave, NULL);
+@@ -2605,11 +2606,13 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
+ bond_for_each_slave_rcu(bond, slave, iter) {
+ unsigned long trans_start = dev_trans_start(slave->dev);
+
++ slave->new_link = BOND_LINK_NOCHANGE;
++
+ if (slave->link != BOND_LINK_UP) {
+ if (bond_time_in_interval(bond, trans_start, 1) &&
+ bond_time_in_interval(bond, slave->last_rx, 1)) {
+
+- slave->link = BOND_LINK_UP;
++ slave->new_link = BOND_LINK_UP;
+ slave_state_changed = 1;
+
+ /* primary_slave has no meaning in round-robin
+@@ -2636,7 +2639,7 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
+ if (!bond_time_in_interval(bond, trans_start, 2) ||
+ !bond_time_in_interval(bond, slave->last_rx, 2)) {
+
+- slave->link = BOND_LINK_DOWN;
++ slave->new_link = BOND_LINK_DOWN;
+ slave_state_changed = 1;
+
+ if (slave->link_failure_count < UINT_MAX)
+@@ -2667,6 +2670,11 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
+ if (!rtnl_trylock())
+ goto re_arm;
+
++ bond_for_each_slave(bond, slave, iter) {
++ if (slave->new_link != BOND_LINK_NOCHANGE)
++ slave->link = slave->new_link;
++ }
++
+ if (slave_state_changed) {
+ bond_slave_state_change(bond);
+ if (BOND_MODE(bond) == BOND_MODE_XOR)
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index e2512ab41168..e13c9cd45dc0 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -61,6 +61,8 @@
+
+ #define ENA_MMIO_READ_TIMEOUT 0xFFFFFFFF
+
++#define ENA_REGS_ADMIN_INTR_MASK 1
++
+ /*****************************************************************************/
+ /*****************************************************************************/
+ /*****************************************************************************/
+@@ -232,11 +234,9 @@ static struct ena_comp_ctx *__ena_com_submit_admin_cmd(struct ena_com_admin_queu
+ tail_masked = admin_queue->sq.tail & queue_size_mask;
+
+ /* In case of queue FULL */
+- cnt = admin_queue->sq.tail - admin_queue->sq.head;
++ cnt = atomic_read(&admin_queue->outstanding_cmds);
+ if (cnt >= admin_queue->q_depth) {
+- pr_debug("admin queue is FULL (tail %d head %d depth: %d)\n",
+- admin_queue->sq.tail, admin_queue->sq.head,
+- admin_queue->q_depth);
++ pr_debug("admin queue is full.\n");
+ admin_queue->stats.out_of_space++;
+ return ERR_PTR(-ENOSPC);
+ }
+@@ -508,15 +508,20 @@ static int ena_com_comp_status_to_errno(u8 comp_status)
+ static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_ctx,
+ struct ena_com_admin_queue *admin_queue)
+ {
+- unsigned long flags;
+- u32 start_time;
++ unsigned long flags, timeout;
+ int ret;
+
+- start_time = ((u32)jiffies_to_usecs(jiffies));
++ timeout = jiffies + ADMIN_CMD_TIMEOUT_US;
++
++ while (1) {
++ spin_lock_irqsave(&admin_queue->q_lock, flags);
++ ena_com_handle_admin_completion(admin_queue);
++ spin_unlock_irqrestore(&admin_queue->q_lock, flags);
++
++ if (comp_ctx->status != ENA_CMD_SUBMITTED)
++ break;
+
+- while (comp_ctx->status == ENA_CMD_SUBMITTED) {
+- if ((((u32)jiffies_to_usecs(jiffies)) - start_time) >
+- ADMIN_CMD_TIMEOUT_US) {
++ if (time_is_before_jiffies(timeout)) {
+ pr_err("Wait for completion (polling) timeout\n");
+ /* ENA didn't have any completion */
+ spin_lock_irqsave(&admin_queue->q_lock, flags);
+@@ -528,10 +533,6 @@ static int ena_com_wait_and_process_admin_cq_polling(struct ena_comp_ctx *comp_c
+ goto err;
+ }
+
+- spin_lock_irqsave(&admin_queue->q_lock, flags);
+- ena_com_handle_admin_completion(admin_queue);
+- spin_unlock_irqrestore(&admin_queue->q_lock, flags);
+-
+ msleep(100);
+ }
+
+@@ -1449,6 +1450,12 @@ void ena_com_admin_destroy(struct ena_com_dev *ena_dev)
+
+ void ena_com_set_admin_polling_mode(struct ena_com_dev *ena_dev, bool polling)
+ {
++ u32 mask_value = 0;
++
++ if (polling)
++ mask_value = ENA_REGS_ADMIN_INTR_MASK;
++
++ writel(mask_value, ena_dev->reg_bar + ENA_REGS_INTR_MASK_OFF);
+ ena_dev->admin_queue.polling = polling;
+ }
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index bfeaec5bd7b9..0d9ce08ee3a9 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1542,6 +1542,7 @@ static int ena_create_io_tx_queue(struct ena_adapter *adapter, int qid)
+ "Failed to get TX queue handlers. TX queue num %d rc: %d\n",
+ qid, rc);
+ ena_com_destroy_io_queue(ena_dev, ena_qid);
++ return rc;
+ }
+
+ ena_com_update_numa_node(tx_ring->ena_com_io_cq, ctx.numa_node);
+@@ -1606,6 +1607,7 @@ static int ena_create_io_rx_queue(struct ena_adapter *adapter, int qid)
+ "Failed to get RX queue handlers. RX queue num %d rc: %d\n",
+ qid, rc);
+ ena_com_destroy_io_queue(ena_dev, ena_qid);
++ return rc;
+ }
+
+ ena_com_update_numa_node(rx_ring->ena_com_io_cq, ctx.numa_node);
+@@ -2806,6 +2808,11 @@ static void ena_release_bars(struct ena_com_dev *ena_dev, struct pci_dev *pdev)
+ {
+ int release_bars;
+
++ if (ena_dev->mem_bar)
++ devm_iounmap(&pdev->dev, ena_dev->mem_bar);
++
++ devm_iounmap(&pdev->dev, ena_dev->reg_bar);
++
+ release_bars = pci_select_bars(pdev, IORESOURCE_MEM) & ENA_BAR_MASK;
+ pci_release_selected_regions(pdev, release_bars);
+ }
+@@ -2893,8 +2900,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto err_free_ena_dev;
+ }
+
+- ena_dev->reg_bar = ioremap(pci_resource_start(pdev, ENA_REG_BAR),
+- pci_resource_len(pdev, ENA_REG_BAR));
++ ena_dev->reg_bar = devm_ioremap(&pdev->dev,
++ pci_resource_start(pdev, ENA_REG_BAR),
++ pci_resource_len(pdev, ENA_REG_BAR));
+ if (!ena_dev->reg_bar) {
+ dev_err(&pdev->dev, "failed to remap regs bar\n");
+ rc = -EFAULT;
+@@ -2914,8 +2922,9 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ ena_set_push_mode(pdev, ena_dev, &get_feat_ctx);
+
+ if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) {
+- ena_dev->mem_bar = ioremap_wc(pci_resource_start(pdev, ENA_MEM_BAR),
+- pci_resource_len(pdev, ENA_MEM_BAR));
++ ena_dev->mem_bar = devm_ioremap_wc(&pdev->dev,
++ pci_resource_start(pdev, ENA_MEM_BAR),
++ pci_resource_len(pdev, ENA_MEM_BAR));
+ if (!ena_dev->mem_bar) {
+ rc = -EFAULT;
+ goto err_device_destroy;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+index ca6c4718000f..31287cec6e3a 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3887,15 +3887,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ /* when transmitting in a vf, start bd must hold the ethertype
+ * for fw to enforce it
+ */
++ u16 vlan_tci = 0;
+ #ifndef BNX2X_STOP_ON_ERROR
+- if (IS_VF(bp))
++ if (IS_VF(bp)) {
+ #endif
+- tx_start_bd->vlan_or_ethertype =
+- cpu_to_le16(ntohs(eth->h_proto));
++ /* Still need to consider inband vlan for enforced */
++ if (__vlan_get_tag(skb, &vlan_tci)) {
++ tx_start_bd->vlan_or_ethertype =
++ cpu_to_le16(ntohs(eth->h_proto));
++ } else {
++ tx_start_bd->bd_flags.as_bitfield |=
++ (X_ETH_INBAND_VLAN <<
++ ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT);
++ tx_start_bd->vlan_or_ethertype =
++ cpu_to_le16(vlan_tci);
++ }
+ #ifndef BNX2X_STOP_ON_ERROR
+- else
++ } else {
+ /* used by FW for packet accounting */
+ tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod);
++ }
+ #endif
+ }
+
+diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+index 0f6811860ad5..a36e38676640 100644
+--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c
++++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c
+@@ -2845,7 +2845,7 @@ bfa_ioc_get_adapter_optrom_ver(struct bfa_ioc *ioc, char *optrom_ver)
+ static void
+ bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer)
+ {
+- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
++ strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+ }
+
+ static void
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index 0c2a32a305bc..3ec32d7c5866 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -2742,6 +2742,16 @@ static int cxgb_setup_tc(struct net_device *dev, u32 handle, __be16 proto,
+ return -EOPNOTSUPP;
+ }
+
++static netdev_features_t cxgb_fix_features(struct net_device *dev,
++ netdev_features_t features)
++{
++ /* Disable GRO, if RX_CSUM is disabled */
++ if (!(features & NETIF_F_RXCSUM))
++ features &= ~NETIF_F_GRO;
++
++ return features;
++}
++
+ static const struct net_device_ops cxgb4_netdev_ops = {
+ .ndo_open = cxgb_open,
+ .ndo_stop = cxgb_close,
+@@ -2766,6 +2776,7 @@ static const struct net_device_ops cxgb4_netdev_ops = {
+ #endif
+ .ndo_set_tx_maxrate = cxgb_set_tx_maxrate,
+ .ndo_setup_tc = cxgb_setup_tc,
++ .ndo_fix_features = cxgb_fix_features,
+ };
+
+ #ifdef CONFIG_PCI_IOV
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+index 6fd3be69ff21..ebeeb3581b9c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+@@ -6185,13 +6185,18 @@ int t4_fw_upgrade(struct adapter *adap, unsigned int mbox,
+ if (!t4_fw_matches_chip(adap, fw_hdr))
+ return -EINVAL;
+
++ /* Disable FW_OK flag so that mbox commands with FW_OK flag set
++ * wont be sent when we are flashing FW.
++ */
++ adap->flags &= ~FW_OK;
++
+ ret = t4_fw_halt(adap, mbox, force);
+ if (ret < 0 && !force)
+- return ret;
++ goto out;
+
+ ret = t4_load_fw(adap, fw_data, size);
+ if (ret < 0)
+- return ret;
++ goto out;
+
+ /*
+ * Older versions of the firmware don't understand the new
+@@ -6202,7 +6207,17 @@ int t4_fw_upgrade(struct adapter *adap, unsigned int mbox,
+ * its header flags to see if it advertises the capability.
+ */
+ reset = ((be32_to_cpu(fw_hdr->flags) & FW_HDR_FLAGS_RESET_HALT) == 0);
+- return t4_fw_restart(adap, mbox, reset);
++ ret = t4_fw_restart(adap, mbox, reset);
++
++ /* Grab potentially new Firmware Device Log parameters so we can see
++ * how healthy the new Firmware is. It's okay to contact the new
++ * Firmware for these parameters even though, as far as it's
++ * concerned, we've never said "HELLO" to it ...
++ */
++ (void)t4_init_devlog_params(adap);
++out:
++ adap->flags |= FW_OK;
++ return ret;
+ }
+
+ /**
+@@ -8073,7 +8088,16 @@ int t4_cim_read_la(struct adapter *adap, u32 *la_buf, unsigned int *wrptr)
+ ret = t4_cim_read(adap, UP_UP_DBG_LA_DATA_A, 1, &la_buf[i]);
+ if (ret)
+ break;
+- idx = (idx + 1) & UPDBGLARDPTR_M;
++
++ /* Bits 0-3 of UpDbgLaRdPtr can be between 0000 to 1001 to
++ * identify the 32-bit portion of the full 312-bit data
++ */
++ if (is_t6(adap->params.chip) && (idx & 0xf) >= 9)
++ idx = (idx & 0xff0) + 0x10;
++ else
++ idx++;
++ /* address can't exceed 0xfff */
++ idx &= UPDBGLARDPTR_M;
+ }
+ restart:
+ if (cfg & UPDBGLAEN_F) {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+index f3ed9ce99e5e..9d64e8e7c417 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+@@ -2616,8 +2616,8 @@ void t4vf_sge_stop(struct adapter *adapter)
+ int t4vf_sge_init(struct adapter *adapter)
+ {
+ struct sge_params *sge_params = &adapter->params.sge;
+- u32 fl0 = sge_params->sge_fl_buffer_size[0];
+- u32 fl1 = sge_params->sge_fl_buffer_size[1];
++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0];
++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1];
+ struct sge *s = &adapter->sge;
+
+ /*
+@@ -2625,9 +2625,20 @@ int t4vf_sge_init(struct adapter *adapter)
+ * the Physical Function Driver. Ideally we should be able to deal
+ * with _any_ configuration. Practice is different ...
+ */
+- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) {
++
++ /* We only bother using the Large Page logic if the Large Page Buffer
++ * is larger than our Page Size Buffer.
++ */
++ if (fl_large_pg <= fl_small_pg)
++ fl_large_pg = 0;
++
++ /* The Page Size Buffer must be exactly equal to our Page Size and the
++ * Large Page Size Buffer should be 0 (per above) or a power of 2.
++ */
++ if (fl_small_pg != PAGE_SIZE ||
++ (fl_large_pg & (fl_large_pg - 1)) != 0) {
+ dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n",
+- fl0, fl1);
++ fl_small_pg, fl_large_pg);
+ return -EINVAL;
+ }
+ if ((sge_params->sge_control & RXPKTCPLMODE_F) !=
+@@ -2639,8 +2650,8 @@ int t4vf_sge_init(struct adapter *adapter)
+ /*
+ * Now translate the adapter parameters into our internal forms.
+ */
+- if (fl1)
+- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT;
++ if (fl_large_pg)
++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT;
+ s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F)
+ ? 128 : 64);
+ s->pktshift = PKTSHIFT_G(sge_params->sge_control);
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 05e5b38e4891..fe00f71bc6b4 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -2371,6 +2371,10 @@ static int fec_enet_get_sset_count(struct net_device *dev, int sset)
+ static inline void fec_enet_update_ethtool_stats(struct net_device *dev)
+ {
+ }
++
++static inline void fec_enet_clear_ethtool_stats(struct net_device *dev)
++{
++}
+ #endif /* !defined(CONFIG_M5272) */
+
+ static int fec_enet_nway_reset(struct net_device *dev)
+diff --git a/drivers/net/ethernet/freescale/fsl_pq_mdio.c b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+index 446c7b374ff5..a10de1e9c157 100644
+--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c
++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c
+@@ -381,7 +381,7 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ {
+ const struct of_device_id *id =
+ of_match_device(fsl_pq_mdio_match, &pdev->dev);
+- const struct fsl_pq_mdio_data *data = id->data;
++ const struct fsl_pq_mdio_data *data;
+ struct device_node *np = pdev->dev.of_node;
+ struct resource res;
+ struct device_node *tbi;
+@@ -389,6 +389,13 @@ static int fsl_pq_mdio_probe(struct platform_device *pdev)
+ struct mii_bus *new_bus;
+ int err;
+
++ if (!id) {
++ dev_err(&pdev->dev, "Failed to match device\n");
++ return -ENODEV;
++ }
++
++ data = id->data;
++
+ dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible);
+
+ new_bus = mdiobus_alloc_size(sizeof(*priv));
+diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
+index 8f139197f1aa..5977b695d0fa 100644
+--- a/drivers/net/ethernet/ibm/emac/core.c
++++ b/drivers/net/ethernet/ibm/emac/core.c
+@@ -342,6 +342,7 @@ static int emac_reset(struct emac_instance *dev)
+ {
+ struct emac_regs __iomem *p = dev->emacp;
+ int n = 20;
++ bool __maybe_unused try_internal_clock = false;
+
+ DBG(dev, "reset" NL);
+
+@@ -354,6 +355,7 @@ static int emac_reset(struct emac_instance *dev)
+ }
+
+ #ifdef CONFIG_PPC_DCR_NATIVE
++do_retry:
+ /*
+ * PPC460EX/GT Embedded Processor Advanced User's Manual
+ * section 28.10.1 Mode Register 0 (EMACx_MR0) states:
+@@ -361,10 +363,19 @@ static int emac_reset(struct emac_instance *dev)
+ * of the EMAC. If none is present, select the internal clock
+ * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
+ * After a soft reset, select the external clock.
++ *
++ * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
++ * ethernet cable is not attached. This causes the reset to timeout
++ * and the PHY detection code in emac_init_phy() is unable to
++ * communicate and detect the AR8035-A PHY. As a result, the emac
++ * driver bails out early and the user has no ethernet.
++ * In order to stay compatible with existing configurations, the
++ * driver will temporarily switch to the internal clock, after
++ * the first reset fails.
+ */
+ if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
+- if (dev->phy_address == 0xffffffff &&
+- dev->phy_map == 0xffffffff) {
++ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
++ dev->phy_map == 0xffffffff)) {
+ /* No PHY: select internal loop clock before reset */
+ dcri_clrset(SDR0, SDR0_ETH_CFG,
+ 0, SDR0_ETH_CFG_ECS << dev->cell_index);
+@@ -382,8 +393,15 @@ static int emac_reset(struct emac_instance *dev)
+
+ #ifdef CONFIG_PPC_DCR_NATIVE
+ if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
+- if (dev->phy_address == 0xffffffff &&
+- dev->phy_map == 0xffffffff) {
++ if (!n && !try_internal_clock) {
++ /* first attempt has timed out. */
++ n = 20;
++ try_internal_clock = true;
++ goto do_retry;
++ }
++
++ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
++ dev->phy_map == 0xffffffff)) {
+ /* No PHY: restore external clock source after reset */
+ dcri_clrset(SDR0, SDR0_ETH_CFG,
+ SDR0_ETH_CFG_ECS << dev->cell_index, 0);
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 528a926dd979..825ec8f710e7 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -1182,6 +1182,7 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work)
+ struct e1000_hw *hw = &adapter->hw;
+
+ if (er32(TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID) {
++ struct sk_buff *skb = adapter->tx_hwtstamp_skb;
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 txstmp;
+
+@@ -1190,9 +1191,14 @@ static void e1000e_tx_hwtstamp_work(struct work_struct *work)
+
+ e1000e_systim_to_hwtstamp(adapter, &shhwtstamps, txstmp);
+
+- skb_tstamp_tx(adapter->tx_hwtstamp_skb, &shhwtstamps);
+- dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
++ /* Clear the global tx_hwtstamp_skb pointer and force writes
++ * prior to notifying the stack of a Tx timestamp.
++ */
+ adapter->tx_hwtstamp_skb = NULL;
++ wmb(); /* force write prior to skb_tstamp_tx */
++
++ skb_tstamp_tx(skb, &shhwtstamps);
++ dev_kfree_skb_any(skb);
+ } else if (time_after(jiffies, adapter->tx_hwtstamp_start
+ + adapter->tx_timeout_factor * HZ)) {
+ dev_kfree_skb_any(adapter->tx_hwtstamp_skb);
+@@ -6645,12 +6651,17 @@ static int e1000e_pm_thaw(struct device *dev)
+ static int e1000e_pm_suspend(struct device *dev)
+ {
+ struct pci_dev *pdev = to_pci_dev(dev);
++ int rc;
+
+ e1000e_flush_lpic(pdev);
+
+ e1000e_pm_freeze(dev);
+
+- return __e1000_shutdown(pdev, false);
++ rc = __e1000_shutdown(pdev, false);
++ if (rc)
++ e1000e_pm_thaw(dev);
++
++ return rc;
+ }
+
+ static int e1000e_pm_resume(struct device *dev)
+diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+index ddf478d6322b..614f93e01500 100644
+--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
++++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c
+@@ -154,6 +154,7 @@ int i40evf_send_vf_config_msg(struct i40evf_adapter *adapter)
+ adapter->current_op = I40E_VIRTCHNL_OP_GET_VF_RESOURCES;
+ adapter->aq_required &= ~I40EVF_FLAG_AQ_GET_CONFIG;
+ caps = I40E_VIRTCHNL_VF_OFFLOAD_L2 |
++ I40E_VIRTCHNL_VF_OFFLOAD_RSS_PF |
+ I40E_VIRTCHNL_VF_OFFLOAD_RSS_AQ |
+ I40E_VIRTCHNL_VF_OFFLOAD_RSS_REG |
+ I40E_VIRTCHNL_VF_OFFLOAD_VLAN |
+diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
+index a7895c4cbcc3..9eb9b68f8935 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
+@@ -721,6 +721,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter)
+ **/
+ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
+ {
++ struct sk_buff *skb = adapter->ptp_tx_skb;
+ struct e1000_hw *hw = &adapter->hw;
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 regval;
+@@ -748,10 +749,17 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
+ shhwtstamps.hwtstamp =
+ ktime_add_ns(shhwtstamps.hwtstamp, adjust);
+
+- skb_tstamp_tx(adapter->ptp_tx_skb, &shhwtstamps);
+- dev_kfree_skb_any(adapter->ptp_tx_skb);
++ /* Clear the lock early before calling skb_tstamp_tx so that
++ * applications are not woken up before the lock bit is clear. We use
++ * a copy of the skb pointer to ensure other threads can't change it
++ * while we're notifying the stack.
