[gentoo-commits] proj/linux-patches:4.4 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     4b55218395b7f03321e40d4a5a6768aad6bd008f
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jun  6 18:00:00 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jun  6 18:00:00 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=4b552183

Linux patch 4.4.136

 0000_README              |    4 +
 1135_linux-4.4.136.patch | 1421 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1425 insertions(+)

diff --git a/0000_README b/0000_README
index 5c020fc..be8e302 100644
--- a/0000_README
+++ b/0000_README
@@ -583,6 +583,10 @@ Patch:  1134_linux-4.4.135.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.135
 
+Patch:  1135_linux-4.4.136.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.136
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1135_linux-4.4.136.patch b/1135_linux-4.4.136.patch
new file mode 100644
index 0000000..66c803b
--- /dev/null
+++ b/1135_linux-4.4.136.patch
@@ -0,0 +1,1421 @@
+diff --git a/Makefile b/Makefile
+index 9b14a5a224c5..a05a7a005715 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 135
++SUBLEVEL = 136
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index 197e06afbf71..e3438c623598 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -114,7 +114,7 @@ static inline void atomic_and(int i, atomic_t *v)
+ 	/* LSE atomics */
+ 	"	mvn	%w[i], %w[i]\n"
+ 	"	stclr	%w[i], %[v]")
+-	: [i] "+r" (w0), [v] "+Q" (v->counter)
++	: [i] "+&r" (w0), [v] "+Q" (v->counter)
+ 	: "r" (x1)
+ 	: "x30");
+ }
+@@ -131,7 +131,7 @@ static inline void atomic_sub(int i, atomic_t *v)
+ 	/* LSE atomics */
+ 	"	neg	%w[i], %w[i]\n"
+ 	"	stadd	%w[i], %[v]")
+-	: [i] "+r" (w0), [v] "+Q" (v->counter)
++	: [i] "+&r" (w0), [v] "+Q" (v->counter)
+ 	: "r" (x1)
+ 	: "x30");
+ }
+@@ -151,7 +151,7 @@ static inline int atomic_sub_return##name(int i, atomic_t *v)		\
+ 	"	neg	%w[i], %w[i]\n"					\
+ 	"	ldadd" #mb "	%w[i], w30, %[v]\n"			\
+ 	"	add	%w[i], %w[i], w30")				\
+-	: [i] "+r" (w0), [v] "+Q" (v->counter)				\
++	: [i] "+&r" (w0), [v] "+Q" (v->counter)				\
+ 	: "r" (x1)							\
+ 	: "x30" , ##cl);						\
+ 									\
+@@ -255,7 +255,7 @@ static inline void atomic64_and(long i, atomic64_t *v)
+ 	/* LSE atomics */
+ 	"	mvn	%[i], %[i]\n"
+ 	"	stclr	%[i], %[v]")
+-	: [i] "+r" (x0), [v] "+Q" (v->counter)
++	: [i] "+&r" (x0), [v] "+Q" (v->counter)
+ 	: "r" (x1)
+ 	: "x30");
+ }
+@@ -272,7 +272,7 @@ static inline void atomic64_sub(long i, atomic64_t *v)
+ 	/* LSE atomics */
+ 	"	neg	%[i], %[i]\n"
+ 	"	stadd	%[i], %[v]")
+-	: [i] "+r" (x0), [v] "+Q" (v->counter)
++	: [i] "+&r" (x0), [v] "+Q" (v->counter)
+ 	: "r" (x1)
+ 	: "x30");
+ }
+@@ -292,7 +292,7 @@ static inline long atomic64_sub_return##name(long i, atomic64_t *v)	\
+ 	"	neg	%[i], %[i]\n"					\
+ 	"	ldadd" #mb "	%[i], x30, %[v]\n"			\
+ 	"	add	%[i], %[i], x30")				\
+-	: [i] "+r" (x0), [v] "+Q" (v->counter)				\
++	: [i] "+&r" (x0), [v] "+Q" (v->counter)				\
+ 	: "r" (x1)							\
+ 	: "x30" , ##cl);						\
+ 									\
+@@ -412,7 +412,7 @@ static inline long __cmpxchg_double##name(unsigned long old1,		\
+ 	"	eor	%[old1], %[old1], %[oldval1]\n"			\
+ 	"	eor	%[old2], %[old2], %[oldval2]\n"			\
+ 	"	orr	%[old1], %[old1], %[old2]")			\
+-	: [old1] "+r" (x0), [old2] "+r" (x1),				\
++	: [old1] "+&r" (x0), [old2] "+&r" (x1),				\
+ 	  [v] "+Q" (*(unsigned long *)ptr)				\
+ 	: [new1] "r" (x2), [new2] "r" (x3), [ptr] "r" (x4),		\
+ 	  [oldval1] "r" (oldval1), [oldval2] "r" (oldval2)		\
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index fcbc4e57d765..1ee603d07847 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -680,6 +680,10 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
+ 	if (value & ~known_bits)
+ 		return -EOPNOTSUPP;
+ 
++	/* Setting FRE without FR is not supported.  */
++	if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE)
++		return -EOPNOTSUPP;
++
+ 	/* Avoid inadvertently triggering emulation */
+ 	if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
+ 	    !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
+diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
+index a9958b4d9194..32fa3ae1a0a6 100644
