From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 68A73138334 for ; Sun, 9 Sep 2018 11:25:29 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 582D8E08F0; Sun, 9 Sep 2018 11:25:27 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 008D8E08F0 for ; Sun, 9 Sep 2018 11:25:26 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 5DADC340D3C for ; Sun, 9 Sep 2018 11:25:24 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 3459F3B1 for ; Sun, 9 Sep 2018 11:25:21 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1536492312.9a044a4deae2ea2a876cb6bea5415a1efac72a9e.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1006_linux-4.18.7.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 9a044a4deae2ea2a876cb6bea5415a1efac72a9e X-VCS-Branch: 4.18 Date: Sun, 9 Sep 2018 11:25:21 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: c47800c2-1f04-4bfa-9ffb-0816f551acff X-Archives-Hash: 312535dde8da51d55f497f81f445770a commit: 9a044a4deae2ea2a876cb6bea5415a1efac72a9e Author: Mike Pagano gentoo org> AuthorDate: Sun Sep 9 11:25:12 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun Sep 9 11:25:12 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=9a044a4d Linux patch 4.18.7 0000_README | 4 + 1006_linux-4.18.7.patch | 5658 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 5662 insertions(+) diff --git a/0000_README b/0000_README index 8bfc2e4..f3682ca 100644 --- a/0000_README +++ b/0000_README @@ -67,6 +67,10 @@ Patch: 1005_linux-4.18.6.patch From: http://www.kernel.org Desc: Linux 4.18.6 +Patch: 1006_linux-4.18.7.patch +From: http://www.kernel.org +Desc: Linux 4.18.7 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1006_linux-4.18.7.patch b/1006_linux-4.18.7.patch new file mode 100644 index 0000000..7ab3155 --- /dev/null +++ b/1006_linux-4.18.7.patch @@ -0,0 +1,5658 @@ +diff --git a/Makefile b/Makefile +index 62524f4d42ad..711b04d00e49 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 18 +-SUBLEVEL = 6 ++SUBLEVEL = 7 + EXTRAVERSION = + NAME = Merciless Moray + +diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c +index c210a25dd6da..cff52d8ffdb1 100644 +--- a/arch/alpha/kernel/osf_sys.c ++++ b/arch/alpha/kernel/osf_sys.c +@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path, + SYSCALL_DEFINE1(osf_utsname, char __user *, name) + { + int error; ++ char tmp[5 * 32]; + + down_read(&uts_sem); +- error = -EFAULT; +- if (copy_to_user(name + 0, utsname()->sysname, 32)) +- goto out; +- if (copy_to_user(name + 32, utsname()->nodename, 32)) +- goto out; +- if (copy_to_user(name + 64, utsname()->release, 32)) +- goto out; +- if (copy_to_user(name + 96, utsname()->version, 32)) +- goto out; +- if (copy_to_user(name + 128, utsname()->machine, 32)) +- goto out; ++ memcpy(tmp + 0 * 32, utsname()->sysname, 32); ++ memcpy(tmp + 1 * 32, utsname()->nodename, 32); ++ memcpy(tmp + 2 * 32, utsname()->release, 32); ++ memcpy(tmp + 3 * 32, utsname()->version, 32); ++ memcpy(tmp + 4 * 32, utsname()->machine, 32); ++ up_read(&uts_sem); + +- error = 0; +- out: +- up_read(&uts_sem); +- return error; ++ if (copy_to_user(name, tmp, sizeof(tmp))) ++ return -EFAULT; ++ return 0; + } + + SYSCALL_DEFINE0(getpagesize) +@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) + { + int len, err = 0; + char *kname; ++ char tmp[32]; + +- if (namelen > 32) ++ if (namelen < 0 || namelen > 32) + namelen = 32; + + down_read(&uts_sem); + kname = utsname()->domainname; + len = strnlen(kname, namelen); +- if (copy_to_user(name, kname, min(len + 1, namelen))) +- err = -EFAULT; ++ len = min(len + 1, namelen); ++ memcpy(tmp, kname, len); + up_read(&uts_sem); + +- return err; ++ if (copy_to_user(name, tmp, len)) ++ return -EFAULT; ++ return 0; + } + + /* +@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) + }; + unsigned long offset; + const char *res; +- long len, err = -EINVAL; ++ long len; ++ char tmp[__NEW_UTS_LEN + 1]; + + offset = command-1; + if (offset >= ARRAY_SIZE(sysinfo_table)) { + /* Digital UNIX has a few unpublished interfaces here */ + printk("sysinfo(%d)", command); +- goto out; ++ return -EINVAL; + } + + down_read(&uts_sem); +@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) + len = strlen(res)+1; + if ((unsigned long)len > (unsigned long)count) + len = count; +- if (copy_to_user(buf, res, len)) +- err = -EFAULT; +- else +- err = 0; ++ memcpy(tmp, res, len); + up_read(&uts_sem); +- out: +- return err; ++ if (copy_to_user(buf, tmp, len)) ++ return -EFAULT; ++ return 0; + } + + SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer, +diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts +index 5bb9d68d6e90..d9a2049a1ea8 100644 +--- a/arch/arm/boot/dts/am571x-idk.dts ++++ b/arch/arm/boot/dts/am571x-idk.dts +@@ -66,10 +66,6 @@ + }; + }; + +-&omap_dwc3_2 { +- extcon = <&extcon_usb2>; +-}; +- + &extcon_usb2 { + id-gpio = <&gpio5 7 GPIO_ACTIVE_HIGH>; + vbus-gpio = <&gpio7 22 GPIO_ACTIVE_HIGH>; +diff --git a/arch/arm/boot/dts/am572x-idk-common.dtsi b/arch/arm/boot/dts/am572x-idk-common.dtsi +index c6d858b31011..784639ddf451 100644 +--- a/arch/arm/boot/dts/am572x-idk-common.dtsi ++++ b/arch/arm/boot/dts/am572x-idk-common.dtsi +@@ -57,10 +57,6 @@ + }; + }; + +-&omap_dwc3_2 { +- extcon = <&extcon_usb2>; +-}; +- + &extcon_usb2 { + id-gpio = <&gpio3 16 GPIO_ACTIVE_HIGH>; + vbus-gpio = <&gpio3 26 GPIO_ACTIVE_HIGH>; +diff --git a/arch/arm/boot/dts/am57xx-idk-common.dtsi b/arch/arm/boot/dts/am57xx-idk-common.dtsi +index ad87f1ae904d..c9063ffca524 100644 +--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi ++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi +@@ -395,8 +395,13 @@ + dr_mode = "host"; + }; + ++&omap_dwc3_2 { ++ extcon = <&extcon_usb2>; ++}; ++ + &usb2 { +- dr_mode = "peripheral"; ++ extcon = <&extcon_usb2>; ++ dr_mode = "otg"; + }; + + &mmc1 { +diff --git a/arch/arm/boot/dts/tegra30-cardhu.dtsi b/arch/arm/boot/dts/tegra30-cardhu.dtsi +index 92a9740c533f..3b1db7b9ec50 100644 +--- a/arch/arm/boot/dts/tegra30-cardhu.dtsi ++++ b/arch/arm/boot/dts/tegra30-cardhu.dtsi +@@ -206,6 +206,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x70>; ++ reset-gpio = <&gpio TEGRA_GPIO(BB, 0) GPIO_ACTIVE_LOW>; + }; + }; + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 42c090cf0292..3eb034189cf8 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -754,7 +754,6 @@ config NEED_PER_CPU_EMBED_FIRST_CHUNK + + config HOLES_IN_ZONE + def_bool y +- depends on NUMA + + source kernel/Kconfig.preempt + source kernel/Kconfig.hz +diff --git a/arch/arm64/crypto/sm4-ce-glue.c b/arch/arm64/crypto/sm4-ce-glue.c +index b7fb5274b250..0c4fc223f225 100644 +--- a/arch/arm64/crypto/sm4-ce-glue.c ++++ b/arch/arm64/crypto/sm4-ce-glue.c +@@ -69,5 +69,5 @@ static void __exit sm4_ce_mod_fini(void) + crypto_unregister_alg(&sm4_ce_alg); + } + +-module_cpu_feature_match(SM3, sm4_ce_mod_init); ++module_cpu_feature_match(SM4, sm4_ce_mod_init); + module_exit(sm4_ce_mod_fini); +diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h +index 5a23010af600..1e7a33592e29 100644 +--- a/arch/powerpc/include/asm/fadump.h ++++ b/arch/powerpc/include/asm/fadump.h +@@ -195,9 +195,6 @@ struct fadump_crash_info_header { + struct cpumask online_mask; + }; + +-/* Crash memory ranges */ +-#define INIT_CRASHMEM_RANGES (INIT_MEMBLOCK_REGIONS + 2) +- + struct fad_crash_memory_ranges { + unsigned long long base; + unsigned long long size; +diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h +index 2160be2e4339..b321c82b3624 100644 +--- a/arch/powerpc/include/asm/nohash/pgtable.h ++++ b/arch/powerpc/include/asm/nohash/pgtable.h +@@ -51,17 +51,14 @@ static inline int pte_present(pte_t pte) + #define pte_access_permitted pte_access_permitted + static inline bool pte_access_permitted(pte_t pte, bool write) + { +- unsigned long pteval = pte_val(pte); + /* + * A read-only access is controlled by _PAGE_USER bit. + * We have _PAGE_READ set for WRITE and EXECUTE + */ +- unsigned long need_pte_bits = _PAGE_PRESENT | _PAGE_USER; +- +- if (write) +- need_pte_bits |= _PAGE_WRITE; ++ if (!pte_present(pte) || !pte_user(pte) || !pte_read(pte)) ++ return false; + +- if ((pteval & need_pte_bits) != need_pte_bits) ++ if (write && !pte_write(pte)) + return false; + + return true; +diff --git a/arch/powerpc/include/asm/pkeys.h b/arch/powerpc/include/asm/pkeys.h +index 5ba80cffb505..3312606fda07 100644 +--- a/arch/powerpc/include/asm/pkeys.h ++++ b/arch/powerpc/include/asm/pkeys.h +@@ -94,8 +94,6 @@ static inline bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) + __mm_pkey_is_allocated(mm, pkey)); + } + +-extern void __arch_activate_pkey(int pkey); +-extern void __arch_deactivate_pkey(int pkey); + /* + * Returns a positive, 5-bit key on success, or -1 on failure. + * Relies on the mmap_sem to protect against concurrency in mm_pkey_alloc() and +@@ -124,11 +122,6 @@ static inline int mm_pkey_alloc(struct mm_struct *mm) + ret = ffz((u32)mm_pkey_allocation_map(mm)); + __mm_pkey_allocated(mm, ret); + +- /* +- * Enable the key in the hardware +- */ +- if (ret > 0) +- __arch_activate_pkey(ret); + return ret; + } + +@@ -140,10 +133,6 @@ static inline int mm_pkey_free(struct mm_struct *mm, int pkey) + if (!mm_pkey_is_allocated(mm, pkey)) + return -EINVAL; + +- /* +- * Disable the key in the hardware +- */ +- __arch_deactivate_pkey(pkey); + __mm_pkey_free(mm, pkey); + + return 0; +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 07e8396d472b..958eb5cd2a9e 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -47,8 +47,10 @@ static struct fadump_mem_struct fdm; + static const struct fadump_mem_struct *fdm_active; + + static DEFINE_MUTEX(fadump_mutex); +-struct fad_crash_memory_ranges crash_memory_ranges[INIT_CRASHMEM_RANGES]; ++struct fad_crash_memory_ranges *crash_memory_ranges; ++int crash_memory_ranges_size; + int crash_mem_ranges; ++int max_crash_mem_ranges; + + /* Scan the Firmware Assisted dump configuration details. */ + int __init early_init_dt_scan_fw_dump(unsigned long node, +@@ -868,38 +870,88 @@ static int __init process_fadump(const struct fadump_mem_struct *fdm_active) + return 0; + } + +-static inline void fadump_add_crash_memory(unsigned long long base, +- unsigned long long end) ++static void free_crash_memory_ranges(void) ++{ ++ kfree(crash_memory_ranges); ++ crash_memory_ranges = NULL; ++ crash_memory_ranges_size = 0; ++ max_crash_mem_ranges = 0; ++} ++ ++/* ++ * Allocate or reallocate crash memory ranges array in incremental units ++ * of PAGE_SIZE. ++ */ ++static int allocate_crash_memory_ranges(void) ++{ ++ struct fad_crash_memory_ranges *new_array; ++ u64 new_size; ++ ++ new_size = crash_memory_ranges_size + PAGE_SIZE; ++ pr_debug("Allocating %llu bytes of memory for crash memory ranges\n", ++ new_size); ++ ++ new_array = krealloc(crash_memory_ranges, new_size, GFP_KERNEL); ++ if (new_array == NULL) { ++ pr_err("Insufficient memory for setting up crash memory ranges\n"); ++ free_crash_memory_ranges(); ++ return -ENOMEM; ++ } ++ ++ crash_memory_ranges = new_array; ++ crash_memory_ranges_size = new_size; ++ max_crash_mem_ranges = (new_size / ++ sizeof(struct fad_crash_memory_ranges)); ++ return 0; ++} ++ ++static inline int fadump_add_crash_memory(unsigned long long base, ++ unsigned long long end) + { + if (base == end) +- return; ++ return 0; ++ ++ if (crash_mem_ranges == max_crash_mem_ranges) { ++ int ret; ++ ++ ret = allocate_crash_memory_ranges(); ++ if (ret) ++ return ret; ++ } + + pr_debug("crash_memory_range[%d] [%#016llx-%#016llx], %#llx bytes\n", + crash_mem_ranges, base, end - 1, (end - base)); + crash_memory_ranges[crash_mem_ranges].base = base; + crash_memory_ranges[crash_mem_ranges].size = end - base; + crash_mem_ranges++; ++ return 0; + } + +-static void fadump_exclude_reserved_area(unsigned long long start, ++static int fadump_exclude_reserved_area(unsigned long long start, + unsigned long long end) + { + unsigned long long ra_start, ra_end; ++ int ret = 0; + + ra_start = fw_dump.reserve_dump_area_start; + ra_end = ra_start + fw_dump.reserve_dump_area_size; + + if ((ra_start < end) && (ra_end > start)) { + if ((start < ra_start) && (end > ra_end)) { +- fadump_add_crash_memory(start, ra_start); +- fadump_add_crash_memory(ra_end, end); ++ ret = fadump_add_crash_memory(start, ra_start); ++ if (ret) ++ return ret; ++ ++ ret = fadump_add_crash_memory(ra_end, end); + } else if (start < ra_start) { +- fadump_add_crash_memory(start, ra_start); ++ ret = fadump_add_crash_memory(start, ra_start); + } else if (ra_end < end) { +- fadump_add_crash_memory(ra_end, end); ++ ret = fadump_add_crash_memory(ra_end, end); + } + } else +- fadump_add_crash_memory(start, end); ++ ret = fadump_add_crash_memory(start, end); ++ ++ return ret; + } + + static int fadump_init_elfcore_header(char *bufp) +@@ -939,10 +991,11 @@ static int fadump_init_elfcore_header(char *bufp) + * Traverse through memblock structure and setup crash memory ranges. These + * ranges will be used create PT_LOAD program headers in elfcore header. + */ +-static void fadump_setup_crash_memory_ranges(void) ++static int fadump_setup_crash_memory_ranges(void) + { + struct memblock_region *reg; + unsigned long long start, end; ++ int ret; + + pr_debug("Setup crash memory ranges.