++ */
+ adapter->ptp_tx_skb = NULL;
+ clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state);
++
++ /* Notify the stack and free the skb after we've unlocked */
++ skb_tstamp_tx(skb, &shhwtstamps);
++ dev_kfree_skb_any(skb);
+ }
+
+ /**
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 941c8e2c944e..93ab0b3ad393 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -5079,7 +5079,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ INIT_WORK(&hw->restart_work, sky2_restart);
+
+ pci_set_drvdata(pdev, hw);
+- pdev->d3_delay = 150;
++ pdev->d3_delay = 200;
+
+ return 0;
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+index b04760a5034b..af2e6ea36eac 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+@@ -156,57 +156,63 @@ static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
+ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
+ {
+ struct mlx4_en_priv *priv = netdev_priv(netdev);
++ struct mlx4_en_port_profile *prof = priv->prof;
+ struct mlx4_en_dev *mdev = priv->mdev;
++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp;
+
+ if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+ return 1;
+
+ if (priv->cee_config.pfc_state) {
+ int tc;
++ rx_ppp = prof->rx_ppp;
++ tx_ppp = prof->tx_ppp;
+
+- priv->prof->rx_pause = 0;
+- priv->prof->tx_pause = 0;
+ for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
+ u8 tc_mask = 1 << tc;
+
+ switch (priv->cee_config.dcb_pfc[tc]) {
+ case pfc_disabled:
+- priv->prof->tx_ppp &= ~tc_mask;
+- priv->prof->rx_ppp &= ~tc_mask;
++ tx_ppp &= ~tc_mask;
++ rx_ppp &= ~tc_mask;
+ break;
+ case pfc_enabled_full:
+- priv->prof->tx_ppp |= tc_mask;
+- priv->prof->rx_ppp |= tc_mask;
++ tx_ppp |= tc_mask;
++ rx_ppp |= tc_mask;
+ break;
+ case pfc_enabled_tx:
+- priv->prof->tx_ppp |= tc_mask;
+- priv->prof->rx_ppp &= ~tc_mask;
++ tx_ppp |= tc_mask;
++ rx_ppp &= ~tc_mask;
+ break;
+ case pfc_enabled_rx:
+- priv->prof->tx_ppp &= ~tc_mask;
+- priv->prof->rx_ppp |= tc_mask;
++ tx_ppp &= ~tc_mask;
++ rx_ppp |= tc_mask;
+ break;
+ default:
+ break;
+ }
+ }
+- en_dbg(DRV, priv, "Set pfc on\n");
++ rx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->rx_pause;
++ tx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->tx_pause;
+ } else {
+- priv->prof->rx_pause = 1;
+- priv->prof->tx_pause = 1;
+- en_dbg(DRV, priv, "Set pfc off\n");
++ rx_ppp = 0;
++ tx_ppp = 0;
++ rx_pause = prof->rx_pause;
++ tx_pause = prof->tx_pause;
+ }
+
+ if (mlx4_SET_PORT_general(mdev->dev, priv->port,
+ priv->rx_skb_size + ETH_FCS_LEN,
+- priv->prof->tx_pause,
+- priv->prof->tx_ppp,
+- priv->prof->rx_pause,
+- priv->prof->rx_ppp)) {
++ tx_pause, tx_ppp, rx_pause, rx_ppp)) {
+ en_err(priv, "Failed setting pause params\n");
+ return 1;
+ }
+
++ prof->tx_ppp = tx_ppp;
++ prof->rx_ppp = rx_ppp;
++ prof->tx_pause = tx_pause;
++ prof->rx_pause = rx_pause;
++
+ return 0;
+ }
+
+@@ -310,6 +316,7 @@ static int mlx4_en_ets_validate(struct mlx4_en_priv *priv, struct ieee_ets *ets)
+ }
+
+ switch (ets->tc_tsa[i]) {
++ case IEEE_8021QAZ_TSA_VENDOR:
+ case IEEE_8021QAZ_TSA_STRICT:
+ break;
+ case IEEE_8021QAZ_TSA_ETS:
+@@ -347,6 +354,10 @@ static int mlx4_en_config_port_scheduler(struct mlx4_en_priv *priv,
+ /* higher TC means higher priority => lower pg */
+ for (i = IEEE_8021QAZ_MAX_TCS - 1; i >= 0; i--) {
+ switch (ets->tc_tsa[i]) {
++ case IEEE_8021QAZ_TSA_VENDOR:
++ pg[i] = MLX4_EN_TC_VENDOR;
++ tc_tx_bw[i] = MLX4_EN_BW_MAX;
++ break;
+ case IEEE_8021QAZ_TSA_STRICT:
+ pg[i] = num_strict++;
+ tc_tx_bw[i] = MLX4_EN_BW_MAX;
+@@ -403,6 +414,7 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev,
+ struct mlx4_en_priv *priv = netdev_priv(dev);
+ struct mlx4_en_port_profile *prof = priv->prof;
+ struct mlx4_en_dev *mdev = priv->mdev;
++ u32 tx_pause, tx_ppp, rx_pause, rx_ppp;
+ int err;
+
+ en_dbg(DRV, priv, "cap: 0x%x en: 0x%x mbc: 0x%x delay: %d\n",
+@@ -411,23 +423,26 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev,
+ pfc->mbc,
+ pfc->delay);
+
+- prof->rx_pause = !pfc->pfc_en;
+- prof->tx_pause = !pfc->pfc_en;
+- prof->rx_ppp = pfc->pfc_en;
+- prof->tx_ppp = pfc->pfc_en;
++ rx_pause = prof->rx_pause && !pfc->pfc_en;
++ tx_pause = prof->tx_pause && !pfc->pfc_en;
++ rx_ppp = pfc->pfc_en;
++ tx_ppp = pfc->pfc_en;
+
+ err = mlx4_SET_PORT_general(mdev->dev, priv->port,
+ priv->rx_skb_size + ETH_FCS_LEN,
+- prof->tx_pause,
+- prof->tx_ppp,
+- prof->rx_pause,
+- prof->rx_ppp);
+- if (err)
++ tx_pause, tx_ppp, rx_pause, rx_ppp);
++ if (err) {
+ en_err(priv, "Failed setting pause params\n");
+- else
+- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
+- prof->rx_ppp, prof->rx_pause,
+- prof->tx_ppp, prof->tx_pause);
++ return err;
++ }
++
++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
++ rx_ppp, rx_pause, tx_ppp, tx_pause);
++
++ prof->tx_ppp = tx_ppp;
++ prof->rx_ppp = rx_ppp;
++ prof->rx_pause = rx_pause;
++ prof->tx_pause = tx_pause;
+
+ return err;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+index bdda17d2ea0f..24977cc881d2 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+@@ -1003,27 +1003,32 @@ static int mlx4_en_set_pauseparam(struct net_device *dev,
+ {
+ struct mlx4_en_priv *priv = netdev_priv(dev);
+ struct mlx4_en_dev *mdev = priv->mdev;
++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp;
+ int err;
+
+ if (pause->autoneg)
+ return -EINVAL;
+
+- priv->prof->tx_pause = pause->tx_pause != 0;
+- priv->prof->rx_pause = pause->rx_pause != 0;
++ tx_pause = !!(pause->tx_pause);
++ rx_pause = !!(pause->rx_pause);
++ rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause);
++ tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause);
++
+ err = mlx4_SET_PORT_general(mdev->dev, priv->port,
+ priv->rx_skb_size + ETH_FCS_LEN,
+- priv->prof->tx_pause,
+- priv->prof->tx_ppp,
+- priv->prof->rx_pause,
+- priv->prof->rx_ppp);
+- if (err)
+- en_err(priv, "Failed setting pause params\n");
+- else
+- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
+- priv->prof->rx_ppp,
+- priv->prof->rx_pause,
+- priv->prof->tx_ppp,
+- priv->prof->tx_pause);
++ tx_pause, tx_ppp, rx_pause, rx_ppp);
++ if (err) {
++ en_err(priv, "Failed setting pause params, err = %d\n", err);
++ return err;
++ }
++
++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap,
++ rx_ppp, rx_pause, tx_ppp, tx_pause);
++
++ priv->prof->tx_pause = tx_pause;
++ priv->prof->rx_pause = rx_pause;
++ priv->prof->tx_ppp = tx_ppp;
++ priv->prof->rx_ppp = rx_ppp;
+
+ return err;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c
+index bf7628db098a..22c3fdd5482a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c
+@@ -163,9 +163,9 @@ static int mlx4_en_get_profile(struct mlx4_en_dev *mdev)
+ params->udp_rss = 0;
+ }
+ for (i = 1; i <= MLX4_MAX_PORTS; i++) {
+- params->prof[i].rx_pause = 1;
++ params->prof[i].rx_pause = !(pfcrx || pfctx);
+ params->prof[i].rx_ppp = pfcrx;
+- params->prof[i].tx_pause = 1;
++ params->prof[i].tx_pause = !(pfcrx || pfctx);
+ params->prof[i].tx_ppp = pfctx;
+ params->prof[i].tx_ring_size = MLX4_EN_DEF_TX_RING_SIZE;
+ params->prof[i].rx_ring_size = MLX4_EN_DEF_RX_RING_SIZE;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index d223e7cb68ba..0160c93de6d3 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -3125,6 +3125,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
+ priv->msg_enable = MLX4_EN_MSG_LEVEL;
+ #ifdef CONFIG_MLX4_EN_DCB
+ if (!mlx4_is_slave(priv->mdev->dev)) {
++ u8 prio;
++
++ for (prio = 0; prio < IEEE_8021QAZ_MAX_TCS; ++prio) {
++ priv->ets.prio_tc[prio] = prio;
++ priv->ets.tc_tsa[prio] = IEEE_8021QAZ_TSA_VENDOR;
++ }
++
+ priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST |
+ DCB_CAP_DCBX_VER_IEEE;
+ priv->flags |= MLX4_EN_DCB_ENABLED;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+index 1a670b681555..0710b3677464 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+@@ -35,6 +35,7 @@
+ #include <linux/etherdevice.h>
+
+ #include <linux/mlx4/cmd.h>
++#include <linux/mlx4/qp.h>
+ #include <linux/export.h>
+
+ #include "mlx4.h"
+@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
+ if (IS_ERR(mailbox))
+ return PTR_ERR(mailbox);
+
++ if (!mlx4_qp_lookup(dev, rule->qpn)) {
++ mlx4_err_rule(dev, "QP doesn't exist\n", rule);
++ ret = -EINVAL;
++ goto out;
++ }
++
+ trans_rule_ctrl_to_hw(rule, mailbox->buf);
+
+ size += sizeof(struct mlx4_net_trans_rule_hw_ctrl);
+
+ list_for_each_entry(cur, &rule->list, list) {
+ ret = parse_trans_rule(dev, cur, mailbox->buf + size);
+- if (ret < 0) {
+- mlx4_free_cmd_mailbox(dev, mailbox);
+- return ret;
+- }
++ if (ret < 0)
++ goto out;
++
+ size += ret;
+ }
+
+@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *dev,
+ }
+ }
+
++out:
+ mlx4_free_cmd_mailbox(dev, mailbox);
+
+ return ret;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index df0f39611c5e..18f221d8a04d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -472,6 +472,7 @@ struct mlx4_en_frag_info {
+ #define MLX4_EN_BW_MIN 1
+ #define MLX4_EN_BW_MAX 100 /* Utilize 100% of the line */
+
++#define MLX4_EN_TC_VENDOR 0
+ #define MLX4_EN_TC_ETS 7
+
+ enum dcb_pfc_type {
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
+index 6143113a7fef..474ff36b9755 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -387,6 +387,19 @@ static void mlx4_qp_free_icm(struct mlx4_dev *dev, int qpn)
+ __mlx4_qp_free_icm(dev, qpn);
+ }
+
++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
++{
++ struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
++ struct mlx4_qp *qp;
++
++ spin_lock(&qp_table->lock);
++
++ qp = __mlx4_qp_lookup(dev, qpn);
++
++ spin_unlock(&qp_table->lock);
++ return qp;
++}
++
+ int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp)
+ {
+ struct mlx4_priv *priv = mlx4_priv(dev);
+@@ -474,6 +487,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
+ }
+
+ if (attr & MLX4_UPDATE_QP_QOS_VPORT) {
++ if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) {
++ mlx4_warn(dev, "Granular QoS per VF is not enabled\n");
++ err = -EOPNOTSUPP;
++ goto out;
++ }
++
+ qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP;
+ cmd->qp_context.qos_vport = params->qos_vport;
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index 1822382212ee..d6b06bef1b69 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -5048,6 +5048,7 @@ static void rem_slave_fs_rule(struct mlx4_dev *dev, int slave)
+ &tracker->res_tree[RES_FS_RULE]);
+ list_del(&fs_rule->com.list);
+ spin_unlock_irq(mlx4_tlock(dev));
++ kfree(fs_rule->mirr_mbox);
+ kfree(fs_rule);
+ state = 0;
+ break;
+@@ -5214,6 +5215,13 @@ void mlx4_delete_all_resources_for_slave(struct mlx4_dev *dev, int slave)
+ mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex);
+ }
+
++static void update_qos_vpp(struct mlx4_update_qp_context *ctx,
++ struct mlx4_vf_immed_vlan_work *work)
++{
++ ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP);
++ ctx->qp_context.qos_vport = work->qos_vport;
++}
++
+ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
+ {
+ struct mlx4_vf_immed_vlan_work *work =
+@@ -5328,11 +5336,10 @@ void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work)
+ qp->sched_queue & 0xC7;
+ upd_context->qp_context.pri_path.sched_queue |=
+ ((work->qos & 0x7) << 3);
+- upd_context->qp_mask |=
+- cpu_to_be64(1ULL <<
+- MLX4_UPD_QP_MASK_QOS_VPP);
+- upd_context->qp_context.qos_vport =
+- work->qos_vport;
++
++ if (dev->caps.flags2 &
++ MLX4_DEV_CAP_FLAG2_QOS_VPP)
++ update_qos_vpp(upd_context, work);
+ }
+
+ err = mlx4_cmd(dev, mailbox->dma,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+index 38981db43bc3..2d235e8433be 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -2741,6 +2741,9 @@ static int set_feature_lro(struct net_device *netdev, bool enable)
+
+ mutex_unlock(&priv->state_lock);
+
++ if (mlx5e_vxlan_allowed(priv->mdev))
++ udp_tunnel_get_rx_info(netdev);
++
+ return err;
+ }
+
+@@ -3785,13 +3788,6 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
+ if (netdev->reg_state != NETREG_REGISTERED)
+ return;
+
+- /* Device already registered: sync netdev system state */
+- if (mlx5e_vxlan_allowed(mdev)) {
+- rtnl_lock();
+- udp_tunnel_get_rx_info(netdev);
+- rtnl_unlock();
+- }
+-
+ queue_work(priv->wq, &priv->set_rx_mode_work);
+ }
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 981cd1d84a5b..3c183b8c083a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -548,7 +548,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+ struct mlx5_priv *priv = &mdev->priv;
+ struct msix_entry *msix = priv->msix_arr;
+ int irq = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
+- int err;
+
+ if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
+ mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
+@@ -558,18 +557,11 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
+ cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
+ priv->irq_info[i].mask);
+
+- err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
+- if (err) {
+- mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
+- irq);
+- goto err_clear_mask;
+- }
++ if (IS_ENABLED(CONFIG_SMP) &&
++ irq_set_affinity_hint(irq, priv->irq_info[i].mask))
++ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+
+ return 0;
+-
+-err_clear_mask:
+- free_cpumask_var(priv->irq_info[i].mask);
+- return err;
+ }
+
+ static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index bea9ae31a769..60e1edcbe573 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1448,8 +1448,7 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp,
+ err = mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid,
+ adding, true);
+ if (err) {
+- if (net_ratelimit())
+- netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
++ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
+ return;
+ }
+
+@@ -1509,8 +1508,7 @@ static void mlxsw_sp_fdb_notify_mac_lag_process(struct mlxsw_sp *mlxsw_sp,
+ err = mlxsw_sp_port_fdb_uc_lag_op(mlxsw_sp, lag_id, mac, fid, lag_vid,
+ adding, true);
+ if (err) {
+- if (net_ratelimit())
+- netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
++ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
+ return;
+ }
+
+diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+index b8d5270359cd..e30676515529 100644
+--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
+ cmd.req.arg3 = 0;
+
+ if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
+- netxen_issue_cmd(adapter, &cmd);
++ rcode = netxen_issue_cmd(adapter, &cmd);
+
+ if (rcode != NX_RCODE_SUCCESS)
+ return -EIO;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index afe5e57d9acb..d02313770fc2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -850,7 +850,7 @@ qed_hw_init_pf_doorbell_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ NULL) +
+ qed_cxt_get_proto_cid_count(p_hwfn, PROTOCOLID_ETH,
+ NULL);
+- norm_regsize = roundup(QED_PF_DEMS_SIZE * non_pwm_conn, 4096);
++ norm_regsize = roundup(QED_PF_DEMS_SIZE * non_pwm_conn, PAGE_SIZE);
+ min_addr_reg1 = norm_regsize / 4096;
+ pwm_regsize = db_bar_size - norm_regsize;
+
+@@ -1628,6 +1628,9 @@ static int qed_hw_get_nvm_info(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ DP_NOTICE(p_hwfn, "Unknown Speed in 0x%08x\n", link_temp);
+ }
+
++ p_hwfn->mcp_info->link_capabilities.default_speed_autoneg =
++ link->speed.autoneg;
++
+ link_temp &= NVM_CFG1_PORT_DRV_FLOW_CONTROL_MASK;
+ link_temp >>= NVM_CFG1_PORT_DRV_FLOW_CONTROL_OFFSET;
+ link->pause.autoneg = !!(link_temp &
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
+index dba3fbe4800e..0b949c6d83fc 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1240,7 +1240,7 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+
+ /* TODO - at the moment assume supported and advertised speed equal */
+ if_link->supported_caps = QED_LM_FIBRE_BIT;
+- if (params.speed.autoneg)
++ if (link_caps.default_speed_autoneg)
+ if_link->supported_caps |= QED_LM_Autoneg_BIT;
+ if (params.pause.autoneg ||
+ (params.pause.forced_rx && params.pause.forced_tx))
+@@ -1250,6 +1250,10 @@ static void qed_fill_link(struct qed_hwfn *hwfn,
+ if_link->supported_caps |= QED_LM_Pause_BIT;
+
+ if_link->advertised_caps = if_link->supported_caps;
++ if (params.speed.autoneg)
++ if_link->advertised_caps |= QED_LM_Autoneg_BIT;
++ else
++ if_link->advertised_caps &= ~QED_LM_Autoneg_BIT;
+ if (params.speed.advertised_speeds &
+ NVM_CFG1_PORT_DRV_SPEED_CAPABILITY_MASK_1G)
+ if_link->advertised_caps |= QED_LM_1000baseT_Half_BIT |
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.h b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+index dff520ed069b..7b7a84d2c839 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -35,6 +35,7 @@ struct qed_mcp_link_params {
+
+ struct qed_mcp_link_capabilities {
+ u32 speed_capabilities;
++ bool default_speed_autoneg;
+ };
+
+ struct qed_mcp_link_state {
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+index 509b596cf1e8..bd1ec70fb736 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c
+@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapter *adapter, int sem, u32 id_reg)
+ }
+ return -EIO;
+ }
+- usleep_range(1000, 1500);
++ udelay(1200);
+ }
+
+ if (id_reg)
+diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+index be258d90de9e..e3223f2fe2ff 100644
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+@@ -765,7 +765,7 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump)
+ sizeof(struct mpi_coredump_global_header);
+ mpi_coredump->mpi_global_header.imageSize =
+ sizeof(struct ql_mpi_coredump);
+- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
+ sizeof(mpi_coredump->mpi_global_header.idString));
+
+ /* Get generic NIC reg dump */
+@@ -1255,7 +1255,7 @@ static void ql_gen_reg_dump(struct ql_adapter *qdev,
+ sizeof(struct mpi_coredump_global_header);
+ mpi_coredump->mpi_global_header.imageSize =
+ sizeof(struct ql_reg_dump);
+- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",
+ sizeof(mpi_coredump->mpi_global_header.idString));
+
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 6e2add979471..8bbb55f31909 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca)
+
+ /* Allocate rx SKB if we don't have one available. */
+ if (!qca->rx_skb) {
+- qca->rx_skb = netdev_alloc_skb(net_dev,
+- net_dev->mtu + VLAN_ETH_HLEN);
++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
++ net_dev->mtu +
++ VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ netdev_dbg(net_dev, "out of RX resources\n");
+ qca->stats.out_of_mem++;
+@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca)
+ qca->rx_skb, qca->rx_skb->dev);
+ qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
+ netif_rx_ni(qca->rx_skb);
+- qca->rx_skb = netdev_alloc_skb(net_dev,
++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+ net_dev->mtu + VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ netdev_dbg(net_dev, "out of RX resources\n");
+@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *dev)
+ if (!qca->rx_buffer)
+ return -ENOBUFS;
+
+- qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN);
++ qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu +
++ VLAN_ETH_HLEN);
+ if (!qca->rx_skb) {
+ kfree(qca->rx_buffer);
+ netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n");
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 18e68c91e651..dbb63640bc6e 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -8446,12 +8446,12 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ goto err_out_msi_5;
+ }
+
++ pci_set_drvdata(pdev, dev);
++
+ rc = register_netdev(dev);
+ if (rc < 0)
+ goto err_out_cnt_6;
+
+- pci_set_drvdata(pdev, dev);
+-
+ netif_info(tp, probe, dev, "%s at 0x%p, %pM, XID %08x IRQ %d\n",
+ rtl_chip_infos[chipset].name, ioaddr, dev->dev_addr,
+ (u32)(RTL_R32(TxConfig) & 0x9cf0f8ff), pdev->irq);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index b6816ae00b7a..c8fd99b3ca29 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3133,7 +3133,7 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
+ /* MDIO bus init */
+ ret = sh_mdio_init(mdp, pd);
+ if (ret) {
+- dev_err(&ndev->dev, "failed to initialise MDIO\n");
++ dev_err(&pdev->dev, "failed to initialise MDIO\n");
+ goto out_release;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 98bbb91336e4..c212d1dd8bfd 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -478,7 +478,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
+ /* PTP v1, UDP, any kind of event packet */
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+ /* take time stamp for all event messages */
+- snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
++ if (priv->plat->has_gmac4)
++ snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
++ else
++ snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+
+ ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+@@ -510,7 +513,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+ ptp_v2 = PTP_TCR_TSVER2ENA;
+ /* take time stamp for all event messages */
+- snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
++ if (priv->plat->has_gmac4)
++ snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
++ else
++ snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+
+ ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+@@ -544,7 +550,10 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr)
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ ptp_v2 = PTP_TCR_TSVER2ENA;
+ /* take time stamp for all event messages */
+- snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
++ if (priv->plat->has_gmac4)
++ snap_type_sel = PTP_GMAC4_TCR_SNAPTYPSEL_1;
++ else
++ snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+
+ ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+index c06938c47af5..174777cd888e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h
+@@ -63,7 +63,8 @@
+ /* Enable Snapshot for Messages Relevant to Master */
+ #define PTP_TCR_TSMSTRENA BIT(15)
+ /* Select PTP packets for Taking Snapshots */
+-#define PTP_TCR_SNAPTYPSEL_1 GENMASK(17, 16)
++#define PTP_TCR_SNAPTYPSEL_1 BIT(16)
++#define PTP_GMAC4_TCR_SNAPTYPSEL_1 GENMASK(17, 16)
+ /* Enable MAC address for PTP Frame Filtering */
+ #define PTP_TCR_TSENMACADDR BIT(18)
+
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index 2bd1282735b0..552de9c490c6 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -282,6 +282,10 @@ struct cpsw_ss_regs {
+ /* Bit definitions for the CPSW1_TS_SEQ_LTYPE register */
+ #define CPSW_V1_SEQ_ID_OFS_SHIFT 16
+
++#define CPSW_MAX_BLKS_TX 15
++#define CPSW_MAX_BLKS_TX_SHIFT 4
++#define CPSW_MAX_BLKS_RX 5
++
+ struct cpsw_host_regs {
+ u32 max_blks;
+ u32 blk_cnt;
+@@ -1160,11 +1164,23 @@ static void cpsw_slave_open(struct cpsw_slave *slave, struct cpsw_priv *priv)
+ switch (cpsw->version) {
+ case CPSW_VERSION_1:
+ slave_write(slave, TX_PRIORITY_MAPPING, CPSW1_TX_PRI_MAP);
++ /* Increase RX FIFO size to 5 for supporting fullduplex
++ * flow control mode
++ */
++ slave_write(slave,
++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) |
++ CPSW_MAX_BLKS_RX, CPSW1_MAX_BLKS);
+ break;
+ case CPSW_VERSION_2:
+ case CPSW_VERSION_3:
+ case CPSW_VERSION_4:
+ slave_write(slave, TX_PRIORITY_MAPPING, CPSW2_TX_PRI_MAP);
++ /* Increase RX FIFO size to 5 for supporting fullduplex
++ * flow control mode
++ */
++ slave_write(slave,
++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) |
++ CPSW_MAX_BLKS_RX, CPSW2_MAX_BLKS);
+ break;
+ }
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 3c1f89ab0110..92ad43e53c72 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -209,6 +209,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ struct genevehdr *gnvh = geneve_hdr(skb);
+ struct metadata_dst *tun_dst = NULL;
+ struct pcpu_sw_netstats *stats;
++ unsigned int len;
+ int err = 0;
+ void *oiph;
+
+@@ -222,8 +223,10 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags,
+ vni_to_tunnel_id(gnvh->vni),
+ gnvh->opt_len * 4);
+- if (!tun_dst)
++ if (!tun_dst) {
++ geneve->dev->stats.rx_dropped++;
+ goto drop;
++ }
+ /* Update tunnel dst according to Geneve options. */
+ ip_tunnel_info_opts_set(&tun_dst->u.tun_info,
+ gnvh->options, gnvh->opt_len * 4);
+@@ -231,8 +234,11 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ /* Drop packets w/ critical options,
+ * since we don't support any...
+ */
+- if (gnvh->critical)
++ if (gnvh->critical) {
++ geneve->dev->stats.rx_frame_errors++;
++ geneve->dev->stats.rx_errors++;
+ goto drop;
++ }
+ }
+
+ skb_reset_mac_header(skb);
+@@ -243,8 +249,10 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ skb_dst_set(skb, &tun_dst->dst);
+
+ /* Ignore packet loops (and multicast echo) */
+- if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr))
++ if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) {
++ geneve->dev->stats.rx_errors++;
+ goto drop;
++ }
+
+ oiph = skb_network_header(skb);
+ skb_reset_network_header(skb);
+@@ -276,13 +284,15 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
+ }
+ }
+
+- stats = this_cpu_ptr(geneve->dev->tstats);
+- u64_stats_update_begin(&stats->syncp);
+- stats->rx_packets++;
+- stats->rx_bytes += skb->len;
+- u64_stats_update_end(&stats->syncp);
+-
+- gro_cells_receive(&geneve->gro_cells, skb);
++ len = skb->len;
++ err = gro_cells_receive(&geneve->gro_cells, skb);
++ if (likely(err == NET_RX_SUCCESS)) {
++ stats = this_cpu_ptr(geneve->dev->tstats);
++ u64_stats_update_begin(&stats->syncp);
++ stats->rx_packets++;
++ stats->rx_bytes += len;
++ u64_stats_update_end(&stats->syncp);
++ }
+ return;
+ drop:
+ /* Consume bad packet */
+@@ -332,7 +342,7 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ struct geneve_sock *gs;
+ int opts_len;
+
+- /* Need Geneve and inner Ethernet header to be present */
++ /* Need UDP and Geneve header to be present */
+ if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN)))
+ goto drop;
+
+@@ -355,8 +365,10 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ opts_len = geneveh->opt_len * 4;
+ if (iptunnel_pull_header(skb, GENEVE_BASE_HLEN + opts_len,
+ htons(ETH_P_TEB),
+- !net_eq(geneve->net, dev_net(geneve->dev))))
++ !net_eq(geneve->net, dev_net(geneve->dev)))) {
++ geneve->dev->stats.rx_dropped++;
+ goto drop;
++ }
+
+ geneve_rx(geneve, gs, skb);
+ return 0;
+diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
+index 4bad0b894e9c..27160d1870e1 100644
+--- a/drivers/net/hamradio/hdlcdrv.c
++++ b/drivers/net/hamradio/hdlcdrv.c
+@@ -576,6 +576,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ case HDLCDRVCTL_CALIBRATE:
+ if(!capable(CAP_SYS_RAWIO))
+ return -EPERM;
++ if (s->par.bitrate <= 0)
++ return -EINVAL;
+ if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+ return -EINVAL;
+ s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 2caac0c37059..365a48cfcbbf 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -742,7 +742,12 @@ static struct sk_buff *macsec_encrypt(struct sk_buff *skb,
+ macsec_fill_iv(iv, secy->sci, pn);
+
+ sg_init_table(sg, ret);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ ret = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(ret < 0)) {
++ macsec_txsa_put(tx_sa);
++ kfree_skb(skb);
++ return ERR_PTR(ret);
++ }
+
+ if (tx_sc->encrypt) {
+ int len = skb->len - macsec_hdr_len(sci_present) -
+@@ -949,7 +954,11 @@ static struct sk_buff *macsec_decrypt(struct sk_buff *skb,
+ macsec_fill_iv(iv, sci, ntohl(hdr->packet_number));
+
+ sg_init_table(sg, ret);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ ret = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(ret < 0)) {
++ kfree_skb(skb);
++ return ERR_PTR(ret);
++ }
+
+ if (hdr->tci_an & MACSEC_TCI_E) {
+ /* confidentiality: ethernet + macsec header
+diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
+index 963838d4fac1..599ce24c514f 100644
+--- a/drivers/net/phy/mdio-mux.c
++++ b/drivers/net/phy/mdio-mux.c
+@@ -122,10 +122,9 @@ int mdio_mux_init(struct device *dev,
+ pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
+ if (pb == NULL) {
+ ret_val = -ENOMEM;
+- goto err_parent_bus;
++ goto err_pb_kz;
+ }
+
+-
+ pb->switch_data = data;
+ pb->switch_fn = switch_fn;
+ pb->current_child = -1;
+@@ -154,6 +153,7 @@ int mdio_mux_init(struct device *dev,
+ cb->mii_bus = mdiobus_alloc();
+ if (!cb->mii_bus) {
+ ret_val = -ENOMEM;
++ devm_kfree(dev, cb);
+ of_node_put(child_bus_node);
+ break;
+ }
+@@ -170,7 +170,6 @@ int mdio_mux_init(struct device *dev,
+ mdiobus_free(cb->mii_bus);
+ devm_kfree(dev, cb);
+ } else {
+- of_node_get(child_bus_node);
+ cb->next = pb->children;
+ pb->children = cb;
+ }
+@@ -181,9 +180,11 @@ int mdio_mux_init(struct device *dev,
+ return 0;
+ }
+
++ devm_kfree(dev, pb);
++err_pb_kz:
+ /* balance the reference of_mdio_find_bus() took */
+- put_device(&pb->mii_bus->dev);
+-
++ if (!mux_bus)
++ put_device(&parent_bus->dev);
+ err_parent_bus:
+ of_node_put(parent_bus_node);
+ return ret_val;
+diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
+index 2032a6de026b..4da73e2c37cf 100644
+--- a/drivers/net/phy/micrel.c
++++ b/drivers/net/phy/micrel.c
+@@ -268,23 +268,12 @@ static int kszphy_nand_tree_disable(struct phy_device *phydev)
+ return ret;
+ }
+
+-static int kszphy_config_init(struct phy_device *phydev)
++/* Some config bits need to be set again on resume, handle them here. */
++static int kszphy_config_reset(struct phy_device *phydev)
+ {
+ struct kszphy_priv *priv = phydev->priv;
+- const struct kszphy_type *type;
+ int ret;
+
+- if (!priv)
+- return 0;
+-
+- type = priv->type;
+-
+- if (type->has_broadcast_disable)
+- kszphy_broadcast_disable(phydev);
+-
+- if (type->has_nand_tree_disable)
+- kszphy_nand_tree_disable(phydev);
+-
+ if (priv->rmii_ref_clk_sel) {
+ ret = kszphy_rmii_clk_sel(phydev, priv->rmii_ref_clk_sel_val);
+ if (ret) {
+@@ -295,7 +284,7 @@ static int kszphy_config_init(struct phy_device *phydev)
+ }
+
+ if (priv->led_mode >= 0)
+- kszphy_setup_led(phydev, type->led_mode_reg, priv->led_mode);
++ kszphy_setup_led(phydev, priv->type->led_mode_reg, priv->led_mode);
+
+ if (phy_interrupt_is_valid(phydev)) {
+ int ctl = phy_read(phydev, MII_BMCR);
+@@ -311,6 +300,25 @@ static int kszphy_config_init(struct phy_device *phydev)
+ return 0;
+ }
+
++static int kszphy_config_init(struct phy_device *phydev)
++{
++ struct kszphy_priv *priv = phydev->priv;
++ const struct kszphy_type *type;
++
++ if (!priv)
++ return 0;
++
++ type = priv->type;
++
++ if (type->has_broadcast_disable)
++ kszphy_broadcast_disable(phydev);
++
++ if (type->has_nand_tree_disable)
++ kszphy_nand_tree_disable(phydev);
++
++ return kszphy_config_reset(phydev);
++}
++
+ static int ksz8041_config_init(struct phy_device *phydev)
+ {
+ struct device_node *of_node = phydev->mdio.dev.of_node;
+@@ -715,8 +723,14 @@ static int kszphy_suspend(struct phy_device *phydev)
+
+ static int kszphy_resume(struct phy_device *phydev)
+ {
++ int ret;
++
+ genphy_resume(phydev);
+
++ ret = kszphy_config_reset(phydev);
++ if (ret)
++ return ret;
++
+ /* Enable PHY Interrupts */
+ if (phy_interrupt_is_valid(phydev)) {
+ phydev->interrupts = PHY_INTERRUPT_ENABLED;
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index e2d9ca60e467..4d217649c8b1 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -148,6 +148,12 @@ static inline int phy_aneg_done(struct phy_device *phydev)
+ if (phydev->drv->aneg_done)
+ return phydev->drv->aneg_done(phydev);
+
++ /* Avoid genphy_aneg_done() if the Clause 45 PHY does not
++ * implement Clause 22 registers
++ */
++ if (phydev->is_c45 && !(phydev->c45_ids.devices_in_package & BIT(0)))
++ return -EINVAL;
++
+ return genphy_aneg_done(phydev);
+ }
+
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 1951b1085cb8..3045c9662ed6 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -465,7 +465,6 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.mtu = dst_mtu(&rt->dst);
+ if (!po->chan.mtu)
+ po->chan.mtu = PPP_MRU;
+- ip_rt_put(rt);
+ po->chan.mtu -= PPTP_HEADER_OVERHEAD;
+
+ po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index a0a9c9d39f01..8673ef3c9cdc 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1203,11 +1203,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ goto err_dev_open;
+ }
+
+- netif_addr_lock_bh(dev);
+- dev_uc_sync_multiple(port_dev, dev);
+- dev_mc_sync_multiple(port_dev, dev);
+- netif_addr_unlock_bh(dev);
+-
+ err = vlan_vids_add_by_dev(port_dev, dev);
+ if (err) {
+ netdev_err(dev, "Failed to add vlan ids to device %s\n",
+@@ -1247,6 +1242,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ goto err_option_port_add;
+ }
+
++ netif_addr_lock_bh(dev);
++ dev_uc_sync_multiple(port_dev, dev);
++ dev_mc_sync_multiple(port_dev, dev);
++ netif_addr_unlock_bh(dev);
++
+ port->index = -1;
+ list_add_tail_rcu(&port->list, &team->port_list);
+ team_port_enable(team, port);
+@@ -1271,8 +1271,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ vlan_vids_del_by_dev(port_dev, dev);
+
+ err_vids_add:
+- dev_uc_unsync(port_dev, dev);
+- dev_mc_unsync(port_dev, dev);
+ dev_close(port_dev);
+
+ err_dev_open:
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index dc6d3b0a0be8..feb61eaffe32 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -1118,6 +1118,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ u16 n = 0, index, ndplen;
+ u8 ready2send = 0;
+ u32 delayed_ndp_size;
++ size_t padding_count;
+
+ /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated
+ * accordingly. Otherwise, we should check here.