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -841,7 +841,7 @@ long arch_ptrace(struct task_struct *child, long request,
+ 				break;
+ 			}
+ #endif
+-			tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++			tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ 			break;
+ 		case PC:
+ 			tmp = regs->cp0_epc;
+diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c
+index b4b7e02443e7..d95117e71f69 100644
+--- a/arch/mips/kernel/ptrace32.c
++++ b/arch/mips/kernel/ptrace32.c
+@@ -107,7 +107,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ 						addr & 1);
+ 				break;
+ 			}
+-			tmp = get_fpr32(&fregs[addr - FPR_BASE], 0);
++			tmp = get_fpr64(&fregs[addr - FPR_BASE], 0);
+ 			break;
+ 		case PC:
+ 			tmp = regs->cp0_epc;
+diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
+index 9c9b7411b28b..55eb3b752ca0 100644
+--- a/arch/powerpc/kernel/cpu_setup_power.S
++++ b/arch/powerpc/kernel/cpu_setup_power.S
+@@ -27,6 +27,7 @@ _GLOBAL(__setup_cpu_power7)
+ 	beqlr
+ 	li	r0,0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PCR,r0
+ 	mfspr	r3,SPRN_LPCR
+ 	bl	__init_LPCR
+ 	bl	__init_tlb_power7
+@@ -40,6 +41,7 @@ _GLOBAL(__restore_cpu_power7)
+ 	beqlr
+ 	li	r0,0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PCR,r0
+ 	mfspr	r3,SPRN_LPCR
+ 	bl	__init_LPCR
+ 	bl	__init_tlb_power7
+@@ -55,6 +57,7 @@ _GLOBAL(__setup_cpu_power8)
+ 	beqlr
+ 	li	r0,0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PCR,r0
+ 	mfspr	r3,SPRN_LPCR
+ 	ori	r3, r3, LPCR_PECEDH
+ 	bl	__init_LPCR
+@@ -74,6 +77,7 @@ _GLOBAL(__restore_cpu_power8)
+ 	beqlr
+ 	li	r0,0
+ 	mtspr	SPRN_LPID,r0
++	mtspr	SPRN_PCR,r0
+ 	mfspr   r3,SPRN_LPCR
+ 	ori	r3, r3, LPCR_PECEDH
+ 	bl	__init_LPCR
+diff --git a/arch/sh/kernel/sh_ksyms_32.c b/arch/sh/kernel/sh_ksyms_32.c
+index d77f2f6c7ff0..0b30b9dfc87f 100644
+--- a/arch/sh/kernel/sh_ksyms_32.c
++++ b/arch/sh/kernel/sh_ksyms_32.c
+@@ -34,6 +34,9 @@ DECLARE_EXPORT(__sdivsi3);
+ DECLARE_EXPORT(__lshrsi3);
+ DECLARE_EXPORT(__ashrsi3);
+ DECLARE_EXPORT(__ashlsi3);
++DECLARE_EXPORT(__lshrsi3_r0);
++DECLARE_EXPORT(__ashrsi3_r0);
++DECLARE_EXPORT(__ashlsi3_r0);
+ DECLARE_EXPORT(__ashiftrt_r4_6);
+ DECLARE_EXPORT(__ashiftrt_r4_7);
+ DECLARE_EXPORT(__ashiftrt_r4_8);
+diff --git a/arch/sh/lib/ashlsi3.S b/arch/sh/lib/ashlsi3.S
+index bd47e9b403a5..70a6434945ab 100644
+--- a/arch/sh/lib/ashlsi3.S
++++ b/arch/sh/lib/ashlsi3.S
+@@ -54,21 +54,38 @@ Boston, MA 02110-1301, USA.  */
+ !
+ ! (none)
+ !
++! __ashlsi3_r0
++!
++! Entry:
++!
++! r4: Value to shift
++! r0: Shifts
++!
++! Exit:
++!
++! r0: Result
++!
++! Destroys:
++!
++! (none)
++
++
+ 	.global	__ashlsi3
++	.global	__ashlsi3_r0
+ 	
+ 	.align	2
+ __ashlsi3:
+-	mov	#31,r0
+-	and	r0,r5
++	mov	r5,r0
++	.align	2
++__ashlsi3_r0:
++	and	#31,r0
++	mov.l	r4,@-r15
++	mov	r0,r4
+ 	mova	ashlsi3_table,r0
+-	mov.b	@(r0,r5),r5
+-#ifdef __sh1__
+-	add	r5,r0
++	mov.b	@(r0,r4),r4
++	add	r4,r0
+ 	jmp	@r0
+-#else
+-	braf	r5
+-#endif
+-	mov	r4,r0
++	mov.l	@r15+,r0
+ 
+ 	.align	2
+ ashlsi3_table:
+diff --git a/arch/sh/lib/ashrsi3.S b/arch/sh/lib/ashrsi3.S
+index 6f3cf46b77c2..602599d80209 100644
+--- a/arch/sh/lib/ashrsi3.S
++++ b/arch/sh/lib/ashrsi3.S
+@@ -54,22 +54,37 @@ Boston, MA 02110-1301, USA.  */
+ !
+ ! (none)
+ !
++! __ashrsi3_r0
++!
++! Entry:
++!
++! r4: Value to shift
++! r0: Shifts
++!
++! Exit:
++!
++! r0: Result
++!
++! Destroys:
++!
++! (none)
+ 
+ 	.global	__ashrsi3
++	.global	__ashrsi3_r0
+ 	
+ 	.align	2
+ __ashrsi3:
+-	mov	#31,r0
+-	and	r0,r5
++	mov	r5,r0
++	.align	2
++__ashrsi3_r0:
++	and	#31,r0
++	mov.l	r4,@-r15
++	mov	r0,r4
+ 	mova	ashrsi3_table,r0
+-	mov.b	@(r0,r5),r5
+-#ifdef __sh1__
+-	add	r5,r0
++	mov.b	@(r0,r4),r4
++	add	r4,r0
+ 	jmp	@r0
+-#else
+-	braf	r5
+-#endif
+-	mov	r4,r0
++	mov.l	@r15+,r0
+ 
+ 	.align	2
+ ashrsi3_table:
+diff --git a/arch/sh/lib/lshrsi3.S b/arch/sh/lib/lshrsi3.S
+index 1e7aaa557130..f2a6959f526d 100644
+--- a/arch/sh/lib/lshrsi3.S
++++ b/arch/sh/lib/lshrsi3.S
+@@ -53,22 +53,38 @@ Boston, MA 02110-1301, USA.  */
+ ! Destroys:
+ !
+ ! (none)
++!
++! __lshrsi3_r0
++!
++! Entry:
++!
++! r0: Value to shift
++! r5: Shifts
++!
++! Exit:
++!
++! r0: Result
++!
++! Destroys:
++!
++! (none)
+ !