\n"); + crash_mem_ranges = 0; +@@ -953,7 +1006,9 @@ static void fadump_setup_crash_memory_ranges(void) + * specified during fadump registration. We need to create a separate + * program header for this chunk with the correct offset. + */ +- fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); ++ ret = fadump_add_crash_memory(RMA_START, fw_dump.boot_memory_size); ++ if (ret) ++ return ret; + + for_each_memblock(memory, reg) { + start = (unsigned long long)reg->base; +@@ -973,8 +1028,12 @@ static void fadump_setup_crash_memory_ranges(void) + } + + /* add this range excluding the reserved dump area. */ +- fadump_exclude_reserved_area(start, end); ++ ret = fadump_exclude_reserved_area(start, end); ++ if (ret) ++ return ret; + } ++ ++ return 0; + } + + /* +@@ -1097,6 +1156,7 @@ static int register_fadump(void) + { + unsigned long addr; + void *vaddr; ++ int ret; + + /* + * If no memory is reserved then we can not register for firmware- +@@ -1105,7 +1165,9 @@ static int register_fadump(void) + if (!fw_dump.reserve_dump_area_size) + return -ENODEV; + +- fadump_setup_crash_memory_ranges(); ++ ret = fadump_setup_crash_memory_ranges(); ++ if (ret) ++ return ret; + + addr = be64_to_cpu(fdm.rmr_region.destination_address) + be64_to_cpu(fdm.rmr_region.source_len); + /* Initialize fadump crash info header. */ +@@ -1183,6 +1245,7 @@ void fadump_cleanup(void) + } else if (fw_dump.dump_registered) { + /* Un-register Firmware-assisted dump if it was registered. */ + fadump_unregister_dump(&fdm); ++ free_crash_memory_ranges(); + } + } + +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 9ef4aea9fffe..991d09774108 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -583,6 +583,7 @@ static void save_all(struct task_struct *tsk) + __giveup_spe(tsk); + + msr_check_and_clear(msr_all_available); ++ thread_pkey_regs_save(&tsk->thread); + } + + void flush_all_to_thread(struct task_struct *tsk) +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index de686b340f4a..a995513573c2 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -46,6 +46,7 @@ + #include + #include + ++#include + #include + #include + #include +diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c +index f3d4b4a0e561..3bb5cec03d1f 100644 +--- a/arch/powerpc/mm/mmu_context_book3s64.c ++++ b/arch/powerpc/mm/mmu_context_book3s64.c +@@ -200,9 +200,9 @@ static void pte_frag_destroy(void *pte_frag) + /* drop all the pending references */ + count = ((unsigned long)pte_frag & ~PAGE_MASK) >> PTE_FRAG_SIZE_SHIFT; + /* We allow PTE_FRAG_NR fragments from a PTE page */ +- if (page_ref_sub_and_test(page, PTE_FRAG_NR - count)) { ++ if (atomic_sub_and_test(PTE_FRAG_NR - count, &page->pt_frag_refcount)) { + pgtable_page_dtor(page); +- free_unref_page(page); ++ __free_page(page); + } + } + +@@ -215,9 +215,9 @@ static void pmd_frag_destroy(void *pmd_frag) + /* drop all the pending references */ + count = ((unsigned long)pmd_frag & ~PAGE_MASK) >> PMD_FRAG_SIZE_SHIFT; + /* We allow PTE_FRAG_NR fragments from a PTE page */ +- if (page_ref_sub_and_test(page, PMD_FRAG_NR - count)) { ++ if (atomic_sub_and_test(PMD_FRAG_NR - count, &page->pt_frag_refcount)) { + pgtable_pmd_page_dtor(page); +- free_unref_page(page); ++ __free_page(page); + } + } + +diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c +index a4ca57612558..c9ee9e23845f 100644 +--- a/arch/powerpc/mm/mmu_context_iommu.c ++++ b/arch/powerpc/mm/mmu_context_iommu.c +@@ -129,6 +129,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + long i, j, ret = 0, locked_entries = 0; + unsigned int pageshift; + unsigned long flags; ++ unsigned long cur_ua; + struct page *page = NULL; + + mutex_lock(&mem_list_mutex); +@@ -177,7 +178,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + } + + for (i = 0; i < entries; ++i) { +- if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT), ++ cur_ua = ua + (i << PAGE_SHIFT); ++ if (1 != get_user_pages_fast(cur_ua, + 1/* pages */, 1/* iswrite */, &page)) { + ret = -EFAULT; + for (j = 0; j < i; ++j) +@@ -196,7 +198,7 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + if (is_migrate_cma_page(page)) { + if (mm_iommu_move_page_from_cma(page)) + goto populate; +- if (1 != get_user_pages_fast(ua + (i << PAGE_SHIFT), ++ if (1 != get_user_pages_fast(cur_ua, + 1/* pages */, 1/* iswrite */, + &page)) { + ret = -EFAULT; +@@ -210,20 +212,21 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + } + populate: + pageshift = PAGE_SHIFT; +- if (PageCompound(page)) { ++ if (mem->pageshift > PAGE_SHIFT && PageCompound(page)) { + pte_t *pte; + struct page *head = compound_head(page); + unsigned int compshift = compound_order(head); ++ unsigned int pteshift; + + local_irq_save(flags); /* disables as well */ +- pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift); +- local_irq_restore(flags); ++ pte = find_linux_pte(mm->pgd, cur_ua, NULL, &pteshift); + + /* Double check it is still the same pinned page */ + if (pte && pte_page(*pte) == head && +- pageshift == compshift) +- pageshift = max_t(unsigned int, pageshift, ++ pteshift == compshift + PAGE_SHIFT) ++ pageshift = max_t(unsigned int, pteshift, + PAGE_SHIFT); ++ local_irq_restore(flags); + } + mem->pageshift = min(mem->pageshift, pageshift); + mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT; +diff --git a/arch/powerpc/mm/pgtable-book3s64.c b/arch/powerpc/mm/pgtable-book3s64.c +index 4afbfbb64bfd..78d0b3d5ebad 100644 +--- a/arch/powerpc/mm/pgtable-book3s64.c ++++ b/arch/powerpc/mm/pgtable-book3s64.c +@@ -270,6 +270,8 @@ static pmd_t *__alloc_for_pmdcache(struct mm_struct *mm) + return NULL; + } + ++ atomic_set(&page->pt_frag_refcount, 1); ++ + ret = page_address(page); + /* + * if we support only one fragment just return the +@@ -285,7 +287,7 @@ static pmd_t *__alloc_for_pmdcache(struct mm_struct *mm) + * count. + */ + if (likely(!mm->context.pmd_frag)) { +- set_page_count(page, PMD_FRAG_NR); ++ atomic_set(&page->pt_frag_refcount, PMD_FRAG_NR); + mm->context.pmd_frag = ret + PMD_FRAG_SIZE; + } + spin_unlock(&mm->page_table_lock); +@@ -308,9 +310,10 @@ void pmd_fragment_free(unsigned long *pmd) + { + struct page *page = virt_to_page(pmd); + +- if (put_page_testzero(page)) { ++ BUG_ON(atomic_read(&page->pt_frag_refcount) <= 0); ++ if (atomic_dec_and_test(&page->pt_frag_refcount)) { + pgtable_pmd_page_dtor(page); +- free_unref_page(page); ++ __free_page(page); + } + } + +@@ -352,6 +355,7 @@ static pte_t *__alloc_for_ptecache(struct mm_struct *mm, int kernel) + return NULL; + } + ++ atomic_set(&page->pt_frag_refcount, 1); + + ret = page_address(page); + /* +@@ -367,7 +371,7 @@ static pte_t *__alloc_for_ptecache(struct mm_struct *mm, int kernel) + * count. + */ + if (likely(!mm->context.pte_frag)) { +- set_page_count(page, PTE_FRAG_NR); ++ atomic_set(&page->pt_frag_refcount, PTE_FRAG_NR); + mm->context.pte_frag = ret + PTE_FRAG_SIZE; + } + spin_unlock(&mm->page_table_lock); +@@ -390,10 +394,11 @@ void pte_fragment_free(unsigned long *table, int kernel) + { + struct page *page = virt_to_page(table); + +- if (put_page_testzero(page)) { ++ BUG_ON(atomic_read(&page->pt_frag_refcount) <= 0); ++ if (atomic_dec_and_test(&page->pt_frag_refcount)) { + if (!kernel) + pgtable_page_dtor(page); +- free_unref_page(page); ++ __free_page(page); + } + } + +diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c +index e6f500fabf5e..0e7810ccd1ae 100644 +--- a/arch/powerpc/mm/pkeys.c ++++ b/arch/powerpc/mm/pkeys.c +@@ -15,8 +15,10 @@ bool pkey_execute_disable_supported; + int pkeys_total; /* Total pkeys as per device tree */ + bool pkeys_devtree_defined; /* pkey property exported by device tree */ + u32 initial_allocation_mask; /* Bits set for reserved keys */ +-u64 pkey_amr_uamor_mask; /* Bits in AMR/UMOR not to be touched */ ++u64 pkey_amr_mask; /* Bits in AMR not to be touched */ + u64 pkey_iamr_mask; /* Bits in AMR not to be touched */ ++u64 pkey_uamor_mask; /* Bits in UMOR not to be touched */ ++int execute_only_key = 2; + + #define AMR_BITS_PER_PKEY 2 + #define AMR_RD_BIT 0x1UL +@@ -91,7 +93,7 @@ int pkey_initialize(void) + * arch-neutral code. + */ + pkeys_total = min_t(int, pkeys_total, +- (ARCH_VM_PKEY_FLAGS >> VM_PKEY_SHIFT)); ++ ((ARCH_VM_PKEY_FLAGS >> VM_PKEY_SHIFT)+1)); + + if (!pkey_mmu_enabled() || radix_enabled() || !pkeys_total) + static_branch_enable(&pkey_disabled); +@@ -119,20 +121,38 @@ int pkey_initialize(void) + #else + os_reserved = 0; + #endif +- initial_allocation_mask = ~0x0; +- pkey_amr_uamor_mask = ~0x0ul; ++ initial_allocation_mask = (0x1 << 0) | (0x1 << 1) | ++ (0x1 << execute_only_key); ++ ++ /* register mask is in BE format */ ++ pkey_amr_mask = ~0x0ul; ++ pkey_amr_mask &= ~(0x3ul << pkeyshift(0)); ++ + pkey_iamr_mask = ~0x0ul; +- /* +- * key 0, 1 are reserved. +- * key 0 is the default key, which allows read/write/execute. +- * key 1 is recommended not to be used. PowerISA(3.0) page 1015, +- * programming note. +- */ +- for (i = 2; i < (pkeys_total - os_reserved); i++) { +- initial_allocation_mask &= ~(0x1 << i); +- pkey_amr_uamor_mask &= ~(0x3ul << pkeyshift(i)); +- pkey_iamr_mask &= ~(0x1ul << pkeyshift(i)); ++ pkey_iamr_mask &= ~(0x3ul << pkeyshift(0)); ++ pkey_iamr_mask &= ~(0x3ul << pkeyshift(execute_only_key)); ++ ++ pkey_uamor_mask = ~0x0ul; ++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(0)); ++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(execute_only_key)); ++ ++ /* mark the rest of the keys as reserved and hence unavailable */ ++ for (i = (pkeys_total - os_reserved); i < pkeys_total; i++) { ++ initial_allocation_mask |= (0x1 << i); ++ pkey_uamor_mask &= ~(0x3ul << pkeyshift(i)); ++ } ++ ++ if (unlikely((pkeys_total - os_reserved) <= execute_only_key)) { ++ /* ++ * Insufficient number of keys to support ++ * execute only key. Mark it unavailable. ++ * Any AMR, UAMOR, IAMR bit set for ++ * this key is irrelevant since this key ++ * can never be allocated. ++ */ ++ execute_only_key = -1; + } ++ + return 0; + } + +@@ -143,8 +163,7 @@ void pkey_mm_init(struct mm_struct *mm) + if (static_branch_likely(&pkey_disabled)) + return; + mm_pkey_allocation_map(mm) = initial_allocation_mask; +- /* -1 means unallocated or invalid */ +- mm->context.execute_only_pkey = -1; ++ mm->context.execute_only_pkey = execute_only_key; + } + + static inline u64 read_amr(void) +@@ -213,33 +232,6 @@ static inline void init_iamr(int pkey, u8 init_bits) + write_iamr(old_iamr | new_iamr_bits); + } + +-static void pkey_status_change(int pkey, bool enable) +-{ +- u64 old_uamor; +- +- /* Reset the AMR and IAMR bits for this key */ +- init_amr(pkey, 0x0); +- init_iamr(pkey, 0x0); +- +- /* Enable/disable key */ +- old_uamor = read_uamor(); +- if (enable) +- old_uamor |= (0x3ul << pkeyshift(pkey)); +- else +- old_uamor &= ~(0x3ul << pkeyshift(pkey)); +- write_uamor(old_uamor); +-} +- +-void __arch_activate_pkey(int pkey) +-{ +- pkey_status_change(pkey, true); +-} +- +-void __arch_deactivate_pkey(int pkey) +-{ +- pkey_status_change(pkey, false); +-} +- + /* + * Set the access rights in AMR IAMR and UAMOR registers for @pkey to that + * specified in @init_val. +@@ -289,9 +281,6 @@ void thread_pkey_regs_restore(struct thread_struct *new_thread, + if (static_branch_likely(&pkey_disabled)) + return; + +- /* +- * TODO: Just set UAMOR to zero if @new_thread hasn't used any keys yet. +- */ + if (old_thread->amr != new_thread->amr) + write_amr(new_thread->amr); + if (old_thread->iamr != new_thread->iamr) +@@ -305,9 +294,13 @@ void thread_pkey_regs_init(struct thread_struct *thread) + if (static_branch_likely(&pkey_disabled)) + return; + +- thread->amr = read_amr() & pkey_amr_uamor_mask; +- thread->iamr = read_iamr() & pkey_iamr_mask; +- thread->uamor = read_uamor() & pkey_amr_uamor_mask; ++ thread->amr = pkey_amr_mask; ++ thread->iamr = pkey_iamr_mask; ++ thread->uamor = pkey_uamor_mask; ++ ++ write_uamor(pkey_uamor_mask); ++ write_amr(pkey_amr_mask); ++ write_iamr(pkey_iamr_mask); + } + + static inline bool pkey_allows_readwrite(int pkey) +@@ -322,48 +315,7 @@ static inline bool pkey_allows_readwrite(int pkey) + + int __execute_only_pkey(struct mm_struct *mm) + { +- bool need_to_set_mm_pkey = false; +- int execute_only_pkey = mm->context.execute_only_pkey; +- int ret; +- +- /* Do we need to assign a pkey for mm's execute-only maps? */ +- if (execute_only_pkey == -1) { +- /* Go allocate one to use, which might fail */ +- execute_only_pkey = mm_pkey_alloc(mm); +- if (execute_only_pkey < 0) +- return -1; +- need_to_set_mm_pkey = true; +- } +- +- /* +- * We do not want to go through the relatively costly dance to set AMR +- * if we do not need to. Check it first and assume that if the +- * execute-only pkey is readwrite-disabled than we do not have to set it +- * ourselves. +- */ +- if (!need_to_set_mm_pkey && !pkey_allows_readwrite(execute_only_pkey)) +- return execute_only_pkey; +- +- /* +- * Set up AMR so that it denies access for everything other than +- * execution. +- */ +- ret = __arch_set_user_pkey_access(current, execute_only_pkey, +- PKEY_DISABLE_ACCESS | +- PKEY_DISABLE_WRITE); +- /* +- * If the AMR-set operation failed somehow, just return 0 and +- * effectively disable execute-only support. +- */ +- if (ret) { +- mm_pkey_free(mm, execute_only_pkey); +- return -1; +- } +- +- /* We got one, store it and use it from here on out */ +- if (need_to_set_mm_pkey) +- mm->context.execute_only_pkey = execute_only_pkey; +- return execute_only_pkey; ++ return mm->context.execute_only_pkey; + } + + static inline bool vma_is_pkey_exec_only(struct vm_area_struct *vma) +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index 70b2e1e0f23c..a2cdf358a3ac 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -3368,12 +3368,49 @@ static void pnv_pci_ioda_create_dbgfs(void) + #endif /* CONFIG_DEBUG_FS */ + } + ++static void pnv_pci_enable_bridge(struct pci_bus *bus) ++{ ++ struct pci_dev *dev = bus->self; ++ struct pci_bus *child; ++ ++ /* Empty bus ? bail */ ++ if (list_empty(&bus->devices)) ++ return; ++ ++ /* ++ * If there's a bridge associated with that bus enable it. This works ++ * around races in the generic code if the enabling is done during ++ * parallel probing. This can be removed once those races have been ++ * fixed. ++ */ ++ if (dev) { ++ int rc = pci_enable_device(dev); ++ if (rc) ++ pci_err(dev, "Error enabling bridge (%d)\n", rc); ++ pci_set_master(dev); ++ } ++ ++ /* Perform the same to child busses */ ++ list_for_each_entry(child, &bus->children, node) ++ pnv_pci_enable_bridge(child); ++} ++ ++static void pnv_pci_enable_bridges(void) ++{ ++ struct pci_controller *hose; ++ ++ list_for_each_entry(hose, &hose_list, list_node) ++ pnv_pci_enable_bridge(hose->bus); ++} ++ + static void pnv_pci_ioda_fixup(void) + { + pnv_pci_ioda_setup_PEs(); + pnv_pci_ioda_setup_iommu_api(); + pnv_pci_ioda_create_dbgfs(); + ++ pnv_pci_enable_bridges(); ++ + #ifdef CONFIG_EEH + pnv_eeh_post_init(); + #endif +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 5e1ef9150182..2edc673be137 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -360,7 +360,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) + } + + savep = __va(regs->gpr[3]); +- regs->gpr[3] = savep[0]; /* restore original r3 */ ++ regs->gpr[3] = be64_to_cpu(savep[0]); /* restore original r3 */ + + /* If it isn't an extended log we can use the per cpu 64bit buffer */ + h = (struct rtas_error_log *)&savep[1]; +diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c +index 7f3d9c59719a..452e4d080855 100644 +--- a/arch/sparc/kernel/sys_sparc_32.c ++++ b/arch/sparc/kernel/sys_sparc_32.c +@@ -197,23 +197,27 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, + + SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) + { +- int nlen, err; +- ++ int nlen, err; ++ char tmp[__NEW_UTS_LEN + 1]; ++ + if (len < 0) + return -EINVAL; + +- down_read(&uts_sem); +- ++ down_read(&uts_sem); ++ + nlen = strlen(utsname()->domainname) + 1; + err = -EINVAL; + if (nlen > len) +- goto out; ++ goto out_unlock; ++ memcpy(tmp, utsname()->domainname, nlen); + +- err = -EFAULT; +- if (!copy_to_user(name, utsname()->domainname, nlen)) +- err = 0; ++ up_read(&uts_sem); + +-out: ++ if (copy_to_user(name, tmp, nlen)) ++ return -EFAULT; ++ return 0; ++ ++out_unlock: + up_read(&uts_sem); + return err; + } +diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c +index 63baa8aa9414..274ed0b9b3e0 100644 +--- a/arch/sparc/kernel/sys_sparc_64.c ++++ b/arch/sparc/kernel/sys_sparc_64.c +@@ -519,23 +519,27 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs) + + SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) + { +- int nlen, err; ++ int nlen, err; ++ char tmp[__NEW_UTS_LEN + 1]; + + if (len < 0) + return -EINVAL; + +- down_read(&uts_sem); +- ++ down_read(&uts_sem); ++ + nlen = strlen(utsname()->domainname) + 1; + err = -EINVAL; + if (nlen > len) +- goto out; ++ goto out_unlock; ++ memcpy(tmp, utsname()->domainname, nlen); ++ ++ up_read(&uts_sem); + +- err = -EFAULT; +- if (!copy_to_user(name, utsname()->domainname, nlen)) +- err = 0; ++ if (copy_to_user(name, tmp, nlen)) ++ return -EFAULT; ++ return 0; + +-out: ++out_unlock: + up_read(&uts_sem); + return err; + } +diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S +index e762ef417562..d27a50656aa1 100644 +--- a/arch/x86/crypto/aesni-intel_asm.S ++++ b/arch/x86/crypto/aesni-intel_asm.S +@@ -223,34 +223,34 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff + pcmpeqd TWOONE(%rip), \TMP2 + pand POLY(%rip), \TMP2 + pxor \TMP2, \TMP3 +- movdqa \TMP3, HashKey(%arg2) ++ movdqu \TMP3, HashKey(%arg2) + + movdqa \TMP3, \TMP5 + pshufd $78, \TMP3, \TMP1 + pxor \TMP3, \TMP1 +- movdqa \TMP1, HashKey_k(%arg2) ++ movdqu \TMP1, HashKey_k(%arg2) + + GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7 + # TMP5 = HashKey^2<<1 (mod poly) +- movdqa \TMP5, HashKey_2(%arg2) ++ movdqu \TMP5, HashKey_2(%arg2) + # HashKey_2 = HashKey^2<<1 (mod poly) + pshufd $78, \TMP5, \TMP1 + pxor \TMP5, \TMP1 +- movdqa \TMP1, HashKey_2_k(%arg2) ++ movdqu \TMP1, HashKey_2_k(%arg2) + + GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7 + # TMP5 = HashKey^3<<1 (mod poly) +- movdqa \TMP5, HashKey_3(%arg2) ++ movdqu \TMP5, HashKey_3(%arg2) + pshufd $78, \TMP5, \TMP1 + pxor \TMP5, \TMP1 +- movdqa \TMP1, HashKey_3_k(%arg2) ++ movdqu \TMP1, HashKey_3_k(%arg2) + + GHASH_MUL \TMP5, \TMP3, \TMP1, \TMP2, \TMP4, \TMP6, \TMP7 + # TMP5 = HashKey^3<<1 (mod poly) +- movdqa \TMP5, HashKey_4(%arg2) ++ movdqu \TMP5, HashKey_4(%arg2) + pshufd $78, \TMP5, \TMP1 + pxor \TMP5, \TMP1 +- movdqa \TMP1, HashKey_4_k(%arg2) ++ movdqu \TMP1, HashKey_4_k(%arg2) + .endm + + # GCM_INIT initializes a gcm_context struct to prepare for encoding/decoding. +@@ -271,7 +271,7 @@ ALL_F: .octa 0xffffffffffffffffffffffffffffffff + movdqu %xmm0, CurCount(%arg2) # ctx_data.current_counter = iv + + PRECOMPUTE \SUBKEY, %xmm1, %xmm2, %xmm3, %xmm4, %xmm5, %xmm6, %xmm7, +- movdqa HashKey(%arg2), %xmm13 ++ movdqu HashKey(%arg2), %xmm13 + + CALC_AAD_HASH %xmm13, \AAD, \AADLEN, %xmm0, %xmm1, %xmm2, %xmm3, \ + %xmm4, %xmm5, %xmm6 +@@ -997,7 +997,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + pshufd $78, \XMM5, \TMP6 + pxor \XMM5, \TMP6 + paddd ONE(%rip), \XMM0 # INCR CNT +- movdqa HashKey_4(%arg2), \TMP5 ++ movdqu HashKey_4(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP4 # TMP4 = a1*b1 + movdqa \XMM0, \XMM1 + paddd ONE(%rip), \XMM0 # INCR CNT +@@ -1016,7 +1016,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + pxor (%arg1), \XMM2 + pxor (%arg1), \XMM3 + pxor (%arg1), \XMM4 +- movdqa HashKey_4_k(%arg2), \TMP5 ++ movdqu HashKey_4_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP6 # TMP6 = (a1+a0)*(b1+b0) + movaps 0x10(%arg1), \TMP1 + AESENC \TMP1, \XMM1 # Round 1 +@@ -1031,7 +1031,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM6, \TMP1 + pshufd $78, \XMM6, \TMP2 + pxor \XMM6, \TMP2 +- movdqa HashKey_3(%arg2), \TMP5 ++ movdqu HashKey_3(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1 * b1 + movaps 0x30(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 3 +@@ -1044,7 +1044,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + AESENC \TMP3, \XMM2 + AESENC \TMP3, \XMM3 + AESENC \TMP3, \XMM4 +- movdqa HashKey_3_k(%arg2), \TMP5 ++ movdqu HashKey_3_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movaps 0x50(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 5 +@@ -1058,7 +1058,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM7, \TMP1 + pshufd $78, \XMM7, \TMP2 + pxor \XMM7, \TMP2 +- movdqa HashKey_2(%arg2), \TMP5 ++ movdqu HashKey_2(%arg2), \TMP5 + + # Multiply TMP5 * HashKey using karatsuba + +@@ -1074,7 +1074,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + AESENC \TMP3, \XMM2 + AESENC \TMP3, \XMM3 + AESENC \TMP3, \XMM4 +- movdqa HashKey_2_k(%arg2), \TMP5 ++ movdqu HashKey_2_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movaps 0x80(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 8 +@@ -1092,7 +1092,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM8, \TMP1 + pshufd $78, \XMM8, \TMP2 + pxor \XMM8, \TMP2 +- movdqa HashKey(%arg2), \TMP5 ++ movdqu HashKey(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1 + movaps 0x90(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 9 +@@ -1121,7 +1121,7 @@ aes_loop_par_enc_done\@: + AESENCLAST \TMP3, \XMM2 + AESENCLAST \TMP3, \XMM3 + AESENCLAST \TMP3, \XMM4 +- movdqa HashKey_k(%arg2), \TMP5 ++ movdqu HashKey_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movdqu (%arg4,%r11,1), \TMP3 + pxor \TMP3, \XMM1 # Ciphertext/Plaintext XOR EK +@@ -1205,7 +1205,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + pshufd $78, \XMM5, \TMP6 + pxor \XMM5, \TMP6 + paddd ONE(%rip), \XMM0 # INCR CNT +- movdqa HashKey_4(%arg2), \TMP5 ++ movdqu HashKey_4(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP4 # TMP4 = a1*b1 + movdqa \XMM0, \XMM1 + paddd ONE(%rip), \XMM0 # INCR CNT +@@ -1224,7 +1224,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + pxor (%arg1), \XMM2 + pxor (%arg1), \XMM3 + pxor (%arg1), \XMM4 +- movdqa HashKey_4_k(%arg2), \TMP5 ++ movdqu HashKey_4_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP6 # TMP6 = (a1+a0)*(b1+b0) + movaps 0x10(%arg1), \TMP1 + AESENC \TMP1, \XMM1 # Round 1 +@@ -1239,7 +1239,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM6, \TMP1 + pshufd $78, \XMM6, \TMP2 + pxor \XMM6, \TMP2 +- movdqa HashKey_3(%arg2), \TMP5 ++ movdqu HashKey_3(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1 * b1 + movaps 0x30(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 3 +@@ -1252,7 +1252,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + AESENC \TMP3, \XMM2 + AESENC \TMP3, \XMM3 + AESENC \TMP3, \XMM4 +- movdqa HashKey_3_k(%arg2), \TMP5 ++ movdqu HashKey_3_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movaps 0x50(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 5 +@@ -1266,7 +1266,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM7, \TMP1 + pshufd $78, \XMM7, \TMP2 + pxor \XMM7, \TMP2 +- movdqa HashKey_2(%arg2), \TMP5 ++ movdqu HashKey_2(%arg2), \TMP5 + + # Multiply TMP5 * HashKey using karatsuba + +@@ -1282,7 +1282,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + AESENC \TMP3, \XMM2 + AESENC \TMP3, \XMM3 + AESENC \TMP3, \XMM4 +- movdqa HashKey_2_k(%arg2), \TMP5 ++ movdqu HashKey_2_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movaps 0x80(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 8 +@@ -1300,7 +1300,7 @@ TMP6 XMM0 XMM1 XMM2 XMM3 XMM4 XMM5 XMM6 XMM7 XMM8 operation + movdqa \XMM8, \TMP1 + pshufd $78, \XMM8, \TMP2 + pxor \XMM8, \TMP2 +- movdqa HashKey(%arg2), \TMP5 ++ movdqu HashKey(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1 + movaps 0x90(%arg1), \TMP3 + AESENC \TMP3, \XMM1 # Round 9 +@@ -1329,7 +1329,7 @@ aes_loop_par_dec_done\@: + AESENCLAST \TMP3, \XMM2 + AESENCLAST \TMP3, \XMM3 + AESENCLAST \TMP3, \XMM4 +- movdqa HashKey_k(%arg2), \TMP5 ++ movdqu HashKey_k(%arg2), \TMP5 + PCLMULQDQ 0x00, \TMP5, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movdqu (%arg4,%r11,1), \TMP3 + pxor \TMP3, \XMM1 # Ciphertext/Plaintext XOR EK +@@ -1405,10 +1405,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst + movdqa \XMM1, \TMP6 + pshufd $78, \XMM1, \TMP2 + pxor \XMM1, \TMP2 +- movdqa HashKey_4(%arg2), \TMP5 ++ movdqu HashKey_4(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP6 # TMP6 = a1*b1 + PCLMULQDQ 0x00, \TMP5, \XMM1 # XMM1 = a0*b0 +- movdqa HashKey_4_k(%arg2), \TMP4 ++ movdqu HashKey_4_k(%arg2), \TMP4 + PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + movdqa \XMM1, \XMMDst + movdqa \TMP2, \XMM1 # result in TMP6, XMMDst, XMM1 +@@ -1418,10 +1418,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst + movdqa \XMM2, \TMP1 + pshufd $78, \XMM2, \TMP2 + pxor \XMM2, \TMP2 +- movdqa HashKey_3(%arg2), \TMP5 ++ movdqu HashKey_3(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1 + PCLMULQDQ 0x00, \TMP5, \XMM2 # XMM2 = a0*b0 +- movdqa HashKey_3_k(%arg2), \TMP4 ++ movdqu HashKey_3_k(%arg2), \TMP4 + PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + pxor \TMP1, \TMP6 + pxor \XMM2, \XMMDst +@@ -1433,10 +1433,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst + movdqa \XMM3, \TMP1 + pshufd $78, \XMM3, \TMP2 + pxor \XMM3, \TMP2 +- movdqa HashKey_2(%arg2), \TMP5 ++ movdqu HashKey_2(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1 + PCLMULQDQ 0x00, \TMP5, \XMM3 # XMM3 = a0*b0 +- movdqa HashKey_2_k(%arg2), \TMP4 ++ movdqu HashKey_2_k(%arg2), \TMP4 + PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + pxor \TMP1, \TMP6 + pxor \XMM3, \XMMDst +@@ -1446,10 +1446,10 @@ TMP7 XMM1 XMM2 XMM3 XMM4 XMMDst + movdqa \XMM4, \TMP1 + pshufd $78, \XMM4, \TMP2 + pxor \XMM4, \TMP2 +- movdqa HashKey(%arg2), \TMP5 ++ movdqu HashKey(%arg2), \TMP5 + PCLMULQDQ 0x11, \TMP5, \TMP1 # TMP1 = a1*b1 + PCLMULQDQ 0x00, \TMP5, \XMM4 # XMM4 = a0*b0 +- movdqa HashKey_k(%arg2), \TMP4 ++ movdqu HashKey_k(%arg2), \TMP4 + PCLMULQDQ 0x00, \TMP4, \TMP2 # TMP2 = (a1+a0)*(b1+b0) + pxor \TMP1, \TMP6 + pxor \XMM4, \XMMDst +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +index 7326078eaa7a..278cd07228dd 100644 +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -532,7 +532,7 @@ static int bzImage64_cleanup(void *loader_data) + static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len) + { + return verify_pefile_signature(kernel, kernel_len, +- NULL, ++ VERIFY_USE_SECONDARY_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + } + #endif +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 46b428c0990e..bedabcf33a3e 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -197,12 +197,14 @@ static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_ + + static const struct { + const char *option; +- enum vmx_l1d_flush_state cmd; ++ bool for_parse; + } vmentry_l1d_param[] = { +- {"auto", VMENTER_L1D_FLUSH_AUTO}, +- {"never", VMENTER_L1D_FLUSH_NEVER}, +- {"cond", VMENTER_L1D_FLUSH_COND}, +- {"always", VMENTER_L1D_FLUSH_ALWAYS}, ++ [VMENTER_L1D_FLUSH_AUTO] = {"auto", true}, ++ [VMENTER_L1D_FLUSH_NEVER] = {"never", true}, ++ [VMENTER_L1D_FLUSH_COND] = {"cond", true}, ++ [VMENTER_L1D_FLUSH_ALWAYS] = {"always", true}, ++ [VMENTER_L1D_FLUSH_EPT_DISABLED] = {"EPT disabled", false}, ++ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = {"not required", false}, + }; + + #define L1D_CACHE_ORDER 4 +@@ -286,8 +288,9 @@ static int vmentry_l1d_flush_parse(const char *s) + + if (s) { + for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) { +- if (sysfs_streq(s, vmentry_l1d_param[i].option)) +- return vmentry_l1d_param[i].cmd; ++ if (vmentry_l1d_param[i].for_parse && ++ sysfs_streq(s, vmentry_l1d_param[i].option)) ++ return i; + } + } + return -EINVAL; +@@ -297,13 +300,13 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp) + { + int l1tf, ret; + +- if (!boot_cpu_has(X86_BUG_L1TF)) +- return 0; +- + l1tf = vmentry_l1d_flush_parse(s); + if (l1tf < 0) + return l1tf; + ++ if (!boot_cpu_has(X86_BUG_L1TF)) ++ return 0; ++ + /* + * Has vmx_init() run already? If not then this is the pre init + * parameter parsing. In that case just store the value and let +@@ -323,6 +326,9 @@ static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp) + + static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp) + { ++ if (WARN_ON_ONCE(l1tf_vmx_mitigation >= ARRAY_SIZE(vmentry_l1d_param))) ++ return sprintf(s, "???