+@@ -1274,11 +1275,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ * a ZLP after full sized NTBs.
+ */
+ if (!(dev->driver_info->flags & FLAG_SEND_ZLP) &&
+- skb_out->len > ctx->min_tx_pkt)
+- memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
+- ctx->tx_max - skb_out->len);
+- else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
++ skb_out->len > ctx->min_tx_pkt) {
++ padding_count = ctx->tx_max - skb_out->len;
++ memset(skb_put(skb_out, padding_count), 0, padding_count);
++ } else if (skb_out->len < ctx->tx_max &&
++ (skb_out->len % dev->maxpacket) == 0) {
+ *skb_put(skb_out, 1) = 0; /* force short packet */
++ }
+
+ /* set final frame length */
+ nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data;
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 1568aedddfc9..472ed6df2221 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -529,7 +529,12 @@ static int add_recvbuf_small(struct virtnet_info *vi, struct receive_queue *rq,
+ hdr = skb_vnet_hdr(skb);
+ sg_init_table(rq->sg, 2);
+ sg_set_buf(rq->sg, hdr, vi->hdr_len);
+- skb_to_sgvec(skb, rq->sg + 1, 0, skb->len);
++
++ err = skb_to_sgvec(skb, rq->sg + 1, 0, skb->len);
++ if (unlikely(err < 0)) {
++ dev_kfree_skb(skb);
++ return err;
++ }
+
+ err = virtqueue_add_inbuf(rq->vq, rq->sg, 2, skb, gfp);
+ if (err < 0)
+@@ -831,7 +836,7 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
+ struct virtio_net_hdr_mrg_rxbuf *hdr;
+ const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+- unsigned num_sg;
++ int num_sg;
+ unsigned hdr_len = vi->hdr_len;
+ bool can_push;
+
+@@ -858,11 +863,16 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
+ if (can_push) {
+ __skb_push(skb, hdr_len);
+ num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len);
++ if (unlikely(num_sg < 0))
++ return num_sg;
+ /* Pull header back to avoid skew in tx bytes calculations. */
+ __skb_pull(skb, hdr_len);
+ } else {
+ sg_set_buf(sq->sg, hdr, hdr_len);
+- num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len) + 1;
++ num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len);
++ if (unlikely(num_sg < 0))
++ return num_sg;
++ num_sg++;
+ }
+ return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC);
+ }
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index 4afba17e2403..f809eed0343c 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -2962,6 +2962,11 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter)
+ /* we need to enable NAPI, otherwise dev_close will deadlock */
+ for (i = 0; i < adapter->num_rx_queues; i++)
+ napi_enable(&adapter->rx_queue[i].napi);
++ /*
++ * Need to clear the quiesce bit to ensure that vmxnet3_close
++ * can quiesce the device properly
++ */
++ clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
+ dev_close(adapter->netdev);
+ }
+
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 346e48698555..42c9480acdc7 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -585,13 +585,15 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
+ neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
+ if (unlikely(!neigh))
+ neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
+- if (!IS_ERR(neigh))
++ if (!IS_ERR(neigh)) {
+ ret = dst_neigh_output(dst, neigh, skb);
++ rcu_read_unlock_bh();
++ return ret;
++ }
+
+ rcu_read_unlock_bh();
+ err:
+- if (unlikely(ret < 0))
+- vrf_tx_error(skb->dev, skb);
++ vrf_tx_error(skb->dev, skb);
+ return ret;
+ }
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 0f5dfb8a545d..28afdf22b88f 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -930,7 +930,7 @@ static bool vxlan_snoop(struct net_device *dev,
+ return false;
+
+ /* Don't migrate static entries, drop packets */
+- if (f->state & NUD_NOARP)
++ if (f->state & (NUD_PERMANENT | NUD_NOARP))
+ return true;
+
+ if (net_ratelimit())
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 65647533b401..a8bd68f252e9 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -137,7 +137,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ priv->tx_ring_size = TX_BD_RING_LEN;
+ /* Alloc Rx BD */
+ priv->rx_bd_base = dma_alloc_coherent(priv->dev,
+- RX_BD_RING_LEN * sizeof(struct qe_bd *),
++ RX_BD_RING_LEN * sizeof(struct qe_bd),
+ &priv->dma_rx_bd, GFP_KERNEL);
+
+ if (!priv->rx_bd_base) {
+@@ -148,7 +148,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+
+ /* Alloc Tx BD */
+ priv->tx_bd_base = dma_alloc_coherent(priv->dev,
+- TX_BD_RING_LEN * sizeof(struct qe_bd *),
++ TX_BD_RING_LEN * sizeof(struct qe_bd),
+ &priv->dma_tx_bd, GFP_KERNEL);
+
+ if (!priv->tx_bd_base) {
+@@ -158,7 +158,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ }
+
+ /* Alloc parameter ram for ucc hdlc */
+- priv->ucc_pram_offset = qe_muram_alloc(sizeof(priv->ucc_pram),
++ priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param),
+ ALIGNMENT_OF_UCC_HDLC_PRAM);
+
+ if (priv->ucc_pram_offset < 0) {
+@@ -295,11 +295,11 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ qe_muram_free(priv->ucc_pram_offset);
+ free_tx_bd:
+ dma_free_coherent(priv->dev,
+- TX_BD_RING_LEN * sizeof(struct qe_bd *),
++ TX_BD_RING_LEN * sizeof(struct qe_bd),
+ priv->tx_bd_base, priv->dma_tx_bd);
+ free_rx_bd:
+ dma_free_coherent(priv->dev,
+- RX_BD_RING_LEN * sizeof(struct qe_bd *),
++ RX_BD_RING_LEN * sizeof(struct qe_bd),
+ priv->rx_bd_base, priv->dma_rx_bd);
+ free_uccf:
+ ucc_fast_free(priv->uccf);
+@@ -454,7 +454,7 @@ static int hdlc_tx_done(struct ucc_hdlc_private *priv)
+ static int hdlc_rx_done(struct ucc_hdlc_private *priv, int rx_work_limit)
+ {
+ struct net_device *dev = priv->ndev;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ hdlc_device *hdlc = dev_to_hdlc(dev);
+ struct qe_bd *bd;
+ u32 bd_status;
+@@ -688,7 +688,7 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
+
+ if (priv->rx_bd_base) {
+ dma_free_coherent(priv->dev,
+- RX_BD_RING_LEN * sizeof(struct qe_bd *),
++ RX_BD_RING_LEN * sizeof(struct qe_bd),
+ priv->rx_bd_base, priv->dma_rx_bd);
+
+ priv->rx_bd_base = NULL;
+@@ -697,7 +697,7 @@ static void uhdlc_memclean(struct ucc_hdlc_private *priv)
+
+ if (priv->tx_bd_base) {
+ dma_free_coherent(priv->dev,
+- TX_BD_RING_LEN * sizeof(struct qe_bd *),
++ TX_BD_RING_LEN * sizeof(struct qe_bd),
+ priv->tx_bd_base, priv->dma_tx_bd);
+
+ priv->tx_bd_base = NULL;
+@@ -1002,7 +1002,7 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ struct device_node *np = pdev->dev.of_node;
+ struct ucc_hdlc_private *uhdlc_priv = NULL;
+ struct ucc_tdm_info *ut_info;
+- struct ucc_tdm *utdm;
++ struct ucc_tdm *utdm = NULL;
+ struct resource res;
+ struct net_device *dev;
+ hdlc_device *hdlc;
+diff --git a/drivers/net/wireless/ath/ath10k/bmi.h b/drivers/net/wireless/ath/ath10k/bmi.h
+index 7d3231acfb24..82bdec744055 100644
+--- a/drivers/net/wireless/ath/ath10k/bmi.h
++++ b/drivers/net/wireless/ath/ath10k/bmi.h
+@@ -83,6 +83,8 @@ enum bmi_cmd_id {
+ #define BMI_NVRAM_SEG_NAME_SZ 16
+
+ #define BMI_PARAM_GET_EEPROM_BOARD_ID 0x10
++#define BMI_PARAM_GET_FLASH_BOARD_ID 0x8000
++#define BMI_PARAM_FLASH_SECTION_ALL 0x10000
+
+ #define ATH10K_BMI_BOARD_ID_FROM_OTP_MASK 0x7c00
+ #define ATH10K_BMI_BOARD_ID_FROM_OTP_LSB 10
+diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
+index 7b3017f55e3d..65ad7a130ca1 100644
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -652,7 +652,7 @@ static int ath10k_core_get_board_id_from_otp(struct ath10k *ar)
+ {
+ u32 result, address;
+ u8 board_id, chip_id;
+- int ret;
++ int ret, bmi_board_id_param;
+
+ address = ar->hw_params.patch_load_addr;
+
+@@ -676,8 +676,13 @@ static int ath10k_core_get_board_id_from_otp(struct ath10k *ar)
+ return ret;
+ }
+
+- ret = ath10k_bmi_execute(ar, address, BMI_PARAM_GET_EEPROM_BOARD_ID,
+- &result);
++ if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
++ ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
++ bmi_board_id_param = BMI_PARAM_GET_FLASH_BOARD_ID;
++ else
++ bmi_board_id_param = BMI_PARAM_GET_EEPROM_BOARD_ID;
++
++ ret = ath10k_bmi_execute(ar, address, bmi_board_id_param, &result);
+ if (ret) {
+ ath10k_err(ar, "could not execute otp for board id check: %d\n",
+ ret);
+@@ -739,6 +744,11 @@ static int ath10k_download_and_run_otp(struct ath10k *ar)
+ return ret;
+ }
+
++ /* As of now pre-cal is valid for 10_4 variants */
++ if (ar->cal_mode == ATH10K_PRE_CAL_MODE_DT ||
++ ar->cal_mode == ATH10K_PRE_CAL_MODE_FILE)
++ bmi_otp_exe_param = BMI_PARAM_FLASH_SECTION_ALL;
++
+ ret = ath10k_bmi_execute(ar, address, bmi_otp_exe_param, &result);
+ if (ret) {
+ ath10k_err(ar, "could not execute otp (%d)\n", ret);
+diff --git a/drivers/net/wireless/ath/ath5k/debug.c b/drivers/net/wireless/ath/ath5k/debug.c
+index 4f8d9ed04f5e..4a1054408f1a 100644
+--- a/drivers/net/wireless/ath/ath5k/debug.c
++++ b/drivers/net/wireless/ath/ath5k/debug.c
+@@ -939,7 +939,10 @@ static int open_file_eeprom(struct inode *inode, struct file *file)
+ }
+
+ for (i = 0; i < eesize; ++i) {
+- AR5K_EEPROM_READ(i, val);
++ if (!ath5k_hw_nvram_read(ah, i, &val)) {
++ ret = -EIO;
++ goto freebuf;
++ }
+ buf[i] = val;
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+index d4b73dedf89b..b35adbca7a5d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-7000.c
+@@ -79,8 +79,8 @@
+ /* Lowest firmware API version supported */
+ #define IWL7260_UCODE_API_MIN 17
+ #define IWL7265_UCODE_API_MIN 17
+-#define IWL7265D_UCODE_API_MIN 17
+-#define IWL3168_UCODE_API_MIN 20
++#define IWL7265D_UCODE_API_MIN 22
++#define IWL3168_UCODE_API_MIN 22
+
+ /* NVM versions */
+ #define IWL7260_NVM_VERSION 0x0a1d
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+index 8d3e53fac1da..20d08ddb4388 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+@@ -74,8 +74,8 @@
+ #define IWL8265_UCODE_API_MAX 26
+
+ /* Lowest firmware API version supported */
+-#define IWL8000_UCODE_API_MIN 17
+-#define IWL8265_UCODE_API_MIN 20
++#define IWL8000_UCODE_API_MIN 22
++#define IWL8265_UCODE_API_MIN 22
+
+ /* NVM versions */
+ #define IWL8000_NVM_VERSION 0x0a1d
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index 406ef301b8ab..da8234b762bf 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -369,6 +369,7 @@
+ #define MON_DMARB_RD_DATA_ADDR (0xa03c5c)
+
+ #define DBGC_IN_SAMPLE (0xa03c00)
++#define DBGC_OUT_CTRL (0xa03c0c)
+
+ /* enable the ID buf for read */
+ #define WFPM_PS_CTL_CLR 0xA0300C
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+index 700d244df34b..2642d8e477b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+@@ -914,14 +914,6 @@ int iwl_mvm_fw_dbg_collect_trig(struct iwl_mvm *mvm,
+ return 0;
+ }
+
+-static inline void iwl_mvm_restart_early_start(struct iwl_mvm *mvm)
+-{
+- if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000)
+- iwl_clear_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
+- else
+- iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 1);
+-}
+-
+ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
+ {
+ u8 *ptr;
+@@ -935,10 +927,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
+ /* EARLY START - firmware's configuration is hard coded */
+ if ((!mvm->fw->dbg_conf_tlv[conf_id] ||
+ !mvm->fw->dbg_conf_tlv[conf_id]->num_of_hcmds) &&
+- conf_id == FW_DBG_START_FROM_ALIVE) {
+- iwl_mvm_restart_early_start(mvm);
++ conf_id == FW_DBG_START_FROM_ALIVE)
+ return 0;
+- }
+
+ if (!mvm->fw->dbg_conf_tlv[conf_id])
+ return -EINVAL;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index c60703e0c246..2b1c691bb4b2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -1666,8 +1666,11 @@ int iwl_mvm_find_free_queue(struct iwl_mvm *mvm, u8 sta_id, u8 minq, u8 maxq);
+ */
+ static inline u32 iwl_mvm_flushable_queues(struct iwl_mvm *mvm)
+ {
++ u32 cmd_queue = iwl_mvm_is_dqa_supported(mvm) ? IWL_MVM_DQA_CMD_QUEUE :
++ IWL_MVM_CMD_QUEUE;
++
+ return ((BIT(mvm->cfg->base_params->num_of_queues) - 1) &
+- ~BIT(IWL_MVM_CMD_QUEUE));
++ ~BIT(cmd_queue));
+ }
+
+ static inline
+@@ -1687,6 +1690,7 @@ void iwl_mvm_enable_ac_txq(struct iwl_mvm *mvm, int queue, int mac80211_queue,
+ static inline void iwl_mvm_stop_device(struct iwl_mvm *mvm)
+ {
+ mvm->ucode_loaded = false;
++ mvm->fw_dbg_conf = FW_DBG_INVALID;
+ iwl_trans_stop_device(mvm->trans);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+index 4d35deb628bc..6d38eec3f9d3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+@@ -1118,21 +1118,37 @@ static void iwl_mvm_fw_error_dump_wk(struct work_struct *work)
+
+ mutex_lock(&mvm->mutex);
+
+- /* stop recording */
+ if (mvm->cfg->device_family == IWL_DEVICE_FAMILY_7000) {
++ /* stop recording */
+ iwl_set_bits_prph(mvm->trans, MON_BUFF_SAMPLE_CTL, 0x100);
++
++ iwl_mvm_fw_error_dump(mvm);
++
++ /* start recording again if the firmware is not crashed */
++ if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
++ mvm->fw->dbg_dest_tlv)
++ iwl_clear_bits_prph(mvm->trans,
++ MON_BUFF_SAMPLE_CTL, 0x100);
+ } else {
++ u32 in_sample = iwl_read_prph(mvm->trans, DBGC_IN_SAMPLE);
++ u32 out_ctrl = iwl_read_prph(mvm->trans, DBGC_OUT_CTRL);
++
++ /* stop recording */
+ iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, 0);
+- /* wait before we collect the data till the DBGC stop */
+ udelay(100);
+- }
++ iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, 0);
++ /* wait before we collect the data till the DBGC stop */
++ udelay(500);
+
+- iwl_mvm_fw_error_dump(mvm);
++ iwl_mvm_fw_error_dump(mvm);
+
+- /* start recording again if the firmware is not crashed */
+- WARN_ON_ONCE((!test_bit(STATUS_FW_ERROR, &mvm->trans->status)) &&
+- mvm->fw->dbg_dest_tlv &&
+- iwl_mvm_start_fw_dbg_conf(mvm, mvm->fw_dbg_conf));
++ /* start recording again if the firmware is not crashed */
++ if (!test_bit(STATUS_FW_ERROR, &mvm->trans->status) &&
++ mvm->fw->dbg_dest_tlv) {
++ iwl_write_prph(mvm->trans, DBGC_IN_SAMPLE, in_sample);
++ iwl_write_prph(mvm->trans, DBGC_OUT_CTRL, out_ctrl);
++ }
++ }
+
+ mutex_unlock(&mvm->mutex);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+index bec7d9c46087..c5203568a47a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+@@ -790,11 +790,13 @@ static int iwl_mvm_tcool_set_cur_state(struct thermal_cooling_device *cdev,
+ struct iwl_mvm *mvm = (struct iwl_mvm *)(cdev->devdata);
+ int ret;
+
+- if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR))
+- return -EIO;
+-
+ mutex_lock(&mvm->mutex);
+
++ if (!mvm->ucode_loaded || !(mvm->cur_ucode == IWL_UCODE_REGULAR)) {
++ ret = -EIO;
++ goto unlock;
++ }
++
+ if (new_state >= ARRAY_SIZE(iwl_mvm_cdev_budgets)) {
+ ret = -EINVAL;
+ goto unlock;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 10ef44e8ecd5..fe32de252e6b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -2824,7 +2824,8 @@ static struct iwl_trans_dump_data
+ #ifdef CONFIG_PM_SLEEP
+ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
+ {
+- if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
++ if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
++ (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
+ return iwl_pci_fw_enter_d0i3(trans);
+
+ return 0;
+@@ -2832,7 +2833,8 @@ static int iwl_trans_pcie_suspend(struct iwl_trans *trans)
+
+ static void iwl_trans_pcie_resume(struct iwl_trans *trans)
+ {
+- if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3)
++ if (trans->runtime_pm_mode == IWL_PLAT_PM_MODE_D0I3 &&
++ (trans->system_pm_mode == IWL_PLAT_PM_MODE_D0I3))
+ iwl_pci_fw_exit_d0i3(trans);
+ }
+ #endif /* CONFIG_PM_SLEEP */
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+index 13da95a24cf7..987c7c4f43cd 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -142,15 +142,25 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
+ if (!rt2x00dev->ops->hw->set_rts_threshold &&
+ (tx_info->control.rates[0].flags & (IEEE80211_TX_RC_USE_RTS_CTS |
+ IEEE80211_TX_RC_USE_CTS_PROTECT))) {
+- if (rt2x00queue_available(queue) <= 1)
+- goto exit_fail;
++ if (rt2x00queue_available(queue) <= 1) {
++ /*
++ * Recheck for full queue under lock to avoid race
++ * conditions with rt2x00lib_txdone().
++ */
++ spin_lock(&queue->tx_lock);
++ if (rt2x00queue_threshold(queue))
++ rt2x00queue_pause_queue(queue);
++ spin_unlock(&queue->tx_lock);
++
++ goto exit_free_skb;
++ }
+
+ if (rt2x00mac_tx_rts_cts(rt2x00dev, queue, skb))
+- goto exit_fail;
++ goto exit_free_skb;
+ }
+
+ if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false)))
+- goto exit_fail;
++ goto exit_free_skb;
+
+ /*
+ * Pausing queue has to be serialized with rt2x00lib_txdone(). Note
+@@ -164,10 +174,6 @@ void rt2x00mac_tx(struct ieee80211_hw *hw,
+
+ return;
+
+- exit_fail:
+- spin_lock(&queue->tx_lock);
+- rt2x00queue_pause_queue(queue);
+- spin_unlock(&queue->tx_lock);
+ exit_free_skb:
+ ieee80211_free_txskb(hw, skb);
+ }
+diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
+index 0881ba8535f4..c78abfc7bd96 100644
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_parms[] = {
+ 0x04, 0x08, /* Noise gain, limit offset */
+ 0x28, 0x28, /* det rssi, med busy offsets */
+ 7, /* det sync thresh */
+- 0, 2, 2 /* test mode, min, max */
++ 0, 2, 2, /* test mode, min, max */
++ 0, /* rx/tx delay */
++ 0, 0, 0, 0, 0, 0, /* current BSS id */
++ 0 /* hop set */
+ };
+
+ /*===========================================================================*/
+@@ -598,7 +601,7 @@ static void init_startup_params(ray_dev_t *local)
+ * a_beacon_period = hops a_beacon_period = KuS
+ *//* 64ms = 010000 */
+ if (local->fw_ver == 0x55) {
+- memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms,
++ memcpy(&local->sparm.b4, b4_default_startup_parms,
+ sizeof(struct b4_startup_params));
+ /* Translate sane kus input values to old build 4/5 format */
+ /* i = hop time in uS truncated to 3 bytes */
+diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
+index 1c539c83e8cf..5e41bf04ef61 100644
+--- a/drivers/net/wireless/ti/wl1251/main.c
++++ b/drivers/net/wireless/ti/wl1251/main.c
+@@ -1200,8 +1200,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
+ WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS);
+
+ enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc;
+- wl1251_acx_arp_ip_filter(wl, enable, addr);
+-
++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr);
+ if (ret < 0)
+ goto out_sleep;
+ }
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ad9d82eb2aed..c823e9346389 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2040,6 +2040,10 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
+ struct nvme_ns *ns;
+
+ mutex_lock(&ctrl->namespaces_mutex);
++
++ /* Forcibly start all queues to avoid having stuck requests */
++ blk_mq_start_hw_queues(ctrl->admin_q);
++
+ list_for_each_entry(ns, &ctrl->namespaces, list) {
+ /*
+ * Revalidating a dead namespace sets capacity to 0. This will
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index e48ecb9303ca..8cc856ecec95 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1263,7 +1263,7 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts)
+ bool nssro = dev->subsystem && (csts & NVME_CSTS_NSSRO);
+
+ /* If there is a reset ongoing, we shouldn't reset again. */
+- if (work_busy(&dev->reset_work))
++ if (dev->ctrl.state == NVME_CTRL_RESETTING)
+ return false;
+
+ /* We shouldn't reset unless the controller is on fatal error state
+@@ -1755,7 +1755,7 @@ static void nvme_reset_work(struct work_struct *work)
+ struct nvme_dev *dev = container_of(work, struct nvme_dev, reset_work);
+ int result = -ENODEV;
+
+- if (WARN_ON(dev->ctrl.state == NVME_CTRL_RESETTING))
++ if (WARN_ON(dev->ctrl.state != NVME_CTRL_RESETTING))
+ goto out;
+
+ /*
+@@ -1765,9 +1765,6 @@ static void nvme_reset_work(struct work_struct *work)
+ if (dev->ctrl.ctrl_config & NVME_CC_ENABLE)
+ nvme_dev_disable(dev, false);
+
+- if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
+- goto out;
+-
+ result = nvme_pci_enable(dev);
+ if (result)
+ goto out;
+@@ -1841,8 +1838,8 @@ static int nvme_reset(struct nvme_dev *dev)
+ {
+ if (!dev->ctrl.admin_q || blk_queue_dying(dev->ctrl.admin_q))
+ return -ENODEV;
+- if (work_busy(&dev->reset_work))
+- return -ENODEV;
++ if (!nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING))
++ return -EBUSY;
+ if (!queue_work(nvme_workq, &dev->reset_work))
+ return -EBUSY;
+ return 0;
+@@ -1944,6 +1941,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ if (result)
+ goto release_pools;
+
++ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_RESETTING);
+ dev_info(dev->ctrl.device, "pci function %s\n", dev_name(&pdev->dev));
+
+ queue_work(nvme_workq, &dev->reset_work);
+@@ -1987,6 +1985,7 @@ static void nvme_remove(struct pci_dev *pdev)
+
+ nvme_change_ctrl_state(&dev->ctrl, NVME_CTRL_DELETING);
+
++ cancel_work_sync(&dev->reset_work);
+ pci_set_drvdata(pdev, NULL);
+
+ if (!pci_device_is_present(pdev)) {
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 0a965026b134..fc5b18d3db20 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -46,6 +46,9 @@
+ #define BYT_TRIG_POS BIT(25)
+ #define BYT_TRIG_LVL BIT(24)
+ #define BYT_DEBOUNCE_EN BIT(20)
++#define BYT_GLITCH_FILTER_EN BIT(19)
++#define BYT_GLITCH_F_SLOW_CLK BIT(17)
++#define BYT_GLITCH_F_FAST_CLK BIT(16)
+ #define BYT_PULL_STR_SHIFT 9
+ #define BYT_PULL_STR_MASK (3 << BYT_PULL_STR_SHIFT)
+ #define BYT_PULL_STR_2K (0 << BYT_PULL_STR_SHIFT)
+@@ -1579,6 +1582,9 @@ static int byt_irq_type(struct irq_data *d, unsigned int type)
+ */
+ value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
+ BYT_TRIG_LVL);
++ /* Enable glitch filtering */
++ value |= BYT_GLITCH_FILTER_EN | BYT_GLITCH_F_SLOW_CLK |
++ BYT_GLITCH_F_FAST_CLK;
+
+ writel(value, reg);
+
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 7511723c6b05..257c1c2e5888 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -138,7 +138,6 @@ static const struct pinctrl_pin_desc meson_gxbb_periphs_pins[] = {
+ MESON_PIN(GPIOX_19, EE_OFF),
+ MESON_PIN(GPIOX_20, EE_OFF),
+ MESON_PIN(GPIOX_21, EE_OFF),
+- MESON_PIN(GPIOX_22, EE_OFF),
+
+ MESON_PIN(GPIOCLK_0, EE_OFF),
+ MESON_PIN(GPIOCLK_1, EE_OFF),
+diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
+index 14bde0db8c24..5b10b50f8686 100644
+--- a/drivers/powercap/powercap_sys.c
++++ b/drivers/powercap/powercap_sys.c
+@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone(
+
+ power_zone->id = result;
+ idr_init(&power_zone->idr);
++ result = -ENOMEM;
+ power_zone->name = kstrdup(name, GFP_KERNEL);
+ if (!power_zone->name)
+ goto err_name_alloc;
+diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
+index 6ebd42aad291..25cf3069e2e7 100644
+--- a/drivers/rtc/interface.c
++++ b/drivers/rtc/interface.c
+@@ -227,6 +227,13 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ missing = year;
+ }
+
++ /* Can't proceed if alarm is still invalid after replacing
++ * missing fields.