+ 	.global	__lshrsi3
++	.global	__lshrsi3_r0
+ 	
+ 	.align	2
+ __lshrsi3:
+-	mov	#31,r0
+-	and	r0,r5
++	mov	r5,r0
++	.align	2
++__lshrsi3_r0:
++	and	#31,r0
++	mov.l	r4,@-r15
++	mov	r0,r4
+ 	mova	lshrsi3_table,r0
+-	mov.b	@(r0,r5),r5
+-#ifdef __sh1__
+-	add	r5,r0
++	mov.b	@(r0,r4),r4
++	add	r4,r0
+ 	jmp	@r0
+-#else
+-	braf	r5
+-#endif
+-	mov	r4,r0
++	mov.l	@r15+,r0
+ 
+ 	.align	2
+ lshrsi3_table:
+diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
+index f87a55d77094..9b3f2e212b37 100644
+--- a/arch/sparc/kernel/ds.c
++++ b/arch/sparc/kernel/ds.c
+@@ -908,7 +908,7 @@ static int register_services(struct ds_info *dp)
+ 		pbuf.req.handle = cp->handle;
+ 		pbuf.req.major = 1;
+ 		pbuf.req.minor = 0;
+-		strcpy(pbuf.req.svc_id, cp->service_id);
++		strcpy(pbuf.id_buf, cp->service_id);
+ 
+ 		err = __ds_send(lp, &pbuf, msg_len);
+ 		if (err > 0)
+diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
+index 56410ea75ac5..6682b3eec2b6 100644
+--- a/drivers/dma/sh/usb-dmac.c
++++ b/drivers/dma/sh/usb-dmac.c
+@@ -448,7 +448,7 @@ usb_dmac_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
+ static int usb_dmac_chan_terminate_all(struct dma_chan *chan)
+ {
+ 	struct usb_dmac_chan *uchan = to_usb_dmac_chan(chan);
+-	struct usb_dmac_desc *desc;
++	struct usb_dmac_desc *desc, *_desc;
+ 	unsigned long flags;
+ 	LIST_HEAD(head);
+ 	LIST_HEAD(list);
+@@ -459,7 +459,7 @@ static int usb_dmac_chan_terminate_all(struct dma_chan *chan)
+ 	if (uchan->desc)
+ 		uchan->desc = NULL;
+ 	list_splice_init(&uchan->desc_got, &list);
+-	list_for_each_entry(desc, &list, node)
++	list_for_each_entry_safe(desc, _desc, &list, node)
+ 		list_move_tail(&desc->node, &uchan->desc_freed);
+ 	spin_unlock_irqrestore(&uchan->vc.lock, flags);
+ 	vchan_dma_desc_free_list(&uchan->vc, &head);
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 7f39b8ad88ae..de6710fe3ff4 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -768,6 +768,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
+ 			DMI_EXACT_MATCH(DMI_BOARD_NAME, "D525MW"),
+ 		},
+ 	},
++	{
++		.callback = intel_no_lvds_dmi_callback,
++		.ident = "Radiant P845",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Radiant Systems Inc"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "P845"),
++		},
++	},
+ 
+ 	{ }	/* terminating entry */
+ };
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index d2dff159a471..99434f5be34c 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -26,6 +26,7 @@
+ #include <linux/stm.h>
+ #include <linux/fs.h>
+ #include <linux/mm.h>
++#include <linux/vmalloc.h>
+ #include "stm.h"
+ 
+ #include <uapi/linux/stm.h>
+@@ -602,7 +603,7 @@ static void stm_device_release(struct device *dev)
+ {
+ 	struct stm_device *stm = to_stm_device(dev);
+ 
+-	kfree(stm);
++	vfree(stm);
+ }
+ 
+ int stm_register_device(struct device *parent, struct stm_data *stm_data,
+@@ -619,7 +620,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
+ 		return -EINVAL;
+ 
+ 	nmasters = stm_data->sw_end - stm_data->sw_start;
+-	stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL);
++	stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *));
+ 	if (!stm)
+ 		return -ENOMEM;
+ 
+@@ -656,7 +657,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
+ err_device:
+ 	put_device(&stm->dev);
+ err_free:
+-	kfree(stm);
++	vfree(stm);
+ 
+ 	return err;
+ }
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 599c0d7bd906..6f89484765e3 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -33,7 +33,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+-#include <linux/spinlock.h>
+ 
+ /* register offsets */
+ #define ICSCR	0x00	/* slave ctrl */
+@@ -84,6 +83,7 @@
+ 
+ #define RCAR_BUS_PHASE_START	(MDBS | MIE | ESG)
+ #define RCAR_BUS_PHASE_DATA	(MDBS | MIE)
++#define RCAR_BUS_MASK_DATA	(~(ESG | FSB) & 0xFF)
+ #define RCAR_BUS_PHASE_STOP	(MDBS | MIE | FSB)
+ 
+ #define RCAR_IRQ_SEND	(MNR | MAL | MST | MAT | MDE)
+@@ -94,7 +94,6 @@
+ #define RCAR_IRQ_ACK_RECV	(~(MAT | MDR) & 0xFF)
+ 
+ #define ID_LAST_MSG	(1 << 0)
+-#define ID_IOERROR	(1 << 1)
+ #define ID_DONE		(1 << 2)
+ #define ID_ARBLOST	(1 << 3)
+ #define ID_NACK		(1 << 4)
+@@ -108,10 +107,10 @@ enum rcar_i2c_type {
+ struct rcar_i2c_priv {
+ 	void __iomem *io;
+ 	struct i2c_adapter adap;
+-	struct i2c_msg	*msg;
++	struct i2c_msg *msg;
++	int msgs_left;
+ 	struct clk *clk;
+ 
+-	spinlock_t lock;
+ 	wait_queue_head_t wait;
+ 
+ 	int pos;
+@@ -144,9 +143,10 @@ static void rcar_i2c_init(struct rcar_i2c_priv *priv)
+ {
+ 	/* reset master mode */
+ 	rcar_i2c_write(priv, ICMIER, 0);
+-	rcar_i2c_write(priv, ICMCR, 0);
++	rcar_i2c_write(priv, ICMCR, MDBS);
+ 	rcar_i2c_write(priv, ICMSR, 0);
+-	rcar_i2c_write(priv, ICMAR, 0);
++	/* start clock */
++	rcar_i2c_write(priv, ICCCR, priv->icccr);
+ }
+ 
+ static int rcar_i2c_bus_barrier(struct rcar_i2c_priv *priv)
+@@ -257,16 +257,28 @@ static void rcar_i2c_prepare_msg(struct rcar_i2c_priv *priv)
+ {
+ 	int read = !!rcar_i2c_is_recv(priv);
+ 
++	priv->pos = 0;
++	priv->flags = 0;
++	if (priv->msgs_left == 1)
++		rcar_i2c_flags_set(priv, ID_LAST_MSG);
++
+ 	rcar_i2c_write(priv, ICMAR, (priv->msg->addr << 1) | read);
+ 	rcar_i2c_write(priv, ICMSR, 0);
+ 	rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_START);
+ 	rcar_i2c_write(priv, ICMIER, read ? RCAR_IRQ_RECV : RCAR_IRQ_SEND);
+ }
+ 
++static void rcar_i2c_next_msg(struct rcar_i2c_priv *priv)
++{
++	priv->msg++;
++	priv->msgs_left--;
++	rcar_i2c_prepare_msg(priv);
++}
++
+ /*
+  *		interrupt functions
+  */
+-static int rcar_i2c_irq_send(struct rcar_i2c_priv *priv, u32 msr)
++static void rcar_i2c_irq_send(struct rcar_i2c_priv *priv, u32 msr)
+ {
+ 	struct i2c_msg *msg = priv->msg;
+ 
+@@ -276,14 +288,7 @@ static int rcar_i2c_irq_send(struct rcar_i2c_priv *priv, u32 msr)
+ 	 * Do nothing
+ 	 */
+ 	if (!(msr & MDE))
+-		return 0;
+-
+-	/*
+-	 * If address transfer phase finished,
+-	 * goto data phase.