\n"); ++ + return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option); + } + +diff --git a/arch/xtensa/include/asm/cacheasm.h b/arch/xtensa/include/asm/cacheasm.h +index 2041abb10a23..34545ecfdd6b 100644 +--- a/arch/xtensa/include/asm/cacheasm.h ++++ b/arch/xtensa/include/asm/cacheasm.h +@@ -31,16 +31,32 @@ + * + */ + +- .macro __loop_cache_all ar at insn size line_width + +- movi \ar, 0 ++ .macro __loop_cache_unroll ar at insn size line_width max_immed ++ ++ .if (1 << (\line_width)) > (\max_immed) ++ .set _reps, 1 ++ .elseif (2 << (\line_width)) > (\max_immed) ++ .set _reps, 2 ++ .else ++ .set _reps, 4 ++ .endif ++ ++ __loopi \ar, \at, \size, (_reps << (\line_width)) ++ .set _index, 0 ++ .rep _reps ++ \insn \ar, _index << (\line_width) ++ .set _index, _index + 1 ++ .endr ++ __endla \ar, \at, _reps << (\line_width) ++ ++ .endm ++ + +- __loopi \ar, \at, \size, (4 << (\line_width)) +- \insn \ar, 0 << (\line_width) +- \insn \ar, 1 << (\line_width) +- \insn \ar, 2 << (\line_width) +- \insn \ar, 3 << (\line_width) +- __endla \ar, \at, 4 << (\line_width) ++ .macro __loop_cache_all ar at insn size line_width max_immed ++ ++ movi \ar, 0 ++ __loop_cache_unroll \ar, \at, \insn, \size, \line_width, \max_immed + + .endm + +@@ -57,14 +73,9 @@ + .endm + + +- .macro __loop_cache_page ar at insn line_width ++ .macro __loop_cache_page ar at insn line_width max_immed + +- __loopi \ar, \at, PAGE_SIZE, 4 << (\line_width) +- \insn \ar, 0 << (\line_width) +- \insn \ar, 1 << (\line_width) +- \insn \ar, 2 << (\line_width) +- \insn \ar, 3 << (\line_width) +- __endla \ar, \at, 4 << (\line_width) ++ __loop_cache_unroll \ar, \at, \insn, PAGE_SIZE, \line_width, \max_immed + + .endm + +@@ -72,7 +83,8 @@ + .macro ___unlock_dcache_all ar at + + #if XCHAL_DCACHE_LINE_LOCKABLE && XCHAL_DCACHE_SIZE +- __loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_all \ar \at diu XCHAL_DCACHE_SIZE \ ++ XCHAL_DCACHE_LINEWIDTH 240 + #endif + + .endm +@@ -81,7 +93,8 @@ + .macro ___unlock_icache_all ar at + + #if XCHAL_ICACHE_LINE_LOCKABLE && XCHAL_ICACHE_SIZE +- __loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE XCHAL_ICACHE_LINEWIDTH ++ __loop_cache_all \ar \at iiu XCHAL_ICACHE_SIZE \ ++ XCHAL_ICACHE_LINEWIDTH 240 + #endif + + .endm +@@ -90,7 +103,8 @@ + .macro ___flush_invalidate_dcache_all ar at + + #if XCHAL_DCACHE_SIZE +- __loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_all \ar \at diwbi XCHAL_DCACHE_SIZE \ ++ XCHAL_DCACHE_LINEWIDTH 240 + #endif + + .endm +@@ -99,7 +113,8 @@ + .macro ___flush_dcache_all ar at + + #if XCHAL_DCACHE_SIZE +- __loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_all \ar \at diwb XCHAL_DCACHE_SIZE \ ++ XCHAL_DCACHE_LINEWIDTH 240 + #endif + + .endm +@@ -108,8 +123,8 @@ + .macro ___invalidate_dcache_all ar at + + #if XCHAL_DCACHE_SIZE +- __loop_cache_all \ar \at dii __stringify(DCACHE_WAY_SIZE) \ +- XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_all \ar \at dii XCHAL_DCACHE_SIZE \ ++ XCHAL_DCACHE_LINEWIDTH 1020 + #endif + + .endm +@@ -118,8 +133,8 @@ + .macro ___invalidate_icache_all ar at + + #if XCHAL_ICACHE_SIZE +- __loop_cache_all \ar \at iii __stringify(ICACHE_WAY_SIZE) \ +- XCHAL_ICACHE_LINEWIDTH ++ __loop_cache_all \ar \at iii XCHAL_ICACHE_SIZE \ ++ XCHAL_ICACHE_LINEWIDTH 1020 + #endif + + .endm +@@ -166,7 +181,7 @@ + .macro ___flush_invalidate_dcache_page ar as + + #if XCHAL_DCACHE_SIZE +- __loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_page \ar \as dhwbi XCHAL_DCACHE_LINEWIDTH 1020 + #endif + + .endm +@@ -175,7 +190,7 @@ + .macro ___flush_dcache_page ar as + + #if XCHAL_DCACHE_SIZE +- __loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_page \ar \as dhwb XCHAL_DCACHE_LINEWIDTH 1020 + #endif + + .endm +@@ -184,7 +199,7 @@ + .macro ___invalidate_dcache_page ar as + + #if XCHAL_DCACHE_SIZE +- __loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH ++ __loop_cache_page \ar \as dhi XCHAL_DCACHE_LINEWIDTH 1020 + #endif + + .endm +@@ -193,7 +208,7 @@ + .macro ___invalidate_icache_page ar as + + #if XCHAL_ICACHE_SIZE +- __loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH ++ __loop_cache_page \ar \as ihi XCHAL_ICACHE_LINEWIDTH 1020 + #endif + + .endm +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index a9e8633388f4..58c6efa9f9a9 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -913,7 +913,8 @@ static ssize_t bfq_io_set_weight(struct kernfs_open_file *of, + if (ret) + return ret; + +- return bfq_io_set_weight_legacy(of_css(of), NULL, weight); ++ ret = bfq_io_set_weight_legacy(of_css(of), NULL, weight); ++ return ret ?: nbytes; + } + + #ifdef CONFIG_DEBUG_BLK_CGROUP +diff --git a/block/blk-core.c b/block/blk-core.c +index ee33590f54eb..1646ea85dade 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -715,6 +715,35 @@ void blk_set_queue_dying(struct request_queue *q) + } + EXPORT_SYMBOL_GPL(blk_set_queue_dying); + ++/* Unconfigure the I/O scheduler and dissociate from the cgroup controller. */ ++void blk_exit_queue(struct request_queue *q) ++{ ++ /* ++ * Since the I/O scheduler exit code may access cgroup information, ++ * perform I/O scheduler exit before disassociating from the block ++ * cgroup controller. ++ */ ++ if (q->elevator) { ++ ioc_clear_queue(q); ++ elevator_exit(q, q->elevator); ++ q->elevator = NULL; ++ } ++ ++ /* ++ * Remove all references to @q from the block cgroup controller before ++ * restoring @q->queue_lock to avoid that restoring this pointer causes ++ * e.g. blkcg_print_blkgs() to crash. ++ */ ++ blkcg_exit_queue(q); ++ ++ /* ++ * Since the cgroup code may dereference the @q->backing_dev_info ++ * pointer, only decrease its reference count after having removed the ++ * association with the block cgroup controller. ++ */ ++ bdi_put(q->backing_dev_info); ++} ++ + /** + * blk_cleanup_queue - shutdown a request queue + * @q: request queue to shutdown +@@ -780,30 +809,7 @@ void blk_cleanup_queue(struct request_queue *q) + */ + WARN_ON_ONCE(q->kobj.state_in_sysfs); + +- /* +- * Since the I/O scheduler exit code may access cgroup information, +- * perform I/O scheduler exit before disassociating from the block +- * cgroup controller. +- */ +- if (q->elevator) { +- ioc_clear_queue(q); +- elevator_exit(q, q->elevator); +- q->elevator = NULL; +- } +- +- /* +- * Remove all references to @q from the block cgroup controller before +- * restoring @q->queue_lock to avoid that restoring this pointer causes +- * e.g. blkcg_print_blkgs() to crash. +- */ +- blkcg_exit_queue(q); +- +- /* +- * Since the cgroup code may dereference the @q->backing_dev_info +- * pointer, only decrease its reference count after having removed the +- * association with the block cgroup controller. +- */ +- bdi_put(q->backing_dev_info); ++ blk_exit_queue(q); + + if (q->mq_ops) + blk_mq_free_queue(q); +@@ -1180,6 +1186,7 @@ out_exit_flush_rq: + q->exit_rq_fn(q, q->fq->flush_rq); + out_free_flush_queue: + blk_free_flush_queue(q->fq); ++ q->fq = NULL; + return -ENOMEM; + } + EXPORT_SYMBOL(blk_init_allocated_queue); +@@ -3763,9 +3770,11 @@ EXPORT_SYMBOL(blk_finish_plug); + */ + void blk_pm_runtime_init(struct request_queue *q, struct device *dev) + { +- /* not support for RQF_PM and ->rpm_status in blk-mq yet */ +- if (q->mq_ops) ++ /* Don't enable runtime PM for blk-mq until it is ready */ ++ if (q->mq_ops) { ++ pm_runtime_disable(dev); + return; ++ } + + q->dev = dev; + q->rpm_status = RPM_ACTIVE; +diff --git a/block/blk-lib.c b/block/blk-lib.c +index 8faa70f26fcd..d1b9dd03da25 100644 +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -68,6 +68,8 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, + */ + req_sects = min_t(sector_t, nr_sects, + q->limits.max_discard_sectors); ++ if (!req_sects) ++ goto fail; + if (req_sects > UINT_MAX >> 9) + req_sects = UINT_MAX >> 9; + +@@ -105,6 +107,14 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector, + + *biop = bio; + return 0; ++ ++fail: ++ if (bio) { ++ submit_bio_wait(bio); ++ bio_put(bio); ++ } ++ *biop = NULL; ++ return -EOPNOTSUPP; + } + EXPORT_SYMBOL(__blkdev_issue_discard); + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 94987b1f69e1..96c7dfc04852 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -804,6 +804,21 @@ static void __blk_release_queue(struct work_struct *work) + blk_stat_remove_callback(q, q->poll_cb); + blk_stat_free_callback(q->poll_cb); + ++ if (!blk_queue_dead(q)) { ++ /* ++ * Last reference was dropped without having called ++ * blk_cleanup_queue(). ++ */ ++ WARN_ONCE(blk_queue_init_done(q), ++ "request queue %p has been registered but blk_cleanup_queue() has not been called for that queue\n", ++ q); ++ blk_exit_queue(q); ++ } ++ ++ WARN(blkg_root_lookup(q), ++ "request queue %p is being released but it has not yet been removed from the blkcg controller\n", ++ q); ++ + blk_free_queue_stats(q->stats); + + blk_exit_rl(q, &q->root_rl); +diff --git a/block/blk.h b/block/blk.h +index 8d23aea96ce9..a8f0f7986cfd 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -130,6 +130,7 @@ void blk_free_flush_queue(struct blk_flush_queue *q); + int blk_init_rl(struct request_list *rl, struct request_queue *q, + gfp_t gfp_mask); + void blk_exit_rl(struct request_queue *q, struct request_list *rl); ++void blk_exit_queue(struct request_queue *q); + void blk_rq_bio_prep(struct request_queue *q, struct request *rq, + struct bio *bio); + void blk_queue_bypass_start(struct request_queue *q); +diff --git a/certs/system_keyring.c b/certs/system_keyring.c +index 6251d1b27f0c..81728717523d 100644 +--- a/certs/system_keyring.c ++++ b/certs/system_keyring.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -230,7 +231,7 @@ int verify_pkcs7_signature(const void *data, size_t len, + + if (!trusted_keys) { + trusted_keys = builtin_trusted_keys; +- } else if (trusted_keys == (void *)1UL) { ++ } else if (trusted_keys == VERIFY_USE_SECONDARY_KEYRING) { + #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING + trusted_keys = secondary_trusted_keys; + #else +diff --git a/crypto/asymmetric_keys/pkcs7_key_type.c b/crypto/asymmetric_keys/pkcs7_key_type.c +index e284d9cb9237..5b2f6a2b5585 100644 +--- a/crypto/asymmetric_keys/pkcs7_key_type.c ++++ b/crypto/asymmetric_keys/pkcs7_key_type.c +@@ -63,7 +63,7 @@ static int pkcs7_preparse(struct key_preparsed_payload *prep) + + return verify_pkcs7_signature(NULL, 0, + prep->data, prep->datalen, +- (void *)1UL, usage, ++ VERIFY_USE_SECONDARY_KEYRING, usage, + pkcs7_view_content, prep); + } + +diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c +index fe9d46d81750..d8b8fc2ff563 100644 +--- a/drivers/acpi/acpica/hwsleep.c ++++ b/drivers/acpi/acpica/hwsleep.c +@@ -56,14 +56,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) + if (ACPI_FAILURE(status)) { + return_ACPI_STATUS(status); + } +- /* +- * If the target sleep state is S5, clear all GPEs and fixed events too +- */ +- if (sleep_state == ACPI_STATE_S5) { +- status = acpi_hw_clear_acpi_status(); +- if (ACPI_FAILURE(status)) { +- return_ACPI_STATUS(status); +- } ++ status = acpi_hw_clear_acpi_status(); ++ if (ACPI_FAILURE(status)) { ++ return_ACPI_STATUS(status); + } + acpi_gbl_system_awake_and_running = FALSE; + +diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c +index 44f35ab3347d..0f0bdc9d24c6 100644 +--- a/drivers/acpi/acpica/psloop.c ++++ b/drivers/acpi/acpica/psloop.c +@@ -22,6 +22,7 @@ + #include "acdispat.h" + #include "amlcode.h" + #include "acconvert.h" ++#include "acnamesp.h" + + #define _COMPONENT ACPI_PARSER + ACPI_MODULE_NAME("psloop") +@@ -527,12 +528,18 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) + if (ACPI_FAILURE(status)) { + return_ACPI_STATUS(status); + } +- if (walk_state->opcode == AML_SCOPE_OP) { ++ if (acpi_ns_opens_scope ++ (acpi_ps_get_opcode_info ++ (walk_state->opcode)->object_type)) { + /* +- * If the scope op fails to parse, skip the body of the +- * scope op because the parse failure indicates that the +- * device may not exist. ++ * If the scope/device op fails to parse, skip the body of ++ * the scope op because the parse failure indicates that ++ * the device may not exist. + */ ++ ACPI_ERROR((AE_INFO, ++ "Skip parsing opcode %s", ++ acpi_ps_get_opcode_name ++ (walk_state->opcode))); + walk_state->parser_state.aml = + walk_state->aml + 1; + walk_state->parser_state.aml = +@@ -540,8 +547,6 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state) + (&walk_state->parser_state); + walk_state->aml = + walk_state->parser_state.aml; +- ACPI_ERROR((AE_INFO, +- "Skipping Scope block")); + } + + continue; +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index a390c6d4f72d..af7cb8e618fe 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -337,6 +337,7 @@ static ssize_t backing_dev_store(struct device *dev, + struct device_attribute *attr, const char *buf, size_t len) + { + char *file_name; ++ size_t sz; + struct file *backing_dev = NULL; + struct inode *inode; + struct address_space *mapping; +@@ -357,7 +358,11 @@ static ssize_t backing_dev_store(struct device *dev, + goto out; + } + +- strlcpy(file_name, buf, len); ++ strlcpy(file_name, buf, PATH_MAX); ++ /* ignore trailing newline */ ++ sz = strlen(file_name); ++ if (sz > 0 && file_name[sz - 1] == '\n') ++ file_name[sz - 1] = 0x00; + + backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0); + if (IS_ERR(backing_dev)) { +diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c +index 1d50e97d49f1..6d53f7d9fc7a 100644 +--- a/drivers/cpufreq/cpufreq_governor.c ++++ b/drivers/cpufreq/cpufreq_governor.c +@@ -555,12 +555,20 @@ EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_stop); + + void cpufreq_dbs_governor_limits(struct cpufreq_policy *policy) + { +- struct policy_dbs_info *policy_dbs = policy->governor_data; ++ struct policy_dbs_info *policy_dbs; ++ ++ /* Protect gov->gdbs_data against cpufreq_dbs_governor_exit() */ ++ mutex_lock(&gov_dbs_data_mutex); ++ policy_dbs = policy->governor_data; ++ if (!policy_dbs) ++ goto out; + + mutex_lock(&policy_dbs->update_mutex); + cpufreq_policy_apply_limits(policy); + gov_update_sample_delay(policy_dbs, 0); +- + mutex_unlock(&policy_dbs->update_mutex); ++ ++out: ++ mutex_unlock(&gov_dbs_data_mutex); + } + EXPORT_SYMBOL_GPL(cpufreq_dbs_governor_limits); +diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c +index 1aef60d160eb..910f8a68f58b 100644 +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -349,14 +349,12 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + * If the tick is already stopped, the cost of possible short + * idle duration misprediction is much higher, because the CPU + * may be stuck in a shallow idle state for a long time as a +- * result of it. In that case say we might mispredict and try +- * to force the CPU into a state for which we would have stopped +- * the tick, unless a timer is going to expire really soon +- * anyway. ++ * result of it. In that case say we might mispredict and use ++ * the known time till the closest timer event for the idle ++ * state selection. + */ + if (data->predicted_us < TICK_USEC) +- data->predicted_us = min_t(unsigned int, TICK_USEC, +- ktime_to_us(delta_next)); ++ data->predicted_us = ktime_to_us(delta_next); + } else { + /* + * Use the performance multiplier and the user-configurable +@@ -381,8 +379,33 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + continue; + if (idx == -1) + idx = i; /* first enabled state */ +- if (s->target_residency > data->predicted_us) +- break; ++ if (s->target_residency > data->predicted_us) { ++ if (data->predicted_us < TICK_USEC) ++ break; ++ ++ if (!tick_nohz_tick_stopped()) { ++ /* ++ * If the state selected so far is shallow, ++ * waking up early won't hurt, so retain the ++ * tick in that case and let the governor run ++ * again in the next iteration of the loop. ++ */ ++ expected_interval = drv->states[idx].target_residency; ++ break; ++ } ++ ++ /* ++ * If the state selected so far is shallow and this ++ * state's target residency