++ */
++ err = rtc_valid_tm(&alarm->time);
++ if (err)
++ goto done;
++
+ /* with luck, no rollover is needed */
+ t_now = rtc_tm_to_time64(&now);
+ t_alm = rtc_tm_to_time64(&alarm->time);
+@@ -278,9 +285,9 @@ int __rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)
+ dev_warn(&rtc->dev, "alarm rollover not handled\n");
+ }
+
+-done:
+ err = rtc_valid_tm(&alarm->time);
+
++done:
+ if (err) {
+ dev_warn(&rtc->dev, "invalid alarm value: %d-%d-%d %d:%d:%d\n",
+ alarm->time.tm_year + 1900, alarm->time.tm_mon + 1,
+diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
+index 58698d21c2c3..c4ca6a385790 100644
+--- a/drivers/rtc/rtc-m41t80.c
++++ b/drivers/rtc/rtc-m41t80.c
+@@ -168,6 +168,7 @@ static int m41t80_get_datetime(struct i2c_client *client,
+ /* Sets the given date and time to the real time clock. */
+ static int m41t80_set_datetime(struct i2c_client *client, struct rtc_time *tm)
+ {
++ struct m41t80_data *clientdata = i2c_get_clientdata(client);
+ unsigned char buf[8];
+ int err, flags;
+
+@@ -183,6 +184,17 @@ static int m41t80_set_datetime(struct i2c_client *client, struct rtc_time *tm)
+ buf[M41T80_REG_YEAR] = bin2bcd(tm->tm_year - 100);
+ buf[M41T80_REG_WDAY] = tm->tm_wday;
+
++ /* If the square wave output is controlled in the weekday register */
++ if (clientdata->features & M41T80_FEATURE_SQ_ALT) {
++ int val;
++
++ val = i2c_smbus_read_byte_data(client, M41T80_REG_WDAY);
++ if (val < 0)
++ return val;
++
++ buf[M41T80_REG_WDAY] |= (val & 0xf0);
++ }
++
+ err = i2c_smbus_write_i2c_block_data(client, M41T80_REG_SSEC,
+ sizeof(buf), buf);
+ if (err < 0) {
+diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
+index e4324dcf9508..aa53fceaa5e0 100644
+--- a/drivers/rtc/rtc-opal.c
++++ b/drivers/rtc/rtc-opal.c
+@@ -150,6 +150,16 @@ static int opal_get_tpo_time(struct device *dev, struct rtc_wkalrm *alarm)
+
+ y_m_d = be32_to_cpu(__y_m_d);
+ h_m_s_ms = ((u64)be32_to_cpu(__h_m) << 32);
++
++ /* check if no alarm is set */
++ if (y_m_d == 0 && h_m_s_ms == 0) {
++ pr_debug("No alarm is set\n");
++ rc = -ENOENT;
++ goto exit;
++ } else {
++ pr_debug("Alarm set to %x %llx\n", y_m_d, h_m_s_ms);
++ }
++
+ opal_to_tm(y_m_d, h_m_s_ms, &alarm->time);
+
+ exit:
+diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
+index 0f11c2a228e3..a753ef9c1459 100644
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -257,7 +257,7 @@ static int snvs_rtc_probe(struct platform_device *pdev)
+ of_property_read_u32(pdev->dev.of_node, "offset", &data->offset);
+ }
+
+- if (!data->regmap) {
++ if (IS_ERR(data->regmap)) {
+ dev_err(&pdev->dev, "Can't find snvs syscon\n");
+ return -ENODEV;
+ }
+diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
+index 5ecd40884f01..0da246505f70 100644
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -1950,8 +1950,12 @@ static int __dasd_device_is_unusable(struct dasd_device *device,
+ {
+ int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM);
+
+- if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) {
+- /* dasd is being set offline. */
++ if (test_bit(DASD_FLAG_OFFLINE, &device->flags) &&
++ !test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
++ /*
++ * dasd is being set offline
++ * but it is no safe offline where we have to allow I/O
++ */
+ return 1;
+ }
+ if (device->stopped) {
+diff --git a/drivers/scsi/bnx2fc/bnx2fc.h b/drivers/scsi/bnx2fc/bnx2fc.h
+index fdd4eb4e41b2..e58786f797d9 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc.h
++++ b/drivers/scsi/bnx2fc/bnx2fc.h
+@@ -191,6 +191,7 @@ struct bnx2fc_hba {
+ struct bnx2fc_cmd_mgr *cmd_mgr;
+ spinlock_t hba_lock;
+ struct mutex hba_mutex;
++ struct mutex hba_stats_mutex;
+ unsigned long adapter_state;
+ #define ADAPTER_STATE_UP 0
+ #define ADAPTER_STATE_GOING_DOWN 1
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index f9ddb6156f14..bee7d37367ca 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -670,15 +670,17 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
+ if (!fw_stats)
+ return NULL;
+
++ mutex_lock(&hba->hba_stats_mutex);
++
+ bnx2fc_stats = fc_get_host_stats(shost);
+
+ init_completion(&hba->stat_req_done);
+ if (bnx2fc_send_stat_req(hba))
+- return bnx2fc_stats;
++ goto unlock_stats_mutex;
+ rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ));
+ if (!rc) {
+ BNX2FC_HBA_DBG(lport, "FW stat req timed out\n");
+- return bnx2fc_stats;
++ goto unlock_stats_mutex;
+ }
+ BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt);
+ bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt;
+@@ -700,6 +702,9 @@ static struct fc_host_statistics *bnx2fc_get_host_stats(struct Scsi_Host *shost)
+
+ memcpy(&hba->prev_stats, hba->stats_buffer,
+ sizeof(struct fcoe_statistics_params));
++
++unlock_stats_mutex:
++ mutex_unlock(&hba->hba_stats_mutex);
+ return bnx2fc_stats;
+ }
+
+@@ -1348,6 +1353,7 @@ static struct bnx2fc_hba *bnx2fc_hba_create(struct cnic_dev *cnic)
+ }
+ spin_lock_init(&hba->hba_lock);
+ mutex_init(&hba->hba_mutex);
++ mutex_init(&hba->hba_stats_mutex);
+
+ hba->cnic = cnic;
+
+diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
+index 622bdabc8894..dab195f04da7 100644
+--- a/drivers/scsi/csiostor/csio_hw.c
++++ b/drivers/scsi/csiostor/csio_hw.c
+@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
+ goto bye;
+ }
+
+- mempool_free(mbp, hw->mb_mempool);
+ if (finicsum != cfcsum) {
+ csio_warn(hw,
+ "Config File checksum mismatch: csum=%#x, computed=%#x\n",
+@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
+ rv = csio_hw_validate_caps(hw, mbp);
+ if (rv != 0)
+ goto bye;
++
++ mempool_free(mbp, hw->mb_mempool);
++ mbp = NULL;
++
+ /*
+ * Note that we're operating with parameters
+ * not supplied by the driver, rather than from hard-wired
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 4abd3fce5ab6..c2b682916337 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -1695,6 +1695,15 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc)
+ */
+ switch (session->state) {
+ case ISCSI_STATE_FAILED:
++ /*
++ * cmds should fail during shutdown, if the session
++ * state is bad, allowing completion to happen
++ */
++ if (unlikely(system_state != SYSTEM_RUNNING)) {
++ reason = FAILURE_SESSION_FAILED;
++ sc->result = DID_NO_CONNECT << 16;
++ break;
++ }
+ case ISCSI_STATE_IN_RECOVERY:
+ reason = FAILURE_SESSION_IN_RECOVERY;
+ sc->result = DID_IMM_RETRY << 16;
+@@ -1979,6 +1988,19 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ }
+
+ if (session->state != ISCSI_STATE_LOGGED_IN) {
++ /*
++ * During shutdown, if session is prematurely disconnected,
++ * recovery won't happen and there will be hung cmds. Not
++ * handling cmds would trigger EH, also bad in this case.
++ * Instead, handle cmd, allow completion to happen and let
++ * upper layer to deal with the result.
++ */
++ if (unlikely(system_state != SYSTEM_RUNNING)) {
++ sc->result = DID_NO_CONNECT << 16;
++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n");
++ rc = BLK_EH_HANDLED;
++ goto done;
++ }
+ /*
+ * We are probably in the middle of iscsi recovery so let
+ * that complete and handle the error.
+@@ -2083,7 +2105,7 @@ static enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ task->last_timeout = jiffies;
+ spin_unlock(&session->frwd_lock);
+ ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ?
+- "timer reset" : "nh");
++ "timer reset" : "shutdown or nh");
+ return rc;
+ }
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 022bb6e10d98..12886f96b286 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -282,6 +282,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
+ phy->phy->minimum_linkrate = dr->pmin_linkrate;
+ phy->phy->maximum_linkrate = dr->pmax_linkrate;
+ phy->phy->negotiated_linkrate = phy->linkrate;
++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED);
+
+ skip:
+ if (new_phy)
+@@ -675,7 +676,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy)
+ res = smp_execute_task(dev, req, RPEL_REQ_SIZE,
+ resp, RPEL_RESP_SIZE);
+
+- if (!res)
++ if (res)
+ goto out;
+
+ phy->invalid_dword_count = scsi_to_u32(&resp[12]);
+@@ -684,6 +685,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy)
+ phy->phy_reset_problem_count = scsi_to_u32(&resp[24]);
+
+ out:
++ kfree(req);
+ kfree(resp);
+ return res;
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+index 468acab04d3d..b8589068d175 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4065,19 +4065,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ return 0;
+ }
+
+- /*
+- * Bug work around for firmware SATL handling. The loop
+- * is based on atomic operations and ensures consistency
+- * since we're lockless at this point
+- */
+- do {
+- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) {
+- scmd->result = SAM_STAT_BUSY;
+- scmd->scsi_done(scmd);
+- return 0;
+- }
+- } while (_scsih_set_satl_pending(scmd, true));
+-
+ sas_target_priv_data = sas_device_priv_data->sas_target;
+
+ /* invalid device handle */
+@@ -4103,6 +4090,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ sas_device_priv_data->block)
+ return SCSI_MLQUEUE_DEVICE_BUSY;
+
++ /*
++ * Bug work around for firmware SATL handling. The loop
++ * is based on atomic operations and ensures consistency
++ * since we're lockless at this point
++ */
++ do {
++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) {
++ scmd->result = SAM_STAT_BUSY;
++ scmd->scsi_done(scmd);
++ return 0;
++ }
++ } while (_scsih_set_satl_pending(scmd, true));
++
+ if (scmd->sc_data_direction == DMA_FROM_DEVICE)
+ mpi_control = MPI2_SCSIIO_CONTROL_READ;
+ else if (scmd->sc_data_direction == DMA_TO_DEVICE)
+@@ -4124,6 +4124,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ if (!smid) {
+ pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n",
+ ioc->name, __func__);
++ _scsih_set_satl_pending(scmd, false);
+ goto out;
+ }
+ mpi_request = mpt3sas_base_get_msg_frame(ioc, smid);
+@@ -4154,6 +4155,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
+ if (mpi_request->DataLength) {
+ if (ioc->build_sg_scmd(ioc, scmd, smid)) {
+ mpt3sas_base_free_smid(ioc, smid);
++ _scsih_set_satl_pending(scmd, false);
+ goto out;
+ }
+ } else
+diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c
+index 170de1c9eac4..f815f9d5045f 100644
+--- a/drivers/staging/wlan-ng/prism2mgmt.c
++++ b/drivers/staging/wlan-ng/prism2mgmt.c
+@@ -169,7 +169,7 @@ int prism2mgmt_scan(struct wlandevice *wlandev, void *msgp)
+ hw->ident_sta_fw.variant) >
+ HFA384x_FIRMWARE_VERSION(1, 5, 0)) {
+ if (msg->scantype.data != P80211ENUM_scantype_active)
+- word = cpu_to_le16(msg->maxchanneltime.data);
++ word = msg->maxchanneltime.data;
+ else
+ word = 0;
+
+diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
+index b4d3116cfdaf..3055f9a12a17 100644
+--- a/drivers/thermal/power_allocator.c
++++ b/drivers/thermal/power_allocator.c
+@@ -523,6 +523,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz)
+ struct thermal_instance *instance;
+ struct power_allocator_params *params = tz->governor_data;
+
++ mutex_lock(&tz->lock);
+ list_for_each_entry(instance, &tz->thermal_instances, tz_node) {
+ if ((instance->trip != params->trip_max_desired_temperature) ||
+ (!cdev_is_power_actor(instance->cdev)))
+@@ -534,6 +535,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz)
+ mutex_unlock(&instance->cdev->lock);
+ thermal_cdev_update(instance->cdev);
+ }
++ mutex_unlock(&tz->lock);
+ }
+
+ /**
+diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
+index 54cab59e20ed..fe2291795d2f 100644
+--- a/drivers/tty/n_gsm.c
++++ b/drivers/tty/n_gsm.c
+@@ -1467,6 +1467,10 @@ static void gsm_dlci_open(struct gsm_dlci *dlci)
+ * in which case an opening port goes back to closed and a closing port
+ * is simply put into closed state (any further frames from the other
+ * end will get a DM response)
++ *
++ * Some control dlci can stay in ADM mode with other dlci working just
++ * fine. In that case we can just keep the control dlci open after the
++ * DLCI_OPENING retries time out.
+ */
+
+ static void gsm_dlci_t1(unsigned long data)
+@@ -1480,8 +1484,15 @@ static void gsm_dlci_t1(unsigned long data)
+ if (dlci->retries) {
+ gsm_command(dlci->gsm, dlci->addr, SABM|PF);
+ mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100);
+- } else
++ } else if (!dlci->addr && gsm->control == (DM | PF)) {
++ if (debug & 8)
++ pr_info("DLCI %d opening in ADM mode.\n",
++ dlci->addr);
++ gsm_dlci_open(dlci);
++ } else {
+ gsm_dlci_close(dlci);
++ }
++
+ break;
+ case DLCI_CLOSING:
+ dlci->retries--;
+@@ -1499,8 +1510,8 @@ static void gsm_dlci_t1(unsigned long data)
+ * @dlci: DLCI to open
+ *
+ * Commence opening a DLCI from the Linux side. We issue SABM messages
+- * to the modem which should then reply with a UA, at which point we
+- * will move into open state. Opening is done asynchronously with retry
++ * to the modem which should then reply with a UA or ADM, at which point
++ * we will move into open state. Opening is done asynchronously with retry
+ * running off timers and the responses.
+ */
+
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index da31159a03ec..e8b34f16ba2c 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -613,6 +613,10 @@ static int omap_8250_startup(struct uart_port *port)
+ up->lsr_saved_flags = 0;
+ up->msr_saved_flags = 0;
+
++ /* Disable DMA for console UART */
++ if (uart_console(port))
++ up->dma = NULL;
++
+ if (up->dma) {
+ ret = serial8250_request_dma(up);
+ if (ret) {
+diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
+index fcf803ffad19..cdd2f942317c 100644
+--- a/drivers/tty/serial/sccnxp.c
++++ b/drivers/tty/serial/sccnxp.c
+@@ -884,14 +884,19 @@ static int sccnxp_probe(struct platform_device *pdev)
+
+ clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(clk)) {
+- if (PTR_ERR(clk) == -EPROBE_DEFER) {
+- ret = -EPROBE_DEFER;
++ ret = PTR_ERR(clk);
++ if (ret == -EPROBE_DEFER)
+ goto err_out;
+- }
++ uartclk = 0;
++ } else {
++ clk_prepare_enable(clk);
++ uartclk = clk_get_rate(clk);
++ }
++
++ if (!uartclk) {
+ dev_notice(&pdev->dev, "Using default clock frequency\n");
+ uartclk = s->chip->freq_std;
+- } else
+- uartclk = clk_get_rate(clk);
++ }
+
+ /* Check input frequency */
+ if ((uartclk < s->chip->freq_min) || (uartclk > s->chip->freq_max)) {
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index a55c94dfefd2..107f0d194ac5 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1545,7 +1545,16 @@ static void sci_free_dma(struct uart_port *port)
+ if (s->chan_rx)
+ sci_rx_dma_release(s, false);
+ }
+-#else
++
++static void sci_flush_buffer(struct uart_port *port)
++{
++ /*
++ * In uart_flush_buffer(), the xmit circular buffer has just been
++ * cleared, so we have to reset tx_dma_len accordingly.
++ */
++ to_sci_port(port)->tx_dma_len = 0;
++}
++#else /* !CONFIG_SERIAL_SH_SCI_DMA */
+ static inline void sci_request_dma(struct uart_port *port)
+ {
+ }
+@@ -1553,7 +1562,9 @@ static inline void sci_request_dma(struct uart_port *port)
+ static inline void sci_free_dma(struct uart_port *port)
+ {
+ }
+-#endif
++
++#define sci_flush_buffer NULL
++#endif /* !CONFIG_SERIAL_SH_SCI_DMA */
+
+ static irqreturn_t sci_rx_interrupt(int irq, void *ptr)
+ {
+@@ -2551,6 +2562,7 @@ static const struct uart_ops sci_uart_ops = {
+ .break_ctl = sci_break_ctl,
+ .startup = sci_startup,
+ .shutdown = sci_shutdown,
++ .flush_buffer = sci_flush_buffer,
+ .set_termios = sci_set_termios,
+ .pm = sci_pm,
+ .type = sci_type,
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index fba021f5736a..208bc52fc84d 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map) {
+ ret = -ENOMEM;
+- goto err_map_kobj;
++ goto err_map;
+ }
+ kobject_init(&map->kobj, &map_attr_type);
+ map->mem = mem;
+@@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
+ goto err_map_kobj;
+ ret = kobject_uevent(&map->kobj, KOBJ_ADD);
+ if (ret)
+- goto err_map;
++ goto err_map_kobj;
+ }
+
+ for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
+@@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
+ portio = kzalloc(sizeof(*portio), GFP_KERNEL);
+ if (!portio) {
+ ret = -ENOMEM;
+- goto err_portio_kobj;
++ goto err_portio;
+ }
+ kobject_init(&portio->kobj, &portio_attr_type);
+ portio->port = port;
+@@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
+ goto err_portio_kobj;
+ ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
+ if (ret)
+- goto err_portio;
++ goto err_portio_kobj;
+ }
+
+ return 0;
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 6e0d614a8075..64c6af2c8559 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -839,7 +839,7 @@ static inline void ci_role_destroy(struct ci_hdrc *ci)
+ {
+ ci_hdrc_gadget_destroy(ci);
+ ci_hdrc_host_destroy(ci);
+- if (ci->is_otg)
++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET])
+ ci_hdrc_otg_destroy(ci);
+ }
+
+@@ -939,27 +939,35 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ /* initialize role(s) before the interrupt is requested */
+ if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_HOST) {
+ ret = ci_hdrc_host_init(ci);
+- if (ret)
+- dev_info(dev, "doesn't support host\n");
++ if (ret) {
++ if (ret == -ENXIO)
++ dev_info(dev, "doesn't support host\n");
++ else
++ goto deinit_phy;
++ }
+ }
+
+ if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_PERIPHERAL) {
+ ret = ci_hdrc_gadget_init(ci);
+- if (ret)
+- dev_info(dev, "doesn't support gadget\n");
++ if (ret) {
++ if (ret == -ENXIO)
++ dev_info(dev, "doesn't support gadget\n");
++ else
++ goto deinit_host;
++ }
+ }
+
+ if (!ci->roles[CI_ROLE_HOST] && !ci->roles[CI_ROLE_GADGET]) {
+ dev_err(dev, "no supported roles\n");
+ ret = -ENODEV;
+- goto deinit_phy;
++ goto deinit_gadget;
+ }
+
+ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) {
+ ret = ci_hdrc_otg_init(ci);
+ if (ret) {
+ dev_err(dev, "init otg fails, ret = %d\n", ret);
+- goto stop;
++ goto deinit_gadget;
+ }
+ }
+
+@@ -1024,7 +1032,12 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+
+ ci_extcon_unregister(ci);
+ stop:
+- ci_role_destroy(ci);
++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET])
++ ci_hdrc_otg_destroy(ci);
++deinit_gadget:
++ ci_hdrc_gadget_destroy(ci);
++deinit_host:
++ ci_hdrc_host_destroy(ci);
+ deinit_phy:
+ ci_usb_phy_exit(ci);
+
+diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c
+index 72664700b8a2..12ee23f53cdd 100644
+--- a/drivers/usb/dwc3/dwc3-keystone.c
++++ b/drivers/usb/dwc3/dwc3-keystone.c
+@@ -107,6 +107,10 @@ static int kdwc3_probe(struct platform_device *pdev)
+ return PTR_ERR(kdwc->usbss);
+
+ kdwc->clk = devm_clk_get(kdwc->dev, "usb");
++ if (IS_ERR(kdwc->clk)) {
++ dev_err(kdwc->dev, "unable to get usb clock\n");
++ return PTR_ERR(kdwc->clk);
++ }
+
+ error = clk_prepare_enable(kdwc->clk);
+ if (error < 0) {
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index dec100811946..ca8b0b1ae37d 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -335,7 +335,6 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match);
+ static struct platform_driver usb_xhci_driver = {
+ .probe = xhci_plat_probe,
+ .remove = xhci_plat_remove,
+- .shutdown = usb_hcd_platform_shutdown,
+ .driver = {
+ .name = "xhci-hcd",
+ .pm = DEV_PM_OPS,
+diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
+index 4340b4925daa..4d6eb48b2c45 100644
+--- a/drivers/usb/storage/ene_ub6250.c
++++ b/drivers/usb/storage/ene_ub6250.c
+@@ -1942,6 +1942,8 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag)
+ bcb->CDB[0] = 0xEF;
+
+ result = ene_send_scsi_cmd(us, FDIR_WRITE, buf, 0);
++ if (us->srb != NULL)
++ scsi_set_resid(us->srb, 0);
+ info->BIN_FLAG = flag;
+ kfree(buf);
+
+@@ -2295,21 +2297,22 @@ static int ms_scsi_irp(struct us_data *us, struct scsi_cmnd *srb)
+
+ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us)
+ {
+- int result = 0;
++ int result = USB_STOR_XFER_GOOD;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+
+ /*US_DEBUG(usb_stor_show_command(us, srb)); */
+ scsi_set_resid(srb, 0);
+- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) {
++ if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready)))
+ result = ene_init(us);
+- } else {
++ if (result == USB_STOR_XFER_GOOD) {
++ result = USB_STOR_TRANSPORT_ERROR;
+ if (info->SD_Status.Ready)
+ result = sd_scsi_irp(us, srb);
+
+ if (info->MS_Status.Ready)
+ result = ms_scsi_irp(us, srb);
+ }
+- return 0;
++ return result;
+ }
+
+ static struct scsi_host_template ene_ub6250_host_template;
+diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
+index e5b7652234fc..487586e2d8b9 100644
+--- a/drivers/vhost/net.c
++++ b/drivers/vhost/net.c
+@@ -524,7 +524,7 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
+
+ if (!len && vq->busyloop_timeout) {
+ /* Both tx vq and rx socket were polled here */
+- mutex_lock(&vq->mutex);
++ mutex_lock_nested(&vq->mutex, 1);
+ vhost_disable_notify(&net->dev, vq);
+
+ preempt_disable();
+@@ -657,7 +657,7 @@ static void handle_rx(struct vhost_net *net)
+ struct iov_iter fixup;
+ __virtio16 num_buffers;
+
+- mutex_lock(&vq->mutex);
++ mutex_lock_nested(&vq->mutex, 0);
+ sock = vq->private_data;
+ if (!sock)
+ goto out;
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index cd38f5add254..e2c37aeed45a 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -211,8 +211,7 @@ int vhost_poll_start(struct vhost_poll *poll, struct file *file)
+ if (mask)
+ vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
+ if (mask & POLLERR) {
+- if (poll->wqh)
+- remove_wait_queue(poll->wqh, &poll->wait);
++ vhost_poll_stop(poll);
+ ret = -EINVAL;
+ }
+
+@@ -1176,14 +1175,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq,
+ /* Caller should have vq mutex and device mutex */
+ int vhost_vq_access_ok(struct vhost_virtqueue *vq)
+ {
+- if (vq->iotlb) {
+- /* When device IOTLB was used, the access validation
+- * will be validated during prefetching.
+- */
+- return 1;
+- }
+- return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) &&
+- vq_log_access_ok(vq, vq->log_base);
++ int ret = vq_log_access_ok(vq, vq->log_base);
++
++ if (ret || vq->iotlb)
++ return ret;
++
++ return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used);
+ }
+ EXPORT_SYMBOL_GPL(vhost_vq_access_ok);
+
+diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
+index 288318ad21dd..8049e7656daa 100644
+--- a/drivers/video/backlight/backlight.c
++++ b/drivers/video/backlight/backlight.c
+@@ -134,7 +134,7 @@ static ssize_t bl_power_store(struct device *dev, struct device_attribute *attr,
+ {
+ int rc;
+ struct backlight_device *bd = to_backlight_device(dev);
+- unsigned long power;
++ unsigned long power, old_power;
+
+ rc = kstrtoul(buf, 0, &power);
+ if (rc)
+@@ -145,10 +145,16 @@ static ssize_t bl_power_store(struct device *dev, struct device_attribute *attr,
+ if (bd->ops) {
+ pr_debug("set power to %lu\n", power);
+ if (bd->props.power != power) {
++ old_power = bd->props.power;
+ bd->props.power = power;
+- backlight_update_status(bd);
++ rc = backlight_update_status(bd);
++ if (rc)
++ bd->props.power = old_power;
++ else
++ rc = count;
++ } else {
++ rc = count;
+ }
+- rc = count;
+ }
+ mutex_unlock(&bd->ops_lock);
+
+@@ -176,8 +182,7 @@ int backlight_device_set_brightness(struct backlight_device *bd,
+ else {
+ pr_debug("set brightness to %lu\n", brightness);
+ bd->props.brightness = brightness;
+- backlight_update_status(bd);
+- rc = 0;
++ rc = backlight_update_status(bd);
+ }
+ }
+ mutex_unlock(&bd->ops_lock);
+diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
+index d7c239ea3d09..f5574060f9c8 100644
+--- a/drivers/video/backlight/corgi_lcd.c
++++ b/drivers/video/backlight/corgi_lcd.c
+@@ -177,7 +177,7 @@ static int corgi_ssp_lcdtg_send(struct corgi_lcd *lcd, int adrs, uint8_t data)
+ struct spi_message msg;
+ struct spi_transfer xfer = {
+ .len = 1,
+- .cs_change = 1,
++ .cs_change = 0,
+ .tx_buf = lcd->buf,
+ };
+
+diff --git a/drivers/video/backlight/tdo24m.c b/drivers/video/backlight/tdo24m.c
+index eab1f842f9c0..e4bd63e9db6b 100644
+--- a/drivers/video/backlight/tdo24m.c
++++ b/drivers/video/backlight/tdo24m.c
+@@ -369,7 +369,7 @@ static int tdo24m_probe(struct spi_device *spi)
+
+ spi_message_init(m);
+
+- x->cs_change = 1;
++ x->cs_change = 0;
+ x->tx_buf = &lcd->buf[0];
+ spi_message_add_tail(x, m);
+
+diff --git a/drivers/video/backlight/tosa_lcd.c b/drivers/video/backlight/tosa_lcd.c
+index 6a41ea92737a..4dc5ee8debeb 100644
+--- a/drivers/video/backlight/tosa_lcd.c
++++ b/drivers/video/backlight/tosa_lcd.c
+@@ -49,7 +49,7 @@ static int tosa_tg_send(struct spi_device *spi, int adrs, uint8_t data)
+ struct spi_message msg;
+ struct spi_transfer xfer = {
+ .len = 1,
+- .cs_change = 1,
++ .cs_change = 0,
+ .tx_buf = buf,
+ };
+
+diff --git a/drivers/video/fbdev/vfb.c b/drivers/video/fbdev/vfb.c
+index da653a080394..54127905bfe7 100644
+--- a/drivers/video/fbdev/vfb.c
++++ b/drivers/video/fbdev/vfb.c
+@@ -239,8 +239,23 @@ static int vfb_check_var(struct fb_var_screeninfo *var,
+ */
+ static int vfb_set_par(struct fb_info *info)
+ {
++ switch (info->var.bits_per_pixel) {
++ case 1:
++ info->fix.visual = FB_VISUAL_MONO01;
++ break;
++ case 8:
++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
++ break;
++ case 16:
++ case 24:
++ case 32:
++ info->fix.visual = FB_VISUAL_TRUECOLOR;
++ break;
++ }
++
+ info->fix.line_length = get_line_length(info->var.xres_virtual,
+ info->var.bits_per_pixel);
++
+ return 0;
+ }
+
+@@ -450,6 +465,8 @@ static int vfb_probe(struct platform_device *dev)
+ goto err2;
+ platform_set_drvdata(dev, info);
+
++ vfb_set_par(info);
++
+ fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n",
+ videomemorysize >> 10);
+ return 0;
+diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
+index 3eb58cb51e56..8f8909a668d7 100644
+--- a/drivers/watchdog/Kconfig
++++ b/drivers/watchdog/Kconfig
+@@ -799,11 +799,12 @@ config EBC_C384_WDT
+ the timeout module parameter.