+-	 */
+-	if (msr & MAT)
+-		rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA);
++		return;
+ 
+ 	if (priv->pos < msg->len) {
+ 		/*
+@@ -305,29 +310,23 @@ static int rcar_i2c_irq_send(struct rcar_i2c_priv *priv, u32 msr)
+ 		 * [ICRXTX] -> [SHIFT] -> [I2C bus]
+ 		 */
+ 
+-		if (priv->flags & ID_LAST_MSG)
++		if (priv->flags & ID_LAST_MSG) {
+ 			/*
+ 			 * If current msg is the _LAST_ msg,
+ 			 * prepare stop condition here.
+ 			 * ID_DONE will be set on STOP irq.
+ 			 */
+ 			rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_STOP);
+-		else
+-			/*
+-			 * If current msg is _NOT_ last msg,
+-			 * it doesn't call stop phase.
+-			 * thus, there is no STOP irq.
+-			 * return ID_DONE here.
+-			 */
+-			return ID_DONE;
++		} else {
++			rcar_i2c_next_msg(priv);
++			return;
++		}
+ 	}
+ 
+ 	rcar_i2c_write(priv, ICMSR, RCAR_IRQ_ACK_SEND);
+-
+-	return 0;
+ }
+ 
+-static int rcar_i2c_irq_recv(struct rcar_i2c_priv *priv, u32 msr)
++static void rcar_i2c_irq_recv(struct rcar_i2c_priv *priv, u32 msr)
+ {
+ 	struct i2c_msg *msg = priv->msg;
+ 
+@@ -337,14 +336,10 @@ static int rcar_i2c_irq_recv(struct rcar_i2c_priv *priv, u32 msr)
+ 	 * Do nothing
+ 	 */
+ 	if (!(msr & MDR))
+-		return 0;
++		return;
+ 
+ 	if (msr & MAT) {
+-		/*
+-		 * Address transfer phase finished,
+-		 * but, there is no data at this point.
+-		 * Do nothing.
+-		 */
++		/* Address transfer phase finished, but no data at this point. */
+ 	} else if (priv->pos < msg->len) {
+ 		/*
+ 		 * get received data
+@@ -360,12 +355,11 @@ static int rcar_i2c_irq_recv(struct rcar_i2c_priv *priv, u32 msr)
+ 	 */
+ 	if (priv->pos + 1 >= msg->len)
+ 		rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_STOP);
+-	else
+-		rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_DATA);
+ 
+-	rcar_i2c_write(priv, ICMSR, RCAR_IRQ_ACK_RECV);
+-
+-	return 0;
++	if (priv->pos == msg->len && !(priv->flags & ID_LAST_MSG))
++		rcar_i2c_next_msg(priv);
++	else
++		rcar_i2c_write(priv, ICMSR, RCAR_IRQ_ACK_RECV);
+ }
+ 
+ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+@@ -426,22 +420,21 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
+ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
+ {
+ 	struct rcar_i2c_priv *priv = ptr;
+-	irqreturn_t result = IRQ_HANDLED;
+-	u32 msr;
+-
+-	/*-------------- spin lock -----------------*/
+-	spin_lock(&priv->lock);
++	u32 msr, val;
+ 
+-	if (rcar_i2c_slave_irq(priv))
+-		goto exit;
++	/* Clear START or STOP as soon as we can */
++	val = rcar_i2c_read(priv, ICMCR);
++	rcar_i2c_write(priv, ICMCR, val & RCAR_BUS_MASK_DATA);
+ 
+ 	msr = rcar_i2c_read(priv, ICMSR);
+ 
+ 	/* Only handle interrupts that are currently enabled */
+ 	msr &= rcar_i2c_read(priv, ICMIER);
+ 	if (!msr) {
+-		result = IRQ_NONE;
+-		goto exit;
++		if (rcar_i2c_slave_irq(priv))
++			return IRQ_HANDLED;
++
++		return IRQ_NONE;
+ 	}
+ 
+ 	/* Arbitration lost */
+@@ -452,8 +445,7 @@ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
+ 
+ 	/* Nack */
+ 	if (msr & MNR) {
+-		/* go to stop phase */
+-		rcar_i2c_write(priv, ICMCR, RCAR_BUS_PHASE_STOP);
++		/* HW automatically sends STOP after received NACK */
+ 		rcar_i2c_write(priv, ICMIER, RCAR_IRQ_STOP);
+ 		rcar_i2c_flags_set(priv, ID_NACK);
+ 		goto out;
+@@ -461,14 +453,15 @@ static irqreturn_t rcar_i2c_irq(int irq, void *ptr)
+ 
+ 	/* Stop */
+ 	if (msr & MST) {
++		priv->msgs_left--; /* The last message also made it */
+ 		rcar_i2c_flags_set(priv, ID_DONE);
+ 		goto out;
+ 	}
+ 
+ 	if (rcar_i2c_is_recv(priv))
+-		rcar_i2c_flags_set(priv, rcar_i2c_irq_recv(priv, msr));
++		rcar_i2c_irq_recv(priv, msr);
+ 	else
+-		rcar_i2c_flags_set(priv, rcar_i2c_irq_send(priv, msr));
++		rcar_i2c_irq_send(priv, msr);
+ 
+ out:
+ 	if (rcar_i2c_flags_has(priv, ID_DONE)) {
+@@ -477,11 +470,7 @@ out:
+ 		wake_up(&priv->wait);
+ 	}
+ 
+-exit:
+-	spin_unlock(&priv->lock);
+-	/*-------------- spin unlock -----------------*/
+-
+-	return result;
++	return IRQ_HANDLED;
+ }
+ 
+ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+@@ -490,22 +479,11 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+ {
+ 	struct rcar_i2c_priv *priv = i2c_get_adapdata(adap);
+ 	struct device *dev = rcar_i2c_priv_to_dev(priv);
+-	unsigned long flags;
+ 	int i, ret;
+-	long timeout;
++	long time_left;
+ 
+ 	pm_runtime_get_sync(dev);
+ 
+-	/*-------------- spin lock -----------------*/
+-	spin_lock_irqsave(&priv->lock, flags);
+-
+-	rcar_i2c_init(priv);
+-	/* start clock */
+-	rcar_i2c_write(priv, ICCCR, priv->icccr);
+-
+-	spin_unlock_irqrestore(&priv->lock, flags);