matches the time till the ++ * closest timer event, select this one to avoid getting ++ * stuck in the shallow one for too long. ++ */ ++ if (drv->states[idx].target_residency < TICK_USEC && ++ s->target_residency <= ktime_to_us(delta_next)) ++ idx = i; ++ ++ goto out; ++ } + if (s->exit_latency > latency_req) { + /* + * If we break out of the loop for latency reasons, use +@@ -403,14 +426,13 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + * Don't stop the tick if the selected state is a polling one or if the + * expected idle duration is shorter than the tick period length. + */ +- if ((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) || +- expected_interval < TICK_USEC) { ++ if (((drv->states[idx].flags & CPUIDLE_FLAG_POLLING) || ++ expected_interval < TICK_USEC) && !tick_nohz_tick_stopped()) { + unsigned int delta_next_us = ktime_to_us(delta_next); + + *stop_tick = false; + +- if (!tick_nohz_tick_stopped() && idx > 0 && +- drv->states[idx].target_residency > delta_next_us) { ++ if (idx > 0 && drv->states[idx].target_residency > delta_next_us) { + /* + * The tick is not going to be stopped and the target + * residency of the state to be returned is not within +@@ -429,6 +451,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev, + } + } + ++out: + data->last_state_idx = idx; + + return data->last_state_idx; +diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c +index 6e61cc93c2b0..d7aa7d7ff102 100644 +--- a/drivers/crypto/caam/caamalg_qi.c ++++ b/drivers/crypto/caam/caamalg_qi.c +@@ -679,10 +679,8 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher, + int ret = 0; + + if (keylen != 2 * AES_MIN_KEY_SIZE && keylen != 2 * AES_MAX_KEY_SIZE) { +- crypto_ablkcipher_set_flags(ablkcipher, +- CRYPTO_TFM_RES_BAD_KEY_LEN); + dev_err(jrdev, "key size mismatch\n"); +- return -EINVAL; ++ goto badkey; + } + + ctx->cdata.keylen = keylen; +@@ -715,7 +713,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher, + return ret; + badkey: + crypto_ablkcipher_set_flags(ablkcipher, CRYPTO_TFM_RES_BAD_KEY_LEN); +- return 0; ++ return -EINVAL; + } + + /* +diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c +index 578ea63a3109..f26d62e5533a 100644 +--- a/drivers/crypto/caam/caampkc.c ++++ b/drivers/crypto/caam/caampkc.c +@@ -71,8 +71,8 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc, + dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE); +- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE); +- dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE); ++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL); ++ dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL); + } + + static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc, +@@ -90,8 +90,8 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc, + dma_unmap_single(dev, pdb->dp_dma, p_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->dq_dma, q_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE); +- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE); +- dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_TO_DEVICE); ++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL); ++ dma_unmap_single(dev, pdb->tmp2_dma, q_sz, DMA_BIDIRECTIONAL); + } + + /* RSA Job Completion handler */ +@@ -417,13 +417,13 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req, + goto unmap_p; + } + +- pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE); ++ pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL); + if (dma_mapping_error(dev, pdb->tmp1_dma)) { + dev_err(dev, "Unable to map RSA tmp1 memory\n"); + goto unmap_q; + } + +- pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE); ++ pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL); + if (dma_mapping_error(dev, pdb->tmp2_dma)) { + dev_err(dev, "Unable to map RSA tmp2 memory\n"); + goto unmap_tmp1; +@@ -451,7 +451,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req, + return 0; + + unmap_tmp1: +- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE); ++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL); + unmap_q: + dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE); + unmap_p: +@@ -504,13 +504,13 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req, + goto unmap_dq; + } + +- pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_TO_DEVICE); ++ pdb->tmp1_dma = dma_map_single(dev, key->tmp1, p_sz, DMA_BIDIRECTIONAL); + if (dma_mapping_error(dev, pdb->tmp1_dma)) { + dev_err(dev, "Unable to map RSA tmp1 memory\n"); + goto unmap_qinv; + } + +- pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_TO_DEVICE); ++ pdb->tmp2_dma = dma_map_single(dev, key->tmp2, q_sz, DMA_BIDIRECTIONAL); + if (dma_mapping_error(dev, pdb->tmp2_dma)) { + dev_err(dev, "Unable to map RSA tmp2 memory\n"); + goto unmap_tmp1; +@@ -538,7 +538,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req, + return 0; + + unmap_tmp1: +- dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_TO_DEVICE); ++ dma_unmap_single(dev, pdb->tmp1_dma, p_sz, DMA_BIDIRECTIONAL); + unmap_qinv: + dma_unmap_single(dev, pdb->c_dma, p_sz, DMA_TO_DEVICE); + unmap_dq: +diff --git a/drivers/crypto/caam/jr.c b/drivers/crypto/caam/jr.c +index f4f258075b89..acdd72016ffe 100644 +--- a/drivers/crypto/caam/jr.c ++++ b/drivers/crypto/caam/jr.c +@@ -190,7 +190,8 @@ static void caam_jr_dequeue(unsigned long devarg) + BUG_ON(CIRC_CNT(head, tail + i, JOBR_DEPTH) <= 0); + + /* Unmap just-run descriptor so we can post-process */ +- dma_unmap_single(dev, jrp->outring[hw_idx].desc, ++ dma_unmap_single(dev, ++ caam_dma_to_cpu(jrp->outring[hw_idx].desc), + jrp->entinfo[sw_idx].desc_size, + DMA_TO_DEVICE); + +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 5285ece4f33a..b71895871be3 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -107,24 +107,23 @@ static int p8_aes_cbc_encrypt(struct blkcipher_desc *desc, + ret = crypto_skcipher_encrypt(req); + skcipher_request_zero(req); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->enc_key, walk.iv, 1); ++ disable_kernel_vsx(); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- disable_kernel_vsx(); +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +@@ -147,24 +146,23 @@ static int p8_aes_cbc_decrypt(struct blkcipher_desc *desc, + ret = crypto_skcipher_decrypt(req); + skcipher_request_zero(req); + } else { +- preempt_disable(); +- pagefault_disable(); +- enable_kernel_vsx(); +- + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt(desc, &walk); + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); + aes_p8_cbc_encrypt(walk.src.virt.addr, + walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, + &ctx->dec_key, walk.iv, 0); ++ disable_kernel_vsx(); ++ pagefault_enable(); ++ preempt_enable(); ++ + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- disable_kernel_vsx(); +- pagefault_enable(); +- preempt_enable(); + } + + return ret; +diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c +index 8bd9aff0f55f..e9954a7d4694 100644 +--- a/drivers/crypto/vmx/aes_xts.c ++++ b/drivers/crypto/vmx/aes_xts.c +@@ -116,32 +116,39 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc, + ret = enc? crypto_skcipher_encrypt(req) : crypto_skcipher_decrypt(req); + skcipher_request_zero(req); + } else { ++ blkcipher_walk_init(&walk, dst, src, nbytes); ++ ++ ret = blkcipher_walk_virt(desc, &walk); ++ + preempt_disable(); + pagefault_disable(); + enable_kernel_vsx(); + +- blkcipher_walk_init(&walk, dst, src, nbytes); +- +- ret = blkcipher_walk_virt(desc, &walk); + iv = walk.iv; + memset(tweak, 0, AES_BLOCK_SIZE); + aes_p8_encrypt(iv, tweak, &ctx->tweak_key); + ++ disable_kernel_vsx(); ++ pagefault_enable(); ++ preempt_enable(); ++ + while ((nbytes = walk.nbytes)) { ++ preempt_disable(); ++ pagefault_disable(); ++ enable_kernel_vsx(); + if (enc) + aes_p8_xts_encrypt(walk.src.virt.addr, walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, &ctx->enc_key, NULL, tweak); + else + aes_p8_xts_decrypt(walk.src.virt.addr, walk.dst.virt.addr, + nbytes & AES_BLOCK_MASK, &ctx->dec_key, NULL, tweak); ++ disable_kernel_vsx(); ++ pagefault_enable(); ++ preempt_enable(); + + nbytes &= AES_BLOCK_SIZE - 1; + ret = blkcipher_walk_done(desc, &walk, nbytes); + } +- +- disable_kernel_vsx(); +- pagefault_enable(); +- preempt_enable(); + } + return ret; + } +diff --git a/drivers/dma-buf/reservation.c b/drivers/dma-buf/reservation.c +index 314eb1071cce..532545b9488e 100644 +--- a/drivers/dma-buf/reservation.c ++++ b/drivers/dma-buf/reservation.c +@@ -141,6 +141,7 @@ reservation_object_add_shared_inplace(struct reservation_object *obj, + if (signaled) { + RCU_INIT_POINTER(fobj->shared[signaled_idx], fence); + } else { ++ BUG_ON(fobj->shared_count >= fobj->shared_max); + RCU_INIT_POINTER(fobj->shared[fobj->shared_count], fence); + fobj->shared_count++; + } +@@ -230,10 +231,9 @@ void reservation_object_add_shared_fence(struct reservation_object *obj, + old = reservation_object_get_list(obj); + obj->staged = NULL; + +- if (!fobj) { +- BUG_ON(old->shared_count >= old->shared_max); ++ if (!fobj) + reservation_object_add_shared_inplace(obj, old, fence); +- } else ++ else + reservation_object_add_shared_replace(obj, old, fobj, fence); + } + EXPORT_SYMBOL(reservation_object_add_shared_fence); +diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c +index af83ad58819c..b9d27c8fe57e 100644 +--- a/drivers/extcon/extcon.c ++++ b/drivers/extcon/extcon.c +@@ -433,8 +433,8 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id) + return index; + + spin_lock_irqsave(&edev->lock, flags); +- + state = !!(edev->state & BIT(index)); ++ spin_unlock_irqrestore(&edev->lock, flags); + + /* + * Call functions in a raw notifier chain for the specific one +@@ -448,6 +448,7 @@ int extcon_sync(struct extcon_dev *edev, unsigned int id) + */ + raw_notifier_call_chain(&edev->nh_all, state, edev); + ++ spin_lock_irqsave(&edev->lock, flags); + /* This could be in interrupt handler */ + prop_buf = (char *)get_zeroed_page(GFP_ATOMIC); + if (!prop_buf) { +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index ba0a092ae085..c3949220b770 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -558,11 +558,8 @@ static void reset_channel_cb(void *arg) + channel->onchannel_callback = NULL; + } + +-static int vmbus_close_internal(struct vmbus_channel *channel) ++void vmbus_reset_channel_cb(struct vmbus_channel *channel) + { +- struct vmbus_channel_close_channel *msg; +- int ret; +- + /* + * vmbus_on_event(), running in the per-channel tasklet, can race + * with vmbus_close_internal() in the case of SMP guest, e.g., when +@@ -572,6 +569,29 @@ static int vmbus_close_internal(struct vmbus_channel *channel) + */ + tasklet_disable(&channel->callback_event); + ++ channel->sc_creation_callback = NULL; ++ ++ /* Stop the callback asap */ ++ if (channel->target_cpu != get_cpu()) { ++ put_cpu(); ++ smp_call_function_single(channel->target_cpu, reset_channel_cb, ++ channel, true); ++ } else { ++ reset_channel_cb(channel); ++ put_cpu(); ++ } ++ ++ /* Re-enable tasklet for use on re-open */ ++ tasklet_enable(&channel->callback_event); ++} ++ ++static int vmbus_close_internal(struct vmbus_channel *channel) ++{ ++ struct vmbus_channel_close_channel *msg; ++ int ret; ++ ++ vmbus_reset_channel_cb(channel); ++ + /* + * In case a device driver's probe() fails (e.g., + * util_probe() -> vmbus_open() returns -ENOMEM) and the device is +@@ -585,16 +605,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel) + } + + channel->state = CHANNEL_OPEN_STATE; +- channel->sc_creation_callback = NULL; +- /* Stop callback and cancel the timer asap */ +- if (channel->target_cpu != get_cpu()) { +- put_cpu(); +- smp_call_function_single(channel->target_cpu, reset_channel_cb, +- channel, true); +- } else { +- reset_channel_cb(channel); +- put_cpu(); +- } + + /* Send a closing message */ + +@@ -639,8 +649,6 @@ static int vmbus_close_internal(struct vmbus_channel *channel) + get_order(channel->ringbuffer_pagecount * PAGE_SIZE)); + + out: +- /* re-enable tasklet for use on re-open */ +- tasklet_enable(&channel->callback_event); + return ret; + } + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index ecc2bd275a73..0f0e091c117c 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -527,10 +527,8 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel) + struct hv_device *dev + = newchannel->primary_channel->device_obj; + +- if (vmbus_add_channel_kobj(dev, newchannel)) { +- atomic_dec(&vmbus_connection.offer_in_progress); ++ if (vmbus_add_channel_kobj(dev, newchannel)) + goto err_free_chan; +- } + + if (channel->sc_creation_callback != NULL) + channel->sc_creation_callback(newchannel); +@@ -894,6 +892,12 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr) + return; + } + ++ /* ++ * Before setting channel->rescind in vmbus_rescind_cleanup(), we ++ * should make sure the channel callback is not running any more. ++ */ ++ vmbus_reset_channel_cb(channel); ++ + /* + * Now wait for offer handling to complete. + */ +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 27436a937492..54b2a3a86677 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -693,7 +693,6 @@ int i2c_dw_probe(struct dw_i2c_dev *dev) + i2c_set_adapdata(adap, dev); + + if (dev->pm_disabled) { +- dev_pm_syscore_device(dev->dev, true); + irq_flags = IRQF_NO_SUSPEND; + } else { + irq_flags = IRQF_SHARED | IRQF_COND_SUSPEND; +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 5660daf6c92e..d281d21cdd8e 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -448,6 +448,9 @@ static int dw_i2c_plat_suspend(struct device *dev) + { + struct dw_i2c_dev *i_dev = dev_get_drvdata(dev); + ++ if (i_dev->pm_disabled) ++ return 0; ++ + i_dev->disable(i_dev); + i2c_dw_prepare_clk(i_dev, false); + +@@ -458,7 +461,9 @@ static int dw_i2c_plat_resume(struct device *dev) + { + struct dw_i2c_dev *i_dev = dev_get_drvdata(dev); + +- i2c_dw_prepare_clk(i_dev, true); ++ if (!i_dev->pm_disabled) ++ i2c_dw_prepare_clk(i_dev, true); ++ + i_dev->init(i_dev); + + return 0; +diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c +index 4dceb75e3586..4964561595f5 100644 +--- a/drivers/iio/accel/sca3000.c ++++ b/drivers/iio/accel/sca3000.c +@@ -797,6 +797,7 @@ static int sca3000_write_raw(struct iio_dev *indio_dev, + mutex_lock(&st->lock); + ret = sca3000_write_3db_freq(st, val); + mutex_unlock(&st->lock); ++ return ret; + default: + return -EINVAL; + } +diff --git a/drivers/iio/frequency/ad9523.c b/drivers/iio/frequency/ad9523.c +index ddb6a334ae68..8e8263758439 100644 +--- a/drivers/iio/frequency/ad9523.c ++++ b/drivers/iio/frequency/ad9523.c +@@ -508,7 +508,7 @@ static ssize_t ad9523_store(struct device *dev, + return ret; + + if (!state) +- return 0; ++ return len; + + mutex_lock(&indio_dev->mlock); + switch ((u32)this_attr->address) { +@@ -642,7 +642,7 @@ static int ad9523_read_raw(struct iio_dev *indio_dev, + code = (AD9523_CLK_DIST_DIV_PHASE_REV(ret) * 3141592) / + AD9523_CLK_DIST_DIV_REV(ret); + *val = code / 1000000; +- *val2 = (code % 1000000) * 10; ++ *val2 = code % 1000000; + return IIO_VAL_INT_PLUS_MICRO; + default: + return -EINVAL; +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index b3ba9a222550..cbeae4509359 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -4694,7 +4694,7 @@ static void mlx5_ib_dealloc_counters(struct mlx5_ib_dev *dev) + int i; + + for (i = 0; i < dev->num_ports; i++) { +- if (dev->port[i].cnts.set_id) ++ if (dev->port[i].cnts.set_id_valid) + mlx5_core_dealloc_q_counter(dev->mdev, + dev->port[i].cnts.set_id); + kfree(dev->port[i].cnts.names); +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index a4f1f638509f..01eae67d5a6e 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -1626,7 +1626,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + struct mlx5_ib_resources *devr = &dev->devr; + int inlen = MLX5_ST_SZ_BYTES(create_qp_in); + struct mlx5_core_dev *mdev = dev->mdev; +- struct mlx5_ib_create_qp_resp resp; ++ struct mlx5_ib_create_qp_resp resp = {}; + struct mlx5_ib_cq *send_cq; + struct mlx5_ib_cq *recv_cq; + unsigned long flags; +@@ -5365,7 +5365,9 @@ static int set_user_rq_size(struct mlx5_ib_dev *dev, + + rwq->wqe_count = ucmd->rq_wqe_count; + rwq->wqe_shift = ucmd->rq_wqe_shift; +- rwq->buf_size = (rwq->wqe_count << rwq->wqe_shift); ++ if (check_shl_overflow(rwq->wqe_count, rwq->wqe_shift, &rwq->buf_size)) ++ return -EINVAL; ++ + rwq->log_rq_stride = rwq->wqe_shift; + rwq->log_rq_size = ilog2(rwq->wqe_count); + return 0; +diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c +index 98d470d1f3fc..83311dd07019 100644 +--- a/drivers/infiniband/sw/rxe/rxe_comp.c ++++ b/drivers/infiniband/sw/rxe/rxe_comp.c +@@ -276,6 +276,7 @@ static inline enum comp_state check_ack(struct rxe_qp *qp, + case IB_OPCODE_RC_RDMA_READ_RESPONSE_MIDDLE: + if (wqe->wr.opcode != IB_WR_RDMA_READ && + wqe->wr.opcode != IB_WR_RDMA_READ_WITH_INV) { ++ wqe->status = IB_WC_FATAL_ERR; + return COMPST_ERROR; + } + reset_retry_counters(qp); +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 3081c629a7f7..8a9633e97bec 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1833,8 +1833,7 @@ static bool srpt_close_ch(struct srpt_rdma_ch *ch) + int ret; + + if (!srpt_set_ch_state(ch, CH_DRAINING)) { +- pr_debug("%s-%d: already closed\n", ch->sess_name, +- ch->qp->qp_num); ++ pr_debug("%s: already closed\n", ch->sess_name); + return false; + } + +@@ -1940,8 +1939,8 @@ static void __srpt_close_all_ch(struct srpt_port *sport) + list_for_each_entry(nexus, &sport->nexus_list, entry) { + list_for_each_entry(ch, &nexus->ch_list, list) { + if (srpt_disconnect_ch(ch) >= 0) +- pr_info("Closing channel %s-%d because target %s_%d has been disabled\n", +- ch->sess_name, ch->qp->qp_num, ++ pr_info("Closing channel %s because target %s_%d has been disabled\n", ++ ch->sess_name, + sport->sdev->device->name, sport->port); + srpt_close_ch(ch); + } +@@ -2087,7 +2086,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev, + struct rdma_conn_param rdma_cm; + struct ib_cm_rep_param ib_cm; + } *rep_param = NULL; +- struct srpt_rdma_ch *ch; ++ struct srpt_rdma_ch *ch = NULL; + char i_port_id[36]; + u32 it_iu_len; + int i, ret; +@@ -2234,13 +2233,15 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev, + TARGET_PROT_NORMAL, + i_port_id + 2, ch, NULL); + if (IS_ERR_OR_NULL(ch->sess)) { ++ WARN_ON_ONCE(ch->sess == NULL); + ret = PTR_ERR(ch->sess); ++ ch->sess = NULL; + pr_info("Rejected login for initiator %s: ret = %d.\n", + ch->sess_name, ret); + rej->reason = cpu_to_be32(ret == -ENOMEM ? + SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES : + SRP_LOGIN_REJ_CHANNEL_LIMIT_REACHED); +- goto reject; ++ goto destroy_ib; + } + + mutex_lock(&sport->mutex); +@@ -2279,7 +2280,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev, + rej->reason = cpu_to_be32(SRP_LOGIN_REJ_INSUFFICIENT_RESOURCES); + pr_err("rejected SRP_LOGIN_REQ because enabling RTR failed (error code = %d)\n", + ret); +- goto destroy_ib; ++ goto reject; + } + + pr_debug("Establish connection sess=%p name=%s ch=%p\n", ch->sess, +@@ -2358,8 +2359,11 @@ free_ring: + srpt_free_ioctx_ring((struct srpt_ioctx **)ch->ioctx_ring, + ch->sport->sdev, ch->rq_size, + ch->max_rsp_size, DMA_TO_DEVICE); ++ + free_ch: +- if (ib_cm_id) ++ if (rdma_cm_id) ++ rdma_cm_id->context = NULL; ++ else + ib_cm_id->context = NULL; + kfree(ch); + ch = NULL; +@@ -2379,6 +2383,15 @@ reject: + ib_send_cm_rej(ib_cm_id, IB_CM_REJ_CONSUMER_DEFINED, NULL, 0, + rej, sizeof(*rej)); + ++ if (ch && ch->sess) { ++ srpt_close_ch(ch); ++ /* ++ * Tell the caller not to free cm_id since ++ * srpt_release_channel_work() will do that. ++ */ ++ ret = 0; ++ } ++ + out: + kfree(rep_param); + kfree(rsp); +@@ -2969,7 +2982,8 @@ static void srpt_add_one(struct ib_device *device) + + pr_debug("device = %p\n", device); + +- sdev = kzalloc(sizeof(*sdev), GFP_KERNEL); ++ sdev = kzalloc(struct_size(sdev, port, device->phys_port_cnt), ++ GFP_KERNEL); + if (!sdev) + goto err; + +@@ -3023,8 +3037,6 @@ static void srpt_add_one(struct ib_device *device) + srpt_event_handler); + ib_register_event_handler(&sdev->event_handler); + +- WARN_ON(sdev->device->phys_port_cnt > ARRAY_SIZE(sdev->port)); +- + for (i = 1; i <= sdev->device->phys_port_cnt; i++) { + sport = &sdev->port[i - 1]; + INIT_LIST_HEAD(&sport->nexus_list); +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h +index 2361483476a0..444dfd7281b5 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.h ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.h +@@ -396,9 +396,9 @@ struct srpt_port { + * @sdev_mutex: Serializes use_srq changes. + * @use_srq: Whether or not to use SRQ. + * @ioctx_ring: Per-HCA SRQ. +- * @port: Information about the ports owned by this HCA. + * @event_handler: Per-HCA asynchronous IB event handler. + * @list: Node in srpt_dev_list. ++ * @port: Information about the ports owned by this HCA. + */ + struct srpt_device { + struct ib_device *device; +@@ -410,9 +410,9 @@ struct srpt_device { + struct mutex sdev_mutex; + bool use_srq; + struct srpt_recv_ioctx **ioctx_ring; +- struct srpt_port port[2]; + struct ib_event_handler event_handler; + struct list_head list; ++ struct srpt_port port[]; + }; + + #endif /* IB_SRPT_H */ +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 75456b5aa825..d9c748b6f9e4 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1339,8 +1339,8 @@ void qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr, + qi_submit_sync(&desc, iommu); + } + +-void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, +- u64 addr, unsigned mask) ++void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid, ++ u16 qdep, u64 addr, unsigned mask) + { + struct qi_desc desc; + +@@ -1355,7 +1355,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, + qdep = 0; + + desc.low = QI_DEV_IOTLB_SID(sid) | QI_DEV_IOTLB_QDEP(qdep) | +- QI_DIOTLB_TYPE; ++ QI_DIOTLB_TYPE | QI_DEV_IOTLB_PFSID(pfsid); + + qi_submit_sync(&desc, iommu); + } +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 115ff26e9ced..07dc938199f9 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -421,6 +421,7 @@ struct device_domain_info { + struct list_head global; /* link to global list */ + u8 bus; /* PCI bus number */ + u8 devfn; /* PCI devfn number */ ++ u16 pfsid; /* SRIOV physical function source ID */ + u8 pasid_supported:3; + u8 pasid_enabled:1; + u8 pri_supported:1; +@@ -1501,6 +1502,20 @@ static void iommu_enable_dev_iotlb(struct device_domain_info *info) + return; + + pdev = to_pci_dev(info->dev); ++ /* For IOMMU that supports device IOTLB throttling (DIT), we assign ++ * PFSID to the invalidation desc of a VF such that IOMMU HW can gauge ++ * queue depth at PF level. If DIT is not set, PFSID will be treated as ++ * reserved, which should be set to 0. ++ */ ++ if (!ecap_dit(info->iommu->ecap)) ++ info->pfsid = 0; ++ else { ++ struct pci_dev *pf_pdev; ++ ++ /* pdev will be returned if device is not a vf */ ++ pf_pdev = pci_physfn(pdev); ++ info->pfsid = PCI_DEVID(pf_pdev->bus->number, pf_pdev->devfn); ++ } + + #ifdef CONFIG_INTEL_IOMMU_SVM + /* The PCIe spec, in its wisdom, declares that the behaviour of +@@ -1566,7 +1581,8 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain, + + sid = info->bus << 8 | info->devfn; + qdep = info->ats_qdep; +- qi_flush_dev_iotlb(info->iommu, sid, qdep, addr, mask); ++ qi_flush_dev_iotlb(info->iommu, sid, info->pfsid, ++ qdep, addr, mask); + } + spin_unlock_irqrestore(&device_domain_lock, flags); + } +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 40ae6e87cb88..09b47260c74b 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -1081,12 +1081,19 @@ static struct platform_driver ipmmu_driver = { + + static int __init ipmmu_init(void) + { ++ struct device_node *np; + static bool setup_done; + int ret; + + if (setup_done) + return 0; + ++ np = of_find_matching_node(NULL, ipmmu_of_ids); ++ if (!np) ++ return 0; ++ ++ of_node_put(np); ++ + ret = platform_driver_register(&ipmmu_driver); + if (ret < 0) + return ret; +diff --git a/drivers/mailbox/mailbox-xgene-slimpro.c b/drivers/mailbox/mailbox-xgene-slimpro.c +index a7040163dd43..b8b2b3533f46 100644 +--- a/drivers/mailbox/mailbox-xgene-slimpro.c ++++ b/drivers/mailbox/mailbox-xgene-slimpro.c +@@ -195,9 +195,9 @@ static int slimpro_mbox_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, ctx); + + regs = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- mb_base = devm_ioremap(&pdev->dev, regs->start, resource_size(regs)); +- if (!mb_base) +- return -ENOMEM; ++ mb_base = devm_ioremap_resource(&pdev->dev, regs); ++ if (IS_ERR(mb_base)) ++ return PTR_ERR(mb_base); + + /* Setup mailbox links */ + for (i = 0; i < MBOX_CNT; i++) { +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index ad45ebe1a74b..6c33923c2c35 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -645,8 +645,10 @@ static int bch_writeback_thread(void *arg) + * data on cache. BCACHE_DEV_DETACHING flag is set in + * bch_cached_dev_detach(). + */ +- if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) ++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) { ++ up_write(&dc->writeback_lock); + break; ++ } + } + + up_write(&dc->writeback_lock); +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 0d7212410e21..69dddeab124c 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -363,7 +363,7 @@ static int __write_initial_superblock(struct dm_cache_metadata *cmd) + disk_super->version = cpu_to_le32(cmd->version); + memset(disk_super->policy_name, 0, sizeof(disk_super->policy_name)); + memset(disk_super->policy_version, 0, sizeof(disk_super->policy_version)); +- disk_super->policy_hint_size = 0; ++ disk_super->policy_hint_size = cpu_to_le32(0); + + __copy_sm_root(cmd, disk_super); + +@@ -701,6 +701,7 @@ static int __commit_transaction(struct dm_cache_metadata *cmd, + disk_super->policy_version[0] = cpu_to_le32(cmd->policy_version[0]); + disk_super->policy_version[1] = cpu_to_le32(cmd->policy_version[1]); + disk_super->policy_version[2] = cpu_to_le32(cmd->policy_version[2]); ++ disk_super->policy_hint_size = cpu_to_le32(cmd->policy_hint_size); + + disk_super->read_hits = cpu_to_le32(cmd->stats.read_hits); + disk_super->read_misses = cpu_to_le32(cmd->stats.read_misses); +@@ -1322,6 +1323,7 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd, + + dm_oblock_t oblock; + unsigned flags; ++ bool dirty = true; + + dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le); + memcpy(&mapping, mapping_value_le, sizeof(mapping)); +@@ -1332,8 +1334,10 @@ static int __load_mapping_v1(struct dm_cache_metadata *cmd, + dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le); + memcpy(&hint, hint_value_le, sizeof(hint)); + } ++ if (cmd->clean_when_opened) ++ dirty = flags & M_DIRTY; + +- r = fn(context, oblock, to_cblock(cb), flags & M_DIRTY, ++ r = fn(context, oblock, to_cblock(cb), dirty, + le32_to_cpu(hint), hints_valid); + if (r) { + DMERR("policy couldn't load cache block %llu", +@@ -1361,7 +1365,7 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd, + + dm_oblock_t oblock; + unsigned flags; +- bool dirty; ++ bool dirty = true; + + dm_array_cursor_get_value(mapping_cursor, (void **) &mapping_value_le); + memcpy(&mapping, mapping_value_le, sizeof(mapping)); +@@ -1372,8 +1376,9 @@ static int __load_mapping_v2(struct dm_cache_metadata *cmd, + dm_array_cursor_get_value(hint_cursor, (void **) &hint_value_le); + memcpy(&hint, hint_value_le, sizeof(hint)); + } ++ if (cmd->clean_when_opened) ++ dirty = dm_bitset_cursor_get_value(dirty_cursor); + +- dirty = dm_bitset_cursor_get_value(dirty_cursor); + r = fn(context, oblock, to_cblock(cb), dirty, + le32_to_cpu(hint), hints_valid); + if (r) { +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index b61b069c33af..3fdec1147221 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -3069,11 +3069,11 @@ static void crypt_io_hints(struct dm_target *ti, struct queue_limits *limits) + */ + limits->max_segment_size = PAGE_SIZE; + +- if (cc->sector_size != (1 << SECTOR_SHIFT)) { +- limits->logical_block_size = cc->sector_size; +- limits->physical_block_size = cc->sector_size; +- blk_limits_io_min(limits, cc->sector_size); +- } ++ limits->logical_block_size = ++ max_t(unsigned short, limits->logical_block_size, cc->sector_size); ++ limits->physical_block_size = ++ max_t(unsigned, limits->physical_block_size, cc->sector_size); ++ limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size); + } + + static struct target_type crypt_target = { +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 86438b2f10dd..0a8a4c2aa3ea 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -178,7 +178,7 @@ struct dm_integrity_c { + __u8 sectors_per_block; + + unsigned char mode; +- bool suspending; ++ int suspending; + + int failed; + +@@ -2210,7 +2210,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti) + + del_timer_sync(&ic->autocommit_timer); + +- ic->suspending = true; ++ WRITE_ONCE(ic->suspending, 1); + + queue_work(ic->commit_wq, &ic->commit_work); + drain_workqueue(ic->commit_wq); +@@ -2220,7 +2220,7 @@ static void dm_integrity_postsuspend(struct dm_target *ti) + dm_integrity_flush_buffers(ic); + } + +- ic->suspending = false; ++ WRITE_ONCE(ic->suspending, 0); + + BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress)); + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index b900723bbd0f..1087f6a1ac79 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2520,6 +2520,8 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) + case PM_WRITE: + if (old_mode != new_mode) + notify_of_pool_mode_change(pool, "write"); ++ if (old_mode == PM_OUT_OF_DATA_SPACE) ++ cancel_delayed_work_sync(&pool->no_space_timeout); + pool->out_of_data_space = false; + pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space; + dm_pool_metadata_read_write(pool->pmd); +diff --git a/drivers/md/dm-writecache.c b/drivers/md/dm-writecache.c +index 87107c995cb5..7669069005e9 100644 +--- a/drivers/md/dm-writecache.c ++++ b/drivers/md/dm-writecache.c +@@ -457,7 +457,7 @@ static void ssd_commit_flushed(struct dm_writecache *wc) + COMPLETION_INITIALIZER_ONSTACK(endio.c), + ATOMIC_INIT(1), + }; +- unsigned bitmap_bits = wc->dirty_bitmap_size * BITS_PER_LONG; ++ unsigned bitmap_bits = wc->dirty_bitmap_size * 8; + unsigned i = 0; + + while (1) { +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index b162c2fe62c3..76e6bed5a1da 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -872,7 +872,7 @@ static int tvp5150_fill_fmt(struct v4l2_subdev *sd, + f = &format->format; + + f->width = decoder->rect.width; +- f->height = decoder->rect.height; ++ f->height = decoder->rect.height / 2; + + f->code = MEDIA_BUS_FMT_UYVY8_2X8; + f->field = V4L2_FIELD_ALTERNATE; +diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c +index c37ccbfd52f2..96c07fa1802a 100644 +--- a/drivers/mfd/hi655x-pmic.c ++++ b/drivers/mfd/hi655x-pmic.c +@@ -49,7 +49,7 @@ static struct regmap_config hi655x_regmap_config = { + .reg_bits = 32, + .reg_stride = HI655X_STRIDE, + .val_bits = 8, +- .max_register = HI655X_BUS_ADDR(0xFFF), ++ .max_register = HI655X_BUS_ADDR(0x400) - HI655X_STRIDE, + }; + + static struct resource pwrkey_resources[] = { +diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c +index c1ba0d42cbc8..e0f29b8a872d 100644 +--- a/drivers/misc/cxl/main.c ++++ b/drivers/misc/cxl/main.c +@@ -287,7 +287,7 @@ int cxl_adapter_context_get(struct cxl *adapter) + int rc; + + rc = atomic_inc_unless_negative(&adapter->contexts_num); +- return rc >= 0 ? 0 : -EBUSY; ++ return rc ? 0 : -EBUSY; + } + + void cxl_adapter_context_put(struct cxl *adapter) +diff --git a/drivers/misc/ocxl/link.c b/drivers/misc/ocxl/link.c +index 88876ae8f330..a963b0a4a3c5 100644 +--- a/drivers/misc/ocxl/link.c ++++ b/drivers/misc/ocxl/link.c +@@ -136,7 +136,7 @@ static void xsl_fault_handler_bh(struct work_struct *fault_work) + int rc; + + /* +- * We need to release a reference on the mm whenever exiting this ++ * We must release a reference on mm_users whenever exiting this + * function (taken in the memory fault interrupt handler) + */ + rc = copro_handle_mm_fault(fault->pe_data.mm, fault->dar, fault->dsisr, +@@ -172,7 +172,7 @@ static void xsl_fault_handler_bh(struct work_struct *fault_work) + } + r = RESTART; + ack: +- mmdrop(fault->pe_data.mm); ++ mmput(fault->pe_data.mm); + ack_irq(spa, r); + } + +@@ -184,6 +184,7 @@ static irqreturn_t xsl_fault_handler(int irq, void *data) + struct pe_data *pe_data; + struct ocxl_process_element *pe; + int lpid, pid, tid; ++ bool schedule = false; + + read_irq(spa, &dsisr, &dar, &pe_handle); + trace_ocxl_fault(spa->spa_mem, pe_handle, dsisr, dar, -1); +@@ -226,14 +227,19 @@ static irqreturn_t xsl_fault_handler(int irq, void *data) + } + WARN_ON(pe_data->mm->context.id != pid); + +- spa->xsl_fault.pe = pe_handle; +- spa->xsl_fault.dar = dar; +- spa->xsl_fault.dsisr = dsisr; +- spa->xsl_fault.pe_data = *pe_data; +- mmgrab(pe_data->mm); /* mm count is released by bottom half */ +- ++ if (mmget_not_zero(pe_data->mm)) { ++ spa->xsl_fault.pe = pe_handle; ++ spa->xsl_fault.dar = dar; ++ spa->xsl_fault.dsisr = dsisr; ++ spa->xsl_fault.pe_data = *pe_data; ++ schedule = true; ++ /* mm_users count released by bottom half */ ++ } + rcu_read_unlock(); +- schedule_work(&spa->xsl_fault.fault_work); ++ if (schedule) ++ schedule_work(&spa->xsl_fault.fault_work); ++ else ++ ack_irq(spa, ADDRESS_ERROR); + return IRQ_HANDLED; + } + +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 56c6f79a5c5a..5f8b583c6e41 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -341,7 +341,13 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps) + success = false; + } + +- if (b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) ++ /* ++ * 2MB pages are only supported with batching. If batching is for some ++ * reason disabled, do not use 2MB pages, since otherwise the legacy ++ * mechanism is used with 2MB pages, causing a failure. ++ */ ++ if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) && ++ (b->capabilities & VMW_BALLOON_BATCHED_CMDS)) + b->supported_page_sizes = 2; + else + b->supported_page_sizes = 1; +@@ -450,7 +456,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, + + pfn32 = (u32)pfn; + if (pfn32 != pfn) +- return -1; ++ return -EINVAL; + + STATS_INC(b->stats.lock[false]); + +@@ -460,7 +466,7 @@ static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn, + + pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status); + STATS_INC(b->stats.lock_fail[false]); +- return 1; ++ return -EIO; + } + + static int vmballoon_send_batched_lock(struct vmballoon *b, +@@ -597,11 +603,12 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, + + locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status, + target); +- if (locked > 0) { ++ if (locked) { + STATS_INC(b->stats.refused_alloc[false]); + +- if (hv_status == VMW_BALLOON_ERROR_RESET || +- hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED) { ++ if (locked == -EIO && ++ (hv_status == VMW_BALLOON_ERROR_RESET || ++ hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) { + vmballoon_free_page(page, false); + return -EIO; + } +@@ -617,7 +624,7 @@ static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages, + } else { + vmballoon_free_page(page, false); + } +- return -EIO; ++ return locked; + } + + /* track allocated page */ +@@ -1029,29 +1036,30 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b) + */ + static int vmballoon_vmci_init(struct vmballoon *b) + { +- int error = 0; ++ unsigned long error, dummy; + +- if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) != 0) { +- error = vmci_doorbell_create(&b->vmci_doorbell, +- VMCI_FLAG_DELAYED_CB, +- VMCI_PRIVILEGE_FLAG_RESTRICTED, +- vmballoon_doorbell, b); +- +- if (error == VMCI_SUCCESS) { +- VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, +- b->vmci_doorbell.context, +- b->vmci_doorbell.resource, error); +- STATS_INC(b->stats.doorbell_set); +- } +- } ++ if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0) ++ return 0; + +- if (error != 0) { +- vmballoon_vmci_cleanup(b); ++ error = vmci_doorbell_create(&b->vmci_doorbell, VMCI_FLAG_DELAYED_CB, ++ VMCI_PRIVILEGE_FLAG_RESTRICTED, ++ vmballoon_doorbell, b); + +- return -EIO; +- } ++ if (error != VMCI_SUCCESS) ++ goto fail; ++ ++ error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context, ++ b->vmci_doorbell.resource, dummy); ++ ++ STATS_INC(b->stats.doorbell_set); ++ ++ if (error != VMW_BALLOON_SUCCESS) ++ goto fail; + + return 0; ++fail: ++ vmballoon_vmci_cleanup(b); ++ return -EIO; + } + + /* +@@ -1289,7 +1297,14 @@ static int __init vmballoon_init(void) + + return 0; + } +-module_init(vmballoon_init); ++ ++/* ++ * Using late_initcall() instead of module_init() allows the balloon to use the ++ * VMCI doorbell even when the balloon is built into the kernel. Otherwise the ++ * VMCI is probed only after the balloon is initialized. If the balloon is used ++ * as a module, late_initcall() is equivalent to module_init(). ++ */ ++late_initcall(vmballoon_init); + + static void __exit vmballoon_exit(void) + { +diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c +index 648eb6743ed5..6edffeed9953 100644 +--- a/drivers/mmc/core/queue.c ++++ b/drivers/mmc/core/queue.c +@@ -238,10 +238,6 @@ static void mmc_mq_exit_request(struct blk_mq_tag_set *set, struct request *req, + mmc_exit_request(mq->queue, req); + } + +-/* +- * We use BLK_MQ_F_BLOCKING and have only 1 hardware queue, which means requests +- * will not be dispatched in parallel. +- */ + static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + const struct blk_mq_queue_data *bd) + { +@@ -264,7 +260,7 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + + spin_lock_irq(q->queue_lock); + +- if (mq->recovery_needed) { ++ if (mq->recovery_needed || mq->busy) { + spin_unlock_irq(q->queue_lock); + return BLK_STS_RESOURCE; + } +@@ -291,6 +287,9 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + break; + } + ++ /* Parallel dispatch of requests is not supported at the moment */ ++ mq->busy = true; ++ + mq->in_flight[issue_type] += 1; + get_card = (mmc_tot_in_flight(mq) == 1); + cqe_retune_ok = (mmc_cqe_qcnt(mq) == 1); +@@ -333,9 +332,12 @@ static blk_status_t mmc_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + mq->in_flight[issue_type] -= 1; + if (mmc_tot_in_flight(mq) == 0) + put_card = true; ++ mq->busy = false; + spin_unlock_irq(q->queue_lock); + if (put_card) + mmc_put_card(card, &mq->ctx); ++ } else { ++ WRITE_ONCE(mq->busy, false); + } + + return ret; +diff --git a/drivers/mmc/core/queue.h b/drivers/mmc/core/queue.h +index 17e59d50b496..9bf3c9245075 100644 +--- a/drivers/mmc/core/queue.h ++++ b/drivers/mmc/core/queue.h +@@ -81,6 +81,7 @@ struct mmc_queue { + unsigned int cqe_busy; + #define MMC_CQE_DCMD_BUSY BIT(0) + #define MMC_CQE_QUEUE_FULL BIT(1) ++ bool busy; + bool use_cqe; + bool recovery_needed; + bool in_recovery; +diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +index d032bd63444d..4a7991151918 100644 +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -45,14 +45,16 @@ + /* DM_CM_RST */ + #define RST_DTRANRST1 BIT(9) + #define RST_DTRANRST0 BIT(8) +-#define RST_RESERVED_BITS GENMASK_ULL(32, 0) ++#define RST_RESERVED_BITS GENMASK_ULL(31, 0) + + /* DM_CM_INFO1 and DM_CM_INFO1_MASK */ + #define INFO1_CLEAR 0 ++#define INFO1_MASK_CLEAR GENMASK_ULL(31, 0) + #define INFO1_DTRANEND1 BIT(17) + #define INFO1_DTRANEND0 BIT(16) + + /* DM_CM_INFO2 and DM_CM_INFO2_MASK */ ++#define INFO2_MASK_CLEAR GENMASK_ULL(31, 0) + #define INFO2_DTRANERR1 BIT(17) + #define INFO2_DTRANERR0 BIT(16) + +@@ -236,6 +238,12 @@ renesas_sdhi_internal_dmac_request_dma(struct tmio_mmc_host *host, + { + struct renesas_sdhi *priv = host_to_priv(host); + ++ /* Disable DMAC interrupts, we don't use them */ ++ renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO1_MASK, ++ INFO1_MASK_CLEAR); ++ renesas_sdhi_internal_dmac_dm_write(host, DM_CM_INFO2_MASK, ++ INFO2_MASK_CLEAR); ++ + /* Each value is set to non-zero to assume "enabling" each DMA */ + host->chan_rx = host->chan_tx = (void *)0xdeadbeaf; + +diff --git a/drivers/net/wireless/marvell/libertas/dev.h b/drivers/net/wireless/marvell/libertas/dev.h +index dd1ee1f0af48..469134930026 100644 +--- a/drivers/net/wireless/marvell/libertas/dev.h ++++ b/drivers/net/wireless/marvell/libertas/dev.h +@@ -104,6 +104,7 @@ struct lbs_private { + u8 fw_ready; + u8 surpriseremoved; + u8 setup_fw_on_resume; ++ u8 power_up_on_resume; + int (*hw_host_to_card) (struct lbs_private *priv, u8 type, u8 *payload, u16 nb); + void (*reset_card) (struct lbs_private *priv); + int (*power_save) (struct lbs_private *priv); +diff --git a/drivers/net/wireless/marvell/libertas/if_sdio.c b/drivers/net/wireless/marvell/libertas/if_sdio.c +index 2300e796c6ab..43743c26c071 100644 +--- a/drivers/net/wireless/marvell/libertas/if_sdio.c ++++ b/drivers/net/wireless/marvell/libertas/if_sdio.c +@@ -1290,15 +1290,23 @@ static void if_sdio_remove(struct sdio_func *func) + static int if_sdio_suspend(struct device *dev) + { + struct sdio_func *func = dev_to_sdio_func(dev); +- int ret; + struct if_sdio_card *card = sdio_get_drvdata(func); ++ struct lbs_private *priv = card->priv; ++ int ret; + + mmc_pm_flag_t flags = sdio_get_host_pm_caps(func); ++ priv->power_up_on_resume = false; + + /* If we're powered off anyway, just let the mmc layer remove the + * card. */ +- if (!lbs_iface_active(card->priv)) +- return -ENOSYS; ++ if (!lbs_iface_active(priv)) { ++ if (priv->fw_ready) { ++ priv->power_up_on_resume = true; ++ if_sdio_power_off(card); ++ } ++ ++ return 0; ++ } + + dev_info(dev, "%s: suspend: PM flags = 0x%x\n", + sdio_func_id(func), flags); +@@ -1306,9 +1314,14 @@ static int if_sdio_suspend(struct device *dev) + /* If we aren't being asked to wake on anything, we should bail out + * and let the SD stack power down the card. + */ +- if (card->priv->wol_criteria == EHS_REMOVE_WAKEUP) { ++ if (priv->wol_criteria == EHS_REMOVE_WAKEUP) { + dev_info(dev, "Suspend without wake params -- powering down card\n"); +- return -ENOSYS; ++ if (priv->fw_ready) { ++ priv->power_up_on_resume = true; ++ if_sdio_power_off(card); ++ } ++ ++ return 0; + } + + if (!(flags & MMC_PM_KEEP_POWER)) { +@@ -1321,7 +1334,7 @@ static int if_sdio_suspend(struct device *dev) + if (ret) + return ret; + +- ret = lbs_suspend(card->priv); ++ ret = lbs_suspend(priv); + if (ret) + return ret; + +@@ -1336,6 +1349,11 @@ static int if_sdio_resume(struct device *dev) + + dev_info(dev, "%s: resume: we're back\n", sdio_func_id(func)); + ++ if (card->priv->power_up_on_resume) { ++ if_sdio_power_on(card); ++ wait_event(card->pwron_waitq, card->priv->fw_ready); ++ } ++ + ret = lbs_resume(card->priv); + + return ret; +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index 27902a8799b1..8aae6dcc839f 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -812,9 +812,9 @@ u32 nd_cmd_out_size(struct nvdimm *nvdimm, int cmd, + * overshoots the remainder by 4 bytes, assume it was + * including 'status'. + */ +- if (out_field[1] - 8 == remainder) ++ if (out_field[1] - 4 == remainder) + return remainder; +- return out_field[1] - 4; ++ return out_field[1] - 8; + } else if (cmd == ND_CMD_CALL) { + struct nd_cmd_pkg *pkg = (struct nd_cmd_pkg *) in_field; + +diff --git a/drivers/nvdimm/dimm_devs.c b/drivers/nvdimm/dimm_devs.c +index 8d348b22ba45..863cabc35215 100644 +--- a/drivers/nvdimm/dimm_devs.c ++++ b/drivers/nvdimm/dimm_devs.c +@@ -536,6 +536,37 @@ resource_size_t nd_blk_available_dpa(struct nd_region *nd_region) + return info.available; + } + ++/** ++ * nd_pmem_max_contiguous_dpa - For the given dimm+region, return the max ++ * contiguous unallocated dpa range. ++ * @nd_region: constrain available space check to this reference region ++ * @nd_mapping: container of dpa-resource-root + labels ++ */ ++resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region, ++ struct nd_mapping *nd_mapping) ++{ ++ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping); ++ struct nvdimm_bus *nvdimm_bus; ++ resource_size_t max = 0; ++ struct resource *res; ++ ++ /* if a dimm is disabled the available capacity is zero */ ++ if (!ndd) ++ return 0; ++ ++ nvdimm_bus = walk_to_nvdimm_bus(ndd->dev); ++ if (__reserve_free_pmem(&nd_region->dev, nd_mapping->nvdimm)) ++ return 0; ++ for_each_dpa_resource(ndd, res) { ++ if (strcmp(res->name, "pmem-reserve") != 0) ++ continue; ++ if (resource_size(res) > max) ++ max = resource_size(res); ++ } ++ release_free_pmem(nvdimm_bus, nd_mapping); ++ return max; ++} ++ + /** + * nd_pmem_available_dpa - for the given dimm+region account unallocated dpa + * @nd_mapping: container of dpa-resource-root + labels +diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c +index 28afdd668905..4525d8ef6022 100644 +--- a/drivers/nvdimm/namespace_devs.c ++++ b/drivers/nvdimm/namespace_devs.c +@@ -799,7 +799,7 @@ static int merge_dpa(struct nd_region *nd_region, + return 0; + } + +-static int __reserve_free_pmem(struct device *dev, void *data) ++int __reserve_free_pmem(struct device *dev, void *data) + { + struct nvdimm *nvdimm = data; + struct nd_region *nd_region; +@@ -836,7 +836,7 @@ static int __reserve_free_pmem(struct device *dev, void *data) + return 0; + } + +-static void release_free_pmem(struct nvdimm_bus *nvdimm_bus, ++void release_free_pmem(struct nvdimm_bus *nvdimm_bus, + struct nd_mapping *nd_mapping) + { + struct nvdimm_drvdata *ndd = to_ndd(nd_mapping); +@@ -1032,7 +1032,7 @@ static ssize_t __size_store(struct device *dev, unsigned long long val) + + allocated += nvdimm_allocated_dpa(ndd, &label_id); + } +- available = nd_region_available_dpa(nd_region); ++ available = nd_region_allocatable_dpa(nd_region); + + if (val > available + allocated) + return -ENOSPC; +diff --git a/drivers/nvdimm/nd-core.h b/drivers/nvdimm/nd-core.h +index 79274ead54fb..ac68072fb8cd 100644 +--- a/drivers/nvdimm/nd-core.h ++++ b/drivers/nvdimm/nd-core.h +@@ -100,6 +100,14 @@ struct nd_region; + struct nvdimm_drvdata; + struct nd_mapping; + void nd_mapping_free_labels(struct nd_mapping *nd_mapping); ++ ++int __reserve_free_pmem(struct device *dev, void *data); ++void release_free_pmem(struct nvdimm_bus *nvdimm_bus, ++ struct nd_mapping *nd_mapping); ++ ++resource_size_t nd_pmem_max_contiguous_dpa(struct nd_region *nd_region, ++ struct nd_mapping *nd_mapping); ++resource_size_t nd_region_allocatable_dpa(struct nd_region *nd_region); + resource_size_t nd_pmem_available_dpa(struct nd_region *nd_region, + struct nd_mapping *nd_mapping, resource_size_t *overlap); + resource_size_t nd_blk_available_dpa(struct nd_region *nd_region); +diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c +index ec3543b83330..c30d5af02cc2 100644 +--- a/drivers/nvdimm/region_devs.c ++++ b/drivers/nvdimm/region_devs.c +@@ -389,6 +389,30 @@ resource_size_t nd_region_available_dpa(struct nd_region *nd_region) + return available; + } + ++resource_size_t nd_region_allocatable_dpa(struct nd_region *nd_region) ++{ ++ resource_size_t available = 0; ++ int i; ++ ++ if (is_memory(&nd_region->dev)) ++ available = PHYS_ADDR_MAX; ++ ++ WARN_ON(!is_nvdimm_bus_locked(&nd_region->dev)); ++ for (i = 0; i < nd_region->ndr_mappings; i++) { ++ struct nd_mapping *nd_mapping = &nd_region->mapping[i]; ++ ++ if (is_memory(&nd_region->dev)) ++ available = min(available, ++ nd_pmem_max_contiguous_dpa(nd_region, ++ nd_mapping)); ++ else if (is_nd_blk(&nd_region->dev)) ++ available += nd_blk_available_dpa(nd_region); ++ } ++ if (is_memory(&nd_region->dev)) ++ return available * nd_region->ndr_mappings; ++ return available; ++} ++ + static ssize_t available_size_show(struct device *dev, + struct device_attribute *attr, char *buf) + { +diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c +index 665da3c8fbce..f45798679e3c 100644 +--- a/drivers/pwm/pwm-omap-dmtimer.c ++++ b/drivers/pwm/pwm-omap-dmtimer.c +@@ -264,8 +264,9 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev) + + timer_pdata = dev_get_platdata(&timer_pdev->dev); + if (!timer_pdata) { +- dev_err(&pdev->dev, "dmtimer pdata structure NULL\n"); +- ret = -EINVAL; ++ dev_dbg(&pdev->dev, ++ "dmtimer pdata structure NULL, deferring probe\n"); ++ ret = -EPROBE_DEFER; + goto put; + } + +diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c +index 4c22cb395040..f7b8a86fa5c5 100644 +--- a/drivers/pwm/pwm-tiehrpwm.c ++++ b/drivers/pwm/pwm-tiehrpwm.c +@@ -33,10 +33,6 @@ + #define TBCTL 0x00 + #define TBPRD 0x0A + +-#define TBCTL_RUN_MASK (BIT(15) | BIT(14)) +-#define TBCTL_STOP_NEXT 0 +-#define TBCTL_STOP_ON_CYCLE BIT(14) +-#define TBCTL_FREE_RUN (BIT(15) | BIT(14)) + #define TBCTL_PRDLD_MASK BIT(3) + #define TBCTL_PRDLD_SHDW 0 + #define TBCTL_PRDLD_IMDT BIT(3) +@@ -360,7 +356,7 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + /* Channels polarity can be configured from action qualifier module */ + configure_polarity(pc, pwm->hwpwm); + +- /* Enable TBCLK before enabling PWM device */ ++ /* Enable TBCLK */ + ret = clk_enable(pc->tbclk); + if (ret) { + dev_err(chip->dev, "Failed to enable TBCLK for %s: %d\n", +@@ -368,9 +364,6 @@ static int ehrpwm_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + return ret; + } + +- /* Enable time counter for free_run */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_FREE_RUN); +- + return 0; + } + +@@ -388,6 +381,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + aqcsfrc_mask = AQCSFRC_CSFA_MASK; + } + ++ /* Update shadow register first before modifying active register */ ++ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val); + /* + * Changes to immediate action on Action Qualifier. This puts + * Action Qualifier control on PWM output from next TBCLK +@@ -400,9 +395,6 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + /* Disabling TBCLK on PWM disable */ + clk_disable(pc->tbclk); + +- /* Stop Time base counter */ +- ehrpwm_modify(pc->mmio_base, TBCTL, TBCTL_RUN_MASK, TBCTL_STOP_NEXT); +- + /* Disable clock on PWM disable */ + pm_runtime_put_sync(chip->dev); + } +diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c +index 39086398833e..6a7b804c3074 100644 +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -861,13 +861,6 @@ static int omap_rtc_probe(struct platform_device *pdev) + goto err; + } + +- if (rtc->is_pmic_controller) { +- if (!pm_power_off) { +- omap_rtc_power_off_rtc = rtc; +- pm_power_off = omap_rtc_power_off; +- } +- } +- + /* Support ext_wakeup pinconf */ + rtc_pinctrl_desc.name = dev_name(&pdev->dev); + +@@ -880,12 +873,21 @@ static int omap_rtc_probe(struct platform_device *pdev) + + ret = rtc_register_device(rtc->rtc); + if (ret) +- goto err; ++ goto err_deregister_pinctrl; + + rtc_nvmem_register(rtc->rtc, &omap_rtc_nvmem_config); + ++ if (rtc->is_pmic_controller) { ++ if (!pm_power_off) { ++ omap_rtc_power_off_rtc = rtc; ++ pm_power_off = omap_rtc_power_off; ++ } ++ } ++ + return 0; + ++err_deregister_pinctrl: ++ pinctrl_unregister(rtc->pctldev); + err: + clk_disable_unprepare(rtc->clk); + device_init_wakeup(&pdev->dev, false); +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index f3dad6fcdc35..a568f35522f9 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -319,7 +319,7 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi) + */ + if (cdns_spi_read(xspi, CDNS_SPI_ISR) & + CDNS_SPI_IXR_TXFULL) +- usleep_range(10, 20); ++ udelay(10); + + if (xspi->txbuf) + cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++); +diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c +index 577084bb911b..a02099c90c5c 100644 +--- a/drivers/spi/spi-davinci.c ++++ b/drivers/spi/spi-davinci.c +@@ -217,7 +217,7 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value) + pdata = &dspi->pdata; + + /* program delay transfers if tx_delay is non zero */ +- if (spicfg->wdelay) ++ if (spicfg && spicfg->wdelay) + spidat1 |= SPIDAT1_WDEL; + + /* +diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c +index 0630962ce442..f225f7c99a32 100644 +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -1029,30 +1029,30 @@ static int dspi_probe(struct platform_device *pdev) + goto out_master_put; + } + ++ dspi->clk = devm_clk_get(&pdev->dev, "dspi"); ++ if (IS_ERR(dspi->clk)) { ++ ret = PTR_ERR(dspi->clk); ++ dev_err(&pdev->dev, "unable to get clock\n"); ++ goto out_master_put; ++ } ++ ret = clk_prepare_enable(dspi->clk); ++ if (ret) ++ goto out_master_put; ++ + dspi_init(dspi); + dspi->irq = platform_get_irq(pdev, 0); + if (dspi->irq < 0) { + dev_err(&pdev->dev, "can't get platform irq\n"); + ret = dspi->irq; +- goto out_master_put; ++ goto out_clk_put; + } + + ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt, 0, + pdev->name, dspi); + if (ret < 0) { + dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n"); +- goto out_master_put; +- } +- +- dspi->clk = devm_clk_get(&pdev->dev, "dspi"); +- if (IS_ERR(dspi->clk)) { +- ret = PTR_ERR(dspi->clk); +- dev_err(&pdev->dev, "unable to get clock\n"); +- goto out_master_put; ++ goto out_clk_put; + } +- ret = clk_prepare_enable(dspi->clk); +- if (ret) +- goto out_master_put; + + if (dspi->devtype_data->trans_mode == DSPI_DMA_MODE) { + ret = dspi_request_dma(dspi, res->start); +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 0b2d60d30f69..14f4ea59caff 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1391,6 +1391,10 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = { + { PCI_VDEVICE(INTEL, 0x31c2), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x31c4), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x31c6), LPSS_BXT_SSP }, ++ /* ICL-LP */ ++ { PCI_VDEVICE(INTEL, 0x34aa), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x34ab), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0x34fb), LPSS_CNL_SSP }, + /* APL */ + { PCI_VDEVICE(INTEL, 0x5ac2), LPSS_BXT_SSP }, + { PCI_VDEVICE(INTEL, 0x5ac4), LPSS_BXT_SSP }, +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 9c14a453f73c..80bb56facfb6 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -182,6 +182,7 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state, + { + struct uart_port *uport = uart_port_check(state); + unsigned long page; ++ unsigned long flags = 0; + int retval = 0; + + if (uport->type == PORT_UNKNOWN) +@@ -196,15 +197,18 @@ static int uart_port_startup(struct tty_struct *tty, struct uart_state *state, + * Initialise and allocate the transmit and temporary + * buffer. + */ +- if (!state->xmit.buf) { +- /* This is protected by the per port mutex */ +- page = get_zeroed_page(GFP_KERNEL); +- if (!page) +- return -ENOMEM; ++ page = get_zeroed_page(GFP_KERNEL); ++ if (!page) ++ return -ENOMEM; + ++ uart_port_lock(state, flags); ++ if (!state->xmit.buf) { + state->xmit.buf = (unsigned char *) page; + uart_circ_clear(&state->xmit); ++ } else { ++ free_page(page); + } ++ uart_port_unlock(uport, flags); + + retval = uport->ops->startup(uport); + if (retval == 0) { +@@ -263,6 +267,7 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) + { + struct uart_port *uport = uart_port_check(state); + struct tty_port *port = &state->port; ++ unsigned long flags = 0; + + /* + * Set the TTY IO error marker +@@ -295,10 +300,12 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state) + /* + * Free the transmit buffer page. + */ ++ uart_port_lock(state, flags); + if (state->xmit.buf) { + free_page((unsigned long)state->xmit.buf); + state->xmit.buf = NULL; + } ++ uart_port_unlock(uport, flags); + } + + /** +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 609438d2465b..9ae2fb1344de 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1704,12 +1704,12 @@ static int do_register_framebuffer(struct fb_info *fb_info) + return 0; + } + +-static int do_unregister_framebuffer(struct fb_info *fb_info) ++static int unbind_console(struct fb_info *fb_info) + { + struct fb_event event; +- int i, ret = 0; ++ int ret; ++ int i = fb_info->node; + +- i = fb_info->node; + if (i < 0 || i >= FB_MAX || registered_fb[i] != fb_info) + return -EINVAL; + +@@ -1724,17 +1724,29 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + unlock_fb_info(fb_info); + console_unlock(); + ++ return ret; ++} ++ ++static int __unlink_framebuffer(struct fb_info *fb_info); ++ ++static int do_unregister_framebuffer(struct fb_info *fb_info) ++{ ++ struct fb_event event; ++ int ret; ++ ++ ret = unbind_console(fb_info); ++ + if (ret) + return -EINVAL; + + pm_vt_switch_unregister(fb_info->dev); + +- unlink_framebuffer(fb_info); ++ __unlink_framebuffer(fb_info); + if (fb_info->pixmap.addr && + (fb_info->pixmap.flags & FB_PIXMAP_DEFAULT)) + kfree(fb_info->pixmap.addr); + fb_destroy_modelist(&fb_info->modelist); +- registered_fb[i] = NULL; ++ registered_fb[fb_info->node] = NULL; + num_registered_fb--; + fb_cleanup_device(fb_info); + event.info = fb_info; +@@ -1747,7 +1759,7 @@ static int do_unregister_framebuffer(struct fb_info *fb_info) + return 0; + } + +-int unlink_framebuffer(struct fb_info *fb_info) ++static int __unlink_framebuffer(struct fb_info *fb_info) + { + int i; + +@@ -1759,6 +1771,20 @@ int unlink_framebuffer(struct fb_info *fb_info) + device_destroy(fb_class, MKDEV(FB_MAJOR, i)); + fb_info->dev = NULL; + } ++ ++ return 0; ++} ++ ++int unlink_framebuffer(struct fb_info *fb_info) ++{ ++ int ret; ++ ++ ret = __unlink_framebuffer(fb_info); ++ if (ret) ++ return ret; ++ ++ unbind_console(fb_info); ++ + return 0; + } + EXPORT_SYMBOL(unlink_framebuffer); +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index f365d4862015..862e8027acf6 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include