+
+ config F71808E_WDT
+- tristate "Fintek F71808E, F71862FG, F71869, F71882FG and F71889FG Watchdog"
++ tristate "Fintek F718xx, F818xx Super I/O Watchdog"
+ depends on X86
+ help
+- This is the driver for the hardware watchdog on the Fintek
+- F71808E, F71862FG, F71869, F71882FG and F71889FG Super I/O controllers.
++ This is the driver for the hardware watchdog on the Fintek F71808E,
++ F71862FG, F71868, F71869, F71882FG, F71889FG, F81865 and F81866
++ Super I/O controllers.
+
+ You can compile this driver directly into the kernel, or use
+ it as a module. The module will be called f71808e_wdt.
+diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
+index 1b7e9169072f..8658dba21768 100644
+--- a/drivers/watchdog/f71808e_wdt.c
++++ b/drivers/watchdog/f71808e_wdt.c
+@@ -57,6 +57,7 @@
+ #define SIO_F71808_ID 0x0901 /* Chipset ID */
+ #define SIO_F71858_ID 0x0507 /* Chipset ID */
+ #define SIO_F71862_ID 0x0601 /* Chipset ID */
++#define SIO_F71868_ID 0x1106 /* Chipset ID */
+ #define SIO_F71869_ID 0x0814 /* Chipset ID */
+ #define SIO_F71869A_ID 0x1007 /* Chipset ID */
+ #define SIO_F71882_ID 0x0541 /* Chipset ID */
+@@ -101,7 +102,7 @@ MODULE_PARM_DESC(timeout,
+ static unsigned int pulse_width = WATCHDOG_PULSE_WIDTH;
+ module_param(pulse_width, uint, 0);
+ MODULE_PARM_DESC(pulse_width,
+- "Watchdog signal pulse width. 0(=level), 1 ms, 25 ms, 125 ms or 5000 ms"
++ "Watchdog signal pulse width. 0(=level), 1, 25, 30, 125, 150, 5000 or 6000 ms"
+ " (default=" __MODULE_STRING(WATCHDOG_PULSE_WIDTH) ")");
+
+ static unsigned int f71862fg_pin = WATCHDOG_F71862FG_PIN;
+@@ -119,13 +120,14 @@ module_param(start_withtimeout, uint, 0);
+ MODULE_PARM_DESC(start_withtimeout, "Start watchdog timer on module load with"
+ " given initial timeout. Zero (default) disables this feature.");
+
+-enum chips { f71808fg, f71858fg, f71862fg, f71869, f71882fg, f71889fg, f81865,
+- f81866};
++enum chips { f71808fg, f71858fg, f71862fg, f71868, f71869, f71882fg, f71889fg,
++ f81865, f81866};
+
+ static const char *f71808e_names[] = {
+ "f71808fg",
+ "f71858fg",
+ "f71862fg",
++ "f71868",
+ "f71869",
+ "f71882fg",
+ "f71889fg",
+@@ -252,16 +254,23 @@ static int watchdog_set_timeout(int timeout)
+ static int watchdog_set_pulse_width(unsigned int pw)
+ {
+ int err = 0;
++ unsigned int t1 = 25, t2 = 125, t3 = 5000;
++
++ if (watchdog.type == f71868) {
++ t1 = 30;
++ t2 = 150;
++ t3 = 6000;
++ }
+
+ mutex_lock(&watchdog.lock);
+
+- if (pw <= 1) {
++ if (pw <= 1) {
+ watchdog.pulse_val = 0;
+- } else if (pw <= 25) {
++ } else if (pw <= t1) {
+ watchdog.pulse_val = 1;
+- } else if (pw <= 125) {
++ } else if (pw <= t2) {
+ watchdog.pulse_val = 2;
+- } else if (pw <= 5000) {
++ } else if (pw <= t3) {
+ watchdog.pulse_val = 3;
+ } else {
+ pr_err("pulse width out of range\n");
+@@ -354,6 +363,7 @@ static int watchdog_start(void)
+ goto exit_superio;
+ break;
+
++ case f71868:
+ case f71869:
+ /* GPIO14 --> WDTRST# */
+ superio_clear_bit(watchdog.sioaddr, SIO_REG_MFUNCT1, 4);
+@@ -792,6 +802,9 @@ static int __init f71808e_find(int sioaddr)
+ watchdog.type = f71862fg;
+ err = f71862fg_pin_configure(0); /* validate module parameter */
+ break;
++ case SIO_F71868_ID:
++ watchdog.type = f71868;
++ break;
+ case SIO_F71869_ID:
+ case SIO_F71869A_ID:
+ watchdog.type = f71869;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 8ed05d95584a..03ac3ab4b3b4 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -2453,7 +2453,7 @@ void end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+ if (!uptodate) {
+ ClearPageUptodate(page);
+ SetPageError(page);
+- ret = ret < 0 ? ret : -EIO;
++ ret = err < 0 ? err : -EIO;
+ mapping_set_error(page->mapping, ret);
+ }
+ }
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 02e403af9518..49eeed25f200 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -589,7 +589,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)
+ struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ int rc = 0;
+
+- down_read(&cinode->lock_sem);
++ down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING);
+ if (cinode->can_cache_brlcks) {
+ /* can cache locks - no need to relock */
+ up_read(&cinode->lock_sem);
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 7c26286a525d..44b7ccbe4b08 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -1151,15 +1151,19 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
+ goto tcon_exit;
+ }
+
+- if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
++ switch (rsp->ShareType) {
++ case SMB2_SHARE_TYPE_DISK:
+ cifs_dbg(FYI, "connection to disk share\n");
+- else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
++ break;
++ case SMB2_SHARE_TYPE_PIPE:
+ tcon->ipc = true;
+ cifs_dbg(FYI, "connection to pipe share\n");
+- } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
+- tcon->print = true;
++ break;
++ case SMB2_SHARE_TYPE_PRINT:
++ tcon->ipc = true;
+ cifs_dbg(FYI, "connection to printer\n");
+- } else {
++ break;
++ default:
+ cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
+ rc = -EOPNOTSUPP;
+ goto tcon_error_exit;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index c0c7fa8224ba..2225b9855c5f 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -461,9 +461,11 @@ static void dentry_lru_add(struct dentry *dentry)
+ * d_drop() is used mainly for stuff that wants to invalidate a dentry for some
+ * reason (NFS timeouts or autofs deletes).
+ *
+- * __d_drop requires dentry->d_lock.
++ * __d_drop requires dentry->d_lock
++ * ___d_drop doesn't mark dentry as "unhashed"
++ * (dentry->d_hash.pprev will be LIST_POISON2, not NULL).
+ */
+-void __d_drop(struct dentry *dentry)
++static void ___d_drop(struct dentry *dentry)
+ {
+ if (!d_unhashed(dentry)) {
+ struct hlist_bl_head *b;
+@@ -479,12 +481,17 @@ void __d_drop(struct dentry *dentry)
+
+ hlist_bl_lock(b);
+ __hlist_bl_del(&dentry->d_hash);
+- dentry->d_hash.pprev = NULL;
+ hlist_bl_unlock(b);
+ /* After this call, in-progress rcu-walk path lookup will fail. */
+ write_seqcount_invalidate(&dentry->d_seq);
+ }
+ }
++
++void __d_drop(struct dentry *dentry)
++{
++ ___d_drop(dentry);
++ dentry->d_hash.pprev = NULL;
++}
+ EXPORT_SYMBOL(__d_drop);
+
+ void d_drop(struct dentry *dentry)
+@@ -2378,7 +2385,7 @@ EXPORT_SYMBOL(d_delete);
+ static void __d_rehash(struct dentry *entry)
+ {
+ struct hlist_bl_head *b = d_hash(entry->d_name.hash);
+- BUG_ON(!d_unhashed(entry));
++
+ hlist_bl_lock(b);
+ hlist_bl_add_head_rcu(&entry->d_hash, b);
+ hlist_bl_unlock(b);
+@@ -2815,9 +2822,9 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED);
+
+ /* unhash both */
+- /* __d_drop does write_seqcount_barrier, but they're OK to nest. */
+- __d_drop(dentry);
+- __d_drop(target);
++ /* ___d_drop does write_seqcount_barrier, but they're OK to nest. */
++ ___d_drop(dentry);
++ ___d_drop(target);
+
+ /* Switch the names.. */
+ if (exchange)
+@@ -2829,6 +2836,8 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ __d_rehash(dentry);
+ if (exchange)
+ __d_rehash(target);
++ else
++ target->d_hash.pprev = NULL;
+
+ /* ... and switch them in the tree */
+ if (IS_ROOT(dentry)) {
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 510e66422f04..08fca4add1e2 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -429,7 +429,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode,
+ int i, num;
+ unsigned long nr_pages;
+
+- num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
++ num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
+ nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
+ (pgoff_t)num);
+ if (nr_pages == 0)
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 64056c6eb857..14bd37041e1a 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3877,7 +3877,8 @@ ext4_mb_discard_group_preallocations(struct super_block *sb,
+
+ err = ext4_mb_load_buddy(sb, group, &e4b);
+ if (err) {
+- ext4_error(sb, "Error loading buddy information for %u", group);
++ ext4_warning(sb, "Error %d loading buddy information for %u",
++ err, group);
+ put_bh(bitmap_bh);
+ return 0;
+ }
+@@ -4034,10 +4035,11 @@ void ext4_discard_preallocations(struct inode *inode)
+ BUG_ON(pa->pa_type != MB_INODE_PA);
+ group = ext4_get_group_number(sb, pa->pa_pstart);
+
+- err = ext4_mb_load_buddy(sb, group, &e4b);
++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
++ GFP_NOFS|__GFP_NOFAIL);
+ if (err) {
+- ext4_error(sb, "Error loading buddy information for %u",
+- group);
++ ext4_error(sb, "Error %d loading buddy information for %u",
++ err, group);
+ continue;
+ }
+
+@@ -4293,11 +4295,14 @@ ext4_mb_discard_lg_preallocations(struct super_block *sb,
+ spin_unlock(&lg->lg_prealloc_lock);
+
+ list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
++ int err;
+
+ group = ext4_get_group_number(sb, pa->pa_pstart);
+- if (ext4_mb_load_buddy(sb, group, &e4b)) {
+- ext4_error(sb, "Error loading buddy information for %u",
+- group);
++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
++ GFP_NOFS|__GFP_NOFAIL);
++ if (err) {
++ ext4_error(sb, "Error %d loading buddy information for %u",
++ err, group);
+ continue;
+ }
+ ext4_lock_group(sb, group);
+@@ -5117,8 +5122,8 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,
+
+ ret = ext4_mb_load_buddy(sb, group, &e4b);
+ if (ret) {
+- ext4_error(sb, "Error in loading buddy "
+- "information for %u", group);
++ ext4_warning(sb, "Error %d loading buddy information for %u",
++ ret, group);
+ return ret;
+ }
+ bitmap = e4b.bd_bitmap;
+diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
+index 9d373247222c..85135df0eb34 100644
+--- a/fs/lockd/svc.c
++++ b/fs/lockd/svc.c
+@@ -132,6 +132,8 @@ lockd(void *vrqstp)
+ {
+ int err = 0;
+ struct svc_rqst *rqstp = vrqstp;
++ struct net *net = &init_net;
++ struct lockd_net *ln = net_generic(net, lockd_net_id);
+
+ /* try_to_freeze() is called from svc_recv() */
+ set_freezable();
+@@ -176,6 +178,8 @@ lockd(void *vrqstp)
+ if (nlmsvc_ops)
+ nlmsvc_invalidate_all();
+ nlm_shutdown_hosts();
++ cancel_delayed_work_sync(&ln->grace_period_end);
++ locks_end_grace(&ln->lockd_manager);
+ return 0;
+ }
+
+@@ -270,8 +274,6 @@ static void lockd_down_net(struct svc_serv *serv, struct net *net)
+ if (ln->nlmsvc_users) {
+ if (--ln->nlmsvc_users == 0) {
+ nlm_shutdown_hosts_net(net);
+- cancel_delayed_work_sync(&ln->grace_period_end);
+- locks_end_grace(&ln->lockd_manager);
+ svc_shutdown_net(serv, net);
+ dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
+ }
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 13abd608af0f..4539008502ce 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -475,6 +475,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
+ goto out_err_free;
+
+ /* fh */
++ rc = -EIO;
+ p = xdr_inline_decode(&stream, 4);
+ if (!p)
+ goto out_err_free;
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 4638654e26f3..1b1b616a6171 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3300,6 +3300,7 @@ static int _nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *f
+ .rpc_resp = &res,
+ };
+ int status;
++ int i;
+
+ bitmask[0] = FATTR4_WORD0_SUPPORTED_ATTRS |
+ FATTR4_WORD0_FH_EXPIRE_TYPE |
+@@ -3365,8 +3366,13 @@ static int _nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *f
+ server->cache_consistency_bitmask[0] &= FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE;
+ server->cache_consistency_bitmask[1] &= FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY;
+ server->cache_consistency_bitmask[2] = 0;
++
++ /* Avoid a regression due to buggy server */
++ for (i = 0; i < ARRAY_SIZE(res.exclcreat_bitmask); i++)
++ res.exclcreat_bitmask[i] &= res.attr_bitmask[i];
+ memcpy(server->exclcreat_bitmask, res.exclcreat_bitmask,
+ sizeof(server->exclcreat_bitmask));
++
+ server->acl_bitmask = res.acl_bitmask;
+ server->fh_expire_type = res.fh_expire_type;
+ }
+@@ -8173,6 +8179,12 @@ static int nfs41_reclaim_complete_handle_errors(struct rpc_task *task, struct nf
+ /* fall through */
+ case -NFS4ERR_RETRY_UNCACHED_REP:
+ return -EAGAIN;
++ case -NFS4ERR_BADSESSION:
++ case -NFS4ERR_DEADSESSION:
++ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
++ nfs4_schedule_session_recovery(clp->cl_session,
++ task->tk_status);
++ break;
+ default:
+ nfs4_schedule_lease_recovery(clp);
+ }
+@@ -8251,7 +8263,6 @@ static int nfs41_proc_reclaim_complete(struct nfs_client *clp,
+ if (status == 0)
+ status = task->tk_status;
+ rpc_put_task(task);
+- return 0;
+ out:
+ dprintk("<-- %s status=%d\n", __func__, status);
+ return status;
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 71deeae6eefd..0bb0e620cf42 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1637,13 +1637,14 @@ static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp)
+ nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot);
+ }
+
+-static void nfs4_reclaim_complete(struct nfs_client *clp,
++static int nfs4_reclaim_complete(struct nfs_client *clp,
+ const struct nfs4_state_recovery_ops *ops,
+ struct rpc_cred *cred)
+ {
+ /* Notify the server we're done reclaiming our state */
+ if (ops->reclaim_complete)
+- (void)ops->reclaim_complete(clp, cred);
++ return ops->reclaim_complete(clp, cred);
++ return 0;
+ }
+
+ static void nfs4_clear_reclaim_server(struct nfs_server *server)
+@@ -1690,13 +1691,16 @@ static void nfs4_state_end_reclaim_reboot(struct nfs_client *clp)
+ {
+ const struct nfs4_state_recovery_ops *ops;
+ struct rpc_cred *cred;
++ int err;
+
+ if (!nfs4_state_clear_reclaim_reboot(clp))
+ return;
+ ops = clp->cl_mvops->reboot_recovery_ops;
+ cred = nfs4_get_clid_cred(clp);
+- nfs4_reclaim_complete(clp, ops, cred);
++ err = nfs4_reclaim_complete(clp, ops, cred);
+ put_rpccred(cred);
++ if (err == -NFS4ERR_CONN_NOT_BOUND_TO_SESSION)
++ set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state);
+ }
+
+ static void nfs4_state_start_reclaim_nograce(struct nfs_client *clp)
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 306b6c161840..8546384a5fdf 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -180,6 +180,9 @@ static void ovl_instantiate(struct dentry *dentry, struct inode *inode,
+ inc_nlink(inode);
+ }
+ d_instantiate(dentry, inode);
++ /* Force lookup of new upper hardlink to find its lower */
++ if (hardlink)
++ d_drop(dentry);
+ }
+
+ static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
+diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
+index 7fb53d055537..16f6db88c8e5 100644
+--- a/fs/overlayfs/inode.c
++++ b/fs/overlayfs/inode.c
+@@ -227,6 +227,16 @@ int ovl_xattr_get(struct dentry *dentry, const char *name,
+ return res;
+ }
+
++static bool ovl_can_list(const char *s)
++{
++ /* List all non-trusted xatts */
++ if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0)
++ return true;
++
++ /* Never list trusted.overlay, list other trusted for superuser only */
++ return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN);
++}
++
+ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ {
+ struct dentry *realdentry = ovl_dentry_real(dentry);
+@@ -250,7 +260,7 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
+ return -EIO;
+
+ len -= slen;
+- if (ovl_is_private_xattr(s)) {
++ if (!ovl_can_list(s)) {
+ res -= slen;
+ memmove(s, s + slen, len);
+ } else {
+diff --git a/include/acpi/platform/acgcc.h b/include/acpi/platform/acgcc.h
+index 8f66aaabadf7..9e3f7618593f 100644
+--- a/include/acpi/platform/acgcc.h
++++ b/include/acpi/platform/acgcc.h
+@@ -48,7 +48,17 @@
+ * Use compiler specific <stdarg.h> is a good practice for even when
+ * -nostdinc is specified (i.e., ACPI_USE_STANDARD_HEADERS undefined.
+ */
++#ifndef va_arg
++#ifdef ACPI_USE_BUILTIN_STDARG
++typedef __builtin_va_list va_list;
++#define va_start(v, l) __builtin_va_start(v, l)
++#define va_end(v) __builtin_va_end(v)
++#define va_arg(v, l) __builtin_va_arg(v, l)
++#define va_copy(d, s) __builtin_va_copy(d, s)
++#else
+ #include <stdarg.h>
++#endif
++#endif
+
+ #define ACPI_INLINE __inline__
+
+diff --git a/include/acpi/platform/acintel.h b/include/acpi/platform/acintel.h
+index 17bd3b7b4e5a..bdb6858e2458 100644
+--- a/include/acpi/platform/acintel.h
++++ b/include/acpi/platform/acintel.h
+@@ -48,7 +48,9 @@
+ * Use compiler specific <stdarg.h> is a good practice for even when
+ * -nostdinc is specified (i.e., ACPI_USE_STANDARD_HEADERS undefined.
+ */
++#ifndef va_arg
+ #include <stdarg.h>
++#endif
+
+ /* Configuration specific to Intel 64-bit C compiler */
+
+diff --git a/include/linux/mlx4/qp.h b/include/linux/mlx4/qp.h
+index b4ee8f62ce8d..8e2828d48d7f 100644
+--- a/include/linux/mlx4/qp.h
++++ b/include/linux/mlx4/qp.h
+@@ -470,6 +470,7 @@ struct mlx4_update_qp_params {
+ u16 rate_val;
+ };
+
++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn);
+ int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn,
+ enum mlx4_update_qp_attr attr,
+ struct mlx4_update_qp_params *params);
+diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
+index 58276144ba81..5f3e62253e2f 100644
+--- a/include/linux/mlx5/device.h
++++ b/include/linux/mlx5/device.h
+@@ -750,8 +750,14 @@ enum {
+ };
+
+ enum {
+- CQE_RSS_HTYPE_IP = 0x3 << 6,
+- CQE_RSS_HTYPE_L4 = 0x3 << 2,
++ CQE_RSS_HTYPE_IP = 0x3 << 2,
++ /* cqe->rss_hash_type[3:2] - IP destination selected for hash
++ * (00 = none, 01 = IPv4, 10 = IPv6, 11 = Reserved)
++ */
++ CQE_RSS_HTYPE_L4 = 0x3 << 6,
++ /* cqe->rss_hash_type[7:6] - L4 destination selected for hash
++ * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI
++ */
+ };
+
+ enum {
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 1b711796d989..36522905685b 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1348,9 +1348,9 @@ static inline int pci_alloc_irq_vectors(struct pci_dev *dev,
+ unsigned int min_vecs, unsigned int max_vecs,
+ unsigned int flags)
+ {
+- if (min_vecs > 1)
+- return -EINVAL;
+- return 1;
++ if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1 && dev->irq)
++ return 1;
++ return -ENOSPC;
+ }
+ static inline void pci_free_irq_vectors(struct pci_dev *dev)
+ {
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index a4d0afc009a7..c549c8c9245c 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1412,6 +1412,7 @@ struct sched_dl_entity {
+ u64 dl_deadline; /* relative deadline of each instance */
+ u64 dl_period; /* separation of two instances (period) */
+ u64 dl_bw; /* dl_runtime / dl_deadline */
++ u64 dl_density; /* dl_runtime / dl_deadline */
+
+ /*
+ * Actual scheduling parameters. Initialized with the values above,
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 601dfa849d30..1b3a2f95503d 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -984,10 +984,10 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb,
+ unsigned int headroom);
+ struct sk_buff *skb_copy_expand(const struct sk_buff *skb, int newheadroom,
+ int newtailroom, gfp_t priority);
+-int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
+- int offset, int len);
+-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset,
+- int len);
++int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
++ int offset, int len);
++int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg,
++ int offset, int len);
+ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer);
+ int skb_pad(struct sk_buff *skb, int pad);
+ #define dev_kfree_skb(a) consume_skb(a)
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 66167138120a..9d57639223c3 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -947,9 +947,9 @@ enum rate_info_flags {
+ * @RATE_INFO_BW_160: 160 MHz bandwidth
+ */
+ enum rate_info_bw {
++ RATE_INFO_BW_20 = 0,
+ RATE_INFO_BW_5,
+ RATE_INFO_BW_10,
+- RATE_INFO_BW_20,
+ RATE_INFO_BW_40,
+ RATE_INFO_BW_80,
+ RATE_INFO_BW_160,
+diff --git a/include/net/x25.h b/include/net/x25.h
+index c383aa4edbf0..6d30a01d281d 100644
+--- a/include/net/x25.h
++++ b/include/net/x25.h
+@@ -298,10 +298,10 @@ void x25_check_rbuf(struct sock *);
+
+ /* sysctl_net_x25.c */
+ #ifdef CONFIG_SYSCTL
+-void x25_register_sysctl(void);
++int x25_register_sysctl(void);
+ void x25_unregister_sysctl(void);
+ #else
+-static inline void x25_register_sysctl(void) {};
++static inline int x25_register_sysctl(void) { return 0; };
+ static inline void x25_unregister_sysctl(void) {};
+ #endif /* CONFIG_SYSCTL */
+
+diff --git a/include/soc/fsl/qe/qe.h b/include/soc/fsl/qe/qe.h
+index 0cd4c11479b1..226f915a68c2 100644
+--- a/include/soc/fsl/qe/qe.h
++++ b/include/soc/fsl/qe/qe.h
+@@ -668,6 +668,10 @@ struct ucc_slow_pram {
+ #define UCC_FAST_GUMR_CTSS 0x00800000
+ #define UCC_FAST_GUMR_TXSY 0x00020000
+ #define UCC_FAST_GUMR_RSYN 0x00010000
++#define UCC_FAST_GUMR_SYNL_MASK 0x0000C000
++#define UCC_FAST_GUMR_SYNL_16 0x0000C000
++#define UCC_FAST_GUMR_SYNL_8 0x00008000
++#define UCC_FAST_GUMR_SYNL_AUTO 0x00004000
+ #define UCC_FAST_GUMR_RTSM 0x00002000
+ #define UCC_FAST_GUMR_REVD 0x00000400
+ #define UCC_FAST_GUMR_ENR 0x00000020
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 802eb3361a0a..967163fb90a8 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -63,6 +63,12 @@ struct cpuhp_cpu_state {
+
+ static DEFINE_PER_CPU(struct cpuhp_cpu_state, cpuhp_state);
+
++#if defined(CONFIG_LOCKDEP) && defined(CONFIG_SMP)
++static struct lock_class_key cpuhp_state_key;
++static struct lockdep_map cpuhp_state_lock_map =
++ STATIC_LOCKDEP_MAP_INIT("cpuhp_state", &cpuhp_state_key);
++#endif
++
+ /**
+ * cpuhp_step - Hotplug state machine step
+ * @name: Name of the step
+@@ -563,6 +569,7 @@ static void cpuhp_thread_fun(unsigned int cpu)
+
+ st->should_run = false;
+
++ lock_map_acquire(&cpuhp_state_lock_map);
+ /* Single callback invocation for [un]install ? */
+ if (st->single) {
+ if (st->cb_state < CPUHP_AP_ONLINE) {
+@@ -594,6 +601,7 @@ static void cpuhp_thread_fun(unsigned int cpu)
+ else if (st->state > st->target)
+ ret = cpuhp_ap_offline(cpu, st);
+ }
++ lock_map_release(&cpuhp_state_lock_map);
+ st->result = ret;
+ complete(&st->done);
+ }
+@@ -608,6 +616,9 @@ cpuhp_invoke_ap_callback(int cpu, enum cpuhp_state state, bool bringup,
+ if (!cpu_online(cpu))
+ return 0;
+
++ lock_map_acquire(&cpuhp_state_lock_map);
++ lock_map_release(&cpuhp_state_lock_map);
++
+ /*
+ * If we are up and running, use the hotplug thread. For early calls
+ * we invoke the thread function directly.
+@@ -651,6 +662,8 @@ static int cpuhp_kick_ap_work(unsigned int cpu)
+ enum cpuhp_state state = st->state;
+
+ trace_cpuhp_enter(cpu, st->target, state, cpuhp_kick_ap_work);
++ lock_map_acquire(&cpuhp_state_lock_map);
++ lock_map_release(&cpuhp_state_lock_map);
+ __cpuhp_kick_ap_work(st);
+ wait_for_completion(&st->done);
+ trace_cpuhp_exit(cpu, st->state, state, st->result);
+diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
+index e9fdb5203de5..411226b26bca 100644
+--- a/kernel/events/callchain.c
++++ b/kernel/events/callchain.c
+@@ -227,12 +227,18 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
+ }
+
+ if (regs) {
++ mm_segment_t fs;
++
+ if (crosstask)
+ goto exit_put;
+
+ if (add_mark)
+ perf_callchain_store_context(&ctx, PERF_CONTEXT_USER);
++
++ fs = get_fs();
++ set_fs(USER_DS);
+ perf_callchain_user(&ctx, regs);
++ set_fs(fs);
+ }
+ }
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 13b9784427b0..c4100c38a467 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5669,9 +5669,6 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+ __output_copy(handle, values, n * sizeof(u64));
+ }
+
+-/*
+- * XXX PERF_FORMAT_GROUP vs inherited events seems difficult.
+- */
+ static void perf_output_read_group(struct perf_output_handle *handle,
+ struct perf_event *event,
+ u64 enabled, u64 running)
+@@ -5716,6 +5713,13 @@ static void perf_output_read_group(struct perf_output_handle *handle,
+ #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
+ PERF_FORMAT_TOTAL_TIME_RUNNING)
+
++/*
++ * XXX PERF_SAMPLE_READ vs inherited events seems difficult.
++ *
++ * The problem is that its both hard and excessively expensive to iterate the
++ * child list, not to mention that its impossible to IPI the children running
++ * on another CPU, from interrupt/NMI context.
++ */
+ static void perf_output_read(struct perf_output_handle *handle,
+ struct perf_event *event)
+ {
+@@ -9259,9 +9263,10 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ local64_set(&hwc->period_left, hwc->sample_period);
+
+ /*
+- * we currently do not support PERF_FORMAT_GROUP on inherited events
++ * We currently do not support PERF_SAMPLE_READ on inherited events.
++ * See perf_output_read().