+-	/*-------------- spin unlock -----------------*/
+-
+ 	ret = rcar_i2c_bus_barrier(priv);
+ 	if (ret < 0)
+ 		goto out;
+@@ -514,48 +492,28 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+ 		/* This HW can't send STOP after address phase */
+ 		if (msgs[i].len == 0) {
+ 			ret = -EOPNOTSUPP;
+-			break;
+-		}
+-
+-		/*-------------- spin lock -----------------*/
+-		spin_lock_irqsave(&priv->lock, flags);
+-
+-		/* init each data */
+-		priv->msg	= &msgs[i];
+-		priv->pos	= 0;
+-		priv->flags	= 0;
+-		if (i == num - 1)
+-			rcar_i2c_flags_set(priv, ID_LAST_MSG);
+-
+-		rcar_i2c_prepare_msg(priv);
+-
+-		spin_unlock_irqrestore(&priv->lock, flags);
+-		/*-------------- spin unlock -----------------*/
+-
+-		timeout = wait_event_timeout(priv->wait,
+-					     rcar_i2c_flags_has(priv, ID_DONE),
+-					     adap->timeout);
+-		if (!timeout) {
+-			ret = -ETIMEDOUT;
+-			break;
+-		}
+-
+-		if (rcar_i2c_flags_has(priv, ID_NACK)) {
+-			ret = -ENXIO;
+-			break;
+-		}
+-
+-		if (rcar_i2c_flags_has(priv, ID_ARBLOST)) {
+-			ret = -EAGAIN;
+-			break;
+-		}
+-
+-		if (rcar_i2c_flags_has(priv, ID_IOERROR)) {
+-			ret = -EIO;
+-			break;
++			goto out;
+ 		}
++	}
+ 
+-		ret = i + 1; /* The number of transfer */
++	/* init data */
++	priv->msg = msgs;
++	priv->msgs_left = num;
++
++	rcar_i2c_prepare_msg(priv);
++
++	time_left = wait_event_timeout(priv->wait,
++				     rcar_i2c_flags_has(priv, ID_DONE),
++				     num * adap->timeout);
++	if (!time_left) {
++		rcar_i2c_init(priv);
++		ret = -ETIMEDOUT;
++	} else if (rcar_i2c_flags_has(priv, ID_NACK)) {
++		ret = -ENXIO;
++	} else if (rcar_i2c_flags_has(priv, ID_ARBLOST)) {
++		ret = -EAGAIN;
++	} else {
++		ret = num - priv->msgs_left; /* The number of transfer */
+ 	}
+ out:
+ 	pm_runtime_put(dev);
+@@ -650,23 +608,27 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ 		return PTR_ERR(priv->clk);
+ 	}
+ 
++	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++	priv->io = devm_ioremap_resource(dev, res);
++	if (IS_ERR(priv->io))
++		return PTR_ERR(priv->io);
++
+ 	bus_speed = 100000; /* default 100 kHz */
+ 	of_property_read_u32(dev->of_node, "clock-frequency", &bus_speed);
+ 
+ 	priv->devtype = (enum rcar_i2c_type)of_match_device(rcar_i2c_dt_ids, dev)->data;
+ 
++	pm_runtime_enable(dev);
++	pm_runtime_get_sync(dev);
+ 	ret = rcar_i2c_clock_calculate(priv, bus_speed, dev);
+ 	if (ret < 0)
+-		return ret;
++		goto out_pm_put;
+ 
+-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+-	priv->io = devm_ioremap_resource(dev, res);
+-	if (IS_ERR(priv->io))
+-		return PTR_ERR(priv->io);
++	rcar_i2c_init(priv);
++	pm_runtime_put(dev);
+ 
+ 	irq = platform_get_irq(pdev, 0);
+ 	init_waitqueue_head(&priv->wait);
+-	spin_lock_init(&priv->lock);
+ 
+ 	adap = &priv->adap;
+ 	adap->nr = pdev->id;
+@@ -682,22 +644,26 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ 			       dev_name(dev), priv);
+ 	if (ret < 0) {
+ 		dev_err(dev, "cannot get irq %d\n", irq);
+-		return ret;
++		goto out_pm_disable;
+ 	}
+ 
+-	pm_runtime_enable(dev);
+ 	platform_set_drvdata(pdev, priv);
+ 
+ 	ret = i2c_add_numbered_adapter(adap);
+ 	if (ret < 0) {
+ 		dev_err(dev, "reg adap failed: %d\n", ret);
+-		pm_runtime_disable(dev);
+-		return ret;
++		goto out_pm_disable;
+ 	}
+ 
+ 	dev_info(dev, "probed\n");
+ 
+ 	return 0;
++
++ out_pm_put:
++	pm_runtime_put(dev);
++ out_pm_disable:
++	pm_runtime_disable(dev);
++	return ret;
+ }
+ 
+ static int rcar_i2c_remove(struct platform_device *pdev)
+diff --git a/drivers/iio/buffer/kfifo_buf.c b/drivers/iio/buffer/kfifo_buf.c
+index c5b999f0c519..7ef9b13262a8 100644
+--- a/drivers/iio/buffer/kfifo_buf.c
++++ b/drivers/iio/buffer/kfifo_buf.c
+@@ -24,6 +24,13 @@ static inline int __iio_allocate_kfifo(struct iio_kfifo *buf,
+ 	if ((length == 0) || (bytes_per_datum == 0))
+ 		return -EINVAL;
+ 
++	/*
++	 * Make sure we don't overflow an unsigned int after kfifo rounds up to
++	 * the next power of 2.
++	 */
++	if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum)
++		return -EINVAL;
++
+ 	return __kfifo_alloc((struct __kfifo *)&buf->kf, length,
+ 			     bytes_per_datum, GFP_KERNEL);
+ }
+diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c
+index cb6aecbc1dc2..25dba1d7aa57 100644
+--- a/drivers/input/mouse/elan_i2c_smbus.c
++++ b/drivers/input/mouse/elan_i2c_smbus.c
+@@ -130,7 +130,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client,
+ 					bool max_baseline, u8 *value)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  max_baseline ?
+@@ -149,7 +149,7 @@ static int elan_smbus_get_version(struct i2c_client *client,
+ 				  bool iap, u8 *version)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  iap ? ETP_SMBUS_IAP_VERSION_CMD :
+@@ -169,7 +169,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
+ 				     u8 *ic_type, u8 *version)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  ETP_SMBUS_SM_VERSION_CMD, val);
+@@ -186,7 +186,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client,
+ static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  ETP_SMBUS_UNIQUEID_CMD, val);
+@@ -203,7 +203,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client,
+ 				   bool iap, u16 *csum)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  iap ? ETP_SMBUS_FW_CHECKSUM_CMD :
+@@ -223,7 +223,7 @@ static int elan_smbus_get_max(struct i2c_client *client,
+ 			      unsigned int *max_x, unsigned int *max_y)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val);
+ 	if (error) {
+@@ -241,7 +241,7 @@ static int elan_smbus_get_resolution(struct i2c_client *client,
+ 				     u8 *hw_res_x, u8 *hw_res_y)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  ETP_SMBUS_RESOLUTION_CMD, val);
+@@ -261,7 +261,7 @@ static int elan_smbus_get_num_traces(struct i2c_client *client,
+ 				     unsigned int *y_traces)
+ {
+ 	int error;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client,
+ 					  ETP_SMBUS_XY_TRACENUM_CMD, val);
+@@ -288,7 +288,7 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client,
+ {
+ 	int error;
+ 	u16 constant;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val);
+ 	if (error < 0) {
+@@ -339,7 +339,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client)
+ 	int len;
+ 	int error;
+ 	enum tp_mode mode;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 	u8 cmd[4] = {0x0F, 0x78, 0x00, 0x06};
+ 	u16 password;
+ 
+@@ -413,7 +413,7 @@ static int elan_smbus_write_fw_block(struct i2c_client *client,
+ 	struct device *dev = &client->dev;
+ 	int error;
+ 	u16 result;
+-	u8 val[3];
++	u8 val[I2C_SMBUS_BLOCK_MAX] = {0};
+ 
+ 	/*
+ 	 * Due to the limitation of smbus protocol limiting
+diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
+index 4e3d2e7c697c..e8c3a8c32534 100644
+--- a/drivers/net/irda/w83977af_ir.c
++++ b/drivers/net/irda/w83977af_ir.c
+@@ -518,7 +518,9 @@ static netdev_tx_t w83977af_hard_xmit(struct sk_buff *skb,
+ 		
+ 		mtt = irda_get_mtt(skb);
+ 		pr_debug("%s(%ld), mtt=%d\n", __func__ , jiffies, mtt);
+-			if (mtt)
++			if (mtt > 1000)
++				mdelay(mtt/1000);
++			else if (mtt)
+ 				udelay(mtt);
+ 
+ 			/* Enable DMA interrupt */
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c
+index 5624ade92cc0..c2a156a8acec 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c
+@@ -304,9 +304,6 @@ static void _rtl92c_get_txpower_writeval_by_regulatory(struct ieee80211_hw *hw,
+ 			writeVal = 0x00000000;
+ 		if (rtlpriv->dm.dynamic_txhighpower_lvl == TXHIGHPWRLEVEL_BT1)
+ 			writeVal = writeVal - 0x06060606;
+-		else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+-			 TXHIGHPWRLEVEL_BT2)
+-			writeVal = writeVal;
+ 		*(p_outwriteval + rf) = writeVal;
+ 	}
+ }
+diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
+index e3cd3ece4412..c3d1891d2d3f 100644
+--- a/drivers/scsi/scsi_transport_srp.c
++++ b/drivers/scsi/scsi_transport_srp.c
+@@ -52,6 +52,8 @@ struct srp_internal {
+ 	struct transport_container rport_attr_cont;
+ };
+ 
++static int scsi_is_srp_rport(const struct device *dev);
++
+ #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t)
+ 
+ #define	dev_to_rport(d)	container_of(d, struct srp_rport, dev)
+@@ -61,9 +63,24 @@ static inline struct Scsi_Host *rport_to_shost(struct srp_rport *r)
+ 	return dev_to_shost(r->dev.parent);
+ }
+ 
++static int find_child_rport(struct device *dev, void *data)
++{
++	struct device **child = data;
++
++	if (scsi_is_srp_rport(dev)) {
++		WARN_ON_ONCE(*child);
++		*child = dev;
++	}
++	return 0;
++}
++
+ static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost)
+ {
+-	return transport_class_to_srp_rport(&shost->shost_gendev);
++	struct device *child = NULL;
++
++	WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child,
++					   find_child_rport) < 0);
++	return child ? dev_to_rport(child) : NULL;
+ }
+ 
+ /**
+@@ -637,7 +654,8 @@ static enum blk_eh_timer_return srp_timed_out(struct scsi_cmnd *scmd)
+ 	struct srp_rport *rport = shost_to_rport(shost);
+ 
+ 	pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev));
+-	return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 &&
++	return rport && rport->fast_io_fail_tmo < 0 &&
++		rport->dev_loss_tmo < 0 &&
+ 		i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ?
+ 		BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED;
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 32cadca198b2..e7a051386b32 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -33,7 +33,7 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *);
+ static void cp210x_close(struct usb_serial_port *);
+ static void cp210x_get_termios(struct tty_struct *, struct usb_serial_port *);
+ static void cp210x_get_termios_port(struct usb_serial_port *port,
+-	unsigned int *cflagp, unsigned int *baudp);
++	tcflag_t *cflagp, unsigned int *baudp);
+ static void cp210x_change_speed(struct tty_struct *, struct usb_serial_port *,
+ 							struct ktermios *);
+ static void cp210x_set_termios(struct tty_struct *, struct usb_serial_port *,
+@@ -515,7 +515,7 @@ static void cp210x_get_termios(struct tty_struct *tty,
+ 			&tty->termios.c_cflag, &baud);
+ 		tty_encode_baud_rate(tty, baud, baud);
+ 	} else {
+-		unsigned int cflag;
++		tcflag_t cflag;
+ 		cflag = 0;
+ 		cp210x_get_termios_port(port, &cflag, &baud);
+ 	}
+@@ -526,10 +526,11 @@ static void cp210x_get_termios(struct tty_struct *tty,
+  * This is the heart of cp210x_get_termios which always uses a &usb_serial_port.
+  */
+ static void cp210x_get_termios_port(struct usb_serial_port *port,
+-	unsigned int *cflagp, unsigned int *baudp)
++	tcflag_t *cflagp, unsigned int *baudp)
+ {
+ 	struct device *dev = &port->dev;
+-	unsigned int cflag, modem_ctl[4];
++	tcflag_t cflag;
++	unsigned int modem_ctl[4];
+ 	unsigned int baud;
+ 	unsigned int bits;
+ 
+diff --git a/fs/aio.c b/fs/aio.c
+index 4efaf29354a6..c283eb03cb38 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -628,9 +628,8 @@ static void free_ioctx_users(struct percpu_ref *ref)
+ 	while (!list_empty(&ctx->active_reqs)) {
+ 		req = list_first_entry(&ctx->active_reqs,
+ 				       struct aio_kiocb, ki_list);
+-
+-		list_del_init(&req->ki_list);
+ 		kiocb_cancel(req);
++		list_del_init(&req->ki_list);
+ 	}
+ 
+ 	spin_unlock_irq(&ctx->ctx_lock);
+diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
+index e1e7fe3b5424..b663b756f552 100644
+--- a/fs/xfs/libxfs/xfs_alloc.c
++++ b/fs/xfs/libxfs/xfs_alloc.c
+@@ -1923,6 +1923,93 @@ xfs_alloc_space_available(
+ 	return true;
+ }
+ 
++/*
++ * Check the agfl fields of the agf for inconsistency or corruption. The purpose
++ * is to detect an agfl header padding mismatch between current and early v5
++ * kernels. This problem manifests as a 1-slot size difference between the
++ * on-disk flcount and the active [first, last] range of a wrapped agfl. This
++ * may also catch variants of agfl count corruption unrelated to padding. Either
++ * way, we'll reset the agfl and warn the user.
++ *
++ * Return true if a reset is required before the agfl can be used, false
++ * otherwise.