+ */
+- if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP))
++ if (attr->inherit && (attr->sample_type & PERF_SAMPLE_READ))
+ goto err_ns;
+
+ if (!has_branch_stack(event))
+@@ -9289,8 +9294,10 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ event->addr_filters_offs = kcalloc(pmu->nr_addr_filters,
+ sizeof(unsigned long),
+ GFP_KERNEL);
+- if (!event->addr_filters_offs)
++ if (!event->addr_filters_offs) {
++ err = -ENOMEM;
+ goto err_per_task;
++ }
+
+ /* force hw sync on the address filters */
+ event->addr_filters_gen = 1;
+diff --git a/kernel/pid.c b/kernel/pid.c
+index 693a64385d59..fa704f88ff8e 100644
+--- a/kernel/pid.c
++++ b/kernel/pid.c
+@@ -322,8 +322,10 @@ struct pid *alloc_pid(struct pid_namespace *ns)
+ }
+
+ if (unlikely(is_child_reaper(pid))) {
+- if (pid_ns_prepare_proc(ns))
++ if (pid_ns_prepare_proc(ns)) {
++ disable_pid_allocation(ns);
+ goto out_free;
++ }
+ }
+
+ get_pid_ns(ns);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 291ea6fa7ee6..917be221438b 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -2184,6 +2184,7 @@ void __dl_clear_params(struct task_struct *p)
+ dl_se->dl_period = 0;
+ dl_se->flags = 0;
+ dl_se->dl_bw = 0;
++ dl_se->dl_density = 0;
+
+ dl_se->dl_throttled = 0;
+ dl_se->dl_yielded = 0;
+@@ -3912,6 +3913,7 @@ __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
+ dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
+ dl_se->flags = attr->sched_flags;
+ dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
++ dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime);
+
+ /*
+ * Changing the parameters of a task is 'tricky' and we're not doing
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 3042881169b4..3042927c8b8a 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -484,13 +484,84 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+ }
+
+ /*
+- * When a -deadline entity is queued back on the runqueue, its runtime and
+- * deadline might need updating.
++ * Revised wakeup rule [1]: For self-suspending tasks, rather then
++ * re-initializing task's runtime and deadline, the revised wakeup
++ * rule adjusts the task's runtime to avoid the task to overrun its
++ * density.
+ *
+- * The policy here is that we update the deadline of the entity only if:
+- * - the current deadline is in the past,
+- * - using the remaining runtime with the current deadline would make
+- * the entity exceed its bandwidth.
++ * Reasoning: a task may overrun the density if:
++ * runtime / (deadline - t) > dl_runtime / dl_deadline
++ *
++ * Therefore, runtime can be adjusted to:
++ * runtime = (dl_runtime / dl_deadline) * (deadline - t)
++ *
++ * In such way that runtime will be equal to the maximum density
++ * the task can use without breaking any rule.
++ *
++ * [1] Luca Abeni, Giuseppe Lipari, and Juri Lelli. 2015. Constant
++ * bandwidth server revisited. SIGBED Rev. 11, 4 (January 2015), 19-24.
++ */
++static void
++update_dl_revised_wakeup(struct sched_dl_entity *dl_se, struct rq *rq)
++{
++ u64 laxity = dl_se->deadline - rq_clock(rq);
++
++ /*
++ * If the task has deadline < period, and the deadline is in the past,
++ * it should already be throttled before this check.
++ *
++ * See update_dl_entity() comments for further details.
++ */
++ WARN_ON(dl_time_before(dl_se->deadline, rq_clock(rq)));
++
++ dl_se->runtime = (dl_se->dl_density * laxity) >> 20;
++}
++
++/*
++ * Regarding the deadline, a task with implicit deadline has a relative
++ * deadline == relative period. A task with constrained deadline has a
++ * relative deadline <= relative period.
++ *
++ * We support constrained deadline tasks. However, there are some restrictions
++ * applied only for tasks which do not have an implicit deadline. See
++ * update_dl_entity() to know more about such restrictions.
++ *
++ * The dl_is_implicit() returns true if the task has an implicit deadline.
++ */
++static inline bool dl_is_implicit(struct sched_dl_entity *dl_se)
++{
++ return dl_se->dl_deadline == dl_se->dl_period;
++}
++
++/*
++ * When a deadline entity is placed in the runqueue, its runtime and deadline
++ * might need to be updated. This is done by a CBS wake up rule. There are two
++ * different rules: 1) the original CBS; and 2) the Revisited CBS.
++ *
++ * When the task is starting a new period, the Original CBS is used. In this
++ * case, the runtime is replenished and a new absolute deadline is set.
++ *
++ * When a task is queued before the begin of the next period, using the
++ * remaining runtime and deadline could make the entity to overflow, see
++ * dl_entity_overflow() to find more about runtime overflow. When such case
++ * is detected, the runtime and deadline need to be updated.
++ *
++ * If the task has an implicit deadline, i.e., deadline == period, the Original
++ * CBS is applied. the runtime is replenished and a new absolute deadline is
++ * set, as in the previous cases.
++ *
++ * However, the Original CBS does not work properly for tasks with
++ * deadline < period, which are said to have a constrained deadline. By
++ * applying the Original CBS, a constrained deadline task would be able to run
++ * runtime/deadline in a period. With deadline < period, the task would
++ * overrun the runtime/period allowed bandwidth, breaking the admission test.
++ *
++ * In order to prevent this misbehave, the Revisited CBS is used for
++ * constrained deadline tasks when a runtime overflow is detected. In the
++ * Revisited CBS, rather than replenishing & setting a new absolute deadline,
++ * the remaining runtime of the task is reduced to avoid runtime overflow.
++ * Please refer to the comments update_dl_revised_wakeup() function to find
++ * more about the Revised CBS rule.
+ */
+ static void update_dl_entity(struct sched_dl_entity *dl_se,
+ struct sched_dl_entity *pi_se)
+@@ -500,6 +571,14 @@ static void update_dl_entity(struct sched_dl_entity *dl_se,
+
+ if (dl_time_before(dl_se->deadline, rq_clock(rq)) ||
+ dl_entity_overflow(dl_se, pi_se, rq_clock(rq))) {
++
++ if (unlikely(!dl_is_implicit(dl_se) &&
++ !dl_time_before(dl_se->deadline, rq_clock(rq)) &&
++ !dl_se->dl_boosted)){
++ update_dl_revised_wakeup(dl_se, rq);
++ return;
++ }
++
+ dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+ dl_se->runtime = pi_se->dl_runtime;
+ }
+@@ -961,11 +1040,6 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
+ __dequeue_dl_entity(dl_se);
+ }
+
+-static inline bool dl_is_constrained(struct sched_dl_entity *dl_se)
+-{
+- return dl_se->dl_deadline < dl_se->dl_period;
+-}
+-
+ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ {
+ struct task_struct *pi_task = rt_mutex_get_top_task(p);
+@@ -997,7 +1071,7 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+ * If that is the case, the task will be throttled and
+ * the replenishment timer will be set to the next period.
+ */
+- if (!p->dl.dl_throttled && dl_is_constrained(&p->dl))
++ if (!p->dl.dl_throttled && !dl_is_implicit(&p->dl))
+ dl_check_constrained_dl(&p->dl);
+
+ /*
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 3d862f5b0331..f6e8727f7fa3 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2429,7 +2429,8 @@ void task_numa_work(struct callback_head *work)
+ return;
+
+
+- down_read(&mm->mmap_sem);
++ if (!down_read_trylock(&mm->mmap_sem))
++ return;
+ vma = find_vma(mm, start);
+ if (!vma) {
+ reset_ptenuma_scan(p);
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 68b3193e4493..5f658b6a684f 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1351,8 +1351,6 @@ static bool is_zone_first_populated(pg_data_t *pgdat, struct zone *zone)
+ return zone == compare;
+ }
+
+- /* The zone must be somewhere! */
+- WARN_ON_ONCE(1);
+ return false;
+ }
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 767144128b95..fb3e2a50d76e 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -29,6 +29,7 @@
+ #include <linux/net_tstamp.h>
+ #include <linux/etherdevice.h>
+ #include <linux/ethtool.h>
++#include <linux/phy.h>
+ #include <net/arp.h>
+ #include <net/switchdev.h>
+
+@@ -658,8 +659,11 @@ static int vlan_ethtool_get_ts_info(struct net_device *dev,
+ {
+ const struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+ const struct ethtool_ops *ops = vlan->real_dev->ethtool_ops;
++ struct phy_device *phydev = vlan->real_dev->phydev;
+
+- if (ops->get_ts_info) {
++ if (phydev && phydev->drv && phydev->drv->ts_info) {
++ return phydev->drv->ts_info(phydev, info);
++ } else if (ops->get_ts_info) {
+ return ops->get_ts_info(vlan->real_dev, info);
+ } else {
+ info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE |
+diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
+index 3ac89e9ace71..4bd72d2fe415 100644
+--- a/net/bluetooth/hci_core.c
++++ b/net/bluetooth/hci_core.c
+@@ -548,6 +548,7 @@ static void hci_set_event_mask_page_2(struct hci_request *req)
+ {
+ struct hci_dev *hdev = req->hdev;
+ u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
++ bool changed = false;
+
+ /* If Connectionless Slave Broadcast master role is supported
+ * enable all necessary events for it.
+@@ -557,6 +558,7 @@ static void hci_set_event_mask_page_2(struct hci_request *req)
+ events[1] |= 0x80; /* Synchronization Train Complete */
+ events[2] |= 0x10; /* Slave Page Response Timeout */
+ events[2] |= 0x20; /* CSB Channel Map Change */
++ changed = true;
+ }
+
+ /* If Connectionless Slave Broadcast slave role is supported
+@@ -567,13 +569,24 @@ static void hci_set_event_mask_page_2(struct hci_request *req)
+ events[2] |= 0x02; /* CSB Receive */
+ events[2] |= 0x04; /* CSB Timeout */
+ events[2] |= 0x08; /* Truncated Page Complete */
++ changed = true;
+ }
+
+ /* Enable Authenticated Payload Timeout Expired event if supported */
+- if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
++ if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
+ events[2] |= 0x80;
++ changed = true;
++ }
+
+- hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
++ /* Some Broadcom based controllers indicate support for Set Event
++ * Mask Page 2 command, but then actually do not support it. Since
++ * the default value is all bits set to zero, the command is only
++ * required if the event mask has to be changed. In case no change
++ * to the event mask is needed, skip this command.
++ */
++ if (changed)
++ hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
++ sizeof(events), events);
+ }
+
+ static int hci_init3_req(struct hci_request *req, unsigned long opt)
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index d3f6c26425b3..255c0a075e49 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -295,6 +295,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
+ u32 yes;
+ struct crush_rule *r;
+
++ err = -EINVAL;
+ ceph_decode_32_safe(p, end, yes, bad);
+ if (!yes) {
+ dout("crush_decode NO rule %d off %x %p to %p\n",
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 07d2c93c9636..3d9190c2940d 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -993,7 +993,7 @@ bool dev_valid_name(const char *name)
+ {
+ if (*name == '\0')
+ return false;
+- if (strlen(name) >= IFNAMSIZ)
++ if (strnlen(name, IFNAMSIZ) == IFNAMSIZ)
+ return false;
+ if (!strcmp(name, ".") || !strcmp(name, ".."))
+ return false;
+@@ -2667,7 +2667,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
+ if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr))))
+ return 0;
+
+- eth = (struct ethhdr *)skb_mac_header(skb);
++ eth = (struct ethhdr *)skb->data;
+ type = eth->h_proto;
+ }
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 7b315663f840..a426790b0688 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1130,10 +1130,6 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ lladdr = neigh->ha;
+ }
+
+- if (new & NUD_CONNECTED)
+- neigh->confirmed = jiffies;
+- neigh->updated = jiffies;
+-
+ /* If entry was valid and address is not changed,
+ do not change entry state, if new one is STALE.
+ */
+@@ -1155,6 +1151,16 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ }
+ }
+
++ /* Update timestamps only once we know we will make a change to the
++ * neighbour entry. Otherwise we risk to move the locktime window with
++ * noop updates and ignore relevant ARP updates.
++ */
++ if (new != old || lladdr != neigh->ha) {
++ if (new & NUD_CONNECTED)
++ neigh->confirmed = jiffies;
++ neigh->updated = jiffies;
++ }
++
+ if (new != old) {
+ neigh_del_timer(neigh);
+ if (new & NUD_PROBE)
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index b7efe2f19f83..04fd04ccaa04 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -312,6 +312,25 @@ static __net_init int setup_net(struct net *net, struct user_namespace *user_ns)
+ goto out;
+ }
+
++static int __net_init net_defaults_init_net(struct net *net)
++{
++ net->core.sysctl_somaxconn = SOMAXCONN;
++ return 0;
++}
++
++static struct pernet_operations net_defaults_ops = {
++ .init = net_defaults_init_net,
++};
++
++static __init int net_defaults_init(void)
++{
++ if (register_pernet_subsys(&net_defaults_ops))
++ panic("Cannot initialize net default settings");
++
++ return 0;
++}
++
++core_initcall(net_defaults_init);
+
+ #ifdef CONFIG_NET_NS
+ static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index c5ac9f48f058..fb422dfec848 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2615,7 +2615,8 @@ void skb_split(struct sk_buff *skb, struct sk_buff *skb1, const u32 len)
+ {
+ int pos = skb_headlen(skb);
+
+- skb_shinfo(skb1)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
++ skb_shinfo(skb1)->tx_flags |= skb_shinfo(skb)->tx_flags &
++ SKBTX_SHARED_FRAG;
+ if (len < pos) /* Split line is inside header. */
+ skb_split_inside_header(skb, skb1, len, pos);
+ else /* Second chunk has no header, nothing to copy. */
+@@ -3228,8 +3229,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
+ skb_copy_from_linear_data_offset(head_skb, offset,
+ skb_put(nskb, hsize), hsize);
+
+- skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+- SKBTX_SHARED_FRAG;
++ skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags &
++ SKBTX_SHARED_FRAG;
+
+ while (pos < offset + len) {
+ if (i >= nfrags) {
+@@ -3475,24 +3476,18 @@ void __init skb_init(void)
+ NULL);
+ }
+
+-/**
+- * skb_to_sgvec - Fill a scatter-gather list from a socket buffer
+- * @skb: Socket buffer containing the buffers to be mapped
+- * @sg: The scatter-gather list to map into
+- * @offset: The offset into the buffer's contents to start mapping
+- * @len: Length of buffer space to be mapped
+- *
+- * Fill the specified scatter-gather list with mappings/pointers into a
+- * region of the buffer space attached to a socket buffer.
+- */
+ static int
+-__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
++__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len,
++ unsigned int recursion_level)
+ {
+ int start = skb_headlen(skb);
+ int i, copy = start - offset;
+ struct sk_buff *frag_iter;
+ int elt = 0;
+
++ if (unlikely(recursion_level >= 24))
++ return -EMSGSIZE;
++
+ if (copy > 0) {
+ if (copy > len)
+ copy = len;
+@@ -3511,6 +3506,8 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+ end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]);
+ if ((copy = end - offset) > 0) {
+ skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
++ if (unlikely(elt && sg_is_last(&sg[elt - 1])))
++ return -EMSGSIZE;
+
+ if (copy > len)
+ copy = len;
+@@ -3525,16 +3522,22 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+ }
+
+ skb_walk_frags(skb, frag_iter) {
+- int end;
++ int end, ret;
+
+ WARN_ON(start > offset + len);
+
+ end = start + frag_iter->len;
+ if ((copy = end - offset) > 0) {
++ if (unlikely(elt && sg_is_last(&sg[elt - 1])))
++ return -EMSGSIZE;
++
+ if (copy > len)
+ copy = len;
+- elt += __skb_to_sgvec(frag_iter, sg+elt, offset - start,
+- copy);
++ ret = __skb_to_sgvec(frag_iter, sg+elt, offset - start,
++ copy, recursion_level + 1);
++ if (unlikely(ret < 0))
++ return ret;
++ elt += ret;
+ if ((len -= copy) == 0)
+ return elt;
+ offset += copy;
+@@ -3545,6 +3548,31 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+ return elt;
+ }
+
++/**
++ * skb_to_sgvec - Fill a scatter-gather list from a socket buffer
++ * @skb: Socket buffer containing the buffers to be mapped
++ * @sg: The scatter-gather list to map into
++ * @offset: The offset into the buffer's contents to start mapping
++ * @len: Length of buffer space to be mapped
++ *
++ * Fill the specified scatter-gather list with mappings/pointers into a
++ * region of the buffer space attached to a socket buffer. Returns either
++ * the number of scatterlist items used, or -EMSGSIZE if the contents
++ * could not fit.
++ */
++int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
++{
++ int nsg = __skb_to_sgvec(skb, sg, offset, len, 0);
++
++ if (nsg <= 0)
++ return nsg;
++
++ sg_mark_end(&sg[nsg - 1]);
++
++ return nsg;
++}
++EXPORT_SYMBOL_GPL(skb_to_sgvec);
++
+ /* As compared with skb_to_sgvec, skb_to_sgvec_nomark only map skb to given
+ * sglist without mark the sg which contain last skb data as the end.
+ * So the caller can mannipulate sg list as will when padding new data after
+@@ -3567,19 +3595,11 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+ int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg,
+ int offset, int len)
+ {
+- return __skb_to_sgvec(skb, sg, offset, len);
++ return __skb_to_sgvec(skb, sg, offset, len, 0);
+ }
+ EXPORT_SYMBOL_GPL(skb_to_sgvec_nomark);
+
+-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len)
+-{
+- int nsg = __skb_to_sgvec(skb, sg, offset, len);
+
+- sg_mark_end(&sg[nsg - 1]);
+-
+- return nsg;
+-}
+-EXPORT_SYMBOL_GPL(skb_to_sgvec);
+
+ /**
+ * skb_cow_data - Check that a socket buffer's data buffers are writable
+@@ -3862,7 +3882,8 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ return;
+
+ if (tsonly) {
+- skb_shinfo(skb)->tx_flags = skb_shinfo(orig_skb)->tx_flags;
++ skb_shinfo(skb)->tx_flags |= skb_shinfo(orig_skb)->tx_flags &
++ SKBTX_ANY_TSTAMP;
+ skb_shinfo(skb)->tskey = skb_shinfo(orig_skb)->tskey;
+ }
+
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 1b4619008c4e..546ba76b35a5 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -438,8 +438,6 @@ static __net_init int sysctl_core_net_init(struct net *net)
+ {
+ struct ctl_table *tbl;
+
+- net->core.sysctl_somaxconn = SOMAXCONN;
+-
+ tbl = netns_core_table;
+ if (!net_eq(net, &init_net)) {
+ tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
+diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
+index 4ebe2aa3e7d3..04b5450c5a55 100644
+--- a/net/hsr/hsr_forward.c
++++ b/net/hsr/hsr_forward.c
+@@ -324,8 +324,7 @@ static int hsr_fill_frame_info(struct hsr_frame_info *frame,
+ unsigned long irqflags;
+
+ frame->is_supervision = is_supervision_frame(port->hsr, skb);
+- frame->node_src = hsr_get_node(&port->hsr->node_db, skb,
+- frame->is_supervision);
++ frame->node_src = hsr_get_node(port, skb, frame->is_supervision);
+ if (frame->node_src == NULL)
+ return -1; /* Unknown node and !is_supervision, or no mem */
+
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 7ea925816f79..284a9b820df8 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -158,9 +158,10 @@ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
+
+ /* Get the hsr_node from which 'skb' was sent.
+ */
+-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
++struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
+ bool is_sup)
+ {
++ struct list_head *node_db = &port->hsr->node_db;
+ struct hsr_node *node;
+ struct ethhdr *ethhdr;
+ u16 seq_out;
+@@ -186,7 +187,11 @@ struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
+ */
+ seq_out = hsr_get_skb_sequence_nr(skb) - 1;
+ } else {
+- WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
++ /* this is called also for frames from master port and
++ * so warn only for non master ports
++ */
++ if (port->type != HSR_PT_MASTER)
++ WARN_ONCE(1, "%s: Non-HSR frame\n", __func__);
+ seq_out = HSR_SEQNR_START;
+ }
+
+diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
+index 438b40f98f5a..4e04f0e868e9 100644
+--- a/net/hsr/hsr_framereg.h
++++ b/net/hsr/hsr_framereg.h
+@@ -18,7 +18,7 @@ struct hsr_node;
+
+ struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
+ u16 seq_out);
+-struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
++struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
+ bool is_sup);
+ void hsr_handle_sup_frame(struct sk_buff *skb, struct hsr_node *node_curr,
+ struct hsr_port *port);
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index e0bd013a1e5e..bf5d26d83af0 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -304,12 +304,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ skb->sk = sk;
+ skb->protocol = htons(ETH_P_IEEE802154);
+
+- dev_put(dev);
+-
+ err = dev_queue_xmit(skb);
+ if (err > 0)
+ err = net_xmit_errno(err);
+
++ dev_put(dev);
++
+ return err ?: size;
+
+ out_skb:
+@@ -693,12 +693,12 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ skb->sk = sk;
+ skb->protocol = htons(ETH_P_IEEE802154);
+
+- dev_put(dev);
+-
+ err = dev_queue_xmit(skb);
+ if (err > 0)
+ err = net_xmit_errno(err);
+
++ dev_put(dev);
++
+ return err ?: size;
+
+ out_skb:
+diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
+index 22377c8ff14b..e8f862358518 100644
+--- a/net/ipv4/ah4.c
++++ b/net/ipv4/ah4.c
+@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
+ ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
+ skb_push(skb, ihl);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
+index e60517eb1c3a..8cae791a7ace 100644
+--- a/net/ipv4/arp.c
++++ b/net/ipv4/arp.c
+@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
+ /*unsigned long now; */
+ struct net *net = dev_net(dev);
+
+- rt = ip_route_output(net, sip, tip, 0, 0);
++ rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev));
+ if (IS_ERR(rt))
+ return 1;
+ if (rt->dst.dev != dev) {
+@@ -658,6 +658,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
+ unsigned char *arp_ptr;
+ struct rtable *rt;
+ unsigned char *sha;
++ unsigned char *tha = NULL;
+ __be32 sip, tip;
+ u16 dev_type = dev->type;
+ int addr_type;
+@@ -729,6 +730,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
+ break;
+ #endif
+ default:
++ tha = arp_ptr;
+ arp_ptr += dev->addr_len;
+ }
+ memcpy(&tip, arp_ptr, 4);
+@@ -847,8 +849,18 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
+ It is possible, that this option should be enabled for some
+ devices (strip is candidate)
+ */
+- is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
+- addr_type == RTN_UNICAST;
++ is_garp = tip == sip && addr_type == RTN_UNICAST;
++
++ /* Unsolicited ARP _replies_ also require target hwaddr to be
++ * the same as source.
++ */
++ if (is_garp && arp->ar_op == htons(ARPOP_REPLY))
++ is_garp =
++ /* IPv4 over IEEE 1394 doesn't provide target
++ * hardware address field in its ARP payload.
++ */
++ tha &&
++ !memcmp(tha, sha, dev->addr_len);
+
+ if (!n &&
+ ((arp->ar_op == htons(ARPOP_REPLY) &&
+diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
+index 20fb25e3027b..3d8021d55336 100644
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
+ esph->spi = x->id.spi;
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg,
+- (unsigned char *)esph - skb->data,
+- assoclen + ivlen + clen + alen);
+-
++ err = skb_to_sgvec(skb, sg,
++ (unsigned char *)esph - skb->data,
++ assoclen + ivlen + clen + alen);
++ if (unlikely(err < 0))
++ goto error;
+ aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
+ aead_request_set_ad(req, assoclen);
+
+@@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
+ }
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ err = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out;
+
+ aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
+ aead_request_set_ad(req, assoclen);
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index 7e7b7a3efa99..e1be24416c0e 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -1611,18 +1611,20 @@ void fib_select_multipath(struct fib_result *res, int hash)
+ bool first = false;
+
+ for_nexthops(fi) {
++ if (net->ipv4.sysctl_fib_multipath_use_neigh) {
++ if (!fib_good_nh(nh))
++ continue;
++ if (!first) {
++ res->nh_sel = nhsel;
++ first = true;
++ }
++ }
++
+ if (hash > atomic_read(&nh->nh_upper_bound))
+ continue;
+
+- if (!net->ipv4.sysctl_fib_multipath_use_neigh ||
+- fib_good_nh(nh)) {
+- res->nh_sel = nhsel;
+- return;
+- }
+- if (!first) {
+- res->nh_sel = nhsel;
+- first = true;
+- }
++ res->nh_sel = nhsel;
++ return;
+ } endfor_nexthops(fi);
+ }
+ #endif
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index 96536a0d6e2d..e1271e75e107 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_create(struct net *net,
+ struct net_device *dev;
+ char name[IFNAMSIZ];
+
+- if (parms->name[0])
++ err = -E2BIG;
++ if (parms->name[0]) {
++ if (!dev_valid_name(parms->name))
++ goto failed;
+ strlcpy(name, parms->name, IFNAMSIZ);
+- else {
+- if (strlen(ops->kind) > (IFNAMSIZ - 3)) {
+- err = -E2BIG;
++ } else {
++ if (strlen(ops->kind) > (IFNAMSIZ - 3))
+ goto failed;
+- }
+ strlcpy(name, ops->kind, IFNAMSIZ);
+ strncat(name, "%d", 2);
+ }
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 27089f5ebbb1..742a3432c3ea 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1929,6 +1929,20 @@ int ip_mr_input(struct sk_buff *skb)
+ struct net *net = dev_net(skb->dev);
+ int local = skb_rtable(skb)->rt_flags & RTCF_LOCAL;
+ struct mr_table *mrt;
++ struct net_device *dev;
++
++ /* skb->dev passed in is the loX master dev for vrfs.
++ * As there are no vifs associated with loopback devices,
++ * get the proper interface that does have a vif associated with it.
++ */
++ dev = skb->dev;
++ if (netif_is_l3_master(skb->dev)) {
++ dev = dev_get_by_index_rcu(net, IPCB(skb)->iif);
++ if (!dev) {
++ kfree_skb(skb);
++ return -ENODEV;
++ }
++ }
+
+ /* Packet is looped back after forward, it should not be
+ * forwarded second time, but still can be delivered locally.
+@@ -1966,7 +1980,7 @@ int ip_mr_input(struct sk_buff *skb)
+ /* already under rcu_read_lock() */
+ cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
+ if (!cache) {
+- int vif = ipmr_find_vif(mrt, skb->dev);
++ int vif = ipmr_find_vif(mrt, dev);
+
+ if (vif >= 0)
+ cache = ipmr_cache_find_any(mrt, ip_hdr(skb)->daddr,
+@@ -1986,7 +2000,7 @@ int ip_mr_input(struct sk_buff *skb)
+ }
+
+ read_lock(&mrt_lock);
+- vif = ipmr_find_vif(mrt, skb->dev);
++ vif = ipmr_find_vif(mrt, dev);
+ if (vif >= 0) {
+ int err2 = ipmr_cache_unresolved(mrt, vif, skb);
+ read_unlock(&mrt_lock);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index b5f264ae3bff..eb05ad940e37 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -115,6 +115,7 @@ int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
+ #define FLAG_DSACKING_ACK 0x800 /* SACK blocks contained D-SACK info */
+ #define FLAG_SACK_RENEGING 0x2000 /* snd_una advanced to a sacked seq */
+ #define FLAG_UPDATE_TS_RECENT 0x4000 /* tcp_replace_ts_recent() */
++#define FLAG_NO_CHALLENGE_ACK 0x8000 /* do not call tcp_send_challenge_ack() */
+
+ #define FLAG_ACKED (FLAG_DATA_ACKED|FLAG_SYN_ACKED)
+ #define FLAG_NOT_DUP (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED)
+@@ -3618,7 +3619,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
+ if (before(ack, prior_snd_una)) {
+ /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
+ if (before(ack, prior_snd_una - tp->max_window)) {
+- tcp_send_challenge_ack(sk, skb);
++ if (!(flag & FLAG_NO_CHALLENGE_ACK))
++ tcp_send_challenge_ack(sk, skb);
+ return -1;
+ }
+ goto old_ack;
+@@ -5969,13 +5971,17 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+
+ /* step 5: check the ACK field */
+ acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH |
+- FLAG_UPDATE_TS_RECENT) > 0;
++ FLAG_UPDATE_TS_RECENT |
++ FLAG_NO_CHALLENGE_ACK) > 0;
+
++ if (!acceptable) {
++ if (sk->sk_state == TCP_SYN_RECV)
++ return 1; /* send one RST */
++ tcp_send_challenge_ack(sk, skb);
++ goto discard;
++ }
+ switch (sk->sk_state) {
+ case TCP_SYN_RECV:
+- if (!acceptable)
+- return 1;
+-
+ if (!tp->srtt_us)
+ tcp_synack_rtt_meas(sk, req);
+
+@@ -6045,14 +6051,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
+ * our SYNACK so stop the SYNACK timer.