++ */
++static bool
++xfs_agfl_needs_reset(
++	struct xfs_mount	*mp,
++	struct xfs_agf		*agf)
++{
++	uint32_t		f = be32_to_cpu(agf->agf_flfirst);
++	uint32_t		l = be32_to_cpu(agf->agf_fllast);
++	uint32_t		c = be32_to_cpu(agf->agf_flcount);
++	int			agfl_size = XFS_AGFL_SIZE(mp);
++	int			active;
++
++	/* no agfl header on v4 supers */
++	if (!xfs_sb_version_hascrc(&mp->m_sb))
++		return false;
++
++	/*
++	 * The agf read verifier catches severe corruption of these fields.
++	 * Repeat some sanity checks to cover a packed -> unpacked mismatch if
++	 * the verifier allows it.
++	 */
++	if (f >= agfl_size || l >= agfl_size)
++		return true;
++	if (c > agfl_size)
++		return true;
++
++	/*
++	 * Check consistency between the on-disk count and the active range. An
++	 * agfl padding mismatch manifests as an inconsistent flcount.
++	 */
++	if (c && l >= f)
++		active = l - f + 1;
++	else if (c)
++		active = agfl_size - f + l + 1;
++	else
++		active = 0;
++
++	return active != c;
++}
++
++/*
++ * Reset the agfl to an empty state. Ignore/drop any existing blocks since the
++ * agfl content cannot be trusted. Warn the user that a repair is required to
++ * recover leaked blocks.
++ *
++ * The purpose of this mechanism is to handle filesystems affected by the agfl
++ * header padding mismatch problem. A reset keeps the filesystem online with a
++ * relatively minor free space accounting inconsistency rather than suffer the
++ * inevitable crash from use of an invalid agfl block.
++ */
++static void
++xfs_agfl_reset(
++	struct xfs_trans	*tp,
++	struct xfs_buf		*agbp,
++	struct xfs_perag	*pag)
++{
++	struct xfs_mount	*mp = tp->t_mountp;
++	struct xfs_agf		*agf = XFS_BUF_TO_AGF(agbp);
++
++	ASSERT(pag->pagf_agflreset);
++	trace_xfs_agfl_reset(mp, agf, 0, _RET_IP_);
++
++	xfs_warn(mp,
++	       "WARNING: Reset corrupted AGFL on AG %u. %d blocks leaked. "
++	       "Please unmount and run xfs_repair.",
++	         pag->pag_agno, pag->pagf_flcount);
++
++	agf->agf_flfirst = 0;
++	agf->agf_fllast = cpu_to_be32(XFS_AGFL_SIZE(mp) - 1);
++	agf->agf_flcount = 0;
++	xfs_alloc_log_agf(tp, agbp, XFS_AGF_FLFIRST | XFS_AGF_FLLAST |
++				    XFS_AGF_FLCOUNT);
++
++	pag->pagf_flcount = 0;
++	pag->pagf_agflreset = false;
++}
++
+ /*
+  * Decide whether to use this allocation group for this allocation.
+  * If so, fix up the btree freelist's size.
+@@ -1983,6 +2070,10 @@ xfs_alloc_fix_freelist(
+ 		}
+ 	}
+ 
++	/* reset a padding mismatched agfl before final free space check */
++	if (pag->pagf_agflreset)
++		xfs_agfl_reset(tp, agbp, pag);
++
+ 	/* If there isn't enough total space or single-extent, reject it. */
+ 	need = xfs_alloc_min_freelist(mp, pag);
+ 	if (!xfs_alloc_space_available(args, need, flags))
+@@ -2121,6 +2212,7 @@ xfs_alloc_get_freelist(
+ 		agf->agf_flfirst = 0;
+ 
+ 	pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno));
++	ASSERT(!pag->pagf_agflreset);
+ 	be32_add_cpu(&agf->agf_flcount, -1);
+ 	xfs_trans_agflist_delta(tp, -1);
+ 	pag->pagf_flcount--;
+@@ -2226,6 +2318,7 @@ xfs_alloc_put_freelist(
+ 		agf->agf_fllast = 0;
+ 
+ 	pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno));
++	ASSERT(!pag->pagf_agflreset);
+ 	be32_add_cpu(&agf->agf_flcount, 1);
+ 	xfs_trans_agflist_delta(tp, 1);
+ 	pag->pagf_flcount++;
+@@ -2417,6 +2510,7 @@ xfs_alloc_read_agf(
+ 		pag->pagb_count = 0;
+ 		pag->pagb_tree = RB_ROOT;
+ 		pag->pagf_init = 1;
++		pag->pagf_agflreset = xfs_agfl_needs_reset(mp, agf);
+ 	}
+ #ifdef DEBUG
+ 	else if (!XFS_FORCED_SHUTDOWN(mp)) {
+diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
+index b57098481c10..ae3e52749f20 100644
+--- a/fs/xfs/xfs_mount.h
++++ b/fs/xfs/xfs_mount.h
+@@ -278,6 +278,7 @@ typedef struct xfs_perag {
+ 	char		pagi_inodeok;	/* The agi is ok for inodes */
+ 	__uint8_t	pagf_levels[XFS_BTNUM_AGF];
+ 					/* # of levels in bno & cnt btree */
++	bool		pagf_agflreset; /* agfl requires reset before use */
+ 	__uint32_t	pagf_flcount;	/* count of blocks in freelist */
+ 	xfs_extlen_t	pagf_freeblks;	/* total free blocks */
+ 	xfs_extlen_t	pagf_longest;	/* longest free space */
+diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
+index 877079eb0f8f..cc6fa64821d2 100644
+--- a/fs/xfs/xfs_trace.h
++++ b/fs/xfs/xfs_trace.h
+@@ -1485,7 +1485,7 @@ TRACE_EVENT(xfs_trans_commit_lsn,
+ 		  __entry->lsn)
+ );
+ 
+-TRACE_EVENT(xfs_agf,
++DECLARE_EVENT_CLASS(xfs_agf_class,
+ 	TP_PROTO(struct xfs_mount *mp, struct xfs_agf *agf, int flags,
+ 		 unsigned long caller_ip),
+ 	TP_ARGS(mp, agf, flags, caller_ip),
+@@ -1541,6 +1541,13 @@ TRACE_EVENT(xfs_agf,
+ 		  __entry->longest,
+ 		  (void *)__entry->caller_ip)
+ );
++#define DEFINE_AGF_EVENT(name) \
++DEFINE_EVENT(xfs_agf_class, name, \
++	TP_PROTO(struct xfs_mount *mp, struct xfs_agf *agf, int flags, \
++		 unsigned long caller_ip), \
++	TP_ARGS(mp, agf, flags, caller_ip))
++DEFINE_AGF_EVENT(xfs_agf);
++DEFINE_AGF_EVENT(xfs_agfl_reset);
+ 
+ TRACE_EVENT(xfs_free_extent,
+ 	TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, xfs_agblock_t agbno,
+diff --git a/include/linux/tcp.h b/include/linux/tcp.h
+index 2260f92f1492..5b6df1a8dc74 100644
+--- a/include/linux/tcp.h
++++ b/include/linux/tcp.h
+@@ -324,7 +324,7 @@ struct tcp_sock {
+ 
+ /* Receiver queue space */
+ 	struct {
+-		int	space;
++		u32	space;
+ 		u32	seq;
+ 		u32	time;
+ 	} rcvq_space;
+diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
+index f4227173b5d8..d3aea4f10faf 100644
+--- a/include/uapi/linux/nl80211.h
++++ b/include/uapi/linux/nl80211.h
+@@ -2195,7 +2195,7 @@ enum nl80211_attrs {
+ #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS
+ #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS
+ 
+-#define NL80211_WIPHY_NAME_MAXLEN		128
++#define NL80211_WIPHY_NAME_MAXLEN		64
+ 
+ #define NL80211_MAX_SUPP_RATES			32
+ #define NL80211_MAX_SUPP_HT_RATES		77
+diff --git a/init/Kconfig b/init/Kconfig
+index ef2f97dc6010..47b0bdcf33c2 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1308,6 +1308,17 @@ source "usr/Kconfig"
+ 
+ endif
+ 
++choice
++	prompt "Compiler optimization level"
++	default CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
++
++config CC_OPTIMIZE_FOR_PERFORMANCE
++	bool "Optimize for performance"
++	help
++	  This is the default optimization level for the kernel, building
++	  with the "-O2" compiler flag for best performance and most
++	  helpful compile-time warnings.
++
+ config CC_OPTIMIZE_FOR_SIZE
+ 	bool "Optimize for size"
+ 	help
+@@ -1316,6 +1327,8 @@ config CC_OPTIMIZE_FOR_SIZE
+ 
+ 	  If unsure, say N.
+ 
++endchoice
++
+ config SYSCTL
+ 	bool
+ 
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 42a4009fd75a..2172dd61577e 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -469,9 +469,10 @@ clear_event_triggers(struct trace_array *tr)
+ 	struct trace_event_file *file;
+ 
+ 	list_for_each_entry(file, &tr->events, list) {
+-		struct event_trigger_data *data;
+-		list_for_each_entry_rcu(data, &file->triggers, list) {
++		struct event_trigger_data *data, *n;
++		list_for_each_entry_safe(data, n, &file->triggers, list) {
+ 			trace_event_trigger_enable_disable(file, 0);
++			list_del_rcu(&data->list);
+ 			if (data->ops->free)
+ 				data->ops->free(data->ops, data);
+ 		}
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index b58ca729f20a..76853088f66b 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -1331,7 +1331,7 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode)
+ 				return ret;
+ 
+ 			mapping = page_mapping(page);
+-			migrate_dirty = mapping && mapping->a_ops->migratepage;
++			migrate_dirty = !mapping || mapping->a_ops->migratepage;
+ 			unlock_page(page);
+ 			if (!migrate_dirty)
+ 				return ret;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ed018760502e..23b95aead897 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -557,8 +557,8 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk,
+ void tcp_rcv_space_adjust(struct sock *sk)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
++	u32 copied;
+ 	int time;
+-	int copied;
+ 
+ 	time = tcp_time_stamp - tp->rcvq_space.time;
+ 	if (time < (tp->rcv_rtt_est.rtt >> 3) || tp->rcv_rtt_est.rtt == 0)
+@@ -580,12 +580,13 @@ void tcp_rcv_space_adjust(struct sock *sk)
+ 
+ 	if (sysctl_tcp_moderate_rcvbuf &&
+ 	    !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
+-		int rcvwin, rcvmem, rcvbuf;
++		int rcvmem, rcvbuf;
++		u64 rcvwin;
+ 
+ 		/* minimal window to cope with packet losses, assuming
+ 		 * steady state. Add some cushion because of small variations.
+ 		 */
+-		rcvwin = (copied << 1) + 16 * tp->advmss;
++		rcvwin = ((u64)copied << 1) + 16 * tp->advmss;
+ 
+ 		/* If rate increased by 25%,
+ 		 *	assume slow start, rcvwin = 3 * copied
+@@ -605,7 +606,8 @@ void tcp_rcv_space_adjust(struct sock *sk)
+ 		while (tcp_win_from_space(rcvmem) < tp->advmss)
+ 			rcvmem += 128;
+ 
+-		rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]);
++		do_div(rcvwin, tp->advmss);
++		rcvbuf = min_t(u64, rcvwin * rcvmem, sysctl_tcp_rmem[2]);
+ 		if (rcvbuf > sk->sk_rcvbuf) {
+ 			sk->sk_rcvbuf = rcvbuf;
+ 
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index 8da7c91b725d..c36b98b07d6b 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -383,14 +383,10 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+ 	result = ima_protect_xattr(dentry, xattr_name, xattr_value,
+ 				   xattr_value_len);
+ 	if (result == 1) {
+-		bool digsig;
+-
+ 		if (!xattr_value_len || (xvalue->type >= IMA_XATTR_LAST))
+ 			return -EINVAL;
+-		digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG);
+-		if (!digsig && (ima_appraise & IMA_APPRAISE_ENFORCE))
+-			return -EPERM;
+-		ima_reset_appraise_flags(d_backing_inode(dentry), digsig);
++		ima_reset_appraise_flags(d_backing_inode(dentry),
++			 (xvalue->type == EVM_IMA_XATTR_DIGSIG) ? 1 : 0);
+ 		result = 0;
+ 	}
+ 	return result;
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 23dca68ffe25..0a258c0602d1 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -1441,7 +1441,7 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
+ 				      scontext_len, &context, def_sid);
+ 	if (rc == -EINVAL && force) {
+ 		context.str = str;
+-		context.len = scontext_len;
++		context.len = strlen(str) + 1;
+ 		str = NULL;
+ 	} else if (rc)
+ 		goto out_unlock;
+diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c
+index 1636a1eeb002..be1b69c63bdf 100644
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -260,7 +260,6 @@ int sst_dma_new(struct sst_dsp *sst)
+ 	struct sst_pdata *sst_pdata = sst->pdata;
+ 	struct sst_dma *dma;
+ 	struct resource mem;
+-	const char *dma_dev_name;
+ 	int ret = 0;
+ 
+ 	if (sst->pdata->resindex_dma_base == -1)
+@@ -271,7 +270,6 @@ int sst_dma_new(struct sst_dsp *sst)
+ 	* is attached to the ADSP IP. */
+ 	switch (sst->pdata->dma_engine) {
+ 	case SST_DMA_TYPE_DW:
+-		dma_dev_name = "dw_dmac";
+ 		break;
+ 	default:
+ 		dev_err(sst->dev, "error: invalid DMA engine %d\n",