+ */
+ if (req) {
+- /* Return RST if ack_seq is invalid.
+- * Note that RFC793 only says to generate a
+- * DUPACK for it but for TCP Fast Open it seems
+- * better to treat this case like TCP_SYN_RECV
+- * above.
+- */
+- if (!acceptable)
+- return 1;
+ /* We no longer need the request sock. */
+ reqsk_fastopen_remove(sk, req, false);
+ tcp_rearm_rto(sk);
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 1594d9fc9c92..3a27cf762da1 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -988,7 +988,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
+ INIT_HLIST_NODE(&ifa->addr_lst);
+ ifa->scope = scope;
+ ifa->prefix_len = pfxlen;
+- ifa->flags = flags | IFA_F_TENTATIVE;
++ ifa->flags = flags;
++ /* No need to add the TENTATIVE flag for addresses with NODAD */
++ if (!(flags & IFA_F_NODAD))
++ ifa->flags |= IFA_F_TENTATIVE;
+ ifa->valid_lft = valid_lft;
+ ifa->prefered_lft = prefered_lft;
+ ifa->cstamp = ifa->tstamp = jiffies;
+diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
+index 0630a4d5daaa..0edc44cb254e 100644
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
+ ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+@@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
+ ip6h->hop_limit = 0;
+
+ sg_init_table(sg, nfrags + sglists);
+- skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len);
++ if (unlikely(err < 0))
++ goto out_free;
+
+ if (x->props.flags & XFRM_STATE_ESN) {
+ /* Attach seqhi sg right after packet payload */
+diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
+index 111ba55fd512..6a924be66e37 100644
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
+ esph->spi = x->id.spi;
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg,
+- (unsigned char *)esph - skb->data,
+- assoclen + ivlen + clen + alen);
++ err = skb_to_sgvec(skb, sg,
++ (unsigned char *)esph - skb->data,
++ assoclen + ivlen + clen + alen);
++ if (unlikely(err < 0))
++ goto error;
+
+ aead_request_set_crypt(req, sg, sg, ivlen + clen, iv);
+ aead_request_set_ad(req, assoclen);
+@@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
+ }
+
+ sg_init_table(sg, nfrags);
+- skb_to_sgvec(skb, sg, 0, skb->len);
++ ret = skb_to_sgvec(skb, sg, 0, skb->len);
++ if (unlikely(ret < 0))
++ goto out;
+
+ aead_request_set_crypt(req, sg, sg, elen + ivlen, iv);
+ aead_request_set_ad(req, assoclen);
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index db2613b4a049..caee5530ae2c 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -319,11 +319,13 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
+ if (t || !create)
+ return t;
+
+- if (parms->name[0])
++ if (parms->name[0]) {
++ if (!dev_valid_name(parms->name))
++ return NULL;
+ strlcpy(name, parms->name, IFNAMSIZ);
+- else
++ } else {
+ strcpy(name, "ip6gre%d");
+-
++ }
+ dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
+ ip6gre_tunnel_setup);
+ if (!dev)
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 2e3db3619858..58a6eeeacbf7 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -356,6 +356,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
+ static inline int ip6_forward_finish(struct net *net, struct sock *sk,
+ struct sk_buff *skb)
+ {
++ struct dst_entry *dst = skb_dst(skb);
++
++ __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
++ __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
++
+ return dst_output(net, sk, skb);
+ }
+
+@@ -549,8 +554,6 @@ int ip6_forward(struct sk_buff *skb)
+
+ hdr->hop_limit--;
+
+- __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+- __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
+ return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
+ net, NULL, skb, skb->dev, dst->dev,
+ ip6_forward_finish);
+@@ -1291,7 +1294,7 @@ static int __ip6_append_data(struct sock *sk,
+ const struct sockcm_cookie *sockc)
+ {
+ struct sk_buff *skb, *skb_prev = NULL;
+- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
++ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
+ int exthdrlen = 0;
+ int dst_exthdrlen = 0;
+ int hh_len;
+@@ -1327,6 +1330,12 @@ static int __ip6_append_data(struct sock *sk,
+ sizeof(struct frag_hdr) : 0) +
+ rt->rt6i_nfheader_len;
+
++ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
++ * the first fragment
++ */
++ if (headersize + transhdrlen > mtu)
++ goto emsgsize;
++
+ if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
+ (sk->sk_protocol == IPPROTO_UDP ||
+ sk->sk_protocol == IPPROTO_RAW)) {
+@@ -1342,9 +1351,8 @@ static int __ip6_append_data(struct sock *sk,
+
+ if (cork->length + length > maxnonfragsize - headersize) {
+ emsgsize:
+- ipv6_local_error(sk, EMSGSIZE, fl6,
+- mtu - headersize +
+- sizeof(struct ipv6hdr));
++ pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0);
++ ipv6_local_error(sk, EMSGSIZE, fl6, pmtu);
+ return -EMSGSIZE;
+ }
+
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index a2fcf7bdb597..417af5ea2509 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -298,13 +298,16 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
+ struct net_device *dev;
+ struct ip6_tnl *t;
+ char name[IFNAMSIZ];
+- int err = -ENOMEM;
++ int err = -E2BIG;
+
+- if (p->name[0])
++ if (p->name[0]) {
++ if (!dev_valid_name(p->name))
++ goto failed;
+ strlcpy(name, p->name, IFNAMSIZ);
+- else
++ } else {
+ sprintf(name, "ip6tnl%%d");
+-
++ }
++ err = -ENOMEM;
+ dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
+ ip6_tnl_dev_setup);
+ if (!dev)
+@@ -1097,6 +1100,9 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
+
+ if (!dst) {
+ route_lookup:
++ /* add dsfield to flowlabel for route lookup */
++ fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
++
+ dst = ip6_route_output(net, NULL, fl6);
+
+ if (dst->error)
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 912333586de6..beae93fd66d5 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -212,10 +212,13 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p
+ char name[IFNAMSIZ];
+ int err;
+
+- if (p->name[0])
++ if (p->name[0]) {
++ if (!dev_valid_name(p->name))
++ goto failed;
+ strlcpy(name, p->name, IFNAMSIZ);
+- else
++ } else {
+ sprintf(name, "ip6_vti%%d");
++ }
+
+ dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, vti6_dev_setup);
+ if (!dev)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index a8f80bd20c55..d6a4b2c73a7c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -856,6 +856,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net,
+ struct fib6_node *fn;
+ struct rt6_info *rt;
+
++ if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
++ flags &= ~RT6_LOOKUP_F_IFACE;
++
+ read_lock_bh(&table->tb6_lock);
+ fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
+ restart:
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index d4d84da28672..dcb292134c21 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -244,11 +244,13 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
+ if (!create)
+ goto failed;
+
+- if (parms->name[0])
++ if (parms->name[0]) {
++ if (!dev_valid_name(parms->name))
++ goto failed;
+ strlcpy(name, parms->name, IFNAMSIZ);
+- else
++ } else {
+ strcpy(name, "sit%d");
+-
++ }
+ dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
+ ipip6_tunnel_setup);
+ if (!dev)
+@@ -657,6 +659,7 @@ static int ipip6_rcv(struct sk_buff *skb)
+ if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6),
+ !net_eq(tunnel->net, dev_net(tunnel->dev))))
+ goto out;
++ iph = ip_hdr(skb);
+
+ err = IP_ECN_decapsulate(iph, skb);
+ if (unlikely(err)) {
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 6482b001f19a..15150b412930 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -3305,7 +3305,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
+ p += pol->sadb_x_policy_len*8;
+ sec_ctx = (struct sadb_x_sec_ctx *)p;
+ if (len < pol->sadb_x_policy_len*8 +
+- sec_ctx->sadb_x_sec_len) {
++ sec_ctx->sadb_x_sec_len*8) {
+ *dir = -EINVAL;
+ goto out;
+ }
+diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
+index ee03bc866d1b..ce1238492c0f 100644
+--- a/net/l2tp/l2tp_netlink.c
++++ b/net/l2tp/l2tp_netlink.c
+@@ -750,6 +750,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl
+
+ if ((session->ifname[0] &&
+ nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) ||
++ (session->offset &&
++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) ||
+ (session->cookie_len &&
+ nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len,
+ &session->cookie[0])) ||
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index db916cf51ffe..f7caf0f5d9c8 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -309,6 +309,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ int rc = -EINVAL;
+
+ dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
++
++ lock_sock(sk);
+ if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
+ goto out;
+ rc = -EAFNOSUPPORT;
+@@ -380,6 +382,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
+ out_put:
+ llc_sap_put(sap);
+ out:
++ release_sock(sk);
+ return rc;
+ }
+
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index efa2a2fcae72..d7801f6877af 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2341,10 +2341,17 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy,
+ struct ieee80211_sub_if_data *sdata;
+ enum nl80211_tx_power_setting txp_type = type;
+ bool update_txp_type = false;
++ bool has_monitor = false;
+
+ if (wdev) {
+ sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+
++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
++ sdata = rtnl_dereference(local->monitor_sdata);
++ if (!sdata)
++ return -EOPNOTSUPP;
++ }
++
+ switch (type) {
+ case NL80211_TX_POWER_AUTOMATIC:
+ sdata->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
+@@ -2383,15 +2390,34 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy,
+
+ mutex_lock(&local->iflist_mtx);
+ list_for_each_entry(sdata, &local->interfaces, list) {
++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
++ has_monitor = true;
++ continue;
++ }
+ sdata->user_power_level = local->user_power_level;
+ if (txp_type != sdata->vif.bss_conf.txpower_type)
+ update_txp_type = true;
+ sdata->vif.bss_conf.txpower_type = txp_type;
+ }
+- list_for_each_entry(sdata, &local->interfaces, list)
++ list_for_each_entry(sdata, &local->interfaces, list) {
++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR)
++ continue;
+ ieee80211_recalc_txpower(sdata, update_txp_type);
++ }
+ mutex_unlock(&local->iflist_mtx);
+
++ if (has_monitor) {
++ sdata = rtnl_dereference(local->monitor_sdata);
++ if (sdata) {
++ sdata->user_power_level = local->user_power_level;
++ if (txp_type != sdata->vif.bss_conf.txpower_type)
++ update_txp_type = true;
++ sdata->vif.bss_conf.txpower_type = txp_type;
++
++ ieee80211_recalc_txpower(sdata, update_txp_type);
++ }
++ }
++
+ return 0;
+ }
+
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 09f77e4a8a79..49c8a9c9b91f 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -164,7 +164,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local,
+ if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE ||
+ sdata->vif.type == NL80211_IFTYPE_NAN ||
+ (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+- !sdata->vif.mu_mimo_owner)))
++ !sdata->vif.mu_mimo_owner &&
++ !(changed & BSS_CHANGED_TXPOWER))))
+ return;
+
+ if (!check_sdata_in_driver(sdata))
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index fdab4f1390d2..e6f42d12222e 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4332,6 +4332,10 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
+ if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data))
+ return -EINVAL;
+
++ /* If a reconfig is happening, bail out */
++ if (local->in_reconfig)
++ return -EBUSY;
++
+ if (assoc) {
+ rcu_read_lock();
+ have_sta = sta_info_get(sdata, cbss->bssid);
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 750b8bf13e60..2039fd7daf4e 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -1542,7 +1542,6 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
+ struct nf_conntrack_tuple_hash *h;
+ struct nf_conn *ct;
+ struct hlist_nulls_node *n;
+- int cpu;
+ spinlock_t *lockp;
+
+ for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
+@@ -1564,24 +1563,40 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
+ cond_resched();
+ }
+
++ return NULL;
++found:
++ atomic_inc(&ct->ct_general.use);
++ spin_unlock(lockp);
++ local_bh_enable();
++ return ct;
++}
++
++static void
++__nf_ct_unconfirmed_destroy(struct net *net)
++{
++ int cpu;
++
+ for_each_possible_cpu(cpu) {
+- struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
++ struct nf_conntrack_tuple_hash *h;
++ struct hlist_nulls_node *n;
++ struct ct_pcpu *pcpu;
++
++ pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+ spin_lock_bh(&pcpu->lock);
+ hlist_nulls_for_each_entry(h, n, &pcpu->unconfirmed, hnnode) {
++ struct nf_conn *ct;
++
+ ct = nf_ct_tuplehash_to_ctrack(h);
+- if (iter(ct, data))
+- set_bit(IPS_DYING_BIT, &ct->status);
++
++ /* we cannot call iter() on unconfirmed list, the
++ * owning cpu can reallocate ct->ext at any time.
++ */
++ set_bit(IPS_DYING_BIT, &ct->status);
+ }
+ spin_unlock_bh(&pcpu->lock);
+ cond_resched();
+ }
+- return NULL;
+-found:
+- atomic_inc(&ct->ct_general.use);
+- spin_unlock(lockp);
+- local_bh_enable();
+- return ct;
+ }
+
+ void nf_ct_iterate_cleanup(struct net *net,
+@@ -1596,6 +1611,10 @@ void nf_ct_iterate_cleanup(struct net *net,
+ if (atomic_read(&net->ct.count) == 0)
+ return;
+
++ __nf_ct_unconfirmed_destroy(net);
++
++ synchronize_net();
++
+ while ((ct = get_next_corpse(net, iter, data, &bucket)) != NULL) {
+ /* Time to push up daises... */
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index d49a4639465f..9e30fd0ab227 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -890,8 +890,13 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
+ }
+ out:
+ local_bh_enable();
+- if (last)
++ if (last) {
++ /* nf ct hash resize happened, now clear the leftover. */
++ if ((struct nf_conn *)cb->args[1] == last)
++ cb->args[1] = 0;
++
+ nf_ct_put(last);
++ }
+
+ while (i) {
+ i--;
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index c1f59a06da6f..1e97b8d9a159 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1054,6 +1054,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
+ if (addr->sa_family != AF_NETLINK)
+ return -EINVAL;
+
++ if (alen < sizeof(struct sockaddr_nl))
++ return -EINVAL;
++
+ if ((nladdr->nl_groups || nladdr->nl_pid) &&
+ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
+ return -EPERM;
+diff --git a/net/rds/bind.c b/net/rds/bind.c
+index 095f6ce583fe..adb53ae97a02 100644
+--- a/net/rds/bind.c
++++ b/net/rds/bind.c
+@@ -114,6 +114,7 @@ static int rds_add_bound(struct rds_sock *rs, __be32 addr, __be16 *port)
+ rs, &addr, (int)ntohs(*port));
+ break;
+ } else {
++ rs->rs_bound_addr = 0;
+ rds_sock_put(rs);
+ ret = -ENOMEM;
+ break;
+diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c
+index 4374e7b9c7bf..90df95e18ea4 100644
+--- a/net/rxrpc/rxkad.c
++++ b/net/rxrpc/rxkad.c
+@@ -229,7 +229,9 @@ static int rxkad_secure_packet_encrypt(const struct rxrpc_call *call,
+ len &= ~(call->conn->size_align - 1);
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, 0, len);
++ err = skb_to_sgvec(skb, sg, 0, len);
++ if (unlikely(err < 0))
++ goto out;
+ skcipher_request_set_crypt(req, sg, sg, len, iv.x);
+ crypto_skcipher_encrypt(req);
+
+@@ -325,7 +327,7 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
+ struct sk_buff *trailer;
+ u32 data_size, buf;
+ u16 check;
+- int nsg;
++ int nsg, ret;
+
+ _enter("");
+
+@@ -342,7 +344,9 @@ static int rxkad_verify_packet_1(struct rxrpc_call *call, struct sk_buff *skb,
+ goto nomem;
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, offset, 8);
++ ret = skb_to_sgvec(skb, sg, offset, 8);
++ if (unlikely(ret < 0))
++ return ret;
+
+ /* start the decryption afresh */
+ memset(&iv, 0, sizeof(iv));
+@@ -405,7 +409,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
+ struct sk_buff *trailer;
+ u32 data_size, buf;
+ u16 check;
+- int nsg;
++ int nsg, ret;
+
+ _enter(",{%d}", skb->len);
+
+@@ -429,7 +433,12 @@ static int rxkad_verify_packet_2(struct rxrpc_call *call, struct sk_buff *skb,
+ }
+
+ sg_init_table(sg, nsg);
+- skb_to_sgvec(skb, sg, offset, len);
++ ret = skb_to_sgvec(skb, sg, offset, len);
++ if (unlikely(ret < 0)) {
++ if (sg != _sg)
++ kfree(sg);
++ return ret;
++ }
+
+ /* decrypt from the session key */
+ token = call->conn->params.key->payload.data[0];
+diff --git a/net/sched/act_api.c b/net/sched/act_api.c
+index f3117324146a..67adb4ecded2 100644
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -95,8 +95,10 @@ static int tcf_dump_walker(struct tcf_hashinfo *hinfo, struct sk_buff *skb,
+ continue;
+
+ nest = nla_nest_start(skb, n_i);
+- if (nest == NULL)
++ if (nest == NULL) {
++ index--;
+ goto nla_put_failure;
++ }
+ err = tcf_action_dump_1(skb, p, 0, 0);
+ if (err < 0) {
+ index--;
+diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
+index 1d3960033f61..40496f34bdb3 100644
+--- a/net/sched/act_bpf.c
++++ b/net/sched/act_bpf.c
+@@ -245,10 +245,14 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg)
+
+ static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg)
+ {
+- if (cfg->is_ebpf)
+- bpf_prog_put(cfg->filter);
+- else
+- bpf_prog_destroy(cfg->filter);
++ struct bpf_prog *filter = cfg->filter;
++
++ if (filter) {
++ if (cfg->is_ebpf)
++ bpf_prog_put(filter);
++ else
++ bpf_prog_destroy(filter);
++ }
+
+ kfree(cfg->bpf_ops);
+ kfree(cfg->bpf_name);
+diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
+index f85313d60a4d..bd8e86cb8743 100644
+--- a/net/sched/act_skbmod.c
++++ b/net/sched/act_skbmod.c
+@@ -192,7 +192,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a, int bind)
+ struct tcf_skbmod_params *p;
+
+ p = rcu_dereference_protected(d->skbmod_p, 1);
+- kfree_rcu(p, rcu);
++ if (p)
++ kfree_rcu(p, rcu);
+ }
+
+ static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a,
+diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
+index b6e3abe505ac..901fb8bb9dce 100644
+--- a/net/sched/act_tunnel_key.c
++++ b/net/sched/act_tunnel_key.c
+@@ -196,11 +196,12 @@ static void tunnel_key_release(struct tc_action *a, int bind)
+ struct tcf_tunnel_key_params *params;
+
+ params = rcu_dereference_protected(t->params, 1);
++ if (params) {
++ if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
++ dst_release(¶ms->tcft_enc_metadata->dst);
+
+- if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET)
+- dst_release(¶ms->tcft_enc_metadata->dst);
+-
+- kfree_rcu(params, rcu);
++ kfree_rcu(params, rcu);
++ }
+ }
+
+ static int tunnel_key_dump_addresses(struct sk_buff *skb,
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 11f69d4c5619..355d95a7cd81 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -727,8 +727,10 @@ static int sctp_v6_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
+ sctp_v6_map_v4(addr);
+ }
+
+- if (addr->sa.sa_family == AF_INET)
++ if (addr->sa.sa_family == AF_INET) {
++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
+ return sizeof(struct sockaddr_in);
++ }
+ return sizeof(struct sockaddr_in6);
+ }
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 8cdd6bbe2efa..78f38056fca6 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -335,11 +335,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
+ if (!opt->pf->af_supported(addr->sa.sa_family, opt))
+ return NULL;
+
+- /* V4 mapped address are really of AF_INET family */
+- if (addr->sa.sa_family == AF_INET6 &&
+- ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
+- !opt->pf->af_supported(AF_INET, opt))
+- return NULL;
++ if (addr->sa.sa_family == AF_INET6) {
++ if (len < SIN6_LEN_RFC2133)
++ return NULL;
++ /* V4 mapped address are really of AF_INET family */
++ if (ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
++ !opt->pf->af_supported(AF_INET, opt))
++ return NULL;
++ }
+
+ /* If we get this far, af is valid. */
+ af = sctp_get_af_specific(addr->sa.sa_family);
+@@ -1519,7 +1522,7 @@ static void sctp_close(struct sock *sk, long timeout)
+
+ pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout);
+
+- lock_sock(sk);
++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
+ sk->sk_shutdown = SHUTDOWN_MASK;
+ sk->sk_state = SCTP_SS_CLOSING;
+
+@@ -1569,7 +1572,7 @@ static void sctp_close(struct sock *sk, long timeout)
+ * held and that should be grabbed before socket lock.
+ */
+ spin_lock_bh(&net->sctp.addr_wq_lock);
+- bh_lock_sock(sk);
++ bh_lock_sock_nested(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+ * and we have just a little more cleanup.
+diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
+index b5c279b22680..6cbc935ddd96 100644
+--- a/net/strparser/strparser.c
++++ b/net/strparser/strparser.c
+@@ -59,7 +59,7 @@ static void strp_abort_rx_strp(struct strparser *strp, int err)
+ strp->rx_stopped = 1;
+
+ /* Report an error on the lower socket */
+- csk->sk_err = err;
++ csk->sk_err = -err;
+ csk->sk_error_report(csk);
+ }
+
+@@ -422,7 +422,7 @@ static void strp_rx_msg_timeout(unsigned long arg)
+ /* Message assembly timed out */
+ STRP_STATS_INCR(strp->stats.rx_msg_timeouts);
+ lock_sock(strp->sk);
+- strp->cb.abort_parser(strp, ETIMEDOUT);
++ strp->cb.abort_parser(strp, -ETIMEDOUT);
+ release_sock(strp->sk);
+ }
+
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index d24d14ea8ba4..1bf9153004cd 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2384,7 +2384,12 @@ static void xs_tcp_setup_socket(struct work_struct *work)
+ case -EHOSTUNREACH:
+ case -EADDRINUSE:
+ case -ENOBUFS:
+- /* retry with existing socket, after a delay */
++ /*
++ * xs_tcp_force_close() wakes tasks with -EIO.
++ * We need to wake them first to ensure the
++ * correct error code.
++ */
++ xprt_wake_pending_tasks(xprt, status);
+ xs_tcp_force_close(xprt);
+ goto out;
+ }
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f83b74d3e2ac..007721632b07 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1790,32 +1790,40 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
+
+ static int __init x25_init(void)
+ {
+- int rc = proto_register(&x25_proto, 0);
++ int rc;
+
+- if (rc != 0)
++ rc = proto_register(&x25_proto, 0);
++ if (rc)
+ goto out;
+
+ rc = sock_register(&x25_family_ops);
+- if (rc != 0)
++ if (rc)
+ goto out_proto;
+
+ dev_add_pack(&x25_packet_type);
+
+ rc = register_netdevice_notifier(&x25_dev_notifier);
+- if (rc != 0)
++ if (rc)
+ goto out_sock;
+
+- pr_info("Linux Version 0.2\n");
++ rc = x25_register_sysctl();
++ if (rc)
++ goto out_dev;
+
+- x25_register_sysctl();
+ rc = x25_proc_init();
+- if (rc != 0)
+- goto out_dev;
++ if (rc)
++ goto out_sysctl;
++
++ pr_info("Linux Version 0.2\n");
++
+ out:
+ return rc;
++out_sysctl:
++ x25_unregister_sysctl();
+ out_dev:
+ unregister_netdevice_notifier(&x25_dev_notifier);
+ out_sock:
++ dev_remove_pack(&x25_packet_type);
+ sock_unregister(AF_X25);
+ out_proto:
+ proto_unregister(&x25_proto);
+diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
+index 43239527a205..703d46aae7a2 100644
+--- a/net/x25/sysctl_net_x25.c
++++ b/net/x25/sysctl_net_x25.c
+@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = {
+ { 0, },
+ };
+
+-void __init x25_register_sysctl(void)
++int __init x25_register_sysctl(void)
+ {
+ x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table);
++ if (!x25_table_header)
++ return -ENOMEM;
++ return 0;
+ }
+
+ void x25_unregister_sysctl(void)
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index fdb9742d934e..6f5635770d6a 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -1246,6 +1246,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
+ x->curlft.add_time = orig->curlft.add_time;
+ x->km.state = orig->km.state;
+ x->km.seq = orig->km.seq;
++ x->replay = orig->replay;
++ x->preplay = orig->preplay;
+
+ return x;
+
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index a2ff3388e5ea..2a61db329adf 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -106,6 +106,7 @@ all_compiled_sources()
+ case "$i" in
+ *.[cS])
+ j=${i/\.[cS]/\.o}
++ j="${j#$tree}"
+ if [ -e $j ]; then
+ echo $i
+ fi
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 17627d8d5a26..8ded80867b92 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -2033,8 +2033,9 @@ static inline u32 file_to_av(struct file *file)
+ static inline u32 open_file_to_av(struct file *file)
+ {
+ u32 av = file_to_av(file);
++ struct inode *inode = file_inode(file);
+
+- if (selinux_policycap_openperm)
++ if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
+ av |= FILE__OPEN;
+
+ return av;
+@@ -3031,6 +3032,7 @@ static int selinux_inode_permission(struct inode *inode, int mask)
+ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
+ {
+ const struct cred *cred = current_cred();
++ struct inode *inode = d_backing_inode(dentry);
+ unsigned int ia_valid = iattr->ia_valid;
+ __u32 av = FILE__WRITE;
+
+@@ -3046,8 +3048,10 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
+ ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
+ return dentry_has_perm(cred, dentry, FILE__SETATTR);
+
+- if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
+- && !(ia_valid & ATTR_FILE))
++ if (selinux_policycap_openperm &&
++ inode->i_sb->s_magic != SOCKFS_MAGIC &&
++ (ia_valid & ATTR_SIZE) &&
++ !(ia_valid & ATTR_FILE))
+ av |= FILE__OPEN;
+
+ return dentry_has_perm(cred, dentry, av);
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index dd88c2cb6470..48804e4ab530 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -201,7 +201,7 @@ static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
+ if (ret < 0)
+ return ret;
+
+- ret = asoc_simple_card_init_mic(rtd->card, &priv->hp_jack, PREFIX);
++ ret = asoc_simple_card_init_mic(rtd->card, &priv->mic_jack, PREFIX);
+ if (ret < 0)
+ return ret;
+
+diff --git a/sound/soc/intel/atom/sst/sst_stream.c b/sound/soc/intel/atom/sst/sst_stream.c
+index 4ccc80e5e8cc..c798f8d4ae43 100644
+--- a/sound/soc/intel/atom/sst/sst_stream.c
++++ b/sound/soc/intel/atom/sst/sst_stream.c
+@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct intel_sst_drv *sst_drv_ctx,
+ sst_free_block(sst_drv_ctx, block);
+ out:
+ test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id);
+- return 0;
++ return ret;
+ }
+
+ /*
+diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c
+index 90525614c20a..b1eb696f33b6 100644
+--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
+@@ -111,6 +111,7 @@ static const struct snd_soc_dapm_widget cht_dapm_widgets[] = {
+ SND_SOC_DAPM_HP("Headphone", NULL),
+ SND_SOC_DAPM_MIC("Headset Mic", NULL),
+ SND_SOC_DAPM_MIC("Int Mic", NULL),
++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL),
+ SND_SOC_DAPM_SPK("Ext Spk", NULL),
+ SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
+ platform_clock_control, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
+@@ -121,6 +122,8 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = {
+ {"IN1N", NULL, "Headset Mic"},
+ {"DMIC L1", NULL, "Int Mic"},
+ {"DMIC R1", NULL, "Int Mic"},
++ {"IN2P", NULL, "Int Analog Mic"},
++ {"IN2N", NULL, "Int Analog Mic"},
+ {"Headphone", NULL, "HPOL"},
+ {"Headphone", NULL, "HPOR"},
+ {"Ext Spk", NULL, "SPOL"},
+@@ -134,6 +137,9 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = {
+ {"Headphone", NULL, "Platform Clock"},
+ {"Headset Mic", NULL, "Platform Clock"},
+ {"Int Mic", NULL, "Platform Clock"},
++ {"Int Analog Mic", NULL, "Platform Clock"},
++ {"Int Analog Mic", NULL, "micbias1"},
++ {"Int Analog Mic", NULL, "micbias2"},
+ {"Ext Spk", NULL, "Platform Clock"},
+ };
+
+@@ -162,6 +168,7 @@ static const struct snd_kcontrol_new cht_mc_controls[] = {
+ SOC_DAPM_PIN_SWITCH("Headphone"),
+ SOC_DAPM_PIN_SWITCH("Headset Mic"),
+ SOC_DAPM_PIN_SWITCH("Int Mic"),
++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"),
+ SOC_DAPM_PIN_SWITCH("Ext Spk"),
+ };
+
+diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
+index 805b7f2173f3..78472c908ae9 100644
+--- a/sound/soc/intel/skylake/skl-messages.c
++++ b/sound/soc/intel/skylake/skl-messages.c
+@@ -331,7 +331,11 @@ int skl_resume_dsp(struct skl *skl)
+ if (skl->skl_sst->is_first_boot == true)
+ return 0;
+
++ /* disable dynamic clock gating during fw and lib download */
++ ctx->enable_miscbdcge(ctx->dev, false);
++
+ ret = skl_dsp_wake(ctx->dsp);
++ ctx->enable_miscbdcge(ctx->dev, true);
+ if (ret < 0)
+ return ret;
+
+diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
+index 58c728662600..2fd213cd9a40 100644
+--- a/sound/soc/intel/skylake/skl-pcm.c
++++ b/sound/soc/intel/skylake/skl-pcm.c
+@@ -1191,7 +1191,11 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform)
+ return -EIO;
+ }
+
++ /* disable dynamic clock gating during fw and lib download */
++ skl->skl_sst->enable_miscbdcge(platform->dev, false);
++
+ ret = ops->init_fw(platform->dev, skl->skl_sst);
++ skl->skl_sst->enable_miscbdcge(platform->dev, true);
+ if (ret < 0) {
+ dev_err(platform->dev, "Failed to boot first fw: %d\n", ret);
+ return ret;
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index fefa6ad5de8b..17e305b71fd9 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -552,6 +552,13 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+ u32 *buf = (u32 *)(runtime->dma_area +
+ rsnd_dai_pointer_offset(io, 0));
++ int shift = 0;
++
++ switch (runtime->sample_bits) {
++ case 32:
++ shift = 8;
++ break;
++ }
+
+ /*
+ * 8/16/32 data can be assesse to TDR/RDR register
+@@ -559,9 +566,9 @@ static void __rsnd_ssi_interrupt(struct rsnd_mod *mod,
+ * see rsnd_ssi_init()
+ */
+ if (rsnd_io_is_play(io))
+- rsnd_mod_write(mod, SSITDR, *buf);
++ rsnd_mod_write(mod, SSITDR, (*buf) << shift);
+ else
+- *buf = rsnd_mod_read(mod, SSIRDR);
++ *buf = (rsnd_mod_read(mod, SSIRDR) >> shift);
+
+ elapsed = rsnd_dai_pointer_update(io, sizeof(*buf));
+ }
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index 4c596ba310cb..0fd8bfb77f65 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -679,6 +679,10 @@ static struct syscall_fmt {
+ { .name = "mlockall", .errmsg = true,
+ .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, },
+ { .name = "mmap", .hexret = true,
++/* The standard mmap maps to old_mmap on s390x */
++#if defined(__s390x__)
++ .alias = "old_mmap",
++#endif
+ .arg_scnprintf = { [0] = SCA_HEX, /* addr */
+ [2] = SCA_MMAP_PROT, /* prot */
+ [3] = SCA_MMAP_FLAGS, /* flags */ }, },
+diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
+index ff5bc6363a79..150334064071 100644
+--- a/tools/perf/tests/code-reading.c
++++ b/tools/perf/tests/code-reading.c
+@@ -224,6 +224,8 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
+ unsigned char buf2[BUFSZ];
+ size_t ret_len;
+ u64 objdump_addr;
++ const char *objdump_name;
++ char decomp_name[KMOD_DECOMP_LEN];
+ int ret;
+
+ pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr);
+@@ -284,9 +286,25 @@ static int read_object_code(u64 addr, size_t len, u8 cpumode,
+ state->done[state->done_cnt++] = al.map->start;
+ }
+
++ objdump_name = al.map->dso->long_name;
++ if (dso__needs_decompress(al.map->dso)) {
++ if (dso__decompress_kmodule_path(al.map->dso, objdump_name,
++ decomp_name,
++ sizeof(decomp_name)) < 0) {
++ pr_debug("decompression failed\n");
++ return -1;
++ }
++
++ objdump_name = decomp_name;
++ }
++
+ /* Read the object code using objdump */
+ objdump_addr = map__rip_2objdump(al.map, al.addr);
+- ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len);
++ ret = read_via_objdump(objdump_name, objdump_addr, buf2, len);
++
++ if (dso__needs_decompress(al.map->dso))
++ unlink(objdump_name);
++
+ if (ret > 0) {
+ /*
+ * The kernel maps are inaccurate - assume objdump is right in
+diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
+index d2c6cdd9d42b..4bc58822416c 100644
+--- a/tools/perf/util/dso.c
++++ b/tools/perf/util/dso.c
+@@ -366,7 +366,23 @@ static int __open_dso(struct dso *dso, struct machine *machine)
+ if (!is_regular_file(name))
+ return -EINVAL;
+
++ if (dso__needs_decompress(dso)) {
++ char newpath[KMOD_DECOMP_LEN];
++ size_t len = sizeof(newpath);
++
++ if (dso__decompress_kmodule_path(dso, name, newpath, len) < 0) {
++ free(name);
++ return -dso->load_errno;
++ }
++
++ strcpy(name, newpath);
++ }
++
+ fd = do_open(name);
++
++ if (dso__needs_decompress(dso))
++ unlink(name);
++
+ free(name);
+ return fd;
+ }
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 28bdb48357f0..ab36aa5585b4 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1454,8 +1454,16 @@ static int __event_process_build_id(struct build_id_event *bev,
+
+ dso__set_build_id(dso, &bev->build_id);
+
+- if (!is_kernel_module(filename, cpumode))
+- dso->kernel = dso_type;
++ if (dso_type != DSO_TYPE_USER) {
++ struct kmod_path m = { .name = NULL, };
++
++ if (!kmod_path__parse_name(&m, filename) && m.kmod)
++ dso__set_short_name(dso, strdup(m.name), true);
++ else
++ dso->kernel = dso_type;
++
++ free(m.name);
++ }
+
+ build_id__sprintf(dso->build_id, sizeof(dso->build_id),
+ sbuild_id);
+diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
+index 4d2e22f8bd94..c93daccec755 100644
+--- a/tools/perf/util/probe-event.c
++++ b/tools/perf/util/probe-event.c
+@@ -2609,6 +2609,14 @@ static int get_new_event_name(char *buf, size_t len, const char *base,
+
+ out:
+ free(nbase);
++
++ /* Final validation */
++ if (ret >= 0 && !is_c_func_name(buf)) {
++ pr_warning("Internal error: \"%s\" is an invalid event name.\n",
++ buf);
++ ret = -EINVAL;
++ }
++
+ return ret;
+ }
+
+diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
+index 783a53fb7a4e..b46e1cf347e5 100644
+--- a/tools/perf/util/unwind-libdw.c
++++ b/tools/perf/util/unwind-libdw.c
+@@ -38,6 +38,14 @@ static int __report_module(struct addr_location *al, u64 ip,
+ return 0;
+
+ mod = dwfl_addrmodule(ui->dwfl, ip);
++ if (mod) {
++ Dwarf_Addr s;
++
++ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL);
++ if (s != al->map->start)
++ mod = 0;
++ }
++
+ if (!mod)
+ mod = dwfl_report_elf(ui->dwfl, dso->short_name,
+ dso->long_name, -1, al->map->start,
+@@ -167,12 +175,16 @@ frame_callback(Dwfl_Frame *state, void *arg)
+ {
+ struct unwind_info *ui = arg;
+ Dwarf_Addr pc;
++ bool isactivation;
+
+- if (!dwfl_frame_pc(state, &pc, NULL)) {
++ if (!dwfl_frame_pc(state, &pc, &isactivation)) {
+ pr_err("%s", dwfl_errmsg(-1));
+ return DWARF_CB_ABORT;
+ }
+
++ if (!isactivation)
++ --pc;
++
+ return entry(pc, ui) || !(--ui->max_stack) ?
+ DWARF_CB_ABORT : DWARF_CB_OK;
+ }
+diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
+index 20c2e5743903..120383494ff2 100644
+--- a/tools/perf/util/unwind-libunwind-local.c
++++ b/tools/perf/util/unwind-libunwind-local.c
+@@ -646,6 +646,17 @@ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
+
+ while (!ret && (unw_step(&c) > 0) && i < max_stack) {
+ unw_get_reg(&c, UNW_REG_IP, &ips[i]);
++
++ /*
++ * Decrement the IP for any non-activation frames.
++ * this is required to properly find the srcline
++ * for caller frames.
++ * See also the documentation for dwfl_frame_pc(),
++ * which this code tries to replicate.
++ */
++ if (unw_is_signal_frame(&c) <= 0)
++ --ips[i];
++
+ ++i;
+ }
+
+diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
+index 85c56800f17a..dfb010bd29f2 100644
+--- a/tools/perf/util/util.c
++++ b/tools/perf/util/util.c
+@@ -207,7 +207,7 @@ int copyfile_offset(int ifd, loff_t off_in, int ofd, loff_t off_out, u64 size)
+
+ size -= ret;
+ off_in += ret;
+- off_out -= ret;
++ off_out += ret;
+ }
+ munmap(ptr, off_in + size);
+
+diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+index d9c49f41515e..e79ccd6aada1 100644
+--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
++++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+@@ -42,12 +42,12 @@ int test_body(void)
+ printf("Check DSCR TM context switch: ");
+ fflush(stdout);
+ for (;;) {
+- rv = 1;
+ asm __volatile__ (
+ /* set a known value into the DSCR */
+ "ld 3, %[dscr1];"
+ "mtspr %[sprn_dscr], 3;"
+
++ "li %[rv], 1;"
+ /* start and suspend a transaction */
+ "tbegin.;"
+ "beq 1f;"
+diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
+index cbb0564c0ec4..f68998149351 100644
+--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
+@@ -1318,7 +1318,7 @@ void change_syscall(struct __test_metadata *_metadata,
+ iov.iov_len = sizeof(regs);
+ ret = ptrace(PTRACE_GETREGSET, tracee, NT_PRSTATUS, &iov);
+ #endif
+- EXPECT_EQ(0, ret);
++ EXPECT_EQ(0, ret) {}
+
+ #if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \
+ defined(__s390__) || defined(__hppa__)
next reply other threads:[~2018-04-13 22:21 UTC|newest]
Thread overview: 393+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-13 22:21 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2023-01-07 11:37 [gentoo-commits] proj/linux-patches:4.9 commit in: / Mike Pagano
2022-12-14 12:24 Mike Pagano
2022-12-08 13:09 Alice Ferrazzi
2022-11-25 17:02 Mike Pagano
2022-11-10 15:14 Mike Pagano
2022-11-03 15:09 Mike Pagano
2022-10-26 11:43 Mike Pagano
2022-09-28 9:19 Mike Pagano
2022-09-20 12:04 Mike Pagano
2022-09-15 11:10 Mike Pagano
2022-09-05 12:08 Mike Pagano
2022-08-25 10:37 Mike Pagano
2022-07-29 15:25 Mike Pagano
2022-07-21 20:14 Mike Pagano
2022-07-12 16:03 Mike Pagano
2022-07-07 16:20 Mike Pagano
2022-07-02 16:04 Mike Pagano
2022-06-25 10:24 Mike Pagano
2022-06-16 11:42 Mike Pagano
2022-06-14 15:49 Mike Pagano
2022-06-06 11:07 Mike Pagano
2022-05-27 12:41 Mike Pagano
2022-05-25 11:57 Mike Pagano
2022-05-18 9:52 Mike Pagano
2022-05-15 22:14 Mike Pagano
2022-05-12 11:32 Mike Pagano
2022-04-27 11:38 Mike Pagano
2022-04-20 12:12 Mike Pagano
2022-03-28 11:01 Mike Pagano
2022-03-23 11:59 Mike Pagano
2022-03-16 13:22 Mike Pagano
2022-03-11 10:57 Mike Pagano
2022-03-08 18:28 Mike Pagano
2022-03-02 13:09 Mike Pagano
2022-02-26 23:38 Mike Pagano
2022-02-23 12:40 Mike Pagano
2022-02-16 12:49 Mike Pagano
2022-02-11 12:38 Mike Pagano
2022-02-08 18:03 Mike Pagano
2022-01-29 17:46 Mike Pagano
2022-01-27 11:41 Mike Pagano
2022-01-11 12:59 Mike Pagano
2022-01-05 12:57 Mike Pagano
2021-12-29 13:13 Mike Pagano
2021-12-22 14:08 Mike Pagano
2021-12-14 10:37 Mike Pagano
2021-12-08 12:57 Mike Pagano
2021-11-26 12:01 Mike Pagano
2021-11-12 13:38 Mike Pagano
2021-11-02 17:06 Mike Pagano
2021-10-27 12:00 Mike Pagano
2021-10-17 13:14 Mike Pagano
2021-10-09 21:35 Mike Pagano
2021-10-06 11:32 Mike Pagano
2021-09-26 14:15 Mike Pagano
2021-09-22 11:42 Mike Pagano
2021-09-20 22:06 Mike Pagano
2021-09-03 11:24 Mike Pagano
2021-08-26 14:03 Mike Pagano
2021-08-25 23:14 Mike Pagano
2021-08-25 23:13 Mike Pagano
2021-08-15 20:10 Mike Pagano
2021-08-08 13:41 Mike Pagano
2021-08-04 11:55 Mike Pagano
2021-08-03 12:49 Mike Pagano
2021-07-28 12:39 Mike Pagano
2021-07-20 15:29 Alice Ferrazzi
2021-07-11 14:47 Mike Pagano
2021-06-30 14:28 Mike Pagano
2021-06-17 14:23 Alice Ferrazzi
2021-06-17 11:08 Alice Ferrazzi
2021-06-10 11:10 Mike Pagano
2021-06-03 10:41 Alice Ferrazzi
2021-05-26 12:03 Mike Pagano
2021-05-22 10:01 Mike Pagano
2021-04-28 11:03 Alice Ferrazzi
2021-04-16 11:19 Alice Ferrazzi
2021-04-10 13:22 Mike Pagano
2021-04-07 12:14 Mike Pagano
2021-03-30 14:14 Mike Pagano
2021-03-24 12:07 Mike Pagano
2021-03-17 15:58 Mike Pagano
2021-03-11 14:04 Mike Pagano
2021-03-07 15:13 Mike Pagano
2021-03-03 17:24 Alice Ferrazzi
2021-02-23 13:38 Alice Ferrazzi
2021-02-10 10:15 Alice Ferrazzi
2021-02-05 14:53 Alice Ferrazzi
2021-02-03 23:25 Mike Pagano
2021-01-30 13:18 Alice Ferrazzi
2021-01-23 16:34 Mike Pagano
2021-01-17 16:22 Mike Pagano
2021-01-12 20:08 Mike Pagano
2021-01-09 12:54 Mike Pagano
2020-12-29 14:18 Mike Pagano
2020-12-11 12:54 Mike Pagano
2020-12-02 12:48 Mike Pagano
2020-11-24 13:39 Mike Pagano
2020-11-22 19:12 Mike Pagano
2020-11-18 19:23 Mike Pagano
2020-11-11 15:32 Mike Pagano
2020-11-10 13:54 Mike Pagano
2020-10-29 11:17 Mike Pagano
2020-10-17 10:14 Mike Pagano
2020-10-14 20:34 Mike Pagano
2020-10-01 19:03 Mike Pagano
2020-10-01 18:59 Mike Pagano
2020-09-24 16:02 Mike Pagano
2020-09-23 11:59 Mike Pagano
2020-09-23 11:57 Mike Pagano
2020-09-12 17:31 Mike Pagano
2020-09-03 11:34 Mike Pagano
2020-08-26 11:13 Mike Pagano
2020-08-21 11:23 Alice Ferrazzi
2020-08-21 11:02 Alice Ferrazzi
2020-07-31 16:13 Mike Pagano
2020-07-22 12:30 Mike Pagano
2020-07-09 12:07 Mike Pagano
2020-07-01 12:10 Mike Pagano
2020-06-22 14:44 Mike Pagano
2020-06-11 11:28 Mike Pagano
2020-06-03 11:37 Mike Pagano
2020-05-27 15:26 Mike Pagano
2020-05-20 11:24 Mike Pagano
2020-05-13 12:50 Mike Pagano
2020-05-11 22:52 Mike Pagano
2020-05-05 17:39 Mike Pagano
2020-05-02 19:22 Mike Pagano
2020-04-24 12:01 Mike Pagano
2020-04-15 17:55 Mike Pagano
2020-04-13 11:15 Mike Pagano
2020-04-02 18:55 Mike Pagano
2020-03-20 11:54 Mike Pagano
2020-03-11 10:15 Mike Pagano
2020-02-28 15:29 Mike Pagano
2020-02-14 23:36 Mike Pagano
2020-02-05 14:48 Mike Pagano
2020-01-29 12:36 Mike Pagano
2020-01-23 11:02 Mike Pagano
2020-01-14 22:26 Mike Pagano
2020-01-12 14:52 Mike Pagano
2020-01-04 16:48 Mike Pagano
2019-12-21 14:54 Mike Pagano
2019-12-05 15:17 Alice Ferrazzi
2019-11-29 21:39 Thomas Deutschmann
2019-11-28 23:51 Mike Pagano
2019-11-25 12:08 Mike Pagano
2019-11-16 10:54 Mike Pagano
2019-11-12 20:58 Mike Pagano
2019-11-10 16:15 Mike Pagano
2019-11-06 14:24 Mike Pagano
2019-10-29 11:16 Mike Pagano
2019-10-17 22:21 Mike Pagano
2019-10-07 17:37 Mike Pagano
2019-10-05 11:39 Mike Pagano
2019-09-21 15:57 Mike Pagano
2019-09-19 23:16 Mike Pagano
2019-09-16 12:22 Mike Pagano
2019-09-10 11:10 Mike Pagano
2019-09-06 17:18 Mike Pagano
2019-08-25 17:34 Mike Pagano
2019-08-11 10:59 Mike Pagano
2019-08-06 19:16 Mike Pagano
2019-08-04 16:05 Mike Pagano
2019-07-21 14:38 Mike Pagano
2019-07-10 11:03 Mike Pagano
2019-06-27 11:10 Mike Pagano
2019-06-22 19:04 Mike Pagano
2019-06-17 19:19 Mike Pagano
2019-06-11 17:40 Mike Pagano
2019-06-11 12:39 Mike Pagano
2019-05-31 16:42 Mike Pagano
2019-05-26 17:12 Mike Pagano
2019-05-21 17:14 Mike Pagano
2019-05-16 22:59 Mike Pagano
2019-05-14 20:08 Mike Pagano
2019-05-10 19:38 Mike Pagano
2019-05-08 10:03 Mike Pagano
2019-05-04 18:26 Mike Pagano
2019-05-02 10:16 Mike Pagano
2019-04-27 17:29 Mike Pagano
2019-04-20 11:06 Mike Pagano
2019-04-19 19:54 Mike Pagano
2019-04-05 21:42 Mike Pagano
2019-04-03 10:48 Mike Pagano
2019-03-27 10:20 Mike Pagano
2019-03-23 14:57 Mike Pagano
2019-03-23 14:18 Mike Pagano
2019-03-19 16:56 Mike Pagano
2019-03-13 22:05 Mike Pagano
2019-03-06 19:12 Mike Pagano
2019-03-05 17:59 Mike Pagano
2019-02-27 11:20 Mike Pagano
2019-02-23 14:42 Mike Pagano
2019-02-20 11:16 Mike Pagano
2019-02-15 12:46 Mike Pagano
2019-02-12 20:51 Mike Pagano
2019-02-06 20:14 Mike Pagano
2019-01-31 11:22 Mike Pagano
2019-01-26 15:03 Mike Pagano
2019-01-23 11:29 Mike Pagano
2019-01-16 23:29 Mike Pagano
2019-01-13 19:26 Mike Pagano
2019-01-09 18:09 Mike Pagano
2019-01-09 17:52 Mike Pagano
2018-12-29 22:53 Mike Pagano
2018-12-29 18:51 Mike Pagano
2018-12-21 14:44 Mike Pagano
2018-12-17 11:39 Mike Pagano
2018-12-13 11:36 Mike Pagano
2018-12-08 13:25 Mike Pagano
2018-12-05 19:44 Mike Pagano
2018-12-01 18:00 Mike Pagano
2018-12-01 15:04 Mike Pagano
2018-11-27 16:22 Mike Pagano
2018-11-23 12:48 Mike Pagano
2018-11-23 12:45 Mike Pagano
2018-11-21 12:20 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-14 14:37 Mike Pagano
2018-11-13 21:20 Mike Pagano
2018-11-11 1:44 Mike Pagano
2018-11-11 1:31 Mike Pagano
2018-11-10 21:30 Mike Pagano
2018-10-20 12:43 Mike Pagano
2018-10-18 10:25 Mike Pagano
2018-10-13 16:34 Mike Pagano
2018-10-10 11:19 Mike Pagano
2018-10-04 10:40 Mike Pagano
2018-09-29 13:33 Mike Pagano
2018-09-26 10:42 Mike Pagano
2018-09-19 22:38 Mike Pagano
2018-09-15 10:10 Mike Pagano
2018-09-09 23:27 Mike Pagano
2018-09-05 15:27 Mike Pagano
2018-08-24 11:43 Mike Pagano
2018-08-22 10:06 Alice Ferrazzi
2018-08-18 18:07 Mike Pagano
2018-08-17 19:32 Mike Pagano
2018-08-17 19:25 Mike Pagano
2018-08-16 11:51 Mike Pagano
2018-08-15 16:46 Mike Pagano
2018-08-09 10:52 Mike Pagano
2018-08-07 18:12 Mike Pagano
2018-08-03 12:25 Mike Pagano
2018-07-28 10:38 Mike Pagano
2018-07-25 10:26 Mike Pagano
2018-07-22 15:14 Mike Pagano
2018-07-17 10:25 Mike Pagano
2018-07-12 15:42 Alice Ferrazzi
2018-07-03 13:16 Mike Pagano
2018-06-26 16:34 Alice Ferrazzi
2018-06-16 15:42 Mike Pagano
2018-06-13 15:03 Mike Pagano
2018-06-06 18:04 Mike Pagano
2018-06-05 11:21 Mike Pagano
2018-05-30 22:34 Mike Pagano
2018-05-30 11:39 Mike Pagano
2018-05-25 14:54 Mike Pagano
2018-05-22 17:28 Mike Pagano
2018-05-20 22:20 Mike Pagano
2018-05-16 10:23 Mike Pagano
2018-05-09 10:54 Mike Pagano
2018-05-02 16:13 Mike Pagano
2018-04-30 10:29 Mike Pagano
2018-04-24 11:30 Mike Pagano
2018-04-20 11:12 Mike Pagano
2018-04-08 14:26 Mike Pagano
2018-03-31 22:17 Mike Pagano
2018-03-28 17:42 Mike Pagano
2018-03-25 14:31 Mike Pagano
2018-03-25 13:39 Mike Pagano
2018-03-22 12:58 Mike Pagano
2018-03-18 22:15 Mike Pagano
2018-03-11 18:26 Mike Pagano
2018-03-05 2:38 Alice Ferrazzi
2018-02-28 18:46 Alice Ferrazzi
2018-02-28 15:02 Alice Ferrazzi
2018-02-25 15:47 Mike Pagano
2018-02-22 23:22 Mike Pagano
2018-02-17 15:02 Alice Ferrazzi
2018-02-13 13:25 Alice Ferrazzi
2018-02-03 21:22 Mike Pagano
2018-01-31 13:31 Alice Ferrazzi
2018-01-23 21:17 Mike Pagano
2018-01-17 10:18 Alice Ferrazzi
2018-01-17 10:18 Alice Ferrazzi
2018-01-17 9:16 Alice Ferrazzi
2018-01-15 14:57 Alice Ferrazzi
2018-01-10 12:21 Alice Ferrazzi
2018-01-10 11:47 Mike Pagano
2018-01-05 15:54 Alice Ferrazzi
2018-01-05 15:04 Alice Ferrazzi
2018-01-02 20:13 Mike Pagano
2017-12-29 17:20 Alice Ferrazzi
2017-12-25 14:36 Alice Ferrazzi
2017-12-20 12:44 Mike Pagano
2017-12-16 17:42 Alice Ferrazzi
2017-12-14 8:58 Alice Ferrazzi
2017-12-09 23:29 Mike Pagano
2017-12-05 11:38 Mike Pagano
2017-11-30 12:19 Alice Ferrazzi
2017-11-24 9:44 Alice Ferrazzi
2017-11-21 9:18 Alice Ferrazzi
2017-11-18 18:24 Mike Pagano
2017-11-15 15:44 Mike Pagano
2017-11-08 13:49 Mike Pagano
2017-11-02 10:03 Mike Pagano
2017-10-27 10:29 Mike Pagano
2017-10-21 20:15 Mike Pagano
2017-10-18 13:46 Mike Pagano
2017-10-12 22:26 Mike Pagano
2017-10-12 12:37 Mike Pagano
2017-10-08 14:23 Mike Pagano
2017-10-08 14:21 Mike Pagano
2017-10-08 14:13 Mike Pagano
2017-10-05 11:38 Mike Pagano
2017-09-27 16:38 Mike Pagano
2017-09-20 10:11 Mike Pagano
2017-09-14 11:39 Mike Pagano
2017-09-13 22:28 Mike Pagano
2017-09-13 16:25 Mike Pagano
2017-09-10 14:38 Mike Pagano
2017-09-07 22:43 Mike Pagano
2017-09-02 17:45 Mike Pagano
2017-08-30 10:06 Mike Pagano
2017-08-25 10:59 Mike Pagano
2017-08-16 22:29 Mike Pagano
2017-08-13 16:51 Mike Pagano
2017-08-11 17:41 Mike Pagano
2017-08-07 10:26 Mike Pagano
2017-05-14 13:31 Mike Pagano
2017-05-08 10:43 Mike Pagano
2017-05-03 17:45 Mike Pagano
2017-04-27 9:05 Alice Ferrazzi
2017-04-22 17:01 Mike Pagano
2017-04-18 10:23 Mike Pagano
2017-04-12 18:01 Mike Pagano
2017-04-08 13:53 Mike Pagano
2017-03-31 10:44 Mike Pagano
2017-03-30 18:15 Mike Pagano
2017-03-26 11:54 Mike Pagano
2017-03-23 18:38 Mike Pagano
2017-03-22 12:42 Mike Pagano
2017-03-18 14:34 Mike Pagano
2017-03-15 19:21 Mike Pagano
2017-03-12 12:22 Mike Pagano
2017-03-02 16:23 Mike Pagano
2017-02-26 20:38 Mike Pagano
2017-02-26 20:36 Mike Pagano
2017-02-23 20:34 Mike Pagano
2017-02-23 20:11 Mike Pagano
2017-02-18 20:37 Mike Pagano
2017-02-18 16:13 Alice Ferrazzi
2017-02-15 16:02 Alice Ferrazzi
2017-02-14 23:08 Mike Pagano
2017-02-09 11:11 Alice Ferrazzi
2017-02-04 11:34 Alice Ferrazzi
2017-02-01 13:07 Alice Ferrazzi
2017-01-29 23:08 Alice Ferrazzi
2017-01-26 8:51 Alice Ferrazzi
2017-01-20 11:33 Alice Ferrazzi
2017-01-15 22:59 Mike Pagano
2017-01-12 22:53 Mike Pagano
2017-01-09 12:41 Mike Pagano
2017-01-07 0:55 Mike Pagano
2017-01-06 23:09 Mike Pagano
2016-12-31 19:39 Mike Pagano
2016-12-11 23:20 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1523658091.023e91a8d84de0d3220fe6a0b5663abbf278dac8.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox