From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: /
Date: Tue, 13 Nov 2018 21:17:25 +0000 (UTC) [thread overview]
Message-ID: <1542143816.baff7bbd22061d6307a998016251982c843d4cb7.mpagano@gentoo> (raw)
commit: baff7bbd22061d6307a998016251982c843d4cb7
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 13 21:16:56 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 13 21:16:56 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=baff7bbd
proj/linux-patches: Linux patch 4.18.19
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1018_linux-4.18.19.patch | 15151 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 15155 insertions(+)
diff --git a/0000_README b/0000_README
index bdc7ee9..afaac7a 100644
--- a/0000_README
+++ b/0000_README
@@ -115,6 +115,10 @@ Patch: 1017_linux-4.18.18.patch
From: http://www.kernel.org
Desc: Linux 4.18.18
+Patch: 1018_linux-4.18.19.patch
+From: http://www.kernel.org
+Desc: Linux 4.18.19
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1018_linux-4.18.19.patch b/1018_linux-4.18.19.patch
new file mode 100644
index 0000000..40499cf
--- /dev/null
+++ b/1018_linux-4.18.19.patch
@@ -0,0 +1,15151 @@
+diff --git a/Documentation/filesystems/fscrypt.rst b/Documentation/filesystems/fscrypt.rst
+index 48b424de85bb..cfbc18f0d9c9 100644
+--- a/Documentation/filesystems/fscrypt.rst
++++ b/Documentation/filesystems/fscrypt.rst
+@@ -191,21 +191,11 @@ Currently, the following pairs of encryption modes are supported:
+
+ - AES-256-XTS for contents and AES-256-CTS-CBC for filenames
+ - AES-128-CBC for contents and AES-128-CTS-CBC for filenames
+-- Speck128/256-XTS for contents and Speck128/256-CTS-CBC for filenames
+
+ It is strongly recommended to use AES-256-XTS for contents encryption.
+ AES-128-CBC was added only for low-powered embedded devices with
+ crypto accelerators such as CAAM or CESA that do not support XTS.
+
+-Similarly, Speck128/256 support was only added for older or low-end
+-CPUs which cannot do AES fast enough -- especially ARM CPUs which have
+-NEON instructions but not the Cryptography Extensions -- and for which
+-it would not otherwise be feasible to use encryption at all. It is
+-not recommended to use Speck on CPUs that have AES instructions.
+-Speck support is only available if it has been enabled in the crypto
+-API via CONFIG_CRYPTO_SPECK. Also, on ARM platforms, to get
+-acceptable performance CONFIG_CRYPTO_SPECK_NEON must be enabled.
+-
+ New encryption modes can be added relatively easily, without changes
+ to individual filesystems. However, authenticated encryption (AE)
+ modes are not currently supported because of the difficulty of dealing
+diff --git a/Documentation/media/uapi/cec/cec-ioc-receive.rst b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+index e964074cd15b..b25e48afaa08 100644
+--- a/Documentation/media/uapi/cec/cec-ioc-receive.rst
++++ b/Documentation/media/uapi/cec/cec-ioc-receive.rst
+@@ -16,10 +16,10 @@ CEC_RECEIVE, CEC_TRANSMIT - Receive or transmit a CEC message
+ Synopsis
+ ========
+
+-.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_RECEIVE, struct cec_msg \*argp )
+ :name: CEC_RECEIVE
+
+-.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg *argp )
++.. c:function:: int ioctl( int fd, CEC_TRANSMIT, struct cec_msg \*argp )
+ :name: CEC_TRANSMIT
+
+ Arguments
+@@ -272,6 +272,19 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The transmit failed after one or more retries. This status bit is
+ mutually exclusive with :ref:`CEC_TX_STATUS_OK <CEC-TX-STATUS-OK>`.
+ Other bits can still be set to explain which failures were seen.
++ * .. _`CEC-TX-STATUS-ABORTED`:
++
++ - ``CEC_TX_STATUS_ABORTED``
++ - 0x40
++ - The transmit was aborted due to an HDMI disconnect, or the adapter
++ was unconfigured, or a transmit was interrupted, or the driver
++ returned an error when attempting to start a transmit.
++ * .. _`CEC-TX-STATUS-TIMEOUT`:
++
++ - ``CEC_TX_STATUS_TIMEOUT``
++ - 0x80
++ - The transmit timed out. This should not normally happen and this
++ indicates a driver problem.
+
+
+ .. tabularcolumns:: |p{5.6cm}|p{0.9cm}|p{11.0cm}|
+@@ -300,6 +313,14 @@ View On' messages from initiator 0xf ('Unregistered') to destination 0 ('TV').
+ - The message was received successfully but the reply was
+ ``CEC_MSG_FEATURE_ABORT``. This status is only set if this message
+ was the reply to an earlier transmitted message.
++ * .. _`CEC-RX-STATUS-ABORTED`:
++
++ - ``CEC_RX_STATUS_ABORTED``
++ - 0x08
++ - The wait for a reply to an earlier transmitted message was aborted
++ because the HDMI cable was disconnected, the adapter was unconfigured
++ or the :ref:`CEC_TRANSMIT <CEC_RECEIVE>` that waited for a
++ reply was interrupted.
+
+
+
+diff --git a/Documentation/media/uapi/v4l/biblio.rst b/Documentation/media/uapi/v4l/biblio.rst
+index 1cedcfc04327..386d6cf83e9c 100644
+--- a/Documentation/media/uapi/v4l/biblio.rst
++++ b/Documentation/media/uapi/v4l/biblio.rst
+@@ -226,16 +226,6 @@ xvYCC
+
+ :author: International Electrotechnical Commission (http://www.iec.ch)
+
+-.. _adobergb:
+-
+-AdobeRGB
+-========
+-
+-
+-:title: Adobe© RGB (1998) Color Image Encoding Version 2005-05
+-
+-:author: Adobe Systems Incorporated (http://www.adobe.com)
+-
+ .. _oprgb:
+
+ opRGB
+diff --git a/Documentation/media/uapi/v4l/colorspaces-defs.rst b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+index 410907fe9415..f24615544792 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-defs.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-defs.rst
+@@ -51,8 +51,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - See :ref:`col-rec709`.
+ * - ``V4L2_COLORSPACE_SRGB``
+ - See :ref:`col-srgb`.
+- * - ``V4L2_COLORSPACE_ADOBERGB``
+- - See :ref:`col-adobergb`.
++ * - ``V4L2_COLORSPACE_OPRGB``
++ - See :ref:`col-oprgb`.
+ * - ``V4L2_COLORSPACE_BT2020``
+ - See :ref:`col-bt2020`.
+ * - ``V4L2_COLORSPACE_DCI_P3``
+@@ -90,8 +90,8 @@ whole range, 0-255, dividing the angular value by 1.41. The enum
+ - Use the Rec. 709 transfer function.
+ * - ``V4L2_XFER_FUNC_SRGB``
+ - Use the sRGB transfer function.
+- * - ``V4L2_XFER_FUNC_ADOBERGB``
+- - Use the AdobeRGB transfer function.
++ * - ``V4L2_XFER_FUNC_OPRGB``
++ - Use the opRGB transfer function.
+ * - ``V4L2_XFER_FUNC_SMPTE240M``
+ - Use the SMPTE 240M transfer function.
+ * - ``V4L2_XFER_FUNC_NONE``
+diff --git a/Documentation/media/uapi/v4l/colorspaces-details.rst b/Documentation/media/uapi/v4l/colorspaces-details.rst
+index b5d551b9cc8f..09fabf4cd412 100644
+--- a/Documentation/media/uapi/v4l/colorspaces-details.rst
++++ b/Documentation/media/uapi/v4l/colorspaces-details.rst
+@@ -290,15 +290,14 @@ Y' is clamped to the range [0…1] and Cb and Cr are clamped to the range
+ 170M/BT.601. The Y'CbCr quantization is limited range.
+
+
+-.. _col-adobergb:
++.. _col-oprgb:
+
+-Colorspace Adobe RGB (V4L2_COLORSPACE_ADOBERGB)
++Colorspace opRGB (V4L2_COLORSPACE_OPRGB)
+ ===============================================
+
+-The :ref:`adobergb` standard defines the colorspace used by computer
+-graphics that use the AdobeRGB colorspace. This is also known as the
+-:ref:`oprgb` standard. The default transfer function is
+-``V4L2_XFER_FUNC_ADOBERGB``. The default Y'CbCr encoding is
++The :ref:`oprgb` standard defines the colorspace used by computer
++graphics that use the opRGB colorspace. The default transfer function is
++``V4L2_XFER_FUNC_OPRGB``. The default Y'CbCr encoding is
+ ``V4L2_YCBCR_ENC_601``. The default Y'CbCr quantization is limited
+ range.
+
+@@ -312,7 +311,7 @@ The chromaticities of the primary colors and the white reference are:
+
+ .. tabularcolumns:: |p{4.4cm}|p{4.4cm}|p{8.7cm}|
+
+-.. flat-table:: Adobe RGB Chromaticities
++.. flat-table:: opRGB Chromaticities
+ :header-rows: 1
+ :stub-columns: 0
+ :widths: 1 1 2
+diff --git a/Documentation/media/videodev2.h.rst.exceptions b/Documentation/media/videodev2.h.rst.exceptions
+index a5cb0a8686ac..8813ff9c42b9 100644
+--- a/Documentation/media/videodev2.h.rst.exceptions
++++ b/Documentation/media/videodev2.h.rst.exceptions
+@@ -56,7 +56,8 @@ replace symbol V4L2_MEMORY_USERPTR :c:type:`v4l2_memory`
+ # Documented enum v4l2_colorspace
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_BG :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_470_SYSTEM_M :c:type:`v4l2_colorspace`
+-replace symbol V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
++replace symbol V4L2_COLORSPACE_OPRGB :c:type:`v4l2_colorspace`
++replace define V4L2_COLORSPACE_ADOBERGB :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_BT2020 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DCI_P3 :c:type:`v4l2_colorspace`
+ replace symbol V4L2_COLORSPACE_DEFAULT :c:type:`v4l2_colorspace`
+@@ -69,7 +70,8 @@ replace symbol V4L2_COLORSPACE_SRGB :c:type:`v4l2_colorspace`
+
+ # Documented enum v4l2_xfer_func
+ replace symbol V4L2_XFER_FUNC_709 :c:type:`v4l2_xfer_func`
+-replace symbol V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
++replace symbol V4L2_XFER_FUNC_OPRGB :c:type:`v4l2_xfer_func`
++replace define V4L2_XFER_FUNC_ADOBERGB :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DCI_P3 :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_DEFAULT :c:type:`v4l2_xfer_func`
+ replace symbol V4L2_XFER_FUNC_NONE :c:type:`v4l2_xfer_func`
+diff --git a/Makefile b/Makefile
+index 7b35c1ec0427..71642133ba22 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 18
+-SUBLEVEL = 18
++SUBLEVEL = 19
+ EXTRAVERSION =
+ NAME = Merciless Moray
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index a0ddf497e8cd..2cb45ddd2ae3 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -354,7 +354,7 @@
+ ti,hwmods = "pcie1";
+ phys = <&pcie1_phy>;
+ phy-names = "pcie-phy0";
+- ti,syscon-unaligned-access = <&scm_conf1 0x14 2>;
++ ti,syscon-unaligned-access = <&scm_conf1 0x14 1>;
+ status = "disabled";
+ };
+ };
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index 962af97c1883..aff5d66ae058 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -78,6 +78,22 @@
+ compatible = "arm,cortex-a7";
+ reg = <1>;
+ clock-frequency = <1000000000>;
++ clocks = <&cmu CLK_ARM_CLK>;
++ clock-names = "cpu";
++ #cooling-cells = <2>;
++
++ operating-points = <
++ 1000000 1150000
++ 900000 1112500
++ 800000 1075000
++ 700000 1037500
++ 600000 1000000
++ 500000 962500
++ 400000 925000
++ 300000 887500
++ 200000 850000
++ 100000 850000
++ >;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos4210-origen.dts b/arch/arm/boot/dts/exynos4210-origen.dts
+index 2ab99f9f3d0a..dd9ec05eb0f7 100644
+--- a/arch/arm/boot/dts/exynos4210-origen.dts
++++ b/arch/arm/boot/dts/exynos4210-origen.dts
+@@ -151,6 +151,8 @@
+ reg = <0x66>;
+ interrupt-parent = <&gpx0>;
+ interrupts = <4 IRQ_TYPE_NONE>, <3 IRQ_TYPE_NONE>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&max8997_irq>;
+
+ max8997,pmic-buck1-dvs-voltage = <1350000>;
+ max8997,pmic-buck2-dvs-voltage = <1100000>;
+@@ -288,6 +290,13 @@
+ };
+ };
+
++&pinctrl_1 {
++ max8997_irq: max8997-irq {
++ samsung,pins = "gpx0-3", "gpx0-4";
++ samsung,pin-pud = <EXYNOS_PIN_PULL_NONE>;
++ };
++};
++
+ &sdhci_0 {
+ bus-width = <4>;
+ pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus4 &sd0_cd>;
+diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
+index 88fb47cef9a8..b6091c27f155 100644
+--- a/arch/arm/boot/dts/exynos4210.dtsi
++++ b/arch/arm/boot/dts/exynos4210.dtsi
+@@ -55,6 +55,19 @@
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0x901>;
++ clocks = <&clock CLK_ARM_CLK>;
++ clock-names = "cpu";
++ clock-latency = <160000>;
++
++ operating-points = <
++ 1200000 1250000
++ 1000000 1150000
++ 800000 1075000
++ 500000 975000
++ 400000 975000
++ 200000 950000
++ >;
++ #cooling-cells = <2>; /* min followed by max */
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi
+index 7b43c10c510b..51f72f0327e5 100644
+--- a/arch/arm/boot/dts/exynos4412.dtsi
++++ b/arch/arm/boot/dts/exynos4412.dtsi
+@@ -49,21 +49,30 @@
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0xA01>;
++ clocks = <&clock CLK_ARM_CLK>;
++ clock-names = "cpu";
+ operating-points-v2 = <&cpu0_opp_table>;
++ #cooling-cells = <2>; /* min followed by max */
+ };
+
+ cpu@a02 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0xA02>;
++ clocks = <&clock CLK_ARM_CLK>;
++ clock-names = "cpu";
+ operating-points-v2 = <&cpu0_opp_table>;
++ #cooling-cells = <2>; /* min followed by max */
+ };
+
+ cpu@a03 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a9";
+ reg = <0xA03>;
++ clocks = <&clock CLK_ARM_CLK>;
++ clock-names = "cpu";
+ operating-points-v2 = <&cpu0_opp_table>;
++ #cooling-cells = <2>; /* min followed by max */
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index 2daf505b3d08..f04adf72b80e 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -54,36 +54,106 @@
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <0>;
+- clock-frequency = <1700000000>;
+ clocks = <&clock CLK_ARM_CLK>;
+ clock-names = "cpu";
+- clock-latency = <140000>;
+-
+- operating-points = <
+- 1700000 1300000
+- 1600000 1250000
+- 1500000 1225000
+- 1400000 1200000
+- 1300000 1150000
+- 1200000 1125000
+- 1100000 1100000
+- 1000000 1075000
+- 900000 1050000
+- 800000 1025000
+- 700000 1012500
+- 600000 1000000
+- 500000 975000
+- 400000 950000
+- 300000 937500
+- 200000 925000
+- >;
++ operating-points-v2 = <&cpu0_opp_table>;
+ #cooling-cells = <2>; /* min followed by max */
+ };
+ cpu@1 {
+ device_type = "cpu";
+ compatible = "arm,cortex-a15";
+ reg = <1>;
+- clock-frequency = <1700000000>;
++ clocks = <&clock CLK_ARM_CLK>;
++ clock-names = "cpu";
++ operating-points-v2 = <&cpu0_opp_table>;
++ #cooling-cells = <2>; /* min followed by max */
++ };
++ };
++
++ cpu0_opp_table: opp_table0 {
++ compatible = "operating-points-v2";
++ opp-shared;
++
++ opp-200000000 {
++ opp-hz = /bits/ 64 <200000000>;
++ opp-microvolt = <925000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-300000000 {
++ opp-hz = /bits/ 64 <300000000>;
++ opp-microvolt = <937500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-400000000 {
++ opp-hz = /bits/ 64 <400000000>;
++ opp-microvolt = <950000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-500000000 {
++ opp-hz = /bits/ 64 <500000000>;
++ opp-microvolt = <975000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-600000000 {
++ opp-hz = /bits/ 64 <600000000>;
++ opp-microvolt = <1000000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-700000000 {
++ opp-hz = /bits/ 64 <700000000>;
++ opp-microvolt = <1012500>;
++ clock-latency-ns = <140000>;
++ };
++ opp-800000000 {
++ opp-hz = /bits/ 64 <800000000>;
++ opp-microvolt = <1025000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-900000000 {
++ opp-hz = /bits/ 64 <900000000>;
++ opp-microvolt = <1050000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1000000000 {
++ opp-hz = /bits/ 64 <1000000000>;
++ opp-microvolt = <1075000>;
++ clock-latency-ns = <140000>;
++ opp-suspend;
++ };
++ opp-1100000000 {
++ opp-hz = /bits/ 64 <1100000000>;
++ opp-microvolt = <1100000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1200000000 {
++ opp-hz = /bits/ 64 <1200000000>;
++ opp-microvolt = <1125000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1300000000 {
++ opp-hz = /bits/ 64 <1300000000>;
++ opp-microvolt = <1150000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1400000000 {
++ opp-hz = /bits/ 64 <1400000000>;
++ opp-microvolt = <1200000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1500000000 {
++ opp-hz = /bits/ 64 <1500000000>;
++ opp-microvolt = <1225000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1600000000 {
++ opp-hz = /bits/ 64 <1600000000>;
++ opp-microvolt = <1250000>;
++ clock-latency-ns = <140000>;
++ };
++ opp-1700000000 {
++ opp-hz = /bits/ 64 <1700000000>;
++ opp-microvolt = <1300000>;
++ clock-latency-ns = <140000>;
+ };
+ };
+
+diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi
+index 791ca15c799e..bd1985694bca 100644
+--- a/arch/arm/boot/dts/socfpga_arria10.dtsi
++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi
+@@ -601,7 +601,7 @@
+ status = "disabled";
+ };
+
+- sdr: sdr@ffc25000 {
++ sdr: sdr@ffcfb100 {
+ compatible = "altr,sdr-ctl", "syscon";
+ reg = <0xffcfb100 0x80>;
+ };
+diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig
+index 925d1364727a..b8e69fe282b8 100644
+--- a/arch/arm/crypto/Kconfig
++++ b/arch/arm/crypto/Kconfig
+@@ -121,10 +121,4 @@ config CRYPTO_CHACHA20_NEON
+ select CRYPTO_BLKCIPHER
+ select CRYPTO_CHACHA20
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile
+index 8de542c48ade..bd5bceef0605 100644
+--- a/arch/arm/crypto/Makefile
++++ b/arch/arm/crypto/Makefile
+@@ -10,7 +10,6 @@ obj-$(CONFIG_CRYPTO_SHA1_ARM_NEON) += sha1-arm-neon.o
+ obj-$(CONFIG_CRYPTO_SHA256_ARM) += sha256-arm.o
+ obj-$(CONFIG_CRYPTO_SHA512_ARM) += sha512-arm.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+
+ ce-obj-$(CONFIG_CRYPTO_AES_ARM_CE) += aes-arm-ce.o
+ ce-obj-$(CONFIG_CRYPTO_SHA1_ARM_CE) += sha1-arm-ce.o
+@@ -54,7 +53,6 @@ ghash-arm-ce-y := ghash-ce-core.o ghash-ce-glue.o
+ crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o
+ crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+
+ ifdef REGENERATE_ARM_CRYPTO
+ quiet_cmd_perl = PERL $@
+diff --git a/arch/arm/crypto/speck-neon-core.S b/arch/arm/crypto/speck-neon-core.S
+deleted file mode 100644
+index 57caa742016e..000000000000
+--- a/arch/arm/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,434 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+- .fpu neon
+-
+- // arguments
+- ROUND_KEYS .req r0 // const {u64,u32} *round_keys
+- NROUNDS .req r1 // int nrounds
+- DST .req r2 // void *dst
+- SRC .req r3 // const void *src
+- NBYTES .req r4 // unsigned int nbytes
+- TWEAK .req r5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- X0 .req q0
+- X0_L .req d0
+- X0_H .req d1
+- Y0 .req q1
+- Y0_H .req d3
+- X1 .req q2
+- X1_L .req d4
+- X1_H .req d5
+- Y1 .req q3
+- Y1_H .req d7
+- X2 .req q4
+- X2_L .req d8
+- X2_H .req d9
+- Y2 .req q5
+- Y2_H .req d11
+- X3 .req q6
+- X3_L .req d12
+- X3_H .req d13
+- Y3 .req q7
+- Y3_H .req d15
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req q8
+- ROUND_KEY_L .req d16
+- ROUND_KEY_H .req d17
+-
+- // index vector for vtbl-based 8-bit rotates
+- ROTATE_TABLE .req d18
+-
+- // multiplication table for updating XTS tweaks
+- GF128MUL_TABLE .req d19
+- GF64MUL_TABLE .req d19
+-
+- // current XTS tweak value(s)
+- TWEAKV .req q10
+- TWEAKV_L .req d20
+- TWEAKV_H .req d21
+-
+- TMP0 .req q12
+- TMP0_L .req d24
+- TMP0_H .req d25
+- TMP1 .req q13
+- TMP2 .req q14
+- TMP3 .req q15
+-
+- .align 4
+-.Lror64_8_table:
+- .byte 1, 2, 3, 4, 5, 6, 7, 0
+-.Lror32_8_table:
+- .byte 1, 2, 3, 0, 5, 6, 7, 4
+-.Lrol64_8_table:
+- .byte 7, 0, 1, 2, 3, 4, 5, 6
+-.Lrol32_8_table:
+- .byte 3, 0, 1, 2, 7, 4, 5, 6
+-.Lgf128mul_table:
+- .byte 0, 0x87
+- .fill 14
+-.Lgf64mul_table:
+- .byte 0, 0x1b, (0x1b << 1), (0x1b << 1) ^ 0x1b
+- .fill 12
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- *
+- * The 8-bit rotates are implemented using vtbl instead of vshr + vsli because
+- * the vtbl approach is faster on some processors and the same speed on others.
+- */
+-.macro _speck_round_128bytes n
+-
+- // x = ror(x, 8)
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-
+- // x += y
+- vadd.u\n X0, Y0
+- vadd.u\n X1, Y1
+- vadd.u\n X2, Y2
+- vadd.u\n X3, Y3
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // y = rol(y, 3)
+- vshl.u\n TMP0, Y0, #3
+- vshl.u\n TMP1, Y1, #3
+- vshl.u\n TMP2, Y2, #3
+- vshl.u\n TMP3, Y3, #3
+- vsri.u\n TMP0, Y0, #(\n - 3)
+- vsri.u\n TMP1, Y1, #(\n - 3)
+- vsri.u\n TMP2, Y2, #(\n - 3)
+- vsri.u\n TMP3, Y3, #(\n - 3)
+-
+- // y ^= x
+- veor Y0, TMP0, X0
+- veor Y1, TMP1, X1
+- veor Y2, TMP2, X2
+- veor Y3, TMP3, X3
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n
+-
+- // y ^= x
+- veor TMP0, Y0, X0
+- veor TMP1, Y1, X1
+- veor TMP2, Y2, X2
+- veor TMP3, Y3, X3
+-
+- // y = ror(y, 3)
+- vshr.u\n Y0, TMP0, #3
+- vshr.u\n Y1, TMP1, #3
+- vshr.u\n Y2, TMP2, #3
+- vshr.u\n Y3, TMP3, #3
+- vsli.u\n Y0, TMP0, #(\n - 3)
+- vsli.u\n Y1, TMP1, #(\n - 3)
+- vsli.u\n Y2, TMP2, #(\n - 3)
+- vsli.u\n Y3, TMP3, #(\n - 3)
+-
+- // x ^= k
+- veor X0, ROUND_KEY
+- veor X1, ROUND_KEY
+- veor X2, ROUND_KEY
+- veor X3, ROUND_KEY
+-
+- // x -= y
+- vsub.u\n X0, Y0
+- vsub.u\n X1, Y1
+- vsub.u\n X2, Y2
+- vsub.u\n X3, Y3
+-
+- // x = rol(x, 8);
+- vtbl.8 X0_L, {X0_L}, ROTATE_TABLE
+- vtbl.8 X0_H, {X0_H}, ROTATE_TABLE
+- vtbl.8 X1_L, {X1_L}, ROTATE_TABLE
+- vtbl.8 X1_H, {X1_H}, ROTATE_TABLE
+- vtbl.8 X2_L, {X2_L}, ROTATE_TABLE
+- vtbl.8 X2_H, {X2_H}, ROTATE_TABLE
+- vtbl.8 X3_L, {X3_L}, ROTATE_TABLE
+- vtbl.8 X3_H, {X3_H}, ROTATE_TABLE
+-.endm
+-
+-.macro _xts128_precrypt_one dst_reg, tweak_buf, tmp
+-
+- // Load the next source block
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current tweak in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next source block with the current tweak
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #63
+- vshl.u64 TWEAKV, #1
+- veor TWEAKV_H, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF128MUL_TABLE}, \tmp\()_H
+- veor TWEAKV_L, \tmp\()_H
+-.endm
+-
+-.macro _xts64_precrypt_two dst_reg, tweak_buf, tmp
+-
+- // Load the next two source blocks
+- vld1.8 {\dst_reg}, [SRC]!
+-
+- // Save the current two tweaks in the tweak buffer
+- vst1.8 {TWEAKV}, [\tweak_buf:128]!
+-
+- // XOR the next two source blocks with the current two tweaks
+- veor \dst_reg, TWEAKV
+-
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- vshr.u64 \tmp, TWEAKV, #62
+- vshl.u64 TWEAKV, #2
+- vtbl.8 \tmp\()_L, {GF64MUL_TABLE}, \tmp\()_L
+- vtbl.8 \tmp\()_H, {GF64MUL_TABLE}, \tmp\()_H
+- veor TWEAKV, \tmp
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, decrypting
+- push {r4-r7}
+- mov r7, sp
+-
+- /*
+- * The first four parameters were passed in registers r0-r3. Load the
+- * additional parameters, which were passed on the stack.
+- */
+- ldr NBYTES, [sp, #16]
+- ldr TWEAK, [sp, #20]
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #3
+- sub ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS, lsl #2
+- sub ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for vtbl-based 8-bit rotates
+-.if \decrypting
+- ldr r12, =.Lrol\n\()_8_table
+-.else
+- ldr r12, =.Lror\n\()_8_table
+-.endif
+- vld1.8 {ROTATE_TABLE}, [r12:64]
+-
+- // One-time XTS preparation
+-
+- /*
+- * Allocate stack space to store 128 bytes worth of tweaks. For
+- * performance, this space is aligned to a 16-byte boundary so that we
+- * can use the load/store instructions that declare 16-byte alignment.
+- * For Thumb2 compatibility, don't do the 'bic' directly on 'sp'.
+- */
+- sub r12, sp, #128
+- bic r12, #0xf
+- mov sp, r12
+-
+-.if \n == 64
+- // Load first tweak
+- vld1.8 {TWEAKV}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr r12, =.Lgf128mul_table
+- vld1.8 {GF128MUL_TABLE}, [r12:64]
+-.else
+- // Load first tweak
+- vld1.8 {TWEAKV_L}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr r12, =.Lgf64mul_table
+- vld1.8 {GF64MUL_TABLE}, [r12:64]
+-
+- // Calculate second tweak, packing it together with the first
+- vshr.u64 TMP0_L, TWEAKV_L, #63
+- vtbl.u8 TMP0_L, {GF64MUL_TABLE}, TMP0_L
+- vshl.u64 TWEAKV_H, TWEAKV_L, #1
+- veor TWEAKV_H, TMP0_L
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- /*
+- * Load the source blocks into {X,Y}[0-3], XOR them with their XTS tweak
+- * values, and save the tweaks on the stack for later. Then
+- * de-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- mov r12, sp
+-.if \n == 64
+- _xts128_precrypt_one X0, r12, TMP0
+- _xts128_precrypt_one Y0, r12, TMP0
+- _xts128_precrypt_one X1, r12, TMP0
+- _xts128_precrypt_one Y1, r12, TMP0
+- _xts128_precrypt_one X2, r12, TMP0
+- _xts128_precrypt_one Y2, r12, TMP0
+- _xts128_precrypt_one X3, r12, TMP0
+- _xts128_precrypt_one Y3, r12, TMP0
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- _xts64_precrypt_two X0, r12, TMP0
+- _xts64_precrypt_two Y0, r12, TMP0
+- _xts64_precrypt_two X1, r12, TMP0
+- _xts64_precrypt_two Y1, r12, TMP0
+- _xts64_precrypt_two X2, r12, TMP0
+- _xts64_precrypt_two Y2, r12, TMP0
+- _xts64_precrypt_two X3, r12, TMP0
+- _xts64_precrypt_two Y3, r12, TMP0
+- vuzp.32 Y0, X0
+- vuzp.32 Y1, X1
+- vuzp.32 Y2, X2
+- vuzp.32 Y3, X3
+-.endif
+-
+- // Do the cipher rounds
+-
+- mov r12, ROUND_KEYS
+- mov r6, NROUNDS
+-
+-.Lnext_round_\@:
+-.if \decrypting
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]
+- sub r12, #8
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]
+- sub r12, #4
+-.endif
+- _speck_unround_128bytes \n
+-.else
+-.if \n == 64
+- vld1.64 ROUND_KEY_L, [r12]!
+- vmov ROUND_KEY_H, ROUND_KEY_L
+-.else
+- vld1.32 {ROUND_KEY_L[],ROUND_KEY_H[]}, [r12]!
+-.endif
+- _speck_round_128bytes \n
+-.endif
+- subs r6, r6, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+-.if \n == 64
+- vswp X0_L, Y0_H
+- vswp X1_L, Y1_H
+- vswp X2_L, Y2_H
+- vswp X3_L, Y3_H
+-.else
+- vzip.32 Y0, X0
+- vzip.32 Y1, X1
+- vzip.32 Y2, X2
+- vzip.32 Y3, X3
+-.endif
+-
+- // XOR the encrypted/decrypted blocks with the tweaks we saved earlier
+- mov r12, sp
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X0, TMP0
+- veor Y0, TMP1
+- veor X1, TMP2
+- veor Y1, TMP3
+- vld1.8 {TMP0, TMP1}, [r12:128]!
+- vld1.8 {TMP2, TMP3}, [r12:128]!
+- veor X2, TMP0
+- veor Y2, TMP1
+- veor X3, TMP2
+- veor Y3, TMP3
+-
+- // Store the ciphertext in the destination buffer
+- vst1.8 {X0, Y0}, [DST]!
+- vst1.8 {X1, Y1}, [DST]!
+- vst1.8 {X2, Y2}, [DST]!
+- vst1.8 {X3, Y3}, [DST]!
+-
+- // Continue if there are more 128-byte chunks remaining, else return
+- subs NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak
+-.if \n == 64
+- vst1.8 {TWEAKV}, [TWEAK]
+-.else
+- vst1.8 {TWEAKV_L}, [TWEAK]
+-.endif
+-
+- mov sp, r7
+- pop {r4-r7}
+- bx lr
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm/crypto/speck-neon-glue.c b/arch/arm/crypto/speck-neon-glue.c
+deleted file mode 100644
+index f012c3ea998f..000000000000
+--- a/arch/arm/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,288 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Note: the NIST recommendation for XTS only specifies a 128-bit block size,
+- * but a 64-bit version (needed for Speck64) is fairly straightforward; the math
+- * is just done in GF(2^64) instead of GF(2^128), with the reducing polynomial
+- * x^64 + x^4 + x^3 + x + 1 from the original XEX paper (Rogaway, 2004:
+- * "Efficient Instantiations of Tweakable Blockciphers and Refinements to Modes
+- * OCB and PMAC"), represented as 0x1B.
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_NEON))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index 67dac595dc72..3989876ab699 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -327,7 +327,7 @@
+
+ sysmgr: sysmgr@ffd12000 {
+ compatible = "altr,sys-mgr", "syscon";
+- reg = <0xffd12000 0x1000>;
++ reg = <0xffd12000 0x228>;
+ };
+
+ /* Local timer */
+diff --git a/arch/arm64/crypto/Kconfig b/arch/arm64/crypto/Kconfig
+index e3fdb0fd6f70..d51944ff9f91 100644
+--- a/arch/arm64/crypto/Kconfig
++++ b/arch/arm64/crypto/Kconfig
+@@ -119,10 +119,4 @@ config CRYPTO_AES_ARM64_BS
+ select CRYPTO_AES_ARM64
+ select CRYPTO_SIMD
+
+-config CRYPTO_SPECK_NEON
+- tristate "NEON accelerated Speck cipher algorithms"
+- depends on KERNEL_MODE_NEON
+- select CRYPTO_BLKCIPHER
+- select CRYPTO_SPECK
+-
+ endif
+diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
+index bcafd016618e..7bc4bda6d9c6 100644
+--- a/arch/arm64/crypto/Makefile
++++ b/arch/arm64/crypto/Makefile
+@@ -56,9 +56,6 @@ sha512-arm64-y := sha512-glue.o sha512-core.o
+ obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha20-neon.o
+ chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o
+
+-obj-$(CONFIG_CRYPTO_SPECK_NEON) += speck-neon.o
+-speck-neon-y := speck-neon-core.o speck-neon-glue.o
+-
+ obj-$(CONFIG_CRYPTO_AES_ARM64) += aes-arm64.o
+ aes-arm64-y := aes-cipher-core.o aes-cipher-glue.o
+
+diff --git a/arch/arm64/crypto/speck-neon-core.S b/arch/arm64/crypto/speck-neon-core.S
+deleted file mode 100644
+index b14463438b09..000000000000
+--- a/arch/arm64/crypto/speck-neon-core.S
++++ /dev/null
+@@ -1,352 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * ARM64 NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Author: Eric Biggers <ebiggers@google.com>
+- */
+-
+-#include <linux/linkage.h>
+-
+- .text
+-
+- // arguments
+- ROUND_KEYS .req x0 // const {u64,u32} *round_keys
+- NROUNDS .req w1 // int nrounds
+- NROUNDS_X .req x1
+- DST .req x2 // void *dst
+- SRC .req x3 // const void *src
+- NBYTES .req w4 // unsigned int nbytes
+- TWEAK .req x5 // void *tweak
+-
+- // registers which hold the data being encrypted/decrypted
+- // (underscores avoid a naming collision with ARM64 registers x0-x3)
+- X_0 .req v0
+- Y_0 .req v1
+- X_1 .req v2
+- Y_1 .req v3
+- X_2 .req v4
+- Y_2 .req v5
+- X_3 .req v6
+- Y_3 .req v7
+-
+- // the round key, duplicated in all lanes
+- ROUND_KEY .req v8
+-
+- // index vector for tbl-based 8-bit rotates
+- ROTATE_TABLE .req v9
+- ROTATE_TABLE_Q .req q9
+-
+- // temporary registers
+- TMP0 .req v10
+- TMP1 .req v11
+- TMP2 .req v12
+- TMP3 .req v13
+-
+- // multiplication table for updating XTS tweaks
+- GFMUL_TABLE .req v14
+- GFMUL_TABLE_Q .req q14
+-
+- // next XTS tweak value(s)
+- TWEAKV_NEXT .req v15
+-
+- // XTS tweaks for the blocks currently being encrypted/decrypted
+- TWEAKV0 .req v16
+- TWEAKV1 .req v17
+- TWEAKV2 .req v18
+- TWEAKV3 .req v19
+- TWEAKV4 .req v20
+- TWEAKV5 .req v21
+- TWEAKV6 .req v22
+- TWEAKV7 .req v23
+-
+- .align 4
+-.Lror64_8_table:
+- .octa 0x080f0e0d0c0b0a090007060504030201
+-.Lror32_8_table:
+- .octa 0x0c0f0e0d080b0a090407060500030201
+-.Lrol64_8_table:
+- .octa 0x0e0d0c0b0a09080f0605040302010007
+-.Lrol32_8_table:
+- .octa 0x0e0d0c0f0a09080b0605040702010003
+-.Lgf128mul_table:
+- .octa 0x00000000000000870000000000000001
+-.Lgf64mul_table:
+- .octa 0x0000000000000000000000002d361b00
+-
+-/*
+- * _speck_round_128bytes() - Speck encryption round on 128 bytes at a time
+- *
+- * Do one Speck encryption round on the 128 bytes (8 blocks for Speck128, 16 for
+- * Speck64) stored in X0-X3 and Y0-Y3, using the round key stored in all lanes
+- * of ROUND_KEY. 'n' is the lane size: 64 for Speck128, or 32 for Speck64.
+- * 'lanes' is the lane specifier: "2d" for Speck128 or "4s" for Speck64.
+- */
+-.macro _speck_round_128bytes n, lanes
+-
+- // x = ror(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-
+- // x += y
+- add X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- add X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- add X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- add X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // y = rol(y, 3)
+- shl TMP0.\lanes, Y_0.\lanes, #3
+- shl TMP1.\lanes, Y_1.\lanes, #3
+- shl TMP2.\lanes, Y_2.\lanes, #3
+- shl TMP3.\lanes, Y_3.\lanes, #3
+- sri TMP0.\lanes, Y_0.\lanes, #(\n - 3)
+- sri TMP1.\lanes, Y_1.\lanes, #(\n - 3)
+- sri TMP2.\lanes, Y_2.\lanes, #(\n - 3)
+- sri TMP3.\lanes, Y_3.\lanes, #(\n - 3)
+-
+- // y ^= x
+- eor Y_0.16b, TMP0.16b, X_0.16b
+- eor Y_1.16b, TMP1.16b, X_1.16b
+- eor Y_2.16b, TMP2.16b, X_2.16b
+- eor Y_3.16b, TMP3.16b, X_3.16b
+-.endm
+-
+-/*
+- * _speck_unround_128bytes() - Speck decryption round on 128 bytes at a time
+- *
+- * This is the inverse of _speck_round_128bytes().
+- */
+-.macro _speck_unround_128bytes n, lanes
+-
+- // y ^= x
+- eor TMP0.16b, Y_0.16b, X_0.16b
+- eor TMP1.16b, Y_1.16b, X_1.16b
+- eor TMP2.16b, Y_2.16b, X_2.16b
+- eor TMP3.16b, Y_3.16b, X_3.16b
+-
+- // y = ror(y, 3)
+- ushr Y_0.\lanes, TMP0.\lanes, #3
+- ushr Y_1.\lanes, TMP1.\lanes, #3
+- ushr Y_2.\lanes, TMP2.\lanes, #3
+- ushr Y_3.\lanes, TMP3.\lanes, #3
+- sli Y_0.\lanes, TMP0.\lanes, #(\n - 3)
+- sli Y_1.\lanes, TMP1.\lanes, #(\n - 3)
+- sli Y_2.\lanes, TMP2.\lanes, #(\n - 3)
+- sli Y_3.\lanes, TMP3.\lanes, #(\n - 3)
+-
+- // x ^= k
+- eor X_0.16b, X_0.16b, ROUND_KEY.16b
+- eor X_1.16b, X_1.16b, ROUND_KEY.16b
+- eor X_2.16b, X_2.16b, ROUND_KEY.16b
+- eor X_3.16b, X_3.16b, ROUND_KEY.16b
+-
+- // x -= y
+- sub X_0.\lanes, X_0.\lanes, Y_0.\lanes
+- sub X_1.\lanes, X_1.\lanes, Y_1.\lanes
+- sub X_2.\lanes, X_2.\lanes, Y_2.\lanes
+- sub X_3.\lanes, X_3.\lanes, Y_3.\lanes
+-
+- // x = rol(x, 8)
+- tbl X_0.16b, {X_0.16b}, ROTATE_TABLE.16b
+- tbl X_1.16b, {X_1.16b}, ROTATE_TABLE.16b
+- tbl X_2.16b, {X_2.16b}, ROTATE_TABLE.16b
+- tbl X_3.16b, {X_3.16b}, ROTATE_TABLE.16b
+-.endm
+-
+-.macro _next_xts_tweak next, cur, tmp, n
+-.if \n == 64
+- /*
+- * Calculate the next tweak by multiplying the current one by x,
+- * modulo p(x) = x^128 + x^7 + x^2 + x + 1.
+- */
+- sshr \tmp\().2d, \cur\().2d, #63
+- and \tmp\().16b, \tmp\().16b, GFMUL_TABLE.16b
+- shl \next\().2d, \cur\().2d, #1
+- ext \tmp\().16b, \tmp\().16b, \tmp\().16b, #8
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.else
+- /*
+- * Calculate the next two tweaks by multiplying the current ones by x^2,
+- * modulo p(x) = x^64 + x^4 + x^3 + x + 1.
+- */
+- ushr \tmp\().2d, \cur\().2d, #62
+- shl \next\().2d, \cur\().2d, #2
+- tbl \tmp\().16b, {GFMUL_TABLE.16b}, \tmp\().16b
+- eor \next\().16b, \next\().16b, \tmp\().16b
+-.endif
+-.endm
+-
+-/*
+- * _speck_xts_crypt() - Speck-XTS encryption/decryption
+- *
+- * Encrypt or decrypt NBYTES bytes of data from the SRC buffer to the DST buffer
+- * using Speck-XTS, specifically the variant with a block size of '2n' and round
+- * count given by NROUNDS. The expanded round keys are given in ROUND_KEYS, and
+- * the current XTS tweak value is given in TWEAK. It's assumed that NBYTES is a
+- * nonzero multiple of 128.
+- */
+-.macro _speck_xts_crypt n, lanes, decrypting
+-
+- /*
+- * If decrypting, modify the ROUND_KEYS parameter to point to the last
+- * round key rather than the first, since for decryption the round keys
+- * are used in reverse order.
+- */
+-.if \decrypting
+- mov NROUNDS, NROUNDS /* zero the high 32 bits */
+-.if \n == 64
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #3
+- sub ROUND_KEYS, ROUND_KEYS, #8
+-.else
+- add ROUND_KEYS, ROUND_KEYS, NROUNDS_X, lsl #2
+- sub ROUND_KEYS, ROUND_KEYS, #4
+-.endif
+-.endif
+-
+- // Load the index vector for tbl-based 8-bit rotates
+-.if \decrypting
+- ldr ROTATE_TABLE_Q, .Lrol\n\()_8_table
+-.else
+- ldr ROTATE_TABLE_Q, .Lror\n\()_8_table
+-.endif
+-
+- // One-time XTS preparation
+-.if \n == 64
+- // Load first tweak
+- ld1 {TWEAKV0.16b}, [TWEAK]
+-
+- // Load GF(2^128) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf128mul_table
+-.else
+- // Load first tweak
+- ld1 {TWEAKV0.8b}, [TWEAK]
+-
+- // Load GF(2^64) multiplication table
+- ldr GFMUL_TABLE_Q, .Lgf64mul_table
+-
+- // Calculate second tweak, packing it together with the first
+- ushr TMP0.2d, TWEAKV0.2d, #63
+- shl TMP1.2d, TWEAKV0.2d, #1
+- tbl TMP0.8b, {GFMUL_TABLE.16b}, TMP0.8b
+- eor TMP0.8b, TMP0.8b, TMP1.8b
+- mov TWEAKV0.d[1], TMP0.d[0]
+-.endif
+-
+-.Lnext_128bytes_\@:
+-
+- // Calculate XTS tweaks for next 128 bytes
+- _next_xts_tweak TWEAKV1, TWEAKV0, TMP0, \n
+- _next_xts_tweak TWEAKV2, TWEAKV1, TMP0, \n
+- _next_xts_tweak TWEAKV3, TWEAKV2, TMP0, \n
+- _next_xts_tweak TWEAKV4, TWEAKV3, TMP0, \n
+- _next_xts_tweak TWEAKV5, TWEAKV4, TMP0, \n
+- _next_xts_tweak TWEAKV6, TWEAKV5, TMP0, \n
+- _next_xts_tweak TWEAKV7, TWEAKV6, TMP0, \n
+- _next_xts_tweak TWEAKV_NEXT, TWEAKV7, TMP0, \n
+-
+- // Load the next source blocks into {X,Y}[0-3]
+- ld1 {X_0.16b-Y_1.16b}, [SRC], #64
+- ld1 {X_2.16b-Y_3.16b}, [SRC], #64
+-
+- // XOR the source blocks with their XTS tweaks
+- eor TMP0.16b, X_0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor TMP1.16b, X_1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor TMP2.16b, X_2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor TMP3.16b, X_3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+-
+- /*
+- * De-interleave the 'x' and 'y' elements of each block, i.e. make it so
+- * that the X[0-3] registers contain only the second halves of blocks,
+- * and the Y[0-3] registers contain only the first halves of blocks.
+- * (Speck uses the order (y, x) rather than the more intuitive (x, y).)
+- */
+- uzp2 X_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp1 Y_0.\lanes, TMP0.\lanes, Y_0.\lanes
+- uzp2 X_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp1 Y_1.\lanes, TMP1.\lanes, Y_1.\lanes
+- uzp2 X_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp1 Y_2.\lanes, TMP2.\lanes, Y_2.\lanes
+- uzp2 X_3.\lanes, TMP3.\lanes, Y_3.\lanes
+- uzp1 Y_3.\lanes, TMP3.\lanes, Y_3.\lanes
+-
+- // Do the cipher rounds
+- mov x6, ROUND_KEYS
+- mov w7, NROUNDS
+-.Lnext_round_\@:
+-.if \decrypting
+- ld1r {ROUND_KEY.\lanes}, [x6]
+- sub x6, x6, #( \n / 8 )
+- _speck_unround_128bytes \n, \lanes
+-.else
+- ld1r {ROUND_KEY.\lanes}, [x6], #( \n / 8 )
+- _speck_round_128bytes \n, \lanes
+-.endif
+- subs w7, w7, #1
+- bne .Lnext_round_\@
+-
+- // Re-interleave the 'x' and 'y' elements of each block
+- zip1 TMP0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip2 Y_0.\lanes, Y_0.\lanes, X_0.\lanes
+- zip1 TMP1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip2 Y_1.\lanes, Y_1.\lanes, X_1.\lanes
+- zip1 TMP2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip2 Y_2.\lanes, Y_2.\lanes, X_2.\lanes
+- zip1 TMP3.\lanes, Y_3.\lanes, X_3.\lanes
+- zip2 Y_3.\lanes, Y_3.\lanes, X_3.\lanes
+-
+- // XOR the encrypted/decrypted blocks with the tweaks calculated earlier
+- eor X_0.16b, TMP0.16b, TWEAKV0.16b
+- eor Y_0.16b, Y_0.16b, TWEAKV1.16b
+- eor X_1.16b, TMP1.16b, TWEAKV2.16b
+- eor Y_1.16b, Y_1.16b, TWEAKV3.16b
+- eor X_2.16b, TMP2.16b, TWEAKV4.16b
+- eor Y_2.16b, Y_2.16b, TWEAKV5.16b
+- eor X_3.16b, TMP3.16b, TWEAKV6.16b
+- eor Y_3.16b, Y_3.16b, TWEAKV7.16b
+- mov TWEAKV0.16b, TWEAKV_NEXT.16b
+-
+- // Store the ciphertext in the destination buffer
+- st1 {X_0.16b-Y_1.16b}, [DST], #64
+- st1 {X_2.16b-Y_3.16b}, [DST], #64
+-
+- // Continue if there are more 128-byte chunks remaining
+- subs NBYTES, NBYTES, #128
+- bne .Lnext_128bytes_\@
+-
+- // Store the next tweak and return
+-.if \n == 64
+- st1 {TWEAKV_NEXT.16b}, [TWEAK]
+-.else
+- st1 {TWEAKV_NEXT.8b}, [TWEAK]
+-.endif
+- ret
+-.endm
+-
+-ENTRY(speck128_xts_encrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=0
+-ENDPROC(speck128_xts_encrypt_neon)
+-
+-ENTRY(speck128_xts_decrypt_neon)
+- _speck_xts_crypt n=64, lanes=2d, decrypting=1
+-ENDPROC(speck128_xts_decrypt_neon)
+-
+-ENTRY(speck64_xts_encrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=0
+-ENDPROC(speck64_xts_encrypt_neon)
+-
+-ENTRY(speck64_xts_decrypt_neon)
+- _speck_xts_crypt n=32, lanes=4s, decrypting=1
+-ENDPROC(speck64_xts_decrypt_neon)
+diff --git a/arch/arm64/crypto/speck-neon-glue.c b/arch/arm64/crypto/speck-neon-glue.c
+deleted file mode 100644
+index 6e233aeb4ff4..000000000000
+--- a/arch/arm64/crypto/speck-neon-glue.c
++++ /dev/null
+@@ -1,282 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * NEON-accelerated implementation of Speck128-XTS and Speck64-XTS
+- * (64-bit version; based on the 32-bit version)
+- *
+- * Copyright (c) 2018 Google, Inc
+- */
+-
+-#include <asm/hwcap.h>
+-#include <asm/neon.h>
+-#include <asm/simd.h>
+-#include <crypto/algapi.h>
+-#include <crypto/gf128mul.h>
+-#include <crypto/internal/skcipher.h>
+-#include <crypto/speck.h>
+-#include <crypto/xts.h>
+-#include <linux/kernel.h>
+-#include <linux/module.h>
+-
+-/* The assembly functions only handle multiples of 128 bytes */
+-#define SPECK_NEON_CHUNK_SIZE 128
+-
+-/* Speck128 */
+-
+-struct speck128_xts_tfm_ctx {
+- struct speck128_tfm_ctx main_key;
+- struct speck128_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck128_xts_encrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck128_xts_decrypt_neon(const u64 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck128_crypt_one_t)(const struct speck128_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck128_xts_crypt_many_t)(const u64 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck128_xts_crypt(struct skcipher_request *req,
+- speck128_crypt_one_t crypt_one,
+- speck128_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- le128 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck128_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- le128_xor((le128 *)dst, (const le128 *)src, &tweak);
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- le128_xor((le128 *)dst, (const le128 *)dst, &tweak);
+- gf128mul_x_ble(&tweak, &tweak);
+-
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck128_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_encrypt,
+- speck128_xts_encrypt_neon);
+-}
+-
+-static int speck128_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck128_xts_crypt(req, crypto_speck128_decrypt,
+- speck128_xts_decrypt_neon);
+-}
+-
+-static int speck128_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck128_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck128_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck128_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-/* Speck64 */
+-
+-struct speck64_xts_tfm_ctx {
+- struct speck64_tfm_ctx main_key;
+- struct speck64_tfm_ctx tweak_key;
+-};
+-
+-asmlinkage void speck64_xts_encrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-asmlinkage void speck64_xts_decrypt_neon(const u32 *round_keys, int nrounds,
+- void *dst, const void *src,
+- unsigned int nbytes, void *tweak);
+-
+-typedef void (*speck64_crypt_one_t)(const struct speck64_tfm_ctx *,
+- u8 *, const u8 *);
+-typedef void (*speck64_xts_crypt_many_t)(const u32 *, int, void *,
+- const void *, unsigned int, void *);
+-
+-static __always_inline int
+-__speck64_xts_crypt(struct skcipher_request *req, speck64_crypt_one_t crypt_one,
+- speck64_xts_crypt_many_t crypt_many)
+-{
+- struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
+- const struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- struct skcipher_walk walk;
+- __le64 tweak;
+- int err;
+-
+- err = skcipher_walk_virt(&walk, req, true);
+-
+- crypto_speck64_encrypt(&ctx->tweak_key, (u8 *)&tweak, walk.iv);
+-
+- while (walk.nbytes > 0) {
+- unsigned int nbytes = walk.nbytes;
+- u8 *dst = walk.dst.virt.addr;
+- const u8 *src = walk.src.virt.addr;
+-
+- if (nbytes >= SPECK_NEON_CHUNK_SIZE && may_use_simd()) {
+- unsigned int count;
+-
+- count = round_down(nbytes, SPECK_NEON_CHUNK_SIZE);
+- kernel_neon_begin();
+- (*crypt_many)(ctx->main_key.round_keys,
+- ctx->main_key.nrounds,
+- dst, src, count, &tweak);
+- kernel_neon_end();
+- dst += count;
+- src += count;
+- nbytes -= count;
+- }
+-
+- /* Handle any remainder with generic code */
+- while (nbytes >= sizeof(tweak)) {
+- *(__le64 *)dst = *(__le64 *)src ^ tweak;
+- (*crypt_one)(&ctx->main_key, dst, dst);
+- *(__le64 *)dst ^= tweak;
+- tweak = cpu_to_le64((le64_to_cpu(tweak) << 1) ^
+- ((tweak & cpu_to_le64(1ULL << 63)) ?
+- 0x1B : 0));
+- dst += sizeof(tweak);
+- src += sizeof(tweak);
+- nbytes -= sizeof(tweak);
+- }
+- err = skcipher_walk_done(&walk, nbytes);
+- }
+-
+- return err;
+-}
+-
+-static int speck64_xts_encrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_encrypt,
+- speck64_xts_encrypt_neon);
+-}
+-
+-static int speck64_xts_decrypt(struct skcipher_request *req)
+-{
+- return __speck64_xts_crypt(req, crypto_speck64_decrypt,
+- speck64_xts_decrypt_neon);
+-}
+-
+-static int speck64_xts_setkey(struct crypto_skcipher *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- struct speck64_xts_tfm_ctx *ctx = crypto_skcipher_ctx(tfm);
+- int err;
+-
+- err = xts_verify_key(tfm, key, keylen);
+- if (err)
+- return err;
+-
+- keylen /= 2;
+-
+- err = crypto_speck64_setkey(&ctx->main_key, key, keylen);
+- if (err)
+- return err;
+-
+- return crypto_speck64_setkey(&ctx->tweak_key, key + keylen, keylen);
+-}
+-
+-static struct skcipher_alg speck_algs[] = {
+- {
+- .base.cra_name = "xts(speck128)",
+- .base.cra_driver_name = "xts-speck128-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK128_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck128_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK128_128_KEY_SIZE,
+- .max_keysize = 2 * SPECK128_256_KEY_SIZE,
+- .ivsize = SPECK128_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck128_xts_setkey,
+- .encrypt = speck128_xts_encrypt,
+- .decrypt = speck128_xts_decrypt,
+- }, {
+- .base.cra_name = "xts(speck64)",
+- .base.cra_driver_name = "xts-speck64-neon",
+- .base.cra_priority = 300,
+- .base.cra_blocksize = SPECK64_BLOCK_SIZE,
+- .base.cra_ctxsize = sizeof(struct speck64_xts_tfm_ctx),
+- .base.cra_alignmask = 7,
+- .base.cra_module = THIS_MODULE,
+- .min_keysize = 2 * SPECK64_96_KEY_SIZE,
+- .max_keysize = 2 * SPECK64_128_KEY_SIZE,
+- .ivsize = SPECK64_BLOCK_SIZE,
+- .walksize = SPECK_NEON_CHUNK_SIZE,
+- .setkey = speck64_xts_setkey,
+- .encrypt = speck64_xts_encrypt,
+- .decrypt = speck64_xts_decrypt,
+- }
+-};
+-
+-static int __init speck_neon_module_init(void)
+-{
+- if (!(elf_hwcap & HWCAP_ASIMD))
+- return -ENODEV;
+- return crypto_register_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_neon_module_exit(void)
+-{
+- crypto_unregister_skciphers(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_neon_module_init);
+-module_exit(speck_neon_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (NEON-accelerated)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("xts(speck128)");
+-MODULE_ALIAS_CRYPTO("xts-speck128-neon");
+-MODULE_ALIAS_CRYPTO("xts(speck64)");
+-MODULE_ALIAS_CRYPTO("xts-speck64-neon");
+diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
+index e4103b718a7c..b687c80a9c10 100644
+--- a/arch/arm64/kernel/cpufeature.c
++++ b/arch/arm64/kernel/cpufeature.c
+@@ -847,15 +847,29 @@ static bool has_no_fpsimd(const struct arm64_cpu_capabilities *entry, int __unus
+ }
+
+ static bool has_cache_idc(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_IDC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_IDC_SHIFT);
+ }
+
+ static bool has_cache_dic(const struct arm64_cpu_capabilities *entry,
+- int __unused)
++ int scope)
+ {
+- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_DIC_SHIFT);
++ u64 ctr;
++
++ if (scope == SCOPE_SYSTEM)
++ ctr = arm64_ftr_reg_ctrel0.sys_val;
++ else
++ ctr = read_cpuid_cachetype();
++
++ return ctr & BIT(CTR_DIC_SHIFT);
+ }
+
+ #ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 28ad8799406f..b0db91eefbde 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -599,7 +599,7 @@ el1_undef:
+ inherit_daif pstate=x23, tmp=x2
+ mov x0, sp
+ bl do_undefinstr
+- ASM_BUG()
++ kernel_exit 1
+ el1_dbg:
+ /*
+ * Debug exception handling
+diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
+index d399d459397b..9fa3d69cceaa 100644
+--- a/arch/arm64/kernel/traps.c
++++ b/arch/arm64/kernel/traps.c
+@@ -310,10 +310,12 @@ static int call_undef_hook(struct pt_regs *regs)
+ int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+ void __user *pc = (void __user *)instruction_pointer(regs);
+
+- if (!user_mode(regs))
+- return 1;
+-
+- if (compat_thumb_mode(regs)) {
++ if (!user_mode(regs)) {
++ __le32 instr_le;
++ if (probe_kernel_address((__force __le32 *)pc, instr_le))
++ goto exit;
++ instr = le32_to_cpu(instr_le);
++ } else if (compat_thumb_mode(regs)) {
+ /* 16-bit Thumb instruction */
+ __le16 instr_le;
+ if (get_user(instr_le, (__le16 __user *)pc))
+@@ -407,6 +409,7 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
+ return;
+
+ force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc);
++ BUG_ON(!user_mode(regs));
+ }
+
+ void cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused)
+diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
+index 137710f4dac3..5105bb044aa5 100644
+--- a/arch/arm64/lib/Makefile
++++ b/arch/arm64/lib/Makefile
+@@ -12,7 +12,7 @@ lib-y := bitops.o clear_user.o delay.o copy_from_user.o \
+ # when supported by the CPU. Result and argument registers are handled
+ # correctly, based on the function prototype.
+ lib-$(CONFIG_ARM64_LSE_ATOMICS) += atomic_ll_sc.o
+-CFLAGS_atomic_ll_sc.o := -fcall-used-x0 -ffixed-x1 -ffixed-x2 \
++CFLAGS_atomic_ll_sc.o := -ffixed-x1 -ffixed-x2 \
+ -ffixed-x3 -ffixed-x4 -ffixed-x5 -ffixed-x6 \
+ -ffixed-x7 -fcall-saved-x8 -fcall-saved-x9 \
+ -fcall-saved-x10 -fcall-saved-x11 -fcall-saved-x12 \
+diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
+index a874e54404d1..4d4c76ab0bac 100644
+--- a/arch/m68k/configs/amiga_defconfig
++++ b/arch/m68k/configs/amiga_defconfig
+@@ -650,7 +650,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
+index 8ce39e23aa42..0fd006c19fa3 100644
+--- a/arch/m68k/configs/apollo_defconfig
++++ b/arch/m68k/configs/apollo_defconfig
+@@ -609,7 +609,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
+index 346c4e75edf8..9343e8d5cf60 100644
+--- a/arch/m68k/configs/atari_defconfig
++++ b/arch/m68k/configs/atari_defconfig
+@@ -631,7 +631,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
+index fca9c7aa71a3..a10fff6e7b50 100644
+--- a/arch/m68k/configs/bvme6000_defconfig
++++ b/arch/m68k/configs/bvme6000_defconfig
+@@ -601,7 +601,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
+index f9eab174915c..db81d8ea9d03 100644
+--- a/arch/m68k/configs/hp300_defconfig
++++ b/arch/m68k/configs/hp300_defconfig
+@@ -611,7 +611,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
+index b52e597899eb..2546617a1147 100644
+--- a/arch/m68k/configs/mac_defconfig
++++ b/arch/m68k/configs/mac_defconfig
+@@ -633,7 +633,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
+index 2a84eeec5b02..dc9b0d885e8b 100644
+--- a/arch/m68k/configs/multi_defconfig
++++ b/arch/m68k/configs/multi_defconfig
+@@ -713,7 +713,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
+index 476e69994340..0d815a375ba0 100644
+--- a/arch/m68k/configs/mvme147_defconfig
++++ b/arch/m68k/configs/mvme147_defconfig
+@@ -601,7 +601,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
+index 1477cda9146e..0cb8109b4c9e 100644
+--- a/arch/m68k/configs/mvme16x_defconfig
++++ b/arch/m68k/configs/mvme16x_defconfig
+@@ -601,7 +601,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
+index b3a543dc48a0..e91a1c28bba7 100644
+--- a/arch/m68k/configs/q40_defconfig
++++ b/arch/m68k/configs/q40_defconfig
+@@ -624,7 +624,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
+index d543ed5dfa96..3b2f0914c34f 100644
+--- a/arch/m68k/configs/sun3_defconfig
++++ b/arch/m68k/configs/sun3_defconfig
+@@ -602,7 +602,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
+index a67e54246023..e4365ef4f5ed 100644
+--- a/arch/m68k/configs/sun3x_defconfig
++++ b/arch/m68k/configs/sun3x_defconfig
+@@ -603,7 +603,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_LZO=m
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-helper.c b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+index 75108ec669eb..6c79e8a16a26 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-helper.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-helper.c
+@@ -67,7 +67,7 @@ void (*cvmx_override_pko_queue_priority) (int pko_port,
+ void (*cvmx_override_ipd_port_setup) (int ipd_port);
+
+ /* Port count per interface */
+-static int interface_port_count[5];
++static int interface_port_count[9];
+
+ /**
+ * Return the number of interfaces the chip has. Each interface
+diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S
+index fac26ce64b2f..e76e88222a4b 100644
+--- a/arch/mips/lib/memset.S
++++ b/arch/mips/lib/memset.S
+@@ -262,9 +262,11 @@
+ nop
+
+ .Lsmall_fixup\@:
++ .set reorder
+ PTR_SUBU a2, t1, a0
++ PTR_ADDIU a2, 1
+ jr ra
+- PTR_ADDIU a2, 1
++ .set noreorder
+
+ .endm
+
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 1b4732e20137..843825a7e6e2 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -185,7 +185,7 @@
+ bv,n 0(%r3)
+ nop
+ .word 0 /* checksum (will be patched) */
+- .word PA(os_hpmc) /* address of handler */
++ .word 0 /* address of handler */
+ .word 0 /* length of handler */
+ .endm
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 781c3b9a3e46..fde654115564 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -85,7 +85,7 @@ END(hpmc_pim_data)
+
+ .import intr_save, code
+ .align 16
+-ENTRY_CFI(os_hpmc)
++ENTRY(os_hpmc)
+ .os_hpmc:
+
+ /*
+@@ -302,7 +302,6 @@ os_hpmc_6:
+ b .
+ nop
+ .align 16 /* make function length multiple of 16 bytes */
+-ENDPROC_CFI(os_hpmc)
+ .os_hpmc_end:
+
+
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 4309ad31a874..2cb35e1e0099 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -827,7 +827,8 @@ void __init initialize_ivt(const void *iva)
+ * the Length/4 words starting at Address is zero.
+ */
+
+- /* Compute Checksum for HPMC handler */
++ /* Setup IVA and compute checksum for HPMC handler */
++ ivap[6] = (u32)__pa(os_hpmc);
+ length = os_hpmc_size;
+ ivap[7] = length;
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index 2607d2d33405..db6cd857c8c0 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -495,12 +495,8 @@ static void __init map_pages(unsigned long start_vaddr,
+ pte = pte_mkhuge(pte);
+ }
+
+- if (address >= end_paddr) {
+- if (force)
+- break;
+- else
+- pte_val(pte) = 0;
+- }
++ if (address >= end_paddr)
++ break;
+
+ set_pte(pg_table, pte);
+
+diff --git a/arch/powerpc/include/asm/mpic.h b/arch/powerpc/include/asm/mpic.h
+index fad8ddd697ac..0abf2e7fd222 100644
+--- a/arch/powerpc/include/asm/mpic.h
++++ b/arch/powerpc/include/asm/mpic.h
+@@ -393,7 +393,14 @@ extern struct bus_type mpic_subsys;
+ #define MPIC_REGSET_TSI108 MPIC_REGSET(1) /* Tsi108/109 PIC */
+
+ /* Get the version of primary MPIC */
++#ifdef CONFIG_MPIC
+ extern u32 fsl_mpic_primary_get_version(void);
++#else
++static inline u32 fsl_mpic_primary_get_version(void)
++{
++ return 0;
++}
++#endif
+
+ /* Allocate the controller structure and setup the linux irq descs
+ * for the range if interrupts passed in. No HW initialization is
+diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c
+index 38c5b4764bfe..a74ffd5ad15c 100644
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -97,6 +97,13 @@ static void flush_and_reload_slb(void)
+
+ static void flush_erat(void)
+ {
++#ifdef CONFIG_PPC_BOOK3S_64
++ if (!early_cpu_has_feature(CPU_FTR_ARCH_300)) {
++ flush_and_reload_slb();
++ return;
++ }
++#endif
++ /* PPC_INVALIDATE_ERAT can only be used on ISA v3 and newer */
+ asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
+ }
+
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 225bc5f91049..03dd2f9d60cf 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -242,13 +242,19 @@ static void cpu_ready_for_interrupts(void)
+ }
+
+ /*
+- * Fixup HFSCR:TM based on CPU features. The bit is set by our
+- * early asm init because at that point we haven't updated our
+- * CPU features from firmware and device-tree. Here we have,
+- * so let's do it.
++ * Set HFSCR:TM based on CPU features:
++ * In the special case of TM no suspend (P9N DD2.1), Linux is
++ * told TM is off via the dt-ftrs but told to (partially) use
++ * it via OPAL_REINIT_CPUS_TM_SUSPEND_DISABLED. So HFSCR[TM]
++ * will be off from dt-ftrs but we need to turn it on for the
++ * no suspend case.
+ */
+- if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP))
+- mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ if (cpu_has_feature(CPU_FTR_HVMODE)) {
++ if (cpu_has_feature(CPU_FTR_TM_COMP))
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) | HFSCR_TM);
++ else
++ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM);
++ }
+
+ /* Set IR and DR in PACA MSR */
+ get_paca()->kernel_msr = MSR_KERNEL;
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 1d049c78c82a..2e45e5fbad5b 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -115,6 +115,8 @@ static void tlbiel_all_isa300(unsigned int num_sets, unsigned int is)
+ tlbiel_hash_set_isa300(0, is, 0, 2, 1);
+
+ asm volatile("ptesync": : :"memory");
++
++ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ void hash__tlbiel_all(unsigned int action)
+@@ -140,8 +142,6 @@ void hash__tlbiel_all(unsigned int action)
+ tlbiel_all_isa206(POWER7_TLB_SETS, is);
+ else
+ WARN(1, "%s called on pre-POWER7 CPU\n", __func__);
+-
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline unsigned long ___tlbie(unsigned long vpn, int psize,
+diff --git a/arch/s390/defconfig b/arch/s390/defconfig
+index f40600eb1762..5134c71a4937 100644
+--- a/arch/s390/defconfig
++++ b/arch/s390/defconfig
+@@ -221,7 +221,6 @@ CONFIG_CRYPTO_SALSA20=m
+ CONFIG_CRYPTO_SEED=m
+ CONFIG_CRYPTO_SERPENT=m
+ CONFIG_CRYPTO_SM4=m
+-CONFIG_CRYPTO_SPECK=m
+ CONFIG_CRYPTO_TEA=m
+ CONFIG_CRYPTO_TWOFISH=m
+ CONFIG_CRYPTO_DEFLATE=m
+diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
+index 0859cde36f75..888cc2f166db 100644
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns *sctns)
+ static void fill_stsi_mac(struct sthyi_sctns *sctns,
+ struct sysinfo_1_1_1 *sysinfo)
+ {
++ sclp_ocf_cpc_name_copy(sctns->mac.infmname);
++ if (*(u64 *)sctns->mac.infmname != 0)
++ sctns->mac.infmval1 |= MAC_NAME_VLD;
++
+ if (stsi(sysinfo, 1, 1, 1))
+ return;
+
+- sclp_ocf_cpc_name_copy(sctns->mac.infmname);
+-
+ memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype));
+ memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu));
+ memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman));
+ memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq));
+
+- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD;
++ sctns->mac.infmval1 |= MAC_ID_VLD;
+ }
+
+ static void fill_stsi_par(struct sthyi_sctns *sctns,
+diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
+index d4e6cd4577e5..bf0e82400358 100644
+--- a/arch/x86/boot/tools/build.c
++++ b/arch/x86/boot/tools/build.c
+@@ -391,6 +391,13 @@ int main(int argc, char ** argv)
+ die("Unable to mmap '%s': %m", argv[2]);
+ /* Number of 16-byte paragraphs, including space for a 4-byte CRC */
+ sys_size = (sz + 15 + 4) / 16;
++#ifdef CONFIG_EFI_STUB
++ /*
++ * COFF requires minimum 32-byte alignment of sections, and
++ * adding a signature is problematic without that alignment.
++ */
++ sys_size = (sys_size + 1) & ~1;
++#endif
+
+ /* Patch the setup code with the appropriate size parameters */
+ buf[0x1f1] = setup_sectors-1;
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index acbe7e8336d8..e4b78f962874 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -817,7 +817,7 @@ static int gcmaes_crypt_by_sg(bool enc, struct aead_request *req,
+ /* Linearize assoc, if not already linear */
+ if (req->src->length >= assoclen && req->src->length &&
+ (!PageHighMem(sg_page(req->src)) ||
+- req->src->offset + req->src->length < PAGE_SIZE)) {
++ req->src->offset + req->src->length <= PAGE_SIZE)) {
+ scatterwalk_start(&assoc_sg_walk, req->src);
+ assoc = scatterwalk_map(&assoc_sg_walk);
+ } else {
+diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h
+index 64aaa3f5f36c..c8ac84e90d0f 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -220,6 +220,7 @@
+ #define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */
+ #define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */
+ #define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */
++#define X86_FEATURE_IBRS_ENHANCED ( 7*32+30) /* Enhanced IBRS */
+
+ /* Virtualization flags: Linux defined, word 8 */
+ #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 0722b7745382..ccc23203b327 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -176,6 +176,7 @@ enum {
+
+ #define DR6_BD (1 << 13)
+ #define DR6_BS (1 << 14)
++#define DR6_BT (1 << 15)
+ #define DR6_RTM (1 << 16)
+ #define DR6_FIXED_1 0xfffe0ff0
+ #define DR6_INIT 0xffff0ff0
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index f6f6c63da62f..e7c8086e570e 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -215,6 +215,7 @@ enum spectre_v2_mitigation {
+ SPECTRE_V2_RETPOLINE_GENERIC,
+ SPECTRE_V2_RETPOLINE_AMD,
+ SPECTRE_V2_IBRS,
++ SPECTRE_V2_IBRS_ENHANCED,
+ };
+
+ /* The Speculative Store Bypass disable variants */
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 0af97e51e609..6f293d9a0b07 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -469,6 +469,12 @@ static inline void __native_flush_tlb_one_user(unsigned long addr)
+ */
+ static inline void __flush_tlb_all(void)
+ {
++ /*
++ * This is to catch users with enabled preemption and the PGE feature
++ * and don't trigger the warning in __native_flush_tlb().
++ */
++ VM_WARN_ON_ONCE(preemptible());
++
+ if (boot_cpu_has(X86_FEATURE_PGE)) {
+ __flush_tlb_global();
+ } else {
+diff --git a/arch/x86/kernel/check.c b/arch/x86/kernel/check.c
+index 33399426793e..cc8258a5378b 100644
+--- a/arch/x86/kernel/check.c
++++ b/arch/x86/kernel/check.c
+@@ -31,6 +31,11 @@ static __init int set_corruption_check(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -45,6 +50,11 @@ static __init int set_corruption_check_period(char *arg)
+ ssize_t ret;
+ unsigned long val;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_period config string not provided\n");
++ return -EINVAL;
++ }
++
+ ret = kstrtoul(arg, 10, &val);
+ if (ret)
+ return ret;
+@@ -59,6 +69,11 @@ static __init int set_corruption_check_size(char *arg)
+ char *end;
+ unsigned size;
+
++ if (!arg) {
++ pr_err("memory_corruption_check_size config string not provided\n");
++ return -EINVAL;
++ }
++
+ size = memparse(arg, &end);
+
+ if (*end == '\0')
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 4891a621a752..91e5e086606c 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -35,12 +35,10 @@ static void __init spectre_v2_select_mitigation(void);
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/*
+- * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
+- * writes to SPEC_CTRL contain whatever reserved bits have been set.
+- */
+-u64 __ro_after_init x86_spec_ctrl_base;
++/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -141,6 +139,7 @@ static const char *spectre_v2_strings[] = {
+ [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline",
+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
++ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+ };
+
+ #undef pr_fmt
+@@ -324,6 +323,46 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return cmd;
+ }
+
++static bool stibp_needed(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_NONE)
++ return false;
++
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
++ return false;
++
++ return true;
++}
++
++static void update_stibp_msr(void *info)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++void arch_smt_update(void)
++{
++ u64 mask;
++
++ if (!stibp_needed())
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++ mask = x86_spec_ctrl_base;
++ if (cpu_smt_control == CPU_SMT_ENABLED)
++ mask |= SPEC_CTRL_STIBP;
++ else
++ mask &= ~SPEC_CTRL_STIBP;
++
++ if (mask != x86_spec_ctrl_base) {
++ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
++ cpu_smt_control == CPU_SMT_ENABLED ?
++ "Enabling" : "Disabling");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++ }
++ mutex_unlock(&spec_ctrl_mutex);
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -343,6 +382,13 @@ static void __init spectre_v2_select_mitigation(void)
+
+ case SPECTRE_V2_CMD_FORCE:
+ case SPECTRE_V2_CMD_AUTO:
++ if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
++ mode = SPECTRE_V2_IBRS_ENHANCED;
++ /* Force it so VMEXIT will restore correctly */
++ x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ goto specv2_set_mode;
++ }
+ if (IS_ENABLED(CONFIG_RETPOLINE))
+ goto retpoline_auto;
+ break;
+@@ -380,6 +426,7 @@ retpoline_auto:
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ }
+
++specv2_set_mode:
+ spectre_v2_enabled = mode;
+ pr_info("%s\n", spectre_v2_strings[mode]);
+
+@@ -402,12 +449,22 @@ retpoline_auto:
+
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+- * branches. But firmware isn't, so use IBRS to protect that.
++ * branches. Enhanced IBRS protects firmware too, so, enable restricted
++ * speculation around firmware calls only when Enhanced IBRS isn't
++ * supported.
++ *
++ * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
++ * the user might select retpoline on the kernel command line and if
++ * the CPU supports Enhanced IBRS, kernel might un-intentionally not
++ * enable IBRS around firmware calls.
+ */
+- if (boot_cpu_has(X86_FEATURE_IBRS)) {
++ if (boot_cpu_has(X86_FEATURE_IBRS) && mode != SPECTRE_V2_IBRS_ENHANCED) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
++
++ /* Enable STIBP if appropriate */
++ arch_smt_update();
+ }
+
+ #undef pr_fmt
+@@ -798,6 +855,8 @@ static ssize_t l1tf_show_state(char *buf)
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
++ int ret;
++
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -815,10 +874,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ spectre_v2_module_string());
++ return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 1ee8ea36af30..79561bfcfa87 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1015,6 +1015,9 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
+ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
++ if (ia32_cap & ARCH_CAP_IBRS_ALL)
++ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
++
+ if (x86_match_cpu(cpu_no_meltdown))
+ return;
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 749856a2e736..bc3801985d73 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -2032,6 +2032,13 @@ static int rdtgroup_show_options(struct seq_file *seq, struct kernfs_root *kf)
+ {
+ if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled)
+ seq_puts(seq, ",cdp");
++
++ if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled)
++ seq_puts(seq, ",cdpl2");
++
++ if (is_mba_sc(&rdt_resources_all[RDT_RESOURCE_MBA]))
++ seq_puts(seq, ",mba_MBps");
++
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
+index 23f1691670b6..61a949d84dfa 100644
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -314,7 +314,6 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ * thread's fpu state, reconstruct fxstate from the fsave
+ * header. Validate and sanitize the copied state.
+ */
+- struct fpu *fpu = &tsk->thread.fpu;
+ struct user_i387_ia32_struct env;
+ int err = 0;
+
+diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
+index 203d398802a3..1467f966cfec 100644
+--- a/arch/x86/kernel/kprobes/opt.c
++++ b/arch/x86/kernel/kprobes/opt.c
+@@ -179,7 +179,7 @@ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs)
+ opt_pre_handler(&op->kp, regs);
+ __this_cpu_write(current_kprobe, NULL);
+ }
+- preempt_enable_no_resched();
++ preempt_enable();
+ }
+ NOKPROBE_SYMBOL(optimized_callback);
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 9efe130ea2e6..9fcc3ec3ab78 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3160,10 +3160,13 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned long *exit
+ }
+ } else {
+ if (vmcs12->exception_bitmap & (1u << nr)) {
+- if (nr == DB_VECTOR)
++ if (nr == DB_VECTOR) {
+ *exit_qual = vcpu->arch.dr6;
+- else
++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT);
++ *exit_qual ^= DR6_RTM;
++ } else {
+ *exit_qual = 0;
++ }
+ return 1;
+ }
+ }
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 8d6c34fe49be..800de88208d7 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2063,9 +2063,13 @@ void __kernel_map_pages(struct page *page, int numpages, int enable)
+
+ /*
+ * We should perform an IPI and flush all tlbs,
+- * but that can deadlock->flush only current cpu:
++ * but that can deadlock->flush only current cpu.
++ * Preemption needs to be disabled around __flush_tlb_all() due to
++ * CR3 reload in __native_flush_tlb().
+ */
++ preempt_disable();
+ __flush_tlb_all();
++ preempt_enable();
+
+ arch_flush_lazy_mmu_mode();
+ }
+diff --git a/arch/x86/platform/olpc/olpc-xo1-rtc.c b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+index a2b4efddd61a..8e7ddd7e313a 100644
+--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c
++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c
+@@ -16,6 +16,7 @@
+
+ #include <asm/msr.h>
+ #include <asm/olpc.h>
++#include <asm/x86_init.h>
+
+ static void rtc_wake_on(struct device *dev)
+ {
+@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void)
+ if (r)
+ return r;
+
++ x86_platform.legacy.rtc = 0;
++
+ device_init_wakeup(&xo1_rtc_device.dev, 1);
+ return 0;
+ }
+diff --git a/arch/x86/xen/enlighten_pvh.c b/arch/x86/xen/enlighten_pvh.c
+index c85d1a88f476..f7f77023288a 100644
+--- a/arch/x86/xen/enlighten_pvh.c
++++ b/arch/x86/xen/enlighten_pvh.c
+@@ -75,7 +75,7 @@ static void __init init_pvh_bootparams(void)
+ * Version 2.12 supports Xen entry point but we will use default x86/PC
+ * environment (i.e. hardware_subarch 0).
+ */
+- pvh_bootparams.hdr.version = 0x212;
++ pvh_bootparams.hdr.version = (2 << 8) | 12;
+ pvh_bootparams.hdr.type_of_loader = (9 << 4) | 0; /* Xen loader */
+
+ x86_init.acpi.get_root_pointer = pvh_get_root_pointer;
+diff --git a/arch/x86/xen/platform-pci-unplug.c b/arch/x86/xen/platform-pci-unplug.c
+index 33a783c77d96..184b36922397 100644
+--- a/arch/x86/xen/platform-pci-unplug.c
++++ b/arch/x86/xen/platform-pci-unplug.c
+@@ -146,6 +146,10 @@ void xen_unplug_emulated_devices(void)
+ {
+ int r;
+
++ /* PVH guests don't have emulated devices. */
++ if (xen_pvh_domain())
++ return;
++
+ /* user explicitly requested no unplug */
+ if (xen_emul_unplug & XEN_UNPLUG_NEVER)
+ return;
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index cd97a62394e7..a970a2aa4456 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -9,6 +9,7 @@
+ #include <linux/log2.h>
+ #include <linux/gfp.h>
+ #include <linux/slab.h>
++#include <linux/atomic.h>
+
+ #include <asm/paravirt.h>
+ #include <asm/qspinlock.h>
+@@ -21,6 +22,7 @@
+
+ static DEFINE_PER_CPU(int, lock_kicker_irq) = -1;
+ static DEFINE_PER_CPU(char *, irq_name);
++static DEFINE_PER_CPU(atomic_t, xen_qlock_wait_nest);
+ static bool xen_pvspin = true;
+
+ static void xen_qlock_kick(int cpu)
+@@ -40,33 +42,24 @@ static void xen_qlock_kick(int cpu)
+ static void xen_qlock_wait(u8 *byte, u8 val)
+ {
+ int irq = __this_cpu_read(lock_kicker_irq);
++ atomic_t *nest_cnt = this_cpu_ptr(&xen_qlock_wait_nest);
+
+ /* If kicker interrupts not initialized yet, just spin */
+- if (irq == -1)
++ if (irq == -1 || in_nmi())
+ return;
+
+- /* clear pending */
+- xen_clear_irq_pending(irq);
+- barrier();
+-
+- /*
+- * We check the byte value after clearing pending IRQ to make sure
+- * that we won't miss a wakeup event because of the clearing.
+- *
+- * The sync_clear_bit() call in xen_clear_irq_pending() is atomic.
+- * So it is effectively a memory barrier for x86.
+- */
+- if (READ_ONCE(*byte) != val)
+- return;
++ /* Detect reentry. */
++ atomic_inc(nest_cnt);
+
+- /*
+- * If an interrupt happens here, it will leave the wakeup irq
+- * pending, which will cause xen_poll_irq() to return
+- * immediately.
+- */
++ /* If irq pending already and no nested call clear it. */
++ if (atomic_read(nest_cnt) == 1 && xen_test_irq_pending(irq)) {
++ xen_clear_irq_pending(irq);
++ } else if (READ_ONCE(*byte) == val) {
++ /* Block until irq becomes pending (or a spurious wakeup) */
++ xen_poll_irq(irq);
++ }
+
+- /* Block until irq becomes pending (or perhaps a spurious wakeup) */
+- xen_poll_irq(irq);
++ atomic_dec(nest_cnt);
+ }
+
+ static irqreturn_t dummy_handler(int irq, void *dev_id)
+diff --git a/arch/x86/xen/xen-pvh.S b/arch/x86/xen/xen-pvh.S
+index ca2d3b2bf2af..58722a052f9c 100644
+--- a/arch/x86/xen/xen-pvh.S
++++ b/arch/x86/xen/xen-pvh.S
+@@ -181,7 +181,7 @@ canary:
+ .fill 48, 1, 0
+
+ early_stack:
+- .fill 256, 1, 0
++ .fill BOOT_STACK_SIZE, 1, 0
+ early_stack_end:
+
+ ELFNOTE(Xen, XEN_ELFNOTE_PHYS32_ENTRY,
+diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c
+index 4498c43245e2..681498e5d40a 100644
+--- a/block/bfq-wf2q.c
++++ b/block/bfq-wf2q.c
+@@ -1178,10 +1178,17 @@ bool __bfq_deactivate_entity(struct bfq_entity *entity, bool ins_into_idle_tree)
+ st = bfq_entity_service_tree(entity);
+ is_in_service = entity == sd->in_service_entity;
+
+- if (is_in_service) {
+- bfq_calc_finish(entity, entity->service);
++ bfq_calc_finish(entity, entity->service);
++
++ if (is_in_service)
+ sd->in_service_entity = NULL;
+- }
++ else
++ /*
++ * Non in-service entity: nobody will take care of
++ * resetting its service counter on expiration. Do it
++ * now.
++ */
++ entity->service = 0;
+
+ if (entity->tree == &st->active)
+ bfq_active_extract(st, entity);
+diff --git a/block/blk-lib.c b/block/blk-lib.c
+index d1b9dd03da25..1f196cf0aa5d 100644
+--- a/block/blk-lib.c
++++ b/block/blk-lib.c
+@@ -29,9 +29,7 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
+ struct bio *bio = *biop;
+- unsigned int granularity;
+ unsigned int op;
+- int alignment;
+ sector_t bs_mask;
+
+ if (!q)
+@@ -54,38 +52,15 @@ int __blkdev_issue_discard(struct block_device *bdev, sector_t sector,
+ if ((sector | nr_sects) & bs_mask)
+ return -EINVAL;
+
+- /* Zero-sector (unknown) and one-sector granularities are the same. */
+- granularity = max(q->limits.discard_granularity >> 9, 1U);
+- alignment = (bdev_discard_alignment(bdev) >> 9) % granularity;
+-
+ while (nr_sects) {
+- unsigned int req_sects;
+- sector_t end_sect, tmp;
++ unsigned int req_sects = nr_sects;
++ sector_t end_sect;
+
+- /*
+- * Issue in chunks of the user defined max discard setting,
+- * ensuring that bi_size doesn't overflow
+- */
+- req_sects = min_t(sector_t, nr_sects,
+- q->limits.max_discard_sectors);
+ if (!req_sects)
+ goto fail;
+- if (req_sects > UINT_MAX >> 9)
+- req_sects = UINT_MAX >> 9;
++ req_sects = min(req_sects, bio_allowed_max_sectors(q));
+
+- /*
+- * If splitting a request, and the next starting sector would be
+- * misaligned, stop the discard at the previous aligned sector.
+- */
+ end_sect = sector + req_sects;
+- tmp = end_sect;
+- if (req_sects < nr_sects &&
+- sector_div(tmp, granularity) != alignment) {
+- end_sect = end_sect - alignment;
+- sector_div(end_sect, granularity);
+- end_sect = end_sect * granularity + alignment;
+- req_sects = end_sect - sector;
+- }
+
+ bio = next_bio(bio, 0, gfp_mask);
+ bio->bi_iter.bi_sector = sector;
+@@ -186,7 +161,7 @@ static int __blkdev_issue_write_same(struct block_device *bdev, sector_t sector,
+ return -EOPNOTSUPP;
+
+ /* Ensure that max_write_same_sectors doesn't overflow bi_size */
+- max_write_same_sectors = UINT_MAX >> 9;
++ max_write_same_sectors = bio_allowed_max_sectors(q);
+
+ while (nr_sects) {
+ bio = next_bio(bio, 1, gfp_mask);
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index aaec38cc37b8..2e042190a4f1 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -27,7 +27,8 @@ static struct bio *blk_bio_discard_split(struct request_queue *q,
+ /* Zero-sector (unknown) and one-sector granularities are the same. */
+ granularity = max(q->limits.discard_granularity >> 9, 1U);
+
+- max_discard_sectors = min(q->limits.max_discard_sectors, UINT_MAX >> 9);
++ max_discard_sectors = min(q->limits.max_discard_sectors,
++ bio_allowed_max_sectors(q));
+ max_discard_sectors -= max_discard_sectors % granularity;
+
+ if (unlikely(!max_discard_sectors)) {
+diff --git a/block/blk.h b/block/blk.h
+index a8f0f7986cfd..a26a8fb257a4 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -326,6 +326,16 @@ static inline unsigned long blk_rq_deadline(struct request *rq)
+ return rq->__deadline & ~0x1UL;
+ }
+
++/*
++ * The max size one bio can handle is UINT_MAX becasue bvec_iter.bi_size
++ * is defined as 'unsigned int', meantime it has to aligned to with logical
++ * block size which is the minimum accepted unit by hardware.
++ */
++static inline unsigned int bio_allowed_max_sectors(struct request_queue *q)
++{
++ return round_down(UINT_MAX, queue_logical_block_size(q)) >> 9;
++}
++
+ /*
+ * Internal io_context interface
+ */
+diff --git a/block/bounce.c b/block/bounce.c
+index fd31347b7836..5849535296b9 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -31,6 +31,24 @@
+ static struct bio_set bounce_bio_set, bounce_bio_split;
+ static mempool_t page_pool, isa_page_pool;
+
++static void init_bounce_bioset(void)
++{
++ static bool bounce_bs_setup;
++ int ret;
++
++ if (bounce_bs_setup)
++ return;
++
++ ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
++ BUG_ON(ret);
++ if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
++ BUG_ON(1);
++
++ ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
++ BUG_ON(ret);
++ bounce_bs_setup = true;
++}
++
+ #if defined(CONFIG_HIGHMEM)
+ static __init int init_emergency_pool(void)
+ {
+@@ -44,14 +62,7 @@ static __init int init_emergency_pool(void)
+ BUG_ON(ret);
+ pr_info("pool size: %d pages\n", POOL_SIZE);
+
+- ret = bioset_init(&bounce_bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
+- BUG_ON(ret);
+- if (bioset_integrity_create(&bounce_bio_set, BIO_POOL_SIZE))
+- BUG_ON(1);
+-
+- ret = bioset_init(&bounce_bio_split, BIO_POOL_SIZE, 0, 0);
+- BUG_ON(ret);
+-
++ init_bounce_bioset();
+ return 0;
+ }
+
+@@ -86,6 +97,8 @@ static void *mempool_alloc_pages_isa(gfp_t gfp_mask, void *data)
+ return mempool_alloc_pages(gfp_mask | GFP_DMA, data);
+ }
+
++static DEFINE_MUTEX(isa_mutex);
++
+ /*
+ * gets called "every" time someone init's a queue with BLK_BOUNCE_ISA
+ * as the max address, so check if the pool has already been created.
+@@ -94,14 +107,20 @@ int init_emergency_isa_pool(void)
+ {
+ int ret;
+
+- if (mempool_initialized(&isa_page_pool))
++ mutex_lock(&isa_mutex);
++
++ if (mempool_initialized(&isa_page_pool)) {
++ mutex_unlock(&isa_mutex);
+ return 0;
++ }
+
+ ret = mempool_init(&isa_page_pool, ISA_POOL_SIZE, mempool_alloc_pages_isa,
+ mempool_free_pages, (void *) 0);
+ BUG_ON(ret);
+
+ pr_info("isa pool size: %d pages\n", ISA_POOL_SIZE);
++ init_bounce_bioset();
++ mutex_unlock(&isa_mutex);
+ return 0;
+ }
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index f3e40ac56d93..59e32623a7ce 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1590,20 +1590,6 @@ config CRYPTO_SM4
+
+ If unsure, say N.
+
+-config CRYPTO_SPECK
+- tristate "Speck cipher algorithm"
+- select CRYPTO_ALGAPI
+- help
+- Speck is a lightweight block cipher that is tuned for optimal
+- performance in software (rather than hardware).
+-
+- Speck may not be as secure as AES, and should only be used on systems
+- where AES is not fast enough.
+-
+- See also: <https://eprint.iacr.org/2013/404.pdf>
+-
+- If unsure, say N.
+-
+ config CRYPTO_TEA
+ tristate "TEA, XTEA and XETA cipher algorithms"
+ select CRYPTO_ALGAPI
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 6d1d40eeb964..f6a234d08882 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -115,7 +115,6 @@ obj-$(CONFIG_CRYPTO_TEA) += tea.o
+ obj-$(CONFIG_CRYPTO_KHAZAD) += khazad.o
+ obj-$(CONFIG_CRYPTO_ANUBIS) += anubis.o
+ obj-$(CONFIG_CRYPTO_SEED) += seed.o
+-obj-$(CONFIG_CRYPTO_SPECK) += speck.o
+ obj-$(CONFIG_CRYPTO_SALSA20) += salsa20_generic.o
+ obj-$(CONFIG_CRYPTO_CHACHA20) += chacha20_generic.o
+ obj-$(CONFIG_CRYPTO_POLY1305) += poly1305_generic.o
+diff --git a/crypto/aegis.h b/crypto/aegis.h
+index f1c6900ddb80..405e025fc906 100644
+--- a/crypto/aegis.h
++++ b/crypto/aegis.h
+@@ -21,7 +21,7 @@
+
+ union aegis_block {
+ __le64 words64[AEGIS_BLOCK_SIZE / sizeof(__le64)];
+- u32 words32[AEGIS_BLOCK_SIZE / sizeof(u32)];
++ __le32 words32[AEGIS_BLOCK_SIZE / sizeof(__le32)];
+ u8 bytes[AEGIS_BLOCK_SIZE];
+ };
+
+@@ -57,24 +57,22 @@ static void crypto_aegis_aesenc(union aegis_block *dst,
+ const union aegis_block *src,
+ const union aegis_block *key)
+ {
+- u32 *d = dst->words32;
+ const u8 *s = src->bytes;
+- const u32 *k = key->words32;
+ const u32 *t0 = crypto_ft_tab[0];
+ const u32 *t1 = crypto_ft_tab[1];
+ const u32 *t2 = crypto_ft_tab[2];
+ const u32 *t3 = crypto_ft_tab[3];
+ u32 d0, d1, d2, d3;
+
+- d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]] ^ k[0];
+- d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]] ^ k[1];
+- d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]] ^ k[2];
+- d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]] ^ k[3];
++ d0 = t0[s[ 0]] ^ t1[s[ 5]] ^ t2[s[10]] ^ t3[s[15]];
++ d1 = t0[s[ 4]] ^ t1[s[ 9]] ^ t2[s[14]] ^ t3[s[ 3]];
++ d2 = t0[s[ 8]] ^ t1[s[13]] ^ t2[s[ 2]] ^ t3[s[ 7]];
++ d3 = t0[s[12]] ^ t1[s[ 1]] ^ t2[s[ 6]] ^ t3[s[11]];
+
+- d[0] = d0;
+- d[1] = d1;
+- d[2] = d2;
+- d[3] = d3;
++ dst->words32[0] = cpu_to_le32(d0) ^ key->words32[0];
++ dst->words32[1] = cpu_to_le32(d1) ^ key->words32[1];
++ dst->words32[2] = cpu_to_le32(d2) ^ key->words32[2];
++ dst->words32[3] = cpu_to_le32(d3) ^ key->words32[3];
+ }
+
+ #endif /* _CRYPTO_AEGIS_H */
+diff --git a/crypto/lrw.c b/crypto/lrw.c
+index 954a7064a179..7657bebd060c 100644
+--- a/crypto/lrw.c
++++ b/crypto/lrw.c
+@@ -143,7 +143,12 @@ static inline int get_index128(be128 *block)
+ return x + ffz(val);
+ }
+
+- return x;
++ /*
++ * If we get here, then x == 128 and we are incrementing the counter
++ * from all ones to all zeros. This means we must return index 127, i.e.
++ * the one corresponding to key2*{ 1,...,1 }.
++ */
++ return 127;
+ }
+
+ static int post_crypt(struct skcipher_request *req)
+diff --git a/crypto/morus1280.c b/crypto/morus1280.c
+index 6180b2557836..8f1952d96ebd 100644
+--- a/crypto/morus1280.c
++++ b/crypto/morus1280.c
+@@ -385,14 +385,11 @@ static void crypto_morus1280_final(struct morus1280_state *state,
+ struct morus1280_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+ struct morus1280_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le64(assocbits);
+- tmp.words[1] = cpu_to_le64(cryptbits);
++ tmp.words[0] = assoclen * 8;
++ tmp.words[1] = cryptlen * 8;
+ tmp.words[2] = 0;
+ tmp.words[3] = 0;
+
+diff --git a/crypto/morus640.c b/crypto/morus640.c
+index 5eede3749e64..6ccb901934c3 100644
+--- a/crypto/morus640.c
++++ b/crypto/morus640.c
+@@ -384,21 +384,13 @@ static void crypto_morus640_final(struct morus640_state *state,
+ struct morus640_block *tag_xor,
+ u64 assoclen, u64 cryptlen)
+ {
+- u64 assocbits = assoclen * 8;
+- u64 cryptbits = cryptlen * 8;
+-
+- u32 assocbits_lo = (u32)assocbits;
+- u32 assocbits_hi = (u32)(assocbits >> 32);
+- u32 cryptbits_lo = (u32)cryptbits;
+- u32 cryptbits_hi = (u32)(cryptbits >> 32);
+-
+ struct morus640_block tmp;
+ unsigned int i;
+
+- tmp.words[0] = cpu_to_le32(assocbits_lo);
+- tmp.words[1] = cpu_to_le32(assocbits_hi);
+- tmp.words[2] = cpu_to_le32(cryptbits_lo);
+- tmp.words[3] = cpu_to_le32(cryptbits_hi);
++ tmp.words[0] = lower_32_bits(assoclen * 8);
++ tmp.words[1] = upper_32_bits(assoclen * 8);
++ tmp.words[2] = lower_32_bits(cryptlen * 8);
++ tmp.words[3] = upper_32_bits(cryptlen * 8);
+
+ for (i = 0; i < MORUS_BLOCK_WORDS; i++)
+ state->s[4].words[i] ^= state->s[0].words[i];
+diff --git a/crypto/speck.c b/crypto/speck.c
+deleted file mode 100644
+index 58aa9f7f91f7..000000000000
+--- a/crypto/speck.c
++++ /dev/null
+@@ -1,307 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Speck: a lightweight block cipher
+- *
+- * Copyright (c) 2018 Google, Inc
+- *
+- * Speck has 10 variants, including 5 block sizes. For now we only implement
+- * the variants Speck128/128, Speck128/192, Speck128/256, Speck64/96, and
+- * Speck64/128. Speck${B}/${K} denotes the variant with a block size of B bits
+- * and a key size of K bits. The Speck128 variants are believed to be the most
+- * secure variants, and they use the same block size and key sizes as AES. The
+- * Speck64 variants are less secure, but on 32-bit processors are usually
+- * faster. The remaining variants (Speck32, Speck48, and Speck96) are even less
+- * secure and/or not as well suited for implementation on either 32-bit or
+- * 64-bit processors, so are omitted.
+- *
+- * Reference: "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * In a correspondence, the Speck designers have also clarified that the words
+- * should be interpreted in little-endian format, and the words should be
+- * ordered such that the first word of each block is 'y' rather than 'x', and
+- * the first key word (rather than the last) becomes the first round key.
+- */
+-
+-#include <asm/unaligned.h>
+-#include <crypto/speck.h>
+-#include <linux/bitops.h>
+-#include <linux/crypto.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-
+-/* Speck128 */
+-
+-static __always_inline void speck128_round(u64 *x, u64 *y, u64 k)
+-{
+- *x = ror64(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol64(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck128_unround(u64 *x, u64 *y, u64 k)
+-{
+- *y ^= *x;
+- *y = ror64(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol64(*x, 8);
+-}
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck128_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_encrypt);
+-
+-static void speck128_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u64 y = get_unaligned_le64(in);
+- u64 x = get_unaligned_le64(in + 8);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck128_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le64(y, out);
+- put_unaligned_le64(x, out + 8);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_decrypt);
+-
+-static void speck128_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck128_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u64 l[3];
+- u64 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK128_128_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- ctx->nrounds = SPECK128_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[0], &k, i);
+- }
+- break;
+- case SPECK128_192_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- ctx->nrounds = SPECK128_192_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK128_256_KEY_SIZE:
+- k = get_unaligned_le64(key);
+- l[0] = get_unaligned_le64(key + 8);
+- l[1] = get_unaligned_le64(key + 16);
+- l[2] = get_unaligned_le64(key + 24);
+- ctx->nrounds = SPECK128_256_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck128_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck128_setkey);
+-
+-static int speck128_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck128_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Speck64 */
+-
+-static __always_inline void speck64_round(u32 *x, u32 *y, u32 k)
+-{
+- *x = ror32(*x, 8);
+- *x += *y;
+- *x ^= k;
+- *y = rol32(*y, 3);
+- *y ^= *x;
+-}
+-
+-static __always_inline void speck64_unround(u32 *x, u32 *y, u32 k)
+-{
+- *y ^= *x;
+- *y = ror32(*y, 3);
+- *x ^= k;
+- *x -= *y;
+- *x = rol32(*x, 8);
+-}
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = 0; i < ctx->nrounds; i++)
+- speck64_round(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_encrypt);
+-
+-static void speck64_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_encrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in)
+-{
+- u32 y = get_unaligned_le32(in);
+- u32 x = get_unaligned_le32(in + 4);
+- int i;
+-
+- for (i = ctx->nrounds - 1; i >= 0; i--)
+- speck64_unround(&x, &y, ctx->round_keys[i]);
+-
+- put_unaligned_le32(y, out);
+- put_unaligned_le32(x, out + 4);
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_decrypt);
+-
+-static void speck64_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
+-{
+- crypto_speck64_decrypt(crypto_tfm_ctx(tfm), out, in);
+-}
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keylen)
+-{
+- u32 l[3];
+- u32 k;
+- int i;
+-
+- switch (keylen) {
+- case SPECK64_96_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- ctx->nrounds = SPECK64_96_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 2], &k, i);
+- }
+- break;
+- case SPECK64_128_KEY_SIZE:
+- k = get_unaligned_le32(key);
+- l[0] = get_unaligned_le32(key + 4);
+- l[1] = get_unaligned_le32(key + 8);
+- l[2] = get_unaligned_le32(key + 12);
+- ctx->nrounds = SPECK64_128_NROUNDS;
+- for (i = 0; i < ctx->nrounds; i++) {
+- ctx->round_keys[i] = k;
+- speck64_round(&l[i % 3], &k, i);
+- }
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
+-}
+-EXPORT_SYMBOL_GPL(crypto_speck64_setkey);
+-
+-static int speck64_setkey(struct crypto_tfm *tfm, const u8 *key,
+- unsigned int keylen)
+-{
+- return crypto_speck64_setkey(crypto_tfm_ctx(tfm), key, keylen);
+-}
+-
+-/* Algorithm definitions */
+-
+-static struct crypto_alg speck_algs[] = {
+- {
+- .cra_name = "speck128",
+- .cra_driver_name = "speck128-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK128_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck128_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK128_128_KEY_SIZE,
+- .cia_max_keysize = SPECK128_256_KEY_SIZE,
+- .cia_setkey = speck128_setkey,
+- .cia_encrypt = speck128_encrypt,
+- .cia_decrypt = speck128_decrypt
+- }
+- }
+- }, {
+- .cra_name = "speck64",
+- .cra_driver_name = "speck64-generic",
+- .cra_priority = 100,
+- .cra_flags = CRYPTO_ALG_TYPE_CIPHER,
+- .cra_blocksize = SPECK64_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct speck64_tfm_ctx),
+- .cra_module = THIS_MODULE,
+- .cra_u = {
+- .cipher = {
+- .cia_min_keysize = SPECK64_96_KEY_SIZE,
+- .cia_max_keysize = SPECK64_128_KEY_SIZE,
+- .cia_setkey = speck64_setkey,
+- .cia_encrypt = speck64_encrypt,
+- .cia_decrypt = speck64_decrypt
+- }
+- }
+- }
+-};
+-
+-static int __init speck_module_init(void)
+-{
+- return crypto_register_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-static void __exit speck_module_exit(void)
+-{
+- crypto_unregister_algs(speck_algs, ARRAY_SIZE(speck_algs));
+-}
+-
+-module_init(speck_module_init);
+-module_exit(speck_module_exit);
+-
+-MODULE_DESCRIPTION("Speck block cipher (generic)");
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Eric Biggers <ebiggers@google.com>");
+-MODULE_ALIAS_CRYPTO("speck128");
+-MODULE_ALIAS_CRYPTO("speck128-generic");
+-MODULE_ALIAS_CRYPTO("speck64");
+-MODULE_ALIAS_CRYPTO("speck64-generic");
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index d5bcdd905007..ee4f2a175bda 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -1097,6 +1097,9 @@ static void test_ahash_speed_common(const char *algo, unsigned int secs,
+ break;
+ }
+
++ if (speed[i].klen)
++ crypto_ahash_setkey(tfm, tvmem[0], speed[i].klen);
++
+ pr_info("test%3u "
+ "(%5u byte blocks,%5u bytes per update,%4u updates): ",
+ i, speed[i].blen, speed[i].plen, speed[i].blen / speed[i].plen);
+diff --git a/crypto/testmgr.c b/crypto/testmgr.c
+index 11e45352fd0b..1ed03bf6a977 100644
+--- a/crypto/testmgr.c
++++ b/crypto/testmgr.c
+@@ -3000,18 +3000,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(sm4_tv_template)
+ }
+- }, {
+- .alg = "ecb(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_tv_template)
+- }
+- }, {
+- .alg = "ecb(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_tv_template)
+- }
+ }, {
+ .alg = "ecb(tea)",
+ .test = alg_test_skcipher,
+@@ -3539,18 +3527,6 @@ static const struct alg_test_desc alg_test_descs[] = {
+ .suite = {
+ .cipher = __VECS(serpent_xts_tv_template)
+ }
+- }, {
+- .alg = "xts(speck128)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck128_xts_tv_template)
+- }
+- }, {
+- .alg = "xts(speck64)",
+- .test = alg_test_skcipher,
+- .suite = {
+- .cipher = __VECS(speck64_xts_tv_template)
+- }
+ }, {
+ .alg = "xts(twofish)",
+ .test = alg_test_skcipher,
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index b950aa234e43..36572c665026 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -10141,744 +10141,6 @@ static const struct cipher_testvec sm4_tv_template[] = {
+ }
+ };
+
+-/*
+- * Speck test vectors taken from the original paper:
+- * "The Simon and Speck Families of Lightweight Block Ciphers"
+- * https://eprint.iacr.org/2013/404.pdf
+- *
+- * Note that the paper does not make byte and word order clear. But it was
+- * confirmed with the authors that the intended orders are little endian byte
+- * order and (y, x) word order. Equivalently, the printed test vectors, when
+- * looking at only the bytes (ignoring the whitespace that divides them into
+- * words), are backwards: the left-most byte is actually the one with the
+- * highest memory address, while the right-most byte is actually the one with
+- * the lowest memory address.
+- */
+-
+-static const struct cipher_testvec speck128_tv_template[] = {
+- { /* Speck128/128 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f",
+- .klen = 16,
+- .ptext = "\x20\x6d\x61\x64\x65\x20\x69\x74"
+- "\x20\x65\x71\x75\x69\x76\x61\x6c",
+- .ctext = "\x18\x0d\x57\x5c\xdf\xfe\x60\x78"
+- "\x65\x32\x78\x79\x51\x98\x5d\xa6",
+- .len = 16,
+- }, { /* Speck128/192 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17",
+- .klen = 24,
+- .ptext = "\x65\x6e\x74\x20\x74\x6f\x20\x43"
+- "\x68\x69\x65\x66\x20\x48\x61\x72",
+- .ctext = "\x86\x18\x3c\xe0\x5d\x18\xbc\xf9"
+- "\x66\x55\x13\x13\x3a\xcf\xe4\x1b",
+- .len = 16,
+- }, { /* Speck128/256 */
+- .key = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f",
+- .klen = 32,
+- .ptext = "\x70\x6f\x6f\x6e\x65\x72\x2e\x20"
+- "\x49\x6e\x20\x74\x68\x6f\x73\x65",
+- .ctext = "\x43\x8f\x18\x9c\x8d\xb4\xee\x4e"
+- "\x3e\xf5\xc0\x05\x04\x01\x09\x41",
+- .len = 16,
+- },
+-};
+-
+-/*
+- * Speck128-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck128 as the cipher
+- */
+-static const struct cipher_testvec speck128_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\xbe\xa0\xe7\x03\xd7\xfe\xab\x62"
+- "\x3b\x99\x4a\x64\x74\x77\xac\xed"
+- "\xd8\xf4\xa6\xcf\xae\xb9\x07\x42"
+- "\x51\xd9\xb6\x1d\xe0\x5e\xbc\x54",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\xfb\x53\x81\x75\x6f\x9f\x34\xad"
+- "\x7e\x01\xed\x7b\xcc\xda\x4e\x4a"
+- "\xd4\x84\xa4\x53\xd5\x88\x73\x1b"
+- "\xfd\xcb\xae\x0d\xf3\x04\xee\xe6",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 32,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x21\x52\x84\x15\xd1\xf7\x21\x55"
+- "\xd9\x75\x4a\xd3\xc5\xdb\x9f\x7d"
+- "\xda\x63\xb2\xf1\x82\xb0\x89\x59"
+- "\x86\xd4\xaa\xaa\xdd\xff\x4f\x92",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95",
+- .klen = 32,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x57\xb5\xf8\x71\x6e\x6d\xdd\x82"
+- "\x53\xd0\xed\x2d\x30\xc1\x20\xef"
+- "\x70\x67\x5e\xff\x09\x70\xbb\xc1"
+- "\x3a\x7b\x48\x26\xd9\x0b\xf4\x48"
+- "\xbe\xce\xb1\xc7\xb2\x67\xc4\xa7"
+- "\x76\xf8\x36\x30\xb7\xb4\x9a\xd9"
+- "\xf5\x9d\xd0\x7b\xc1\x06\x96\x44"
+- "\x19\xc5\x58\x84\x63\xb9\x12\x68"
+- "\x68\xc7\xaa\x18\x98\xf2\x1f\x5c"
+- "\x39\xa6\xd8\x32\x2b\xc3\x51\xfd"
+- "\x74\x79\x2e\xb4\x44\xd7\x69\xc4"
+- "\xfc\x29\xe6\xed\x26\x1e\xa6\x9d"
+- "\x1c\xbe\x00\x0e\x7f\x3a\xca\xfb"
+- "\x6d\x13\x65\xa0\xf9\x31\x12\xe2"
+- "\x26\xd1\xec\x2b\x0a\x8b\x59\x99"
+- "\xa7\x49\xa0\x0e\x09\x33\x85\x50"
+- "\xc3\x23\xca\x7a\xdd\x13\x45\x5f"
+- "\xde\x4c\xa7\xcb\x00\x8a\x66\x6f"
+- "\xa2\xb6\xb1\x2e\xe1\xa0\x18\xf6"
+- "\xad\xf3\xbd\xeb\xc7\xef\x55\x4f"
+- "\x79\x91\x8d\x36\x13\x7b\xd0\x4a"
+- "\x6c\x39\xfb\x53\xb8\x6f\x02\x51"
+- "\xa5\x20\xac\x24\x1c\x73\x59\x73"
+- "\x58\x61\x3a\x87\x58\xb3\x20\x56"
+- "\x39\x06\x2b\x4d\xd3\x20\x2b\x89"
+- "\x3f\xa2\xf0\x96\xeb\x7f\xa4\xcd"
+- "\x11\xae\xbd\xcb\x3a\xb4\xd9\x91"
+- "\x09\x35\x71\x50\x65\xac\x92\xe3"
+- "\x7b\x32\xc0\x7a\xdd\xd4\xc3\x92"
+- "\x6f\xeb\x79\xde\x6f\xd3\x25\xc9"
+- "\xcd\x63\xf5\x1e\x7a\x3b\x26\x9d"
+- "\x77\x04\x80\xa9\xbf\x38\xb5\xbd"
+- "\xb8\x05\x07\xbd\xfd\xab\x7b\xf8"
+- "\x2a\x26\xcc\x49\x14\x6d\x55\x01"
+- "\x06\x94\xd8\xb2\x2d\x53\x83\x1b"
+- "\x8f\xd4\xdd\x57\x12\x7e\x18\xba"
+- "\x8e\xe2\x4d\x80\xef\x7e\x6b\x9d"
+- "\x24\xa9\x60\xa4\x97\x85\x86\x2a"
+- "\x01\x00\x09\xf1\xcb\x4a\x24\x1c"
+- "\xd8\xf6\xe6\x5b\xe7\x5d\xf2\xc4"
+- "\x97\x1c\x10\xc6\x4d\x66\x4f\x98"
+- "\x87\x30\xac\xd5\xea\x73\x49\x10"
+- "\x80\xea\xe5\x5f\x4d\x5f\x03\x33"
+- "\x66\x02\x35\x3d\x60\x06\x36\x4f"
+- "\x14\x1c\xd8\x07\x1f\x78\xd0\xf8"
+- "\x4f\x6c\x62\x7c\x15\xa5\x7c\x28"
+- "\x7c\xcc\xeb\x1f\xd1\x07\x90\x93"
+- "\x7e\xc2\xa8\x3a\x80\xc0\xf5\x30"
+- "\xcc\x75\xcf\x16\x26\xa9\x26\x3b"
+- "\xe7\x68\x2f\x15\x21\x5b\xe4\x00"
+- "\xbd\x48\x50\xcd\x75\x70\xc4\x62"
+- "\xbb\x41\xfb\x89\x4a\x88\x3b\x3b"
+- "\x51\x66\x02\x69\x04\x97\x36\xd4"
+- "\x75\xae\x0b\xa3\x42\xf8\xca\x79"
+- "\x8f\x93\xe9\xcc\x38\xbd\xd6\xd2"
+- "\xf9\x70\x4e\xc3\x6a\x8e\x25\xbd"
+- "\xea\x15\x5a\xa0\x85\x7e\x81\x0d"
+- "\x03\xe7\x05\x39\xf5\x05\x26\xee"
+- "\xec\xaa\x1f\x3d\xc9\x98\x76\x01"
+- "\x2c\xf4\xfc\xa3\x88\x77\x38\xc4"
+- "\x50\x65\x50\x6d\x04\x1f\xdf\x5a"
+- "\xaa\xf2\x01\xa9\xc1\x8d\xee\xca"
+- "\x47\x26\xef\x39\xb8\xb4\xf2\xd1"
+- "\xd6\xbb\x1b\x2a\xc1\x34\x14\xcf",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27"
+- "\x31\x41\x59\x26\x53\x58\x97\x93"
+- "\x23\x84\x62\x64\x33\x83\x27\x95"
+- "\x02\x88\x41\x97\x16\x93\x99\x37"
+- "\x51\x05\x82\x09\x74\x94\x45\x92",
+- .klen = 64,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xc5\x85\x2a\x4b\x73\xe4\xf6\xf1"
+- "\x7e\xf9\xf6\xe9\xa3\x73\x36\xcb"
+- "\xaa\xb6\x22\xb0\x24\x6e\x3d\x73"
+- "\x92\x99\xde\xd3\x76\xed\xcd\x63"
+- "\x64\x3a\x22\x57\xc1\x43\x49\xd4"
+- "\x79\x36\x31\x19\x62\xae\x10\x7e"
+- "\x7d\xcf\x7a\xe2\x6b\xce\x27\xfa"
+- "\xdc\x3d\xd9\x83\xd3\x42\x4c\xe0"
+- "\x1b\xd6\x1d\x1a\x6f\xd2\x03\x00"
+- "\xfc\x81\x99\x8a\x14\x62\xf5\x7e"
+- "\x0d\xe7\x12\xe8\x17\x9d\x0b\xec"
+- "\xe2\xf7\xc9\xa7\x63\xd1\x79\xb6"
+- "\x62\x62\x37\xfe\x0a\x4c\x4a\x37"
+- "\x70\xc7\x5e\x96\x5f\xbc\x8e\x9e"
+- "\x85\x3c\x4f\x26\x64\x85\xbc\x68"
+- "\xb0\xe0\x86\x5e\x26\x41\xce\x11"
+- "\x50\xda\x97\x14\xe9\x9e\xc7\x6d"
+- "\x3b\xdc\x43\xde\x2b\x27\x69\x7d"
+- "\xfc\xb0\x28\xbd\x8f\xb1\xc6\x31"
+- "\x14\x4d\xf0\x74\x37\xfd\x07\x25"
+- "\x96\x55\xe5\xfc\x9e\x27\x2a\x74"
+- "\x1b\x83\x4d\x15\x83\xac\x57\xa0"
+- "\xac\xa5\xd0\x38\xef\x19\x56\x53"
+- "\x25\x4b\xfc\xce\x04\x23\xe5\x6b"
+- "\xf6\xc6\x6c\x32\x0b\xb3\x12\xc5"
+- "\xed\x22\x34\x1c\x5d\xed\x17\x06"
+- "\x36\xa3\xe6\x77\xb9\x97\x46\xb8"
+- "\xe9\x3f\x7e\xc7\xbc\x13\x5c\xdc"
+- "\x6e\x3f\x04\x5e\xd1\x59\xa5\x82"
+- "\x35\x91\x3d\x1b\xe4\x97\x9f\x92"
+- "\x1c\x5e\x5f\x6f\x41\xd4\x62\xa1"
+- "\x8d\x39\xfc\x42\xfb\x38\x80\xb9"
+- "\x0a\xe3\xcc\x6a\x93\xd9\x7a\xb1"
+- "\xe9\x69\xaf\x0a\x6b\x75\x38\xa7"
+- "\xa1\xbf\xf7\xda\x95\x93\x4b\x78"
+- "\x19\xf5\x94\xf9\xd2\x00\x33\x37"
+- "\xcf\xf5\x9e\x9c\xf3\xcc\xa6\xee"
+- "\x42\xb2\x9e\x2c\x5f\x48\x23\x26"
+- "\x15\x25\x17\x03\x3d\xfe\x2c\xfc"
+- "\xeb\xba\xda\xe0\x00\x05\xb6\xa6"
+- "\x07\xb3\xe8\x36\x5b\xec\x5b\xbf"
+- "\xd6\x5b\x00\x74\xc6\x97\xf1\x6a"
+- "\x49\xa1\xc3\xfa\x10\x52\xb9\x14"
+- "\xad\xb7\x73\xf8\x78\x12\xc8\x59"
+- "\x17\x80\x4c\x57\x39\xf1\x6d\x80"
+- "\x25\x77\x0f\x5e\x7d\xf0\xaf\x21"
+- "\xec\xce\xb7\xc8\x02\x8a\xed\x53"
+- "\x2c\x25\x68\x2e\x1f\x85\x5e\x67"
+- "\xd1\x07\x7a\x3a\x89\x08\xe0\x34"
+- "\xdc\xdb\x26\xb4\x6b\x77\xfc\x40"
+- "\x31\x15\x72\xa0\xf0\x73\xd9\x3b"
+- "\xd5\xdb\xfe\xfc\x8f\xa9\x44\xa2"
+- "\x09\x9f\xc6\x33\xe5\xe2\x88\xe8"
+- "\xf3\xf0\x1a\xf4\xce\x12\x0f\xd6"
+- "\xf7\x36\xe6\xa4\xf4\x7a\x10\x58"
+- "\xcc\x1f\x48\x49\x65\x47\x75\xe9"
+- "\x28\xe1\x65\x7b\xf2\xc4\xb5\x07"
+- "\xf2\xec\x76\xd8\x8f\x09\xf3\x16"
+- "\xa1\x51\x89\x3b\xeb\x96\x42\xac"
+- "\x65\xe0\x67\x63\x29\xdc\xb4\x7d"
+- "\xf2\x41\x51\x6a\xcb\xde\x3c\xfb"
+- "\x66\x8d\x13\xca\xe0\x59\x2a\x00"
+- "\xc9\x53\x4c\xe6\x9e\xe2\x73\xd5"
+- "\x67\x19\xb2\xbd\x9a\x63\xd7\x5c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+-static const struct cipher_testvec speck64_tv_template[] = {
+- { /* Speck64/96 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13",
+- .klen = 12,
+- .ptext = "\x65\x61\x6e\x73\x20\x46\x61\x74",
+- .ctext = "\x6c\x94\x75\x41\xec\x52\x79\x9f",
+- .len = 8,
+- }, { /* Speck64/128 */
+- .key = "\x00\x01\x02\x03\x08\x09\x0a\x0b"
+- "\x10\x11\x12\x13\x18\x19\x1a\x1b",
+- .klen = 16,
+- .ptext = "\x2d\x43\x75\x74\x74\x65\x72\x3b",
+- .ctext = "\x8b\x02\x4e\x45\x48\xa5\x6f\x8c",
+- .len = 8,
+- },
+-};
+-
+-/*
+- * Speck64-XTS test vectors, taken from the AES-XTS test vectors with the
+- * ciphertext recomputed with Speck64 as the cipher, and key lengths adjusted
+- */
+-static const struct cipher_testvec speck64_xts_tv_template[] = {
+- {
+- .key = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ctext = "\x84\xaf\x54\x07\x19\xd4\x7c\xa6"
+- "\xe4\xfe\xdf\xc4\x1f\x34\xc3\xc2"
+- "\x80\xf5\x72\xe7\xcd\xf0\x99\x22"
+- "\x35\xa7\x2f\x06\xef\xdc\x51\xaa",
+- .len = 32,
+- }, {
+- .key = "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x11\x11\x11\x11\x11\x11\x11\x11"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x12\x56\x73\xcd\x15\x87\xa8\x59"
+- "\xcf\x84\xae\xd9\x1c\x66\xd6\x9f"
+- "\xb3\x12\x69\x7e\x36\xeb\x52\xff"
+- "\x62\xdd\xba\x90\xb3\xe1\xee\x99",
+- .len = 32,
+- }, {
+- .key = "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8"
+- "\xf7\xf6\xf5\xf4\xf3\xf2\xf1\xf0"
+- "\x22\x22\x22\x22\x22\x22\x22\x22",
+- .klen = 24,
+- .iv = "\x33\x33\x33\x33\x33\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44"
+- "\x44\x44\x44\x44\x44\x44\x44\x44",
+- .ctext = "\x15\x1b\xe4\x2c\xa2\x5a\x2d\x2c"
+- "\x27\x36\xc0\xbf\x5d\xea\x36\x37"
+- "\x2d\x1a\x88\xbc\x66\xb5\xd0\x0b"
+- "\xa1\xbc\x19\xb2\x0f\x3b\x75\x34",
+- .len = 32,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x31\x41\x59\x26\x53\x58\x97\x93",
+- .klen = 24,
+- .iv = "\x00\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\xaf\xa1\x81\xa6\x32\xbb\x15\x8e"
+- "\xf8\x95\x2e\xd3\xe6\xee\x7e\x09"
+- "\x0c\x1a\xf5\x02\x97\x8b\xe3\xb3"
+- "\x11\xc7\x39\x96\xd0\x95\xf4\x56"
+- "\xf4\xdd\x03\x38\x01\x44\x2c\xcf"
+- "\x88\xae\x8e\x3c\xcd\xe7\xaa\x66"
+- "\xfe\x3d\xc6\xfb\x01\x23\x51\x43"
+- "\xd5\xd2\x13\x86\x94\x34\xe9\x62"
+- "\xf9\x89\xe3\xd1\x7b\xbe\xf8\xef"
+- "\x76\x35\x04\x3f\xdb\x23\x9d\x0b"
+- "\x85\x42\xb9\x02\xd6\xcc\xdb\x96"
+- "\xa7\x6b\x27\xb6\xd4\x45\x8f\x7d"
+- "\xae\xd2\x04\xd5\xda\xc1\x7e\x24"
+- "\x8c\x73\xbe\x48\x7e\xcf\x65\x28"
+- "\x29\xe5\xbe\x54\x30\xcb\x46\x95"
+- "\x4f\x2e\x8a\x36\xc8\x27\xc5\xbe"
+- "\xd0\x1a\xaf\xab\x26\xcd\x9e\x69"
+- "\xa1\x09\x95\x71\x26\xe9\xc4\xdf"
+- "\xe6\x31\xc3\x46\xda\xaf\x0b\x41"
+- "\x1f\xab\xb1\x8e\xd6\xfc\x0b\xb3"
+- "\x82\xc0\x37\x27\xfc\x91\xa7\x05"
+- "\xfb\xc5\xdc\x2b\x74\x96\x48\x43"
+- "\x5d\x9c\x19\x0f\x60\x63\x3a\x1f"
+- "\x6f\xf0\x03\xbe\x4d\xfd\xc8\x4a"
+- "\xc6\xa4\x81\x6d\xc3\x12\x2a\x5c"
+- "\x07\xff\xf3\x72\x74\x48\xb5\x40"
+- "\x50\xb5\xdd\x90\x43\x31\x18\x15"
+- "\x7b\xf2\xa6\xdb\x83\xc8\x4b\x4a"
+- "\x29\x93\x90\x8b\xda\x07\xf0\x35"
+- "\x6d\x90\x88\x09\x4e\x83\xf5\x5b"
+- "\x94\x12\xbb\x33\x27\x1d\x3f\x23"
+- "\x51\xa8\x7c\x07\xa2\xae\x77\xa6"
+- "\x50\xfd\xcc\xc0\x4f\x80\x7a\x9f"
+- "\x66\xdd\xcd\x75\x24\x8b\x33\xf7"
+- "\x20\xdb\x83\x9b\x4f\x11\x63\x6e"
+- "\xcf\x37\xef\xc9\x11\x01\x5c\x45"
+- "\x32\x99\x7c\x3c\x9e\x42\x89\xe3"
+- "\x70\x6d\x15\x9f\xb1\xe6\xb6\x05"
+- "\xfe\x0c\xb9\x49\x2d\x90\x6d\xcc"
+- "\x5d\x3f\xc1\xfe\x89\x0a\x2e\x2d"
+- "\xa0\xa8\x89\x3b\x73\x39\xa5\x94"
+- "\x4c\xa4\xa6\xbb\xa7\x14\x46\x89"
+- "\x10\xff\xaf\xef\xca\xdd\x4f\x80"
+- "\xb3\xdf\x3b\xab\xd4\xe5\x5a\xc7"
+- "\x33\xca\x00\x8b\x8b\x3f\xea\xec"
+- "\x68\x8a\xc2\x6d\xfd\xd4\x67\x0f"
+- "\x22\x31\xe1\x0e\xfe\x5a\x04\xd5"
+- "\x64\xa3\xf1\x1a\x76\x28\xcc\x35"
+- "\x36\xa7\x0a\x74\xf7\x1c\x44\x9b"
+- "\xc7\x1b\x53\x17\x02\xea\xd1\xad"
+- "\x13\x51\x73\xc0\xa0\xb2\x05\x32"
+- "\xa8\xa2\x37\x2e\xe1\x7a\x3a\x19"
+- "\x26\xb4\x6c\x62\x5d\xb3\x1a\x1d"
+- "\x59\xda\xee\x1a\x22\x18\xda\x0d"
+- "\x88\x0f\x55\x8b\x72\x62\xfd\xc1"
+- "\x69\x13\xcd\x0d\x5f\xc1\x09\x52"
+- "\xee\xd6\xe3\x84\x4d\xee\xf6\x88"
+- "\xaf\x83\xdc\x76\xf4\xc0\x93\x3f"
+- "\x4a\x75\x2f\xb0\x0b\x3e\xc4\x54"
+- "\x7d\x69\x8d\x00\x62\x77\x0d\x14"
+- "\xbe\x7c\xa6\x7d\xc5\x24\x4f\xf3"
+- "\x50\xf7\x5f\xf4\xc2\xca\x41\x97"
+- "\x37\xbe\x75\x74\xcd\xf0\x75\x6e"
+- "\x25\x23\x94\xbd\xda\x8d\xb0\xd4",
+- .len = 512,
+- }, {
+- .key = "\x27\x18\x28\x18\x28\x45\x90\x45"
+- "\x23\x53\x60\x28\x74\x71\x35\x26"
+- "\x62\x49\x77\x57\x24\x70\x93\x69"
+- "\x99\x59\x57\x49\x66\x96\x76\x27",
+- .klen = 32,
+- .iv = "\xff\x00\x00\x00\x00\x00\x00\x00"
+- "\x00\x00\x00\x00\x00\x00\x00\x00",
+- .ptext = "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
+- "\x00\x01\x02\x03\x04\x05\x06\x07"
+- "\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
+- "\x10\x11\x12\x13\x14\x15\x16\x17"
+- "\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
+- "\x20\x21\x22\x23\x24\x25\x26\x27"
+- "\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
+- "\x30\x31\x32\x33\x34\x35\x36\x37"
+- "\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"
+- "\x40\x41\x42\x43\x44\x45\x46\x47"
+- "\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f"
+- "\x50\x51\x52\x53\x54\x55\x56\x57"
+- "\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f"
+- "\x60\x61\x62\x63\x64\x65\x66\x67"
+- "\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f"
+- "\x70\x71\x72\x73\x74\x75\x76\x77"
+- "\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f"
+- "\x80\x81\x82\x83\x84\x85\x86\x87"
+- "\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"
+- "\x90\x91\x92\x93\x94\x95\x96\x97"
+- "\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"
+- "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7"
+- "\xa8\xa9\xaa\xab\xac\xad\xae\xaf"
+- "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7"
+- "\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"
+- "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7"
+- "\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"
+- "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7"
+- "\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"
+- "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7"
+- "\xe8\xe9\xea\xeb\xec\xed\xee\xef"
+- "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7"
+- "\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff",
+- .ctext = "\x55\xed\x71\xd3\x02\x8e\x15\x3b"
+- "\xc6\x71\x29\x2d\x3e\x89\x9f\x59"
+- "\x68\x6a\xcc\x8a\x56\x97\xf3\x95"
+- "\x4e\x51\x08\xda\x2a\xf8\x6f\x3c"
+- "\x78\x16\xea\x80\xdb\x33\x75\x94"
+- "\xf9\x29\xc4\x2b\x76\x75\x97\xc7"
+- "\xf2\x98\x2c\xf9\xff\xc8\xd5\x2b"
+- "\x18\xf1\xaf\xcf\x7c\xc5\x0b\xee"
+- "\xad\x3c\x76\x7c\xe6\x27\xa2\x2a"
+- "\xe4\x66\xe1\xab\xa2\x39\xfc\x7c"
+- "\xf5\xec\x32\x74\xa3\xb8\x03\x88"
+- "\x52\xfc\x2e\x56\x3f\xa1\xf0\x9f"
+- "\x84\x5e\x46\xed\x20\x89\xb6\x44"
+- "\x8d\xd0\xed\x54\x47\x16\xbe\x95"
+- "\x8a\xb3\x6b\x72\xc4\x32\x52\x13"
+- "\x1b\xb0\x82\xbe\xac\xf9\x70\xa6"
+- "\x44\x18\xdd\x8c\x6e\xca\x6e\x45"
+- "\x8f\x1e\x10\x07\x57\x25\x98\x7b"
+- "\x17\x8c\x78\xdd\x80\xa7\xd9\xd8"
+- "\x63\xaf\xb9\x67\x57\xfd\xbc\xdb"
+- "\x44\xe9\xc5\x65\xd1\xc7\x3b\xff"
+- "\x20\xa0\x80\x1a\xc3\x9a\xad\x5e"
+- "\x5d\x3b\xd3\x07\xd9\xf5\xfd\x3d"
+- "\x4a\x8b\xa8\xd2\x6e\x7a\x51\x65"
+- "\x6c\x8e\x95\xe0\x45\xc9\x5f\x4a"
+- "\x09\x3c\x3d\x71\x7f\x0c\x84\x2a"
+- "\xc8\x48\x52\x1a\xc2\xd5\xd6\x78"
+- "\x92\x1e\xa0\x90\x2e\xea\xf0\xf3"
+- "\xdc\x0f\xb1\xaf\x0d\x9b\x06\x2e"
+- "\x35\x10\x30\x82\x0d\xe7\xc5\x9b"
+- "\xde\x44\x18\xbd\x9f\xd1\x45\xa9"
+- "\x7b\x7a\x4a\xad\x35\x65\x27\xca"
+- "\xb2\xc3\xd4\x9b\x71\x86\x70\xee"
+- "\xf1\x89\x3b\x85\x4b\x5b\xaa\xaf"
+- "\xfc\x42\xc8\x31\x59\xbe\x16\x60"
+- "\x4f\xf9\xfa\x12\xea\xd0\xa7\x14"
+- "\xf0\x7a\xf3\xd5\x8d\xbd\x81\xef"
+- "\x52\x7f\x29\x51\x94\x20\x67\x3c"
+- "\xd1\xaf\x77\x9f\x22\x5a\x4e\x63"
+- "\xe7\xff\x73\x25\xd1\xdd\x96\x8a"
+- "\x98\x52\x6d\xf3\xac\x3e\xf2\x18"
+- "\x6d\xf6\x0a\x29\xa6\x34\x3d\xed"
+- "\xe3\x27\x0d\x9d\x0a\x02\x44\x7e"
+- "\x5a\x7e\x67\x0f\x0a\x9e\xd6\xad"
+- "\x91\xe6\x4d\x81\x8c\x5c\x59\xaa"
+- "\xfb\xeb\x56\x53\xd2\x7d\x4c\x81"
+- "\x65\x53\x0f\x41\x11\xbd\x98\x99"
+- "\xf9\xc6\xfa\x51\x2e\xa3\xdd\x8d"
+- "\x84\x98\xf9\x34\xed\x33\x2a\x1f"
+- "\x82\xed\xc1\x73\x98\xd3\x02\xdc"
+- "\xe6\xc2\x33\x1d\xa2\xb4\xca\x76"
+- "\x63\x51\x34\x9d\x96\x12\xae\xce"
+- "\x83\xc9\x76\x5e\xa4\x1b\x53\x37"
+- "\x17\xd5\xc0\x80\x1d\x62\xf8\x3d"
+- "\x54\x27\x74\xbb\x10\x86\x57\x46"
+- "\x68\xe1\xed\x14\xe7\x9d\xfc\x84"
+- "\x47\xbc\xc2\xf8\x19\x4b\x99\xcf"
+- "\x7a\xe9\xc4\xb8\x8c\x82\x72\x4d"
+- "\x7b\x4f\x38\x55\x36\x71\x64\xc1"
+- "\xfc\x5c\x75\x52\x33\x02\x18\xf8"
+- "\x17\xe1\x2b\xc2\x43\x39\xbd\x76"
+- "\x9b\x63\x76\x32\x2f\x19\x72\x10"
+- "\x9f\x21\x0c\xf1\x66\x50\x7f\xa5"
+- "\x0d\x1f\x46\xe0\xba\xd3\x2f\x3c",
+- .len = 512,
+- .also_non_np = 1,
+- .np = 3,
+- .tap = { 512 - 20, 4, 16 },
+- }
+-};
+-
+ /* Cast6 test vectors from RFC 2612 */
+ static const struct cipher_testvec cast6_tv_template[] = {
+ {
+diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
+index cf4fc0161164..e43cb71b6972 100644
+--- a/drivers/acpi/acpi_lpit.c
++++ b/drivers/acpi/acpi_lpit.c
+@@ -117,11 +117,17 @@ static void lpit_update_residency(struct lpit_residency_info *info,
+ if (!info->iomem_addr)
+ return;
+
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_system_residency_us.attr,
+ "cpuidle");
+ } else if (info->gaddr.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
++ return;
++
+ /* Silently fail, if cpuidle attribute group is not present */
+ sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj,
+ &dev_attr_low_power_idle_cpu_residency_us.attr,
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index bf64cfa30feb..969bf8d515c0 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -327,9 +327,11 @@ static const struct acpi_device_id acpi_lpss_device_ids[] = {
+ { "INT33FC", },
+
+ /* Braswell LPSS devices */
++ { "80862286", LPSS_ADDR(lpss_dma_desc) },
+ { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) },
+ { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) },
+ { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) },
++ { "808622C0", LPSS_ADDR(lpss_dma_desc) },
+ { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) },
+
+ /* Broadwell LPSS devices */
+diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c
+index 449d86d39965..fc447410ae4d 100644
+--- a/drivers/acpi/acpi_processor.c
++++ b/drivers/acpi/acpi_processor.c
+@@ -643,7 +643,7 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+
+ status = acpi_get_type(handle, &acpi_type);
+ if (ACPI_FAILURE(status))
+- return false;
++ return status;
+
+ switch (acpi_type) {
+ case ACPI_TYPE_PROCESSOR:
+@@ -663,11 +663,12 @@ static acpi_status __init acpi_processor_ids_walk(acpi_handle handle,
+ }
+
+ processor_validated_ids_update(uid);
+- return true;
++ return AE_OK;
+
+ err:
++ /* Exit on error, but don't abort the namespace walk */
+ acpi_handle_info(handle, "Invalid processor object\n");
+- return false;
++ return AE_OK;
+
+ }
+
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index e9fb0bf3c8d2..78f9de260d5f 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/acpica/psloop.c b/drivers/acpi/acpica/psloop.c
+index 0f0bdc9d24c6..314276779f57 100644
+--- a/drivers/acpi/acpica/psloop.c
++++ b/drivers/acpi/acpica/psloop.c
+@@ -417,6 +417,7 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ union acpi_parse_object *op = NULL; /* current op */
+ struct acpi_parse_state *parser_state;
+ u8 *aml_op_start = NULL;
++ u8 opcode_length;
+
+ ACPI_FUNCTION_TRACE_PTR(ps_parse_loop, walk_state);
+
+@@ -540,8 +541,19 @@ acpi_status acpi_ps_parse_loop(struct acpi_walk_state *walk_state)
+ "Skip parsing opcode %s",
+ acpi_ps_get_opcode_name
+ (walk_state->opcode)));
++
++ /*
++ * Determine the opcode length before skipping the opcode.
++ * An opcode can be 1 byte or 2 bytes in length.
++ */
++ opcode_length = 1;
++ if ((walk_state->opcode & 0xFF00) ==
++ AML_EXTENDED_OPCODE) {
++ opcode_length = 2;
++ }
+ walk_state->parser_state.aml =
+- walk_state->aml + 1;
++ walk_state->aml + opcode_length;
++
+ walk_state->parser_state.aml =
+ acpi_ps_get_next_package_end
+ (&walk_state->parser_state);
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index 7c479002e798..c0db96e8a81a 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2456,7 +2456,8 @@ static int ars_get_cap(struct acpi_nfit_desc *acpi_desc,
+ return cmd_rc;
+ }
+
+-static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa)
++static int ars_start(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa, enum nfit_ars_state req_type)
+ {
+ int rc;
+ int cmd_rc;
+@@ -2467,7 +2468,7 @@ static int ars_start(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa
+ memset(&ars_start, 0, sizeof(ars_start));
+ ars_start.address = spa->address;
+ ars_start.length = spa->length;
+- if (test_bit(ARS_SHORT, &nfit_spa->ars_state))
++ if (req_type == ARS_REQ_SHORT)
+ ars_start.flags = ND_ARS_RETURN_PREV_DATA;
+ if (nfit_spa_type(spa) == NFIT_SPA_PM)
+ ars_start.type = ND_ARS_PERSISTENT;
+@@ -2524,6 +2525,15 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ struct nd_region *nd_region = nfit_spa->nd_region;
+ struct device *dev;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++ /*
++ * Only advance the ARS state for ARS runs initiated by the
++ * kernel, ignore ARS results from BIOS initiated runs for scrub
++ * completion tracking.
++ */
++ if (acpi_desc->scrub_spa != nfit_spa)
++ return;
++
+ if ((ars_status->address >= spa->address && ars_status->address
+ < spa->address + spa->length)
+ || (ars_status->address < spa->address)) {
+@@ -2543,23 +2553,13 @@ static void ars_complete(struct acpi_nfit_desc *acpi_desc,
+ } else
+ return;
+
+- if (test_bit(ARS_DONE, &nfit_spa->ars_state))
+- return;
+-
+- if (!test_and_clear_bit(ARS_REQ, &nfit_spa->ars_state))
+- return;
+-
++ acpi_desc->scrub_spa = NULL;
+ if (nd_region) {
+ dev = nd_region_dev(nd_region);
+ nvdimm_region_notify(nd_region, NVDIMM_REVALIDATE_POISON);
+ } else
+ dev = acpi_desc->dev;
+-
+- dev_dbg(dev, "ARS: range %d %s complete\n", spa->range_index,
+- test_bit(ARS_SHORT, &nfit_spa->ars_state)
+- ? "short" : "long");
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- set_bit(ARS_DONE, &nfit_spa->ars_state);
++ dev_dbg(dev, "ARS: range %d complete\n", spa->range_index);
+ }
+
+ static int ars_status_process_records(struct acpi_nfit_desc *acpi_desc)
+@@ -2840,46 +2840,55 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
+ return 0;
+ }
+
+-static int ars_register(struct acpi_nfit_desc *acpi_desc, struct nfit_spa *nfit_spa,
+- int *query_rc)
++static int ars_register(struct acpi_nfit_desc *acpi_desc,
++ struct nfit_spa *nfit_spa)
+ {
+- int rc = *query_rc;
++ int rc;
+
+- if (no_init_ars)
++ if (no_init_ars || test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ set_bit(ARS_REQ_LONG, &nfit_spa->ars_state);
+
+- switch (rc) {
++ switch (acpi_nfit_query_poison(acpi_desc)) {
+ case 0:
+ case -EAGAIN:
+- rc = ars_start(acpi_desc, nfit_spa);
+- if (rc == -EBUSY) {
+- *query_rc = rc;
++ rc = ars_start(acpi_desc, nfit_spa, ARS_REQ_SHORT);
++ /* shouldn't happen, try again later */
++ if (rc == -EBUSY)
+ break;
+- } else if (rc == 0) {
+- rc = acpi_nfit_query_poison(acpi_desc);
+- } else {
++ if (rc) {
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+- if (rc == -EAGAIN)
+- clear_bit(ARS_SHORT, &nfit_spa->ars_state);
+- else if (rc == 0)
+- ars_complete(acpi_desc, nfit_spa);
++ clear_bit(ARS_REQ_SHORT, &nfit_spa->ars_state);
++ rc = acpi_nfit_query_poison(acpi_desc);
++ if (rc)
++ break;
++ acpi_desc->scrub_spa = nfit_spa;
++ ars_complete(acpi_desc, nfit_spa);
++ /*
++ * If ars_complete() says we didn't complete the
++ * short scrub, we'll try again with a long
++ * request.
++ */
++ acpi_desc->scrub_spa = NULL;
+ break;
+ case -EBUSY:
++ case -ENOMEM:
+ case -ENOSPC:
++ /*
++ * BIOS was using ARS, wait for it to complete (or
++ * resources to become available) and then perform our
++ * own scrubs.
++ */
+ break;
+ default:
+ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ break;
+ }
+
+- if (test_and_clear_bit(ARS_DONE, &nfit_spa->ars_state))
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+-
+ return acpi_nfit_register_region(acpi_desc, nfit_spa);
+ }
+
+@@ -2901,6 +2910,8 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+ struct device *dev = acpi_desc->dev;
+ struct nfit_spa *nfit_spa;
+
++ lockdep_assert_held(&acpi_desc->init_mutex);
++
+ if (acpi_desc->cancel)
+ return 0;
+
+@@ -2924,21 +2935,49 @@ static unsigned int __acpi_nfit_scrub(struct acpi_nfit_desc *acpi_desc,
+
+ ars_complete_all(acpi_desc);
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
++ enum nfit_ars_state req_type;
++ int rc;
++
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+- if (test_bit(ARS_REQ, &nfit_spa->ars_state)) {
+- int rc = ars_start(acpi_desc, nfit_spa);
+-
+- clear_bit(ARS_DONE, &nfit_spa->ars_state);
+- dev = nd_region_dev(nfit_spa->nd_region);
+- dev_dbg(dev, "ARS: range %d ARS start (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- if (rc == 0 || rc == -EBUSY)
+- return 1;
+- dev_err(dev, "ARS: range %d ARS failed (%d)\n",
+- nfit_spa->spa->range_index, rc);
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
++
++ /* prefer short ARS requests first */
++ if (test_bit(ARS_REQ_SHORT, &nfit_spa->ars_state))
++ req_type = ARS_REQ_SHORT;
++ else if (test_bit(ARS_REQ_LONG, &nfit_spa->ars_state))
++ req_type = ARS_REQ_LONG;
++ else
++ continue;
++ rc = ars_start(acpi_desc, nfit_spa, req_type);
++
++ dev = nd_region_dev(nfit_spa->nd_region);
++ dev_dbg(dev, "ARS: range %d ARS start %s (%d)\n",
++ nfit_spa->spa->range_index,
++ req_type == ARS_REQ_SHORT ? "short" : "long",
++ rc);
++ /*
++ * Hmm, we raced someone else starting ARS? Try again in
++ * a bit.
++ */
++ if (rc == -EBUSY)
++ return 1;
++ if (rc == 0) {
++ dev_WARN_ONCE(dev, acpi_desc->scrub_spa,
++ "scrub start while range %d active\n",
++ acpi_desc->scrub_spa->spa->range_index);
++ clear_bit(req_type, &nfit_spa->ars_state);
++ acpi_desc->scrub_spa = nfit_spa;
++ /*
++ * Consider this spa last for future scrub
++ * requests
++ */
++ list_move_tail(&nfit_spa->list, &acpi_desc->spas);
++ return 1;
+ }
++
++ dev_err(dev, "ARS: range %d ARS failed (%d)\n",
++ nfit_spa->spa->range_index, rc);
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ }
+ return 0;
+ }
+@@ -2994,6 +3033,7 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ struct nd_cmd_ars_cap ars_cap;
+ int rc;
+
++ set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ memset(&ars_cap, 0, sizeof(ars_cap));
+ rc = ars_get_cap(acpi_desc, &ars_cap, nfit_spa);
+ if (rc < 0)
+@@ -3010,16 +3050,14 @@ static void acpi_nfit_init_ars(struct acpi_nfit_desc *acpi_desc,
+ nfit_spa->clear_err_unit = ars_cap.clear_err_unit;
+ acpi_desc->max_ars = max(nfit_spa->max_ars, acpi_desc->max_ars);
+ clear_bit(ARS_FAILED, &nfit_spa->ars_state);
+- set_bit(ARS_REQ, &nfit_spa->ars_state);
+ }
+
+ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ {
+ struct nfit_spa *nfit_spa;
+- int rc, query_rc;
++ int rc;
+
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
+- set_bit(ARS_FAILED, &nfit_spa->ars_state);
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+@@ -3028,20 +3066,12 @@ static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc)
+ }
+ }
+
+- /*
+- * Reap any results that might be pending before starting new
+- * short requests.
+- */
+- query_rc = acpi_nfit_query_poison(acpi_desc);
+- if (query_rc == 0)
+- ars_complete_all(acpi_desc);
+-
+ list_for_each_entry(nfit_spa, &acpi_desc->spas, list)
+ switch (nfit_spa_type(nfit_spa->spa)) {
+ case NFIT_SPA_VOLATILE:
+ case NFIT_SPA_PM:
+ /* register regions and kick off initial ARS run */
+- rc = ars_register(acpi_desc, nfit_spa, &query_rc);
++ rc = ars_register(acpi_desc, nfit_spa);
+ if (rc)
+ return rc;
+ break;
+@@ -3236,7 +3266,8 @@ static int acpi_nfit_clear_to_send(struct nvdimm_bus_descriptor *nd_desc,
+ return 0;
+ }
+
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type)
+ {
+ struct device *dev = acpi_desc->dev;
+ int scheduled = 0, busy = 0;
+@@ -3256,13 +3287,10 @@ int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags)
+ if (test_bit(ARS_FAILED, &nfit_spa->ars_state))
+ continue;
+
+- if (test_and_set_bit(ARS_REQ, &nfit_spa->ars_state))
++ if (test_and_set_bit(req_type, &nfit_spa->ars_state))
+ busy++;
+- else {
+- if (test_bit(ARS_SHORT, &flags))
+- set_bit(ARS_SHORT, &nfit_spa->ars_state);
++ else
+ scheduled++;
+- }
+ }
+ if (scheduled) {
+ sched_ars(acpi_desc);
+@@ -3448,10 +3476,11 @@ static void acpi_nfit_update_notify(struct device *dev, acpi_handle handle)
+ static void acpi_nfit_uc_error_notify(struct device *dev, acpi_handle handle)
+ {
+ struct acpi_nfit_desc *acpi_desc = dev_get_drvdata(dev);
+- unsigned long flags = (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON) ?
+- 0 : 1 << ARS_SHORT;
+
+- acpi_nfit_ars_rescan(acpi_desc, flags);
++ if (acpi_desc->scrub_mode == HW_ERROR_SCRUB_ON)
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG);
++ else
++ acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_SHORT);
+ }
+
+ void __acpi_nfit_notify(struct device *dev, acpi_handle handle, u32 event)
+diff --git a/drivers/acpi/nfit/nfit.h b/drivers/acpi/nfit/nfit.h
+index a97ff42fe311..02c10de50386 100644
+--- a/drivers/acpi/nfit/nfit.h
++++ b/drivers/acpi/nfit/nfit.h
+@@ -118,9 +118,8 @@ enum nfit_dimm_notifiers {
+ };
+
+ enum nfit_ars_state {
+- ARS_REQ,
+- ARS_DONE,
+- ARS_SHORT,
++ ARS_REQ_SHORT,
++ ARS_REQ_LONG,
+ ARS_FAILED,
+ };
+
+@@ -197,6 +196,7 @@ struct acpi_nfit_desc {
+ struct device *dev;
+ u8 ars_start_flags;
+ struct nd_cmd_ars_status *ars_status;
++ struct nfit_spa *scrub_spa;
+ struct delayed_work dwork;
+ struct list_head list;
+ struct kernfs_node *scrub_count_state;
+@@ -251,7 +251,8 @@ struct nfit_blk {
+
+ extern struct list_head acpi_descs;
+ extern struct mutex acpi_desc_lock;
+-int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc, unsigned long flags);
++int acpi_nfit_ars_rescan(struct acpi_nfit_desc *acpi_desc,
++ enum nfit_ars_state req_type);
+
+ #ifdef CONFIG_X86_MCE
+ void nfit_mce_register(void);
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index 8df9abfa947b..ed73f6fb0779 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -617,15 +617,18 @@ void acpi_os_stall(u32 us)
+ }
+
+ /*
+- * Support ACPI 3.0 AML Timer operand
+- * Returns 64-bit free-running, monotonically increasing timer
+- * with 100ns granularity
++ * Support ACPI 3.0 AML Timer operand. Returns a 64-bit free-running,
++ * monotonically increasing timer with 100ns granularity. Do not use
++ * ktime_get() to implement this function because this function may get
++ * called after timekeeping has been suspended. Note: calling this function
++ * after timekeeping has been suspended may lead to unexpected results
++ * because when timekeeping is suspended the jiffies counter is not
++ * incremented. See also timekeeping_suspend().
+ */
+ u64 acpi_os_get_timer(void)
+ {
+- u64 time_ns = ktime_to_ns(ktime_get());
+- do_div(time_ns, 100);
+- return time_ns;
++ return (get_jiffies_64() - INITIAL_JIFFIES) *
++ (ACPI_100NSEC_PER_SEC / HZ);
+ }
+
+ acpi_status acpi_os_read_port(acpi_io_address port, u32 * value, u32 width)
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index d1e26cb599bf..da031b1df6f5 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -338,9 +338,6 @@ static struct acpi_pptt_cache *acpi_find_cache_node(struct acpi_table_header *ta
+ return found;
+ }
+
+-/* total number of attributes checked by the properties code */
+-#define PPTT_CHECKED_ATTRIBUTES 4
+-
+ /**
+ * update_cache_properties() - Update cacheinfo for the given processor
+ * @this_leaf: Kernel cache info structure being updated
+@@ -357,25 +354,15 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ struct acpi_pptt_cache *found_cache,
+ struct acpi_pptt_processor *cpu_node)
+ {
+- int valid_flags = 0;
+-
+ this_leaf->fw_token = cpu_node;
+- if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID)
+ this_leaf->size = found_cache->size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) {
++ if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID)
+ this_leaf->coherency_line_size = found_cache->line_size;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) {
++ if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID)
+ this_leaf->number_of_sets = found_cache->number_of_sets;
+- valid_flags++;
+- }
+- if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) {
++ if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID)
+ this_leaf->ways_of_associativity = found_cache->associativity;
+- valid_flags++;
+- }
+ if (found_cache->flags & ACPI_PPTT_WRITE_POLICY_VALID) {
+ switch (found_cache->attributes & ACPI_PPTT_MASK_WRITE_POLICY) {
+ case ACPI_PPTT_CACHE_POLICY_WT:
+@@ -402,11 +389,17 @@ static void update_cache_properties(struct cacheinfo *this_leaf,
+ }
+ }
+ /*
+- * If the above flags are valid, and the cache type is NOCACHE
+- * update the cache type as well.
++ * If cache type is NOCACHE, then the cache hasn't been specified
++ * via other mechanisms. Update the type if a cache type has been
++ * provided.
++ *
++ * Note, we assume such caches are unified based on conventional system
++ * design and known examples. Significant work is required elsewhere to
++ * fully support data/instruction only type caches which are only
++ * specified in PPTT.
+ */
+ if (this_leaf->type == CACHE_TYPE_NOCACHE &&
+- valid_flags == PPTT_CHECKED_ATTRIBUTES)
++ found_cache->flags & ACPI_PPTT_CACHE_TYPE_VALID)
+ this_leaf->type = CACHE_TYPE_UNIFIED;
+ }
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 99bf0c0394f8..321a9579556d 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4552,6 +4552,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/block/ataflop.c b/drivers/block/ataflop.c
+index dfb2c2622e5a..822e3060d834 100644
+--- a/drivers/block/ataflop.c
++++ b/drivers/block/ataflop.c
+@@ -1935,6 +1935,11 @@ static int __init atari_floppy_init (void)
+ unit[i].disk = alloc_disk(1);
+ if (!unit[i].disk)
+ goto Enomem;
++
++ unit[i].disk->queue = blk_init_queue(do_fd_request,
++ &ataflop_lock);
++ if (!unit[i].disk->queue)
++ goto Enomem;
+ }
+
+ if (UseTrackbuffer < 0)
+@@ -1966,10 +1971,6 @@ static int __init atari_floppy_init (void)
+ sprintf(unit[i].disk->disk_name, "fd%d", i);
+ unit[i].disk->fops = &floppy_fops;
+ unit[i].disk->private_data = &unit[i];
+- unit[i].disk->queue = blk_init_queue(do_fd_request,
+- &ataflop_lock);
+- if (!unit[i].disk->queue)
+- goto Enomem;
+ set_capacity(unit[i].disk, MAX_DISK_SIZE * 2);
+ add_disk(unit[i].disk);
+ }
+@@ -1984,13 +1985,17 @@ static int __init atari_floppy_init (void)
+
+ return 0;
+ Enomem:
+- while (i--) {
+- struct request_queue *q = unit[i].disk->queue;
++ do {
++ struct gendisk *disk = unit[i].disk;
+
+- put_disk(unit[i].disk);
+- if (q)
+- blk_cleanup_queue(q);
+- }
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(unit[i].disk);
++ }
++ } while (i--);
+
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+ return -ENOMEM;
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 0e31884a9519..cbe909c51847 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -887,8 +887,17 @@ static int swim_floppy_init(struct swim_priv *swd)
+
+ exit_put_disks:
+ unregister_blkdev(FLOPPY_MAJOR, "fd");
+- while (drive--)
+- put_disk(swd->unit[drive].disk);
++ do {
++ struct gendisk *disk = swd->unit[drive].disk;
++
++ if (disk) {
++ if (disk->queue) {
++ blk_cleanup_queue(disk->queue);
++ disk->queue = NULL;
++ }
++ put_disk(disk);
++ }
++ } while (drive--);
+ return err;
+ }
+
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index b5cedccb5d7d..144df6830b82 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1911,6 +1911,7 @@ static int negotiate_mq(struct blkfront_info *info)
+ GFP_KERNEL);
+ if (!info->rinfo) {
+ xenbus_dev_fatal(info->xbdev, -ENOMEM, "allocating ring_info structure");
++ info->nr_rings = 0;
+ return -ENOMEM;
+ }
+
+@@ -2475,6 +2476,9 @@ static int blkfront_remove(struct xenbus_device *xbdev)
+
+ dev_dbg(&xbdev->dev, "%s removed", xbdev->nodename);
+
++ if (!info)
++ return 0;
++
+ blkif_free(info, 0);
+
+ mutex_lock(&info->mutex);
+diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
+index 99cde1f9467d..e3e4d929e74f 100644
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm_uart_subver_table[] = {
+ { 0x4103, "BCM4330B1" }, /* 002.001.003 */
+ { 0x410e, "BCM43341B0" }, /* 002.001.014 */
+ { 0x4406, "BCM4324B3" }, /* 002.004.006 */
++ { 0x6109, "BCM4335C0" }, /* 003.001.009 */
+ { 0x610c, "BCM4354" }, /* 003.001.012 */
+ { 0x2122, "BCM4343A0" }, /* 001.001.034 */
+ { 0x2209, "BCM43430A1" }, /* 001.002.009 */
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 265d6a6583bc..e33fefd6ceae 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -606,8 +606,9 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->waiting_alert = true;
+ ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ return;
+ }
+@@ -939,8 +940,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ ssif_info->waiting_alert = true;
+ ssif_info->retries_left = SSIF_RECV_RETRIES;
+ ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+- mod_timer(&ssif_info->retry_timer,
+- jiffies + SSIF_MSG_PART_JIFFIES);
++ if (!ssif_info->stopping)
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_MSG_PART_JIFFIES);
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ }
+ }
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 3a3a7a548a85..e8822b3d10e1 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -664,7 +664,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_space *space,
+ return len;
+
+ err = be32_to_cpu(header->return_code);
+- if (err != 0 && desc)
++ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED
++ && desc)
+ dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
+ desc);
+ if (err)
+diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
+index 911475d36800..b150f87f38f5 100644
+--- a/drivers/char/tpm/xen-tpmfront.c
++++ b/drivers/char/tpm/xen-tpmfront.c
+@@ -264,7 +264,7 @@ static int setup_ring(struct xenbus_device *dev, struct tpm_private *priv)
+ return -ENOMEM;
+ }
+
+- rv = xenbus_grant_ring(dev, &priv->shr, 1, &gref);
++ rv = xenbus_grant_ring(dev, priv->shr, 1, &gref);
+ if (rv < 0)
+ return rv;
+
+diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
+index 0a9ebf00be46..e58bfcb1169e 100644
+--- a/drivers/cpufreq/cpufreq-dt.c
++++ b/drivers/cpufreq/cpufreq-dt.c
+@@ -32,6 +32,7 @@ struct private_data {
+ struct device *cpu_dev;
+ struct thermal_cooling_device *cdev;
+ const char *reg_name;
++ bool have_static_opps;
+ };
+
+ static struct freq_attr *cpufreq_dt_attr[] = {
+@@ -204,6 +205,15 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ }
+ }
+
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv) {
++ ret = -ENOMEM;
++ goto out_put_regulator;
++ }
++
++ priv->reg_name = name;
++ priv->opp_table = opp_table;
++
+ /*
+ * Initialize OPP tables for all policy->cpus. They will be shared by
+ * all CPUs which have marked their CPUs shared with OPP bindings.
+@@ -214,7 +224,8 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ *
+ * OPPs might be populated at runtime, don't check for error here
+ */
+- dev_pm_opp_of_cpumask_add_table(policy->cpus);
++ if (!dev_pm_opp_of_cpumask_add_table(policy->cpus))
++ priv->have_static_opps = true;
+
+ /*
+ * But we need OPP table to function so if it is not there let's
+@@ -240,19 +251,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+ __func__, ret);
+ }
+
+- priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+- if (!priv) {
+- ret = -ENOMEM;
+- goto out_free_opp;
+- }
+-
+- priv->reg_name = name;
+- priv->opp_table = opp_table;
+-
+ ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+ if (ret) {
+ dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
+- goto out_free_priv;
++ goto out_free_opp;
+ }
+
+ priv->cpu_dev = cpu_dev;
+@@ -282,10 +284,11 @@ static int cpufreq_init(struct cpufreq_policy *policy)
+
+ out_free_cpufreq_table:
+ dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+-out_free_priv:
+- kfree(priv);
+ out_free_opp:
+- dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->cpus);
++ kfree(priv);
++out_put_regulator:
+ if (name)
+ dev_pm_opp_put_regulators(opp_table);
+ out_put_clk:
+@@ -300,7 +303,8 @@ static int cpufreq_exit(struct cpufreq_policy *policy)
+
+ cpufreq_cooling_unregister(priv->cdev);
+ dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
+- dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
++ if (priv->have_static_opps)
++ dev_pm_opp_of_cpumask_remove_table(policy->related_cpus);
+ if (priv->reg_name)
+ dev_pm_opp_put_regulators(priv->opp_table);
+
+diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
+index f20f20a77d4d..4268f87e99fc 100644
+--- a/drivers/cpufreq/cpufreq_conservative.c
++++ b/drivers/cpufreq/cpufreq_conservative.c
+@@ -80,8 +80,10 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ * changed in the meantime, so fall back to current frequency in that
+ * case.
+ */
+- if (requested_freq > policy->max || requested_freq < policy->min)
++ if (requested_freq > policy->max || requested_freq < policy->min) {
+ requested_freq = policy->cur;
++ dbs_info->requested_freq = requested_freq;
++ }
+
+ freq_step = get_freq_step(cs_tuners, policy);
+
+@@ -92,7 +94,7 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
+ if (policy_dbs->idle_periods < UINT_MAX) {
+ unsigned int freq_steps = policy_dbs->idle_periods * freq_step;
+
+- if (requested_freq > freq_steps)
++ if (requested_freq > policy->min + freq_steps)
+ requested_freq -= freq_steps;
+ else
+ requested_freq = policy->min;
+diff --git a/drivers/crypto/caam/regs.h b/drivers/crypto/caam/regs.h
+index 4fb91ba39c36..ce3f9ad7120f 100644
+--- a/drivers/crypto/caam/regs.h
++++ b/drivers/crypto/caam/regs.h
+@@ -70,22 +70,22 @@
+ extern bool caam_little_end;
+ extern bool caam_imx;
+
+-#define caam_to_cpu(len) \
+-static inline u##len caam##len ## _to_cpu(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return le##len ## _to_cpu(val); \
+- else \
+- return be##len ## _to_cpu(val); \
++#define caam_to_cpu(len) \
++static inline u##len caam##len ## _to_cpu(u##len val) \
++{ \
++ if (caam_little_end) \
++ return le##len ## _to_cpu((__force __le##len)val); \
++ else \
++ return be##len ## _to_cpu((__force __be##len)val); \
+ }
+
+-#define cpu_to_caam(len) \
+-static inline u##len cpu_to_caam##len(u##len val) \
+-{ \
+- if (caam_little_end) \
+- return cpu_to_le##len(val); \
+- else \
+- return cpu_to_be##len(val); \
++#define cpu_to_caam(len) \
++static inline u##len cpu_to_caam##len(u##len val) \
++{ \
++ if (caam_little_end) \
++ return (__force u##len)cpu_to_le##len(val); \
++ else \
++ return (__force u##len)cpu_to_be##len(val); \
+ }
+
+ caam_to_cpu(16)
+diff --git a/drivers/dma/dma-jz4780.c b/drivers/dma/dma-jz4780.c
+index 85820a2d69d4..987899610b46 100644
+--- a/drivers/dma/dma-jz4780.c
++++ b/drivers/dma/dma-jz4780.c
+@@ -761,6 +761,11 @@ static int jz4780_dma_probe(struct platform_device *pdev)
+ struct resource *res;
+ int i, ret;
+
++ if (!dev->of_node) {
++ dev_err(dev, "This driver must be probed from devicetree\n");
++ return -EINVAL;
++ }
++
+ jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL);
+ if (!jzdma)
+ return -ENOMEM;
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 4fa4c06c9edb..21a5708985bc 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -1205,8 +1205,15 @@ static void ioat_shutdown(struct pci_dev *pdev)
+
+ spin_lock_bh(&ioat_chan->prep_lock);
+ set_bit(IOAT_CHAN_DOWN, &ioat_chan->state);
+- del_timer_sync(&ioat_chan->timer);
+ spin_unlock_bh(&ioat_chan->prep_lock);
++ /*
++ * Synchronization rule for del_timer_sync():
++ * - The caller must not hold locks which would prevent
++ * completion of the timer's handler.
++ * So prep_lock cannot be held before calling it.
++ */
++ del_timer_sync(&ioat_chan->timer);
++
+ /* this should quiesce then reset */
+ ioat_reset_hw(ioat_chan);
+ }
+diff --git a/drivers/dma/ppc4xx/adma.c b/drivers/dma/ppc4xx/adma.c
+index 4cf0d4d0cecf..25610286979f 100644
+--- a/drivers/dma/ppc4xx/adma.c
++++ b/drivers/dma/ppc4xx/adma.c
+@@ -4360,7 +4360,7 @@ static ssize_t enable_store(struct device_driver *dev, const char *buf,
+ }
+ static DRIVER_ATTR_RW(enable);
+
+-static ssize_t poly_store(struct device_driver *dev, char *buf)
++static ssize_t poly_show(struct device_driver *dev, char *buf)
+ {
+ ssize_t size = 0;
+ u32 reg;
+diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
+index 18aeabb1d5ee..e2addb2bca29 100644
+--- a/drivers/edac/amd64_edac.c
++++ b/drivers/edac/amd64_edac.c
+@@ -2200,6 +2200,15 @@ static struct amd64_family_type family_types[] = {
+ .dbam_to_cs = f17_base_addr_to_cs_size,
+ }
+ },
++ [F17_M10H_CPUS] = {
++ .ctl_name = "F17h_M10h",
++ .f0_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F0,
++ .f6_id = PCI_DEVICE_ID_AMD_17H_M10H_DF_F6,
++ .ops = {
++ .early_channel_count = f17_early_channel_count,
++ .dbam_to_cs = f17_base_addr_to_cs_size,
++ }
++ },
+ };
+
+ /*
+@@ -3188,6 +3197,11 @@ static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
+ break;
+
+ case 0x17:
++ if (pvt->model >= 0x10 && pvt->model <= 0x2f) {
++ fam_type = &family_types[F17_M10H_CPUS];
++ pvt->ops = &family_types[F17_M10H_CPUS].ops;
++ break;
++ }
+ fam_type = &family_types[F17_CPUS];
+ pvt->ops = &family_types[F17_CPUS].ops;
+ break;
+diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
+index 1d4b74e9a037..4242f8e39c18 100644
+--- a/drivers/edac/amd64_edac.h
++++ b/drivers/edac/amd64_edac.h
+@@ -115,6 +115,8 @@
+ #define PCI_DEVICE_ID_AMD_16H_M30H_NB_F2 0x1582
+ #define PCI_DEVICE_ID_AMD_17H_DF_F0 0x1460
+ #define PCI_DEVICE_ID_AMD_17H_DF_F6 0x1466
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F0 0x15e8
++#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F6 0x15ee
+
+ /*
+ * Function 1 - Address Map
+@@ -281,6 +283,7 @@ enum amd_families {
+ F16_CPUS,
+ F16_M30H_CPUS,
+ F17_CPUS,
++ F17_M10H_CPUS,
+ NUM_FAMILIES,
+ };
+
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 8e120bf60624..f1d19504a028 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1711,6 +1711,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
+ u32 errnum = find_first_bit(&error, 32);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv)
+ tp_event = HW_EVENT_ERR_FATAL;
+ else
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 4a89c8093307..498d253a3b7e 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2881,6 +2881,7 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index fae095162c01..4ba92f1dd0f7 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -668,7 +668,7 @@ sad_found:
+ break;
+ case 2:
+ lchan = (addr >> shift) % 2;
+- lchan = (lchan << 1) | ~lchan;
++ lchan = (lchan << 1) | !lchan;
+ break;
+ case 3:
+ lchan = ((addr >> shift) % 2) << 1;
+@@ -959,6 +959,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
+index 19db5709ae28..898bb9abc41f 100644
+--- a/drivers/firmware/google/coreboot_table.c
++++ b/drivers/firmware/google/coreboot_table.c
+@@ -110,7 +110,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ if (strncmp(header.signature, "LBIO", sizeof(header.signature))) {
+ pr_warn("coreboot_table: coreboot table missing or corrupt!\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto out;
+ }
+
+ ptr_entry = (void *)ptr_header + header.header_bytes;
+@@ -137,7 +138,8 @@ int coreboot_table_init(struct device *dev, void __iomem *ptr)
+
+ ptr_entry += entry.size;
+ }
+-
++out:
++ iounmap(ptr);
+ return ret;
+ }
+ EXPORT_SYMBOL(coreboot_table_init);
+@@ -146,7 +148,6 @@ int coreboot_table_exit(void)
+ {
+ if (ptr_header) {
+ bus_unregister(&coreboot_bus_type);
+- iounmap(ptr_header);
+ ptr_header = NULL;
+ }
+
+diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c
+index 16c7f9f49416..af936dcca659 100644
+--- a/drivers/gpio/gpio-brcmstb.c
++++ b/drivers/gpio/gpio-brcmstb.c
+@@ -664,6 +664,18 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ struct brcmstb_gpio_bank *bank;
+ struct gpio_chip *gc;
+
++ /*
++ * If bank_width is 0, then there is an empty bank in the
++ * register block. Special handling for this case.
++ */
++ if (bank_width == 0) {
++ dev_dbg(dev, "Width 0 found: Empty bank @ %d\n",
++ num_banks);
++ num_banks++;
++ gpio_base += MAX_GPIO_PER_BANK;
++ continue;
++ }
++
+ bank = devm_kzalloc(dev, sizeof(*bank), GFP_KERNEL);
+ if (!bank) {
+ err = -ENOMEM;
+@@ -740,9 +752,6 @@ static int brcmstb_gpio_probe(struct platform_device *pdev)
+ goto fail;
+ }
+
+- dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n",
+- num_banks, priv->gpio_base, gpio_base - 1);
+-
+ if (priv->parent_wake_irq && need_wakeup_event)
+ pm_wakeup_event(dev, 0);
+
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 895741e9cd7d..52ccf1c31855 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -173,6 +173,11 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state)
+ state->crtcs[i].state = NULL;
+ state->crtcs[i].old_state = NULL;
+ state->crtcs[i].new_state = NULL;
++
++ if (state->crtcs[i].commit) {
++ drm_crtc_commit_put(state->crtcs[i].commit);
++ state->crtcs[i].commit = NULL;
++ }
+ }
+
+ for (i = 0; i < config->num_total_plane; i++) {
+diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
+index 81e32199d3ef..abca95b970ea 100644
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1384,15 +1384,16 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_vblanks);
+ void drm_atomic_helper_wait_for_flip_done(struct drm_device *dev,
+ struct drm_atomic_state *old_state)
+ {
+- struct drm_crtc_state *new_crtc_state;
+ struct drm_crtc *crtc;
+ int i;
+
+- for_each_new_crtc_in_state(old_state, crtc, new_crtc_state, i) {
+- struct drm_crtc_commit *commit = new_crtc_state->commit;
++ for (i = 0; i < dev->mode_config.num_crtc; i++) {
++ struct drm_crtc_commit *commit = old_state->crtcs[i].commit;
+ int ret;
+
+- if (!commit)
++ crtc = old_state->crtcs[i].ptr;
++
++ if (!crtc || !commit)
+ continue;
+
+ ret = wait_for_completion_timeout(&commit->flip_done, 10 * HZ);
+@@ -1906,6 +1907,9 @@ int drm_atomic_helper_setup_commit(struct drm_atomic_state *state,
+ drm_crtc_commit_get(commit);
+
+ commit->abort_completion = true;
++
++ state->crtcs[i].commit = commit;
++ drm_crtc_commit_get(commit);
+ }
+
+ for_each_oldnew_connector_in_state(state, conn, old_conn_state, new_conn_state, i) {
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index 98a36e6c69ad..bd207857a964 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -560,9 +560,9 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ struct drm_mode_crtc *crtc_req = data;
+ struct drm_crtc *crtc;
+ struct drm_plane *plane;
+- struct drm_connector **connector_set = NULL, *connector;
+- struct drm_framebuffer *fb = NULL;
+- struct drm_display_mode *mode = NULL;
++ struct drm_connector **connector_set, *connector;
++ struct drm_framebuffer *fb;
++ struct drm_display_mode *mode;
+ struct drm_mode_set set;
+ uint32_t __user *set_connectors_ptr;
+ struct drm_modeset_acquire_ctx ctx;
+@@ -591,6 +591,10 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ mutex_lock(&crtc->dev->mode_config.mutex);
+ drm_modeset_acquire_init(&ctx, DRM_MODESET_ACQUIRE_INTERRUPTIBLE);
+ retry:
++ connector_set = NULL;
++ fb = NULL;
++ mode = NULL;
++
+ ret = drm_modeset_lock_all_ctx(crtc->dev, &ctx);
+ if (ret)
+ goto out;
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 59a11026dceb..45a8ba42c8f4 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ }
+
+ /* The CEC module handles HDMI hotplug detection */
+- cec_np = of_find_compatible_node(np->parent, NULL,
+- "mediatek,mt8173-cec");
++ cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ if (!cec_np) {
+ dev_err(dev, "Failed to find CEC node\n");
+ return -EINVAL;
+@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (!cec_pdev) {
+ dev_err(hdmi->dev, "Waiting for CEC device %pOF\n",
+ cec_np);
++ of_node_put(cec_np);
+ return -EPROBE_DEFER;
+ }
++ of_node_put(cec_np);
+ hdmi->cec_dev = &cec_pdev->dev;
+
+ /*
+diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
+index 23872d08308c..a746017fac17 100644
+--- a/drivers/hid/usbhid/hiddev.c
++++ b/drivers/hid/usbhid/hiddev.c
+@@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
+ if (cmd == HIDIOCGCOLLECTIONINDEX) {
+ if (uref->usage_index >= field->maxusage)
+ goto inval;
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->maxusage);
+ } else if (uref->usage_index >= field->report_count)
+ goto inval;
+ }
+
+- if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+- (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+- uref->usage_index + uref_multi->num_values > field->report_count))
+- goto inval;
++ if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
++ if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
++ uref->usage_index + uref_multi->num_values >
++ field->report_count)
++ goto inval;
++
++ uref->usage_index =
++ array_index_nospec(uref->usage_index,
++ field->report_count -
++ uref_multi->num_values);
++ }
+
+ switch (cmd) {
+ case HIDIOCGUSAGE:
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index ad7afa74d365..ff9a1d8e90f7 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3335,6 +3335,7 @@ static void wacom_setup_intuos(struct wacom_wac *wacom_wac)
+
+ void wacom_setup_device_quirks(struct wacom *wacom)
+ {
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ /* The pen and pad share the same interface on most devices */
+@@ -3464,6 +3465,24 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+
+ if (features->type == REMOTE)
+ features->device_type |= WACOM_DEVICETYPE_WL_MONITOR;
++
++ /* HID descriptor for DTK-2451 / DTH-2452 claims to report lots
++ * of things it shouldn't. Lets fix up the damage...
++ */
++ if (wacom->hdev->product == 0x382 || wacom->hdev->product == 0x37d) {
++ features->quirks &= ~WACOM_QUIRK_TOOLSERIAL;
++ __clear_bit(BTN_TOOL_BRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_PENCIL, wacom_wac->pen_input->keybit);
++ __clear_bit(BTN_TOOL_AIRBRUSH, wacom_wac->pen_input->keybit);
++ __clear_bit(ABS_Z, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_DISTANCE, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_X, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_TILT_Y, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_WHEEL, wacom_wac->pen_input->absbit);
++ __clear_bit(ABS_MISC, wacom_wac->pen_input->absbit);
++ __clear_bit(MSC_SERIAL, wacom_wac->pen_input->mscbit);
++ __clear_bit(EV_MSC, wacom_wac->pen_input->evbit);
++ }
+ }
+
+ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev,
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 0f0e091c117c..c4a1ebcfffb6 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,16 +606,18 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ bool perf_chn = vmbus_devs[dev_type].perf_device;
+ struct vmbus_channel *primary = channel->primary_channel;
+ int next_node;
+- struct cpumask available_mask;
++ cpumask_var_t available_mask;
+ struct cpumask *alloced_mask;
+
+ if ((vmbus_proto_version == VERSION_WS2008) ||
+- (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
++ (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) ||
++ !alloc_cpumask_var(&available_mask, GFP_KERNEL)) {
+ /*
+ * Prior to win8, all channel interrupts are
+ * delivered on cpu 0.
+ * Also if the channel is not a performance critical
+ * channel, bind it to cpu 0.
++ * In case alloc_cpumask_var() fails, bind it to cpu 0.
+ */
+ channel->numa_node = 0;
+ channel->target_cpu = 0;
+@@ -653,7 +655,7 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ cpumask_clear(alloced_mask);
+ }
+
+- cpumask_xor(&available_mask, alloced_mask,
++ cpumask_xor(available_mask, alloced_mask,
+ cpumask_of_node(primary->numa_node));
+
+ cur_cpu = -1;
+@@ -671,10 +673,10 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+ }
+
+ while (true) {
+- cur_cpu = cpumask_next(cur_cpu, &available_mask);
++ cur_cpu = cpumask_next(cur_cpu, available_mask);
+ if (cur_cpu >= nr_cpu_ids) {
+ cur_cpu = -1;
+- cpumask_copy(&available_mask,
++ cpumask_copy(available_mask,
+ cpumask_of_node(primary->numa_node));
+ continue;
+ }
+@@ -704,6 +706,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
+
+ channel->target_cpu = cur_cpu;
+ channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
++
++ free_cpumask_var(available_mask);
+ }
+
+ static void vmbus_wait_for_unload(void)
+diff --git a/drivers/hwmon/pmbus/pmbus.c b/drivers/hwmon/pmbus/pmbus.c
+index 7718e58dbda5..7688dab32f6e 100644
+--- a/drivers/hwmon/pmbus/pmbus.c
++++ b/drivers/hwmon/pmbus/pmbus.c
+@@ -118,6 +118,8 @@ static int pmbus_identify(struct i2c_client *client,
+ } else {
+ info->pages = 1;
+ }
++
++ pmbus_clear_faults(client);
+ }
+
+ if (pmbus_check_byte_register(client, 0, PMBUS_VOUT_MODE)) {
+diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
+index 82c3754e21e3..2e2b5851139c 100644
+--- a/drivers/hwmon/pmbus/pmbus_core.c
++++ b/drivers/hwmon/pmbus/pmbus_core.c
+@@ -2015,7 +2015,10 @@ static int pmbus_init_common(struct i2c_client *client, struct pmbus_data *data,
+ if (ret >= 0 && (ret & PB_CAPABILITY_ERROR_CHECK))
+ client->flags |= I2C_CLIENT_PEC;
+
+- pmbus_clear_faults(client);
++ if (data->info->pages)
++ pmbus_clear_faults(client);
++ else
++ pmbus_clear_fault_page(client, -1);
+
+ if (info->identify) {
+ ret = (*info->identify)(client, info);
+diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
+index 7838af58f92d..9d611dd268e1 100644
+--- a/drivers/hwmon/pwm-fan.c
++++ b/drivers/hwmon/pwm-fan.c
+@@ -290,9 +290,19 @@ static int pwm_fan_remove(struct platform_device *pdev)
+ static int pwm_fan_suspend(struct device *dev)
+ {
+ struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
++ struct pwm_args args;
++ int ret;
++
++ pwm_get_args(ctx->pwm, &args);
++
++ if (ctx->pwm_value) {
++ ret = pwm_config(ctx->pwm, 0, args.period);
++ if (ret < 0)
++ return ret;
+
+- if (ctx->pwm_value)
+ pwm_disable(ctx->pwm);
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
+index 320d29df17e1..8c1d53f7af83 100644
+--- a/drivers/hwtracing/coresight/coresight-etb10.c
++++ b/drivers/hwtracing/coresight/coresight-etb10.c
+@@ -147,6 +147,10 @@ static int etb_enable(struct coresight_device *csdev, u32 mode)
+ if (val == CS_MODE_PERF)
+ return -EBUSY;
+
++ /* Don't let perf disturb sysFS sessions */
++ if (val == CS_MODE_SYSFS && mode == CS_MODE_PERF)
++ return -EBUSY;
++
+ /* Nothing to do, the tracer is already enabled. */
+ if (val == CS_MODE_SYSFS)
+ goto out;
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 3c1c817f6968..e152716bf07f 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -812,8 +812,12 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap,
+
+ time_left = wait_event_timeout(priv->wait, priv->flags & ID_DONE,
+ num * adap->timeout);
+- if (!time_left) {
++
++ /* cleanup DMA if it couldn't complete properly due to an error */
++ if (priv->dma_direction != DMA_NONE)
+ rcar_i2c_cleanup_dma(priv);
++
++ if (!time_left) {
+ rcar_i2c_init(priv);
+ ret = -ETIMEDOUT;
+ } else if (priv->flags & ID_NACK) {
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 44b516863c9d..75d2f73582a3 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -248,12 +248,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *idev = pf->indio_dev;
+ struct at91_adc_state *st = iio_priv(idev);
++ struct iio_chan_spec const *chan;
+ int i, j = 0;
+
+ for (i = 0; i < idev->masklength; i++) {
+ if (!test_bit(i, idev->active_scan_mask))
+ continue;
+- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i));
++ chan = idev->channels + i;
++ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel));
+ j++;
+ }
+
+@@ -279,6 +281,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev)
+ iio_trigger_poll(idev->trig);
+ } else {
+ st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb));
++ /* Needed to ACK the DRDY interruption */
++ at91_adc_readl(st, AT91_ADC_LCDR);
+ st->done = true;
+ wake_up_interruptible(&st->wq_data_avail);
+ }
+diff --git a/drivers/iio/adc/fsl-imx25-gcq.c b/drivers/iio/adc/fsl-imx25-gcq.c
+index ea264fa9e567..929c617db364 100644
+--- a/drivers/iio/adc/fsl-imx25-gcq.c
++++ b/drivers/iio/adc/fsl-imx25-gcq.c
+@@ -209,12 +209,14 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ ret = of_property_read_u32(child, "reg", ®);
+ if (ret) {
+ dev_err(dev, "Failed to get reg property\n");
++ of_node_put(child);
+ return ret;
+ }
+
+ if (reg >= MX25_NUM_CFGS) {
+ dev_err(dev,
+ "reg value is greater than the number of available configuration registers\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -228,6 +230,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ if (IS_ERR(priv->vref[refp])) {
+ dev_err(dev, "Error, trying to use external voltage reference without a vref-%s regulator.",
+ mx25_gcq_refp_names[refp]);
++ of_node_put(child);
+ return PTR_ERR(priv->vref[refp]);
+ }
+ priv->channel_vref_mv[reg] =
+@@ -240,6 +243,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ break;
+ default:
+ dev_err(dev, "Invalid positive reference %d\n", refp);
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -254,10 +258,12 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+
+ if ((refp & MX25_ADCQ_CFG_REFP_MASK) != refp) {
+ dev_err(dev, "Invalid fsl,adc-refp property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+ if ((refn & MX25_ADCQ_CFG_REFN_MASK) != refn) {
+ dev_err(dev, "Invalid fsl,adc-refn property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/iio/dac/ad5064.c b/drivers/iio/dac/ad5064.c
+index bf4fc40ec84d..2f98cb2a3b96 100644
+--- a/drivers/iio/dac/ad5064.c
++++ b/drivers/iio/dac/ad5064.c
+@@ -808,6 +808,40 @@ static int ad5064_set_config(struct ad5064_state *st, unsigned int val)
+ return ad5064_write(st, cmd, 0, val, 0);
+ }
+
++static int ad5064_request_vref(struct ad5064_state *st, struct device *dev)
++{
++ unsigned int i;
++ int ret;
++
++ for (i = 0; i < ad5064_num_vref(st); ++i)
++ st->vref_reg[i].supply = ad5064_vref_name(st, i);
++
++ if (!st->chip_info->internal_vref)
++ return devm_regulator_bulk_get(dev, ad5064_num_vref(st),
++ st->vref_reg);
++
++ /*
++ * This assumes that when the regulator has an internal VREF
++ * there is only one external VREF connection, which is
++ * currently the case for all supported devices.
++ */
++ st->vref_reg[0].consumer = devm_regulator_get_optional(dev, "vref");
++ if (!IS_ERR(st->vref_reg[0].consumer))
++ return 0;
++
++ ret = PTR_ERR(st->vref_reg[0].consumer);
++ if (ret != -ENODEV)
++ return ret;
++
++ /* If no external regulator was supplied use the internal VREF */
++ st->use_internal_vref = true;
++ ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
++ if (ret)
++ dev_err(dev, "Failed to enable internal vref: %d\n", ret);
++
++ return ret;
++}
++
+ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ const char *name, ad5064_write_func write)
+ {
+@@ -828,22 +862,11 @@ static int ad5064_probe(struct device *dev, enum ad5064_type type,
+ st->dev = dev;
+ st->write = write;
+
+- for (i = 0; i < ad5064_num_vref(st); ++i)
+- st->vref_reg[i].supply = ad5064_vref_name(st, i);
++ ret = ad5064_request_vref(st, dev);
++ if (ret)
++ return ret;
+
+- ret = devm_regulator_bulk_get(dev, ad5064_num_vref(st),
+- st->vref_reg);
+- if (ret) {
+- if (!st->chip_info->internal_vref)
+- return ret;
+- st->use_internal_vref = true;
+- ret = ad5064_set_config(st, AD5064_CONFIG_INT_VREF_ENABLE);
+- if (ret) {
+- dev_err(dev, "Failed to enable internal vref: %d\n",
+- ret);
+- return ret;
+- }
+- } else {
++ if (!st->use_internal_vref) {
+ ret = regulator_bulk_enable(ad5064_num_vref(st), st->vref_reg);
+ if (ret)
+ return ret;
+diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
+index 31c7efaf8e7a..63406cd212a7 100644
+--- a/drivers/infiniband/core/sysfs.c
++++ b/drivers/infiniband/core/sysfs.c
+@@ -516,7 +516,7 @@ static ssize_t show_pma_counter(struct ib_port *p, struct port_attribute *attr,
+ ret = get_perf_mad(p->ibdev, p->port_num, tab_attr->attr_id, &data,
+ 40 + offset / 8, sizeof(data));
+ if (ret < 0)
+- return sprintf(buf, "N/A (no PMA)\n");
++ return ret;
+
+ switch (width) {
+ case 4:
+@@ -1061,10 +1061,12 @@ static int add_port(struct ib_device *device, int port_num,
+ goto err_put;
+ }
+
+- p->pma_table = get_counter_table(device, port_num);
+- ret = sysfs_create_group(&p->kobj, p->pma_table);
+- if (ret)
+- goto err_put_gid_attrs;
++ if (device->process_mad) {
++ p->pma_table = get_counter_table(device, port_num);
++ ret = sysfs_create_group(&p->kobj, p->pma_table);
++ if (ret)
++ goto err_put_gid_attrs;
++ }
+
+ p->gid_group.name = "gids";
+ p->gid_group.attrs = alloc_group_attrs(show_port_gid, attr.gid_tbl_len);
+@@ -1177,7 +1179,8 @@ err_free_gid:
+ p->gid_group.attrs = NULL;
+
+ err_remove_pma:
+- sysfs_remove_group(&p->kobj, p->pma_table);
++ if (p->pma_table)
++ sysfs_remove_group(&p->kobj, p->pma_table);
+
+ err_put_gid_attrs:
+ kobject_put(&p->gid_attr_group->kobj);
+@@ -1289,7 +1292,9 @@ static void free_port_list_attributes(struct ib_device *device)
+ kfree(port->hw_stats);
+ free_hsag(&port->kobj, port->hw_stats_ag);
+ }
+- sysfs_remove_group(p, port->pma_table);
++
++ if (port->pma_table)
++ sysfs_remove_group(p, port->pma_table);
+ sysfs_remove_group(p, &port->pkey_group);
+ sysfs_remove_group(p, &port->gid_group);
+ sysfs_remove_group(&port->gid_attr_group->kobj,
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+index 6ad0d46ab879..249efa0a6aba 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+@@ -360,7 +360,8 @@ void bnxt_qplib_disable_nq(struct bnxt_qplib_nq *nq)
+ }
+
+ /* Make sure the HW is stopped! */
+- bnxt_qplib_nq_stop_irq(nq, true);
++ if (nq->requested)
++ bnxt_qplib_nq_stop_irq(nq, true);
+
+ if (nq->bar_reg_iomem)
+ iounmap(nq->bar_reg_iomem);
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+index 2852d350ada1..6637df77d236 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+@@ -309,8 +309,17 @@ static int bnxt_qplib_process_qp_event(struct bnxt_qplib_rcfw *rcfw,
+ rcfw->aeq_handler(rcfw, qp_event, qp);
+ break;
+ default:
+- /* Command Response */
+- spin_lock_irqsave(&cmdq->lock, flags);
++ /*
++ * Command Response
++ * cmdq->lock needs to be acquired to synchronie
++ * the command send and completion reaping. This function
++ * is always called with creq->lock held. Using
++ * the nested variant of spin_lock.
++ *
++ */
++
++ spin_lock_irqsave_nested(&cmdq->lock, flags,
++ SINGLE_DEPTH_NESTING);
+ cookie = le16_to_cpu(qp_event->cookie);
+ mcookie = qp_event->cookie;
+ blocked = cookie & RCFW_CMD_IS_BLOCKING;
+diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
+index 73339fd47dd8..addd432f3f38 100644
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -691,7 +691,6 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ init_completion(&ent->compl);
+ INIT_WORK(&ent->work, cache_work_func);
+ INIT_DELAYED_WORK(&ent->dwork, delayed_cache_work_func);
+- queue_work(cache->wq, &ent->work);
+
+ if (i > MR_CACHE_LAST_STD_ENTRY) {
+ mlx5_odp_init_mr_cache_entry(ent);
+@@ -711,6 +710,7 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
+ ent->limit = dev->mdev->profile->mr_cache[i].limit;
+ else
+ ent->limit = 0;
++ queue_work(cache->wq, &ent->work);
+ }
+
+ err = mlx5_mr_cache_debugfs_init(dev);
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 01eae67d5a6e..e260f6a156ed 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3264,7 +3264,9 @@ static bool modify_dci_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state new
+ int req = IB_QP_STATE;
+ int opt = 0;
+
+- if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
++ if (new_state == IB_QPS_RESET) {
++ return is_valid_mask(attr_mask, req, opt);
++ } else if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) {
+ req |= IB_QP_PKEY_INDEX | IB_QP_PORT;
+ return is_valid_mask(attr_mask, req, opt);
+ } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) {
+diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
+index 5b57de30dee4..b8104d50b1a0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_resp.c
++++ b/drivers/infiniband/sw/rxe/rxe_resp.c
+@@ -682,6 +682,7 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ rxe_advance_resp_resource(qp);
+
+ res->type = RXE_READ_MASK;
++ res->replay = 0;
+
+ res->read.va = qp->resp.va;
+ res->read.va_org = qp->resp.va;
+@@ -752,7 +753,8 @@ static enum resp_states read_reply(struct rxe_qp *qp,
+ state = RESPST_DONE;
+ } else {
+ qp->resp.res = NULL;
+- qp->resp.opcode = -1;
++ if (!res->replay)
++ qp->resp.opcode = -1;
+ if (psn_compare(res->cur_psn, qp->resp.psn) >= 0)
+ qp->resp.psn = res->cur_psn;
+ state = RESPST_CLEANUP;
+@@ -814,6 +816,7 @@ static enum resp_states execute(struct rxe_qp *qp, struct rxe_pkt_info *pkt)
+
+ /* next expected psn, read handles this separately */
+ qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK;
++ qp->resp.ack_psn = qp->resp.psn;
+
+ qp->resp.opcode = pkt->opcode;
+ qp->resp.status = IB_WC_SUCCESS;
+@@ -1060,7 +1063,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ struct rxe_pkt_info *pkt)
+ {
+ enum resp_states rc;
+- u32 prev_psn = (qp->resp.psn - 1) & BTH_PSN_MASK;
++ u32 prev_psn = (qp->resp.ack_psn - 1) & BTH_PSN_MASK;
+
+ if (pkt->mask & RXE_SEND_MASK ||
+ pkt->mask & RXE_WRITE_MASK) {
+@@ -1103,6 +1106,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
+ res->state = (pkt->psn == res->first_psn) ?
+ rdatm_res_state_new :
+ rdatm_res_state_replay;
++ res->replay = 1;
+
+ /* Reset the resource, except length. */
+ res->read.va_org = iova;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index af1470d29391..332a16dad2a7 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -171,6 +171,7 @@ enum rdatm_res_state {
+
+ struct resp_res {
+ int type;
++ int replay;
+ u32 first_psn;
+ u32 last_psn;
+ u32 cur_psn;
+@@ -195,6 +196,7 @@ struct rxe_resp_info {
+ enum rxe_qp_state state;
+ u32 msn;
+ u32 psn;
++ u32 ack_psn;
+ int opcode;
+ int drop_msg;
+ int goto_error;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index a620701f9d41..1ac2bbc84671 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1439,11 +1439,15 @@ static void ipoib_cm_skb_reap(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->lock, flags);
+ netif_tx_unlock_bh(dev);
+
+- if (skb->protocol == htons(ETH_P_IP))
++ if (skb->protocol == htons(ETH_P_IP)) {
++ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
++ }
+ #if IS_ENABLED(CONFIG_IPV6)
+- else if (skb->protocol == htons(ETH_P_IPV6))
++ else if (skb->protocol == htons(ETH_P_IPV6)) {
++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
++ }
+ #endif
+ dev_kfree_skb_any(skb);
+
+diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
+index 5349e22b5c78..29646004a4a7 100644
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -469,6 +469,9 @@ static void arm_smmu_tlb_inv_range_nosync(unsigned long iova, size_t size,
+ bool stage1 = cfg->cbar != CBAR_TYPE_S2_TRANS;
+ void __iomem *reg = ARM_SMMU_CB(smmu_domain->smmu, cfg->cbndx);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ if (stage1) {
+ reg += leaf ? ARM_SMMU_CB_S1_TLBIVAL : ARM_SMMU_CB_S1_TLBIVA;
+
+@@ -510,6 +513,9 @@ static void arm_smmu_tlb_inv_vmid_nosync(unsigned long iova, size_t size,
+ struct arm_smmu_domain *smmu_domain = cookie;
+ void __iomem *base = ARM_SMMU_GR0(smmu_domain->smmu);
+
++ if (smmu_domain->smmu->features & ARM_SMMU_FEAT_COHERENT_WALK)
++ wmb();
++
+ writel_relaxed(smmu_domain->cfg.vmid, base + ARM_SMMU_GR0_TLBIVMID);
+ }
+
+diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c
+index b1b47a40a278..faa7d61b9d6c 100644
+--- a/drivers/irqchip/qcom-pdc.c
++++ b/drivers/irqchip/qcom-pdc.c
+@@ -124,6 +124,7 @@ static int qcom_pdc_gic_set_type(struct irq_data *d, unsigned int type)
+ break;
+ case IRQ_TYPE_EDGE_BOTH:
+ pdc_type = PDC_EDGE_DUAL;
++ type = IRQ_TYPE_EDGE_RISING;
+ break;
+ case IRQ_TYPE_LEVEL_HIGH:
+ pdc_type = PDC_LEVEL_HIGH;
+diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c
+index ed9cc977c8b3..f6427e805150 100644
+--- a/drivers/lightnvm/pblk-core.c
++++ b/drivers/lightnvm/pblk-core.c
+@@ -1538,13 +1538,14 @@ struct pblk_line *pblk_line_replace_data(struct pblk *pblk)
+ struct pblk_line *cur, *new = NULL;
+ unsigned int left_seblks;
+
+- cur = l_mg->data_line;
+ new = l_mg->data_next;
+ if (!new)
+ goto out;
+- l_mg->data_line = new;
+
+ spin_lock(&l_mg->free_lock);
++ cur = l_mg->data_line;
++ l_mg->data_line = new;
++
+ pblk_line_setup_metadata(new, l_mg, &pblk->lm);
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c
+index d83466b3821b..958bda8a69b7 100644
+--- a/drivers/lightnvm/pblk-recovery.c
++++ b/drivers/lightnvm/pblk-recovery.c
+@@ -956,12 +956,14 @@ next:
+ }
+ }
+
+- spin_lock(&l_mg->free_lock);
+ if (!open_lines) {
++ spin_lock(&l_mg->free_lock);
+ WARN_ON_ONCE(!test_and_clear_bit(meta_line,
+ &l_mg->meta_bitmap));
++ spin_unlock(&l_mg->free_lock);
+ pblk_line_replace_data(pblk);
+ } else {
++ spin_lock(&l_mg->free_lock);
+ /* Allocate next line for preparation */
+ l_mg->data_next = pblk_line_get(pblk);
+ if (l_mg->data_next) {
+@@ -969,8 +971,8 @@ next:
+ l_mg->data_next->type = PBLK_LINETYPE_DATA;
+ is_next = 1;
+ }
++ spin_unlock(&l_mg->free_lock);
+ }
+- spin_unlock(&l_mg->free_lock);
+
+ if (is_next)
+ pblk_line_erase(pblk, l_mg->data_next);
+diff --git a/drivers/lightnvm/pblk-sysfs.c b/drivers/lightnvm/pblk-sysfs.c
+index 88a0a7c407aa..432f7d94d369 100644
+--- a/drivers/lightnvm/pblk-sysfs.c
++++ b/drivers/lightnvm/pblk-sysfs.c
+@@ -262,8 +262,14 @@ static ssize_t pblk_sysfs_lines(struct pblk *pblk, char *page)
+ sec_in_line = l_mg->data_line->sec_in_line;
+ meta_weight = bitmap_weight(&l_mg->meta_bitmap,
+ PBLK_DATA_LINES);
+- map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
++
++ spin_lock(&l_mg->data_line->lock);
++ if (l_mg->data_line->map_bitmap)
++ map_weight = bitmap_weight(l_mg->data_line->map_bitmap,
+ lm->sec_per_line);
++ else
++ map_weight = 0;
++ spin_unlock(&l_mg->data_line->lock);
+ }
+ spin_unlock(&l_mg->free_lock);
+
+diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c
+index f353e52941f5..89ac60d4849e 100644
+--- a/drivers/lightnvm/pblk-write.c
++++ b/drivers/lightnvm/pblk-write.c
+@@ -417,12 +417,11 @@ int pblk_submit_meta_io(struct pblk *pblk, struct pblk_line *meta_line)
+ rqd->ppa_list[i] = addr_to_gen_ppa(pblk, paddr, id);
+ }
+
++ spin_lock(&l_mg->close_lock);
+ emeta->mem += rq_len;
+- if (emeta->mem >= lm->emeta_len[0]) {
+- spin_lock(&l_mg->close_lock);
++ if (emeta->mem >= lm->emeta_len[0])
+ list_del(&meta_line->list);
+- spin_unlock(&l_mg->close_lock);
+- }
++ spin_unlock(&l_mg->close_lock);
+
+ pblk_down_page(pblk, rqd->ppa_list, rqd->nr_ppas);
+
+@@ -491,14 +490,15 @@ static struct pblk_line *pblk_should_submit_meta_io(struct pblk *pblk,
+ struct pblk_line *meta_line;
+
+ spin_lock(&l_mg->close_lock);
+-retry:
+ if (list_empty(&l_mg->emeta_list)) {
+ spin_unlock(&l_mg->close_lock);
+ return NULL;
+ }
+ meta_line = list_first_entry(&l_mg->emeta_list, struct pblk_line, list);
+- if (meta_line->emeta->mem >= lm->emeta_len[0])
+- goto retry;
++ if (meta_line->emeta->mem >= lm->emeta_len[0]) {
++ spin_unlock(&l_mg->close_lock);
++ return NULL;
++ }
+ spin_unlock(&l_mg->close_lock);
+
+ if (!pblk_valid_meta_ppa(pblk, meta_line, data_rqd))
+diff --git a/drivers/mailbox/pcc.c b/drivers/mailbox/pcc.c
+index 311e91b1a14f..256f18b67e8a 100644
+--- a/drivers/mailbox/pcc.c
++++ b/drivers/mailbox/pcc.c
+@@ -461,8 +461,11 @@ static int __init acpi_pcc_probe(void)
+ count = acpi_table_parse_entries_array(ACPI_SIG_PCCT,
+ sizeof(struct acpi_table_pcct), proc,
+ ACPI_PCCT_TYPE_RESERVED, MAX_PCC_SUBSPACES);
+- if (count == 0 || count > MAX_PCC_SUBSPACES) {
+- pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
++ if (count <= 0 || count > MAX_PCC_SUBSPACES) {
++ if (count < 0)
++ pr_warn("Error parsing PCC subspaces from PCCT\n");
++ else
++ pr_warn("Invalid PCCT: %d PCC subspaces\n", count);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 547c9eedc2f4..d681524f82a4 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -2380,7 +2380,7 @@ static int refill_keybuf_fn(struct btree_op *op, struct btree *b,
+ struct keybuf *buf = refill->buf;
+ int ret = MAP_CONTINUE;
+
+- if (bkey_cmp(k, refill->end) >= 0) {
++ if (bkey_cmp(k, refill->end) > 0) {
+ ret = MAP_DONE;
+ goto out;
+ }
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index ae67f5fa8047..9d2fa1359029 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -843,7 +843,7 @@ static void cached_dev_read_done_bh(struct closure *cl)
+
+ bch_mark_cache_accounting(s->iop.c, s->d,
+ !s->cache_missed, s->iop.bypass);
+- trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass);
++ trace_bcache_read(s->orig_bio, !s->cache_missed, s->iop.bypass);
+
+ if (s->iop.status)
+ continue_at_nobarrier(cl, cached_dev_read_error, bcache_wq);
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index fa4058e43202..6e5220554220 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1131,11 +1131,12 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ }
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) {
+- bch_sectors_dirty_init(&dc->disk);
+ atomic_set(&dc->has_dirty, 1);
+ bch_writeback_queue(dc);
+ }
+
++ bch_sectors_dirty_init(&dc->disk);
++
+ bch_cached_dev_run(dc);
+ bcache_device_link(&dc->disk, c, "bdev");
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 225b15aa0340..34819f2c257d 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -263,6 +263,7 @@ STORE(__cached_dev)
+ 1, WRITEBACK_RATE_UPDATE_SECS_MAX);
+ d_strtoul(writeback_rate_i_term_inverse);
+ d_strtoul_nonzero(writeback_rate_p_term_inverse);
++ d_strtoul_nonzero(writeback_rate_minimum);
+
+ sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX);
+
+@@ -389,6 +390,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_writeback_rate_update_seconds,
+ &sysfs_writeback_rate_i_term_inverse,
+ &sysfs_writeback_rate_p_term_inverse,
++ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+ &sysfs_errors,
+ &sysfs_io_error_limit,
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index b810ea77e6b1..f666778ad237 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -1720,8 +1720,7 @@ static void free_params(struct dm_ioctl *param, size_t param_size, int param_fla
+ }
+
+ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kernel,
+- int ioctl_flags,
+- struct dm_ioctl **param, int *param_flags)
++ int ioctl_flags, struct dm_ioctl **param, int *param_flags)
+ {
+ struct dm_ioctl *dmi;
+ int secure_data;
+@@ -1762,18 +1761,13 @@ static int copy_params(struct dm_ioctl __user *user, struct dm_ioctl *param_kern
+
+ *param_flags |= DM_PARAMS_MALLOC;
+
+- if (copy_from_user(dmi, user, param_kernel->data_size))
+- goto bad;
++ /* Copy from param_kernel (which was already copied from user) */
++ memcpy(dmi, param_kernel, minimum_data_size);
+
+-data_copied:
+- /*
+- * Abort if something changed the ioctl data while it was being copied.
+- */
+- if (dmi->data_size != param_kernel->data_size) {
+- DMERR("rejecting ioctl: data size modified while processing parameters");
++ if (copy_from_user(&dmi->data, (char __user *)user + minimum_data_size,
++ param_kernel->data_size - minimum_data_size))
+ goto bad;
+- }
+-
++data_copied:
+ /* Wipe the user buffer so we do not return it to userspace */
+ if (secure_data && clear_user(user, param_kernel->data_size))
+ goto bad;
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index 969954915566..fa68336560c3 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -99,7 +99,7 @@ struct dmz_mblock {
+ struct rb_node node;
+ struct list_head link;
+ sector_t no;
+- atomic_t ref;
++ unsigned int ref;
+ unsigned long state;
+ struct page *page;
+ void *data;
+@@ -296,7 +296,7 @@ static struct dmz_mblock *dmz_alloc_mblock(struct dmz_metadata *zmd,
+
+ RB_CLEAR_NODE(&mblk->node);
+ INIT_LIST_HEAD(&mblk->link);
+- atomic_set(&mblk->ref, 0);
++ mblk->ref = 0;
+ mblk->state = 0;
+ mblk->no = mblk_no;
+ mblk->data = page_address(mblk->page);
+@@ -339,10 +339,11 @@ static void dmz_insert_mblock(struct dmz_metadata *zmd, struct dmz_mblock *mblk)
+ }
+
+ /*
+- * Lookup a metadata block in the rbtree.
++ * Lookup a metadata block in the rbtree. If the block is found, increment
++ * its reference count.
+ */
+-static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_fast(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+ struct rb_root *root = &zmd->mblk_rbtree;
+ struct rb_node *node = root->rb_node;
+@@ -350,8 +351,17 @@ static struct dmz_mblock *dmz_lookup_mblock(struct dmz_metadata *zmd,
+
+ while (node) {
+ mblk = container_of(node, struct dmz_mblock, node);
+- if (mblk->no == mblk_no)
++ if (mblk->no == mblk_no) {
++ /*
++ * If this is the first reference to the block,
++ * remove it from the LRU list.
++ */
++ mblk->ref++;
++ if (mblk->ref == 1 &&
++ !test_bit(DMZ_META_DIRTY, &mblk->state))
++ list_del_init(&mblk->link);
+ return mblk;
++ }
+ node = (mblk->no < mblk_no) ? node->rb_left : node->rb_right;
+ }
+
+@@ -382,32 +392,47 @@ static void dmz_mblock_bio_end_io(struct bio *bio)
+ }
+
+ /*
+- * Read a metadata block from disk.
++ * Read an uncached metadata block from disk and add it to the cache.
+ */
+-static struct dmz_mblock *dmz_fetch_mblock(struct dmz_metadata *zmd,
+- sector_t mblk_no)
++static struct dmz_mblock *dmz_get_mblock_slow(struct dmz_metadata *zmd,
++ sector_t mblk_no)
+ {
+- struct dmz_mblock *mblk;
++ struct dmz_mblock *mblk, *m;
+ sector_t block = zmd->sb[zmd->mblk_primary].block + mblk_no;
+ struct bio *bio;
+
+- /* Get block and insert it */
++ /* Get a new block and a BIO to read it */
+ mblk = dmz_alloc_mblock(zmd, mblk_no);
+ if (!mblk)
+ return NULL;
+
+- spin_lock(&zmd->mblk_lock);
+- atomic_inc(&mblk->ref);
+- set_bit(DMZ_META_READING, &mblk->state);
+- dmz_insert_mblock(zmd, mblk);
+- spin_unlock(&zmd->mblk_lock);
+-
+ bio = bio_alloc(GFP_NOIO, 1);
+ if (!bio) {
+ dmz_free_mblock(zmd, mblk);
+ return NULL;
+ }
+
++ spin_lock(&zmd->mblk_lock);
++
++ /*
++ * Make sure that another context did not start reading
++ * the block already.
++ */
++ m = dmz_get_mblock_fast(zmd, mblk_no);
++ if (m) {
++ spin_unlock(&zmd->mblk_lock);
++ dmz_free_mblock(zmd, mblk);
++ bio_put(bio);
++ return m;
++ }
++
++ mblk->ref++;
++ set_bit(DMZ_META_READING, &mblk->state);
++ dmz_insert_mblock(zmd, mblk);
++
++ spin_unlock(&zmd->mblk_lock);
++
++ /* Submit read BIO */
+ bio->bi_iter.bi_sector = dmz_blk2sect(block);
+ bio_set_dev(bio, zmd->dev->bdev);
+ bio->bi_private = mblk;
+@@ -484,7 +509,8 @@ static void dmz_release_mblock(struct dmz_metadata *zmd,
+
+ spin_lock(&zmd->mblk_lock);
+
+- if (atomic_dec_and_test(&mblk->ref)) {
++ mblk->ref--;
++ if (mblk->ref == 0) {
+ if (test_bit(DMZ_META_ERROR, &mblk->state)) {
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -508,18 +534,12 @@ static struct dmz_mblock *dmz_get_mblock(struct dmz_metadata *zmd,
+
+ /* Check rbtree */
+ spin_lock(&zmd->mblk_lock);
+- mblk = dmz_lookup_mblock(zmd, mblk_no);
+- if (mblk) {
+- /* Cache hit: remove block from LRU list */
+- if (atomic_inc_return(&mblk->ref) == 1 &&
+- !test_bit(DMZ_META_DIRTY, &mblk->state))
+- list_del_init(&mblk->link);
+- }
++ mblk = dmz_get_mblock_fast(zmd, mblk_no);
+ spin_unlock(&zmd->mblk_lock);
+
+ if (!mblk) {
+ /* Cache miss: read the block from disk */
+- mblk = dmz_fetch_mblock(zmd, mblk_no);
++ mblk = dmz_get_mblock_slow(zmd, mblk_no);
+ if (!mblk)
+ return ERR_PTR(-ENOMEM);
+ }
+@@ -753,7 +773,7 @@ int dmz_flush_metadata(struct dmz_metadata *zmd)
+
+ spin_lock(&zmd->mblk_lock);
+ clear_bit(DMZ_META_DIRTY, &mblk->state);
+- if (atomic_read(&mblk->ref) == 0)
++ if (mblk->ref == 0)
+ list_add_tail(&mblk->link, &zmd->mblk_lru_list);
+ spin_unlock(&zmd->mblk_lock);
+ }
+@@ -2308,7 +2328,7 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ mblk = list_first_entry(&zmd->mblk_dirty_list,
+ struct dmz_mblock, link);
+ dmz_dev_warn(zmd->dev, "mblock %llu still in dirty list (ref %u)",
+- (u64)mblk->no, atomic_read(&mblk->ref));
++ (u64)mblk->no, mblk->ref);
+ list_del_init(&mblk->link);
+ rb_erase(&mblk->node, &zmd->mblk_rbtree);
+ dmz_free_mblock(zmd, mblk);
+@@ -2326,8 +2346,8 @@ static void dmz_cleanup_metadata(struct dmz_metadata *zmd)
+ root = &zmd->mblk_rbtree;
+ rbtree_postorder_for_each_entry_safe(mblk, next, root, node) {
+ dmz_dev_warn(zmd->dev, "mblock %llu ref %u still in rbtree",
+- (u64)mblk->no, atomic_read(&mblk->ref));
+- atomic_set(&mblk->ref, 0);
++ (u64)mblk->no, mblk->ref);
++ mblk->ref = 0;
+ dmz_free_mblock(zmd, mblk);
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 994aed2f9dff..71665e2c30eb 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -455,10 +455,11 @@ static void md_end_flush(struct bio *fbio)
+ rdev_dec_pending(rdev, mddev);
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -512,10 +513,11 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ rcu_read_unlock();
+
+ if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0)
++ if (bio->bi_iter.bi_size == 0) {
+ /* an empty barrier - all done */
+ bio_endio(bio);
+- else {
++ mempool_free(fi, mddev->flush_pool);
++ } else {
+ INIT_WORK(&fi->flush_work, submit_flushes);
+ queue_work(md_wq, &fi->flush_work);
+ }
+@@ -5907,14 +5909,6 @@ static void __md_stop(struct mddev *mddev)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+-}
+-
+-void md_stop(struct mddev *mddev)
+-{
+- /* stop the array and free an attached data structures.
+- * This is called from dm-raid
+- */
+- __md_stop(mddev);
+ if (mddev->flush_bio_pool) {
+ mempool_destroy(mddev->flush_bio_pool);
+ mddev->flush_bio_pool = NULL;
+@@ -5923,6 +5917,14 @@ void md_stop(struct mddev *mddev)
+ mempool_destroy(mddev->flush_pool);
+ mddev->flush_pool = NULL;
+ }
++}
++
++void md_stop(struct mddev *mddev)
++{
++ /* stop the array and free an attached data structures.
++ * This is called from dm-raid
++ */
++ __md_stop(mddev);
+ bioset_exit(&mddev->bio_set);
+ bioset_exit(&mddev->sync_set);
+ }
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 8e05c1092aef..c9362463d266 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1736,6 +1736,7 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ */
+ if (rdev->saved_raid_disk >= 0 &&
+ rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ first = last = rdev->saved_raid_disk;
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8c93d44a052c..e555221fb75b 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1808,6 +1808,7 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+ first = last = rdev->raid_disk;
+
+ if (rdev->saved_raid_disk >= first &&
++ rdev->saved_raid_disk < conf->geo.raid_disks &&
+ conf->mirrors[rdev->saved_raid_disk].rdev == NULL)
+ mirror = rdev->saved_raid_disk;
+ else
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index b7fad0ec5710..fecba7ddcd00 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -325,7 +325,7 @@ static void cec_data_completed(struct cec_data *data)
+ *
+ * This function is called with adap->lock held.
+ */
+-static void cec_data_cancel(struct cec_data *data)
++static void cec_data_cancel(struct cec_data *data, u8 tx_status)
+ {
+ /*
+ * It's either the current transmit, or it is a pending
+@@ -340,13 +340,11 @@ static void cec_data_cancel(struct cec_data *data)
+ }
+
+ if (data->msg.tx_status & CEC_TX_STATUS_OK) {
+- /* Mark the canceled RX as a timeout */
+ data->msg.rx_ts = ktime_get_ns();
+- data->msg.rx_status = CEC_RX_STATUS_TIMEOUT;
++ data->msg.rx_status = CEC_RX_STATUS_ABORTED;
+ } else {
+- /* Mark the canceled TX as an error */
+ data->msg.tx_ts = ktime_get_ns();
+- data->msg.tx_status |= CEC_TX_STATUS_ERROR |
++ data->msg.tx_status |= tx_status |
+ CEC_TX_STATUS_MAX_RETRIES;
+ data->msg.tx_error_cnt++;
+ data->attempts = 0;
+@@ -374,15 +372,15 @@ static void cec_flush(struct cec_adapter *adap)
+ while (!list_empty(&adap->transmit_queue)) {
+ data = list_first_entry(&adap->transmit_queue,
+ struct cec_data, list);
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+ }
+ if (adap->transmitting)
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting, CEC_TX_STATUS_ABORTED);
+
+ /* Cancel the pending timeout work. */
+ list_for_each_entry_safe(data, n, &adap->wait_queue, list) {
+ if (cancel_delayed_work(&data->work))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_OK);
+ /*
+ * If cancel_delayed_work returned false, then
+ * the cec_wait_timeout function is running,
+@@ -458,12 +456,13 @@ int cec_thread_func(void *_adap)
+ * so much traffic on the bus that the adapter was
+ * unable to transmit for CEC_XFER_TIMEOUT_MS (2.1s).
+ */
+- dprintk(1, "%s: message %*ph timed out\n", __func__,
++ pr_warn("cec-%s: message %*ph timed out\n", adap->name,
+ adap->transmitting->msg.len,
+ adap->transmitting->msg.msg);
+ adap->tx_timeouts++;
+ /* Just give up on this. */
+- cec_data_cancel(adap->transmitting);
++ cec_data_cancel(adap->transmitting,
++ CEC_TX_STATUS_TIMEOUT);
+ goto unlock;
+ }
+
+@@ -498,9 +497,11 @@ int cec_thread_func(void *_adap)
+ if (data->attempts) {
+ /* should be >= 3 data bit periods for a retry */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_RETRY;
+- } else if (data->new_initiator) {
++ } else if (adap->last_initiator !=
++ cec_msg_initiator(&data->msg)) {
+ /* should be >= 5 data bit periods for new initiator */
+ signal_free_time = CEC_SIGNAL_FREE_TIME_NEW_INITIATOR;
++ adap->last_initiator = cec_msg_initiator(&data->msg);
+ } else {
+ /*
+ * should be >= 7 data bit periods for sending another
+@@ -514,7 +515,7 @@ int cec_thread_func(void *_adap)
+ /* Tell the adapter to transmit, cancel on error */
+ if (adap->ops->adap_transmit(adap, data->attempts,
+ signal_free_time, &data->msg))
+- cec_data_cancel(data);
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+ unlock:
+ mutex_unlock(&adap->lock);
+@@ -685,9 +686,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ struct cec_fh *fh, bool block)
+ {
+ struct cec_data *data;
+- u8 last_initiator = 0xff;
+- unsigned int timeout;
+- int res = 0;
+
+ msg->rx_ts = 0;
+ msg->tx_ts = 0;
+@@ -797,23 +795,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ data->adap = adap;
+ data->blocking = block;
+
+- /*
+- * Determine if this message follows a message from the same
+- * initiator. Needed to determine the free signal time later on.
+- */
+- if (msg->len > 1) {
+- if (!(list_empty(&adap->transmit_queue))) {
+- const struct cec_data *last;
+-
+- last = list_last_entry(&adap->transmit_queue,
+- const struct cec_data, list);
+- last_initiator = cec_msg_initiator(&last->msg);
+- } else if (adap->transmitting) {
+- last_initiator =
+- cec_msg_initiator(&adap->transmitting->msg);
+- }
+- }
+- data->new_initiator = last_initiator != cec_msg_initiator(msg);
+ init_completion(&data->c);
+ INIT_DELAYED_WORK(&data->work, cec_wait_timeout);
+
+@@ -829,48 +810,23 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg,
+ if (!block)
+ return 0;
+
+- /*
+- * If we don't get a completion before this time something is really
+- * wrong and we time out.
+- */
+- timeout = CEC_XFER_TIMEOUT_MS;
+- /* Add the requested timeout if we have to wait for a reply as well */
+- if (msg->timeout)
+- timeout += msg->timeout;
+-
+ /*
+ * Release the lock and wait, retake the lock afterwards.
+ */
+ mutex_unlock(&adap->lock);
+- res = wait_for_completion_killable_timeout(&data->c,
+- msecs_to_jiffies(timeout));
++ wait_for_completion_killable(&data->c);
++ if (!data->completed)
++ cancel_delayed_work_sync(&data->work);
+ mutex_lock(&adap->lock);
+
+- if (data->completed) {
+- /* The transmit completed (possibly with an error) */
+- *msg = data->msg;
+- kfree(data);
+- return 0;
+- }
+- /*
+- * The wait for completion timed out or was interrupted, so mark this
+- * as non-blocking and disconnect from the filehandle since it is
+- * still 'in flight'. When it finally completes it will just drop the
+- * result silently.
+- */
+- data->blocking = false;
+- if (data->fh)
+- list_del(&data->xfer_list);
+- data->fh = NULL;
++ /* Cancel the transmit if it was interrupted */
++ if (!data->completed)
++ cec_data_cancel(data, CEC_TX_STATUS_ABORTED);
+
+- if (res == 0) { /* timed out */
+- /* Check if the reply or the transmit failed */
+- if (msg->timeout && (msg->tx_status & CEC_TX_STATUS_OK))
+- msg->rx_status = CEC_RX_STATUS_TIMEOUT;
+- else
+- msg->tx_status = CEC_TX_STATUS_MAX_RETRIES;
+- }
+- return res > 0 ? 0 : res;
++ /* The transmit completed (possibly with an error) */
++ *msg = data->msg;
++ kfree(data);
++ return 0;
+ }
+
+ /* Helper function to be used by drivers and this framework. */
+@@ -1028,6 +984,8 @@ void cec_received_msg_ts(struct cec_adapter *adap,
+ mutex_lock(&adap->lock);
+ dprintk(2, "%s: %*ph\n", __func__, msg->len, msg->msg);
+
++ adap->last_initiator = 0xff;
++
+ /* Check if this message was for us (directed or broadcast). */
+ if (!cec_msg_is_broadcast(msg))
+ valid_la = cec_has_log_addr(adap, msg_dest);
+@@ -1490,6 +1448,8 @@ void __cec_s_phys_addr(struct cec_adapter *adap, u16 phys_addr, bool block)
+ }
+
+ mutex_lock(&adap->devnode.lock);
++ adap->last_initiator = 0xff;
++
+ if ((adap->needs_hpd || list_empty(&adap->devnode.fhs)) &&
+ adap->ops->adap_enable(adap, true)) {
+ mutex_unlock(&adap->devnode.lock);
+diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
+index 10b67fc40318..0199765fbae6 100644
+--- a/drivers/media/cec/cec-api.c
++++ b/drivers/media/cec/cec-api.c
+@@ -101,6 +101,23 @@ static long cec_adap_g_phys_addr(struct cec_adapter *adap,
+ return 0;
+ }
+
++static int cec_validate_phys_addr(u16 phys_addr)
++{
++ int i;
++
++ if (phys_addr == CEC_PHYS_ADDR_INVALID)
++ return 0;
++ for (i = 0; i < 16; i += 4)
++ if (phys_addr & (0xf << i))
++ break;
++ if (i == 16)
++ return 0;
++ for (i += 4; i < 16; i += 4)
++ if ((phys_addr & (0xf << i)) == 0)
++ return -EINVAL;
++ return 0;
++}
++
+ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ bool block, __u16 __user *parg)
+ {
+@@ -112,7 +129,7 @@ static long cec_adap_s_phys_addr(struct cec_adapter *adap, struct cec_fh *fh,
+ if (copy_from_user(&phys_addr, parg, sizeof(phys_addr)))
+ return -EFAULT;
+
+- err = cec_phys_addr_validate(phys_addr, NULL, NULL);
++ err = cec_validate_phys_addr(phys_addr);
+ if (err)
+ return err;
+ mutex_lock(&adap->lock);
+diff --git a/drivers/media/cec/cec-edid.c b/drivers/media/cec/cec-edid.c
+index ec72ac1c0b91..f587e8eaefd8 100644
+--- a/drivers/media/cec/cec-edid.c
++++ b/drivers/media/cec/cec-edid.c
+@@ -10,66 +10,6 @@
+ #include <linux/types.h>
+ #include <media/cec.h>
+
+-/*
+- * This EDID is expected to be a CEA-861 compliant, which means that there are
+- * at least two blocks and one or more of the extensions blocks are CEA-861
+- * blocks.
+- *
+- * The returned location is guaranteed to be < size - 1.
+- */
+-static unsigned int cec_get_edid_spa_location(const u8 *edid, unsigned int size)
+-{
+- unsigned int blocks = size / 128;
+- unsigned int block;
+- u8 d;
+-
+- /* Sanity check: at least 2 blocks and a multiple of the block size */
+- if (blocks < 2 || size % 128)
+- return 0;
+-
+- /*
+- * If there are fewer extension blocks than the size, then update
+- * 'blocks'. It is allowed to have more extension blocks than the size,
+- * since some hardware can only read e.g. 256 bytes of the EDID, even
+- * though more blocks are present. The first CEA-861 extension block
+- * should normally be in block 1 anyway.
+- */
+- if (edid[0x7e] + 1 < blocks)
+- blocks = edid[0x7e] + 1;
+-
+- for (block = 1; block < blocks; block++) {
+- unsigned int offset = block * 128;
+-
+- /* Skip any non-CEA-861 extension blocks */
+- if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
+- continue;
+-
+- /* search Vendor Specific Data Block (tag 3) */
+- d = edid[offset + 2] & 0x7f;
+- /* Check if there are Data Blocks */
+- if (d <= 4)
+- continue;
+- if (d > 4) {
+- unsigned int i = offset + 4;
+- unsigned int end = offset + d;
+-
+- /* Note: 'end' is always < 'size' */
+- do {
+- u8 tag = edid[i] >> 5;
+- u8 len = edid[i] & 0x1f;
+-
+- if (tag == 3 && len >= 5 && i + len <= end &&
+- edid[i + 1] == 0x03 &&
+- edid[i + 2] == 0x0c &&
+- edid[i + 3] == 0x00)
+- return i + 4;
+- i += len + 1;
+- } while (i < end);
+- }
+- }
+- return 0;
+-}
+-
+ u16 cec_get_edid_phys_addr(const u8 *edid, unsigned int size,
+ unsigned int *offset)
+ {
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+index 3a3dc23c560c..a4341205c197 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-colors.c
+@@ -602,14 +602,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE170M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -658,14 +658,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][5] = { 3138, 657, 810 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][6] = { 731, 680, 3048 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][1] = { 3046, 3054, 886 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][2] = { 0, 3058, 3031 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][3] = { 360, 3079, 877 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][4] = { 3103, 587, 3027 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][5] = { 3116, 723, 861 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][6] = { 789, 744, 3025 },
+- [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][1] = { 3046, 3054, 886 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][2] = { 0, 3058, 3031 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][3] = { 360, 3079, 877 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][4] = { 3103, 587, 3027 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][5] = { 3116, 723, 861 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][6] = { 789, 744, 3025 },
++ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2941, 2950, 546 },
+ [V4L2_COLORSPACE_SMPTE240M][V4L2_XFER_FUNC_SMPTE240M][2] = { 0, 2954, 2924 },
+@@ -714,14 +714,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_REC709][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -770,14 +770,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][5] = { 2599, 901, 909 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][6] = { 991, 0, 2966 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SRGB][7] = { 800, 799, 800 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][1] = { 2989, 3120, 1180 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][2] = { 1913, 3011, 3009 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][3] = { 1836, 3099, 1105 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][4] = { 2627, 413, 2966 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][5] = { 2576, 943, 951 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][6] = { 1026, 0, 2942 },
+- [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][1] = { 2989, 3120, 1180 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][2] = { 1913, 3011, 3009 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][3] = { 1836, 3099, 1105 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][4] = { 2627, 413, 2966 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][5] = { 2576, 943, 951 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][6] = { 1026, 0, 2942 },
++ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][1] = { 2879, 3022, 874 },
+ [V4L2_COLORSPACE_470_SYSTEM_M][V4L2_XFER_FUNC_SMPTE240M][2] = { 1688, 2903, 2901 },
+@@ -826,14 +826,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][5] = { 3001, 800, 799 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3071 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][2] = { 1068, 3033, 3033 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][3] = { 1068, 3033, 776 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][4] = { 2977, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][5] = { 2977, 851, 851 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3048 },
+- [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][2] = { 1068, 3033, 3033 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][3] = { 1068, 3033, 776 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][4] = { 2977, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][5] = { 2977, 851, 851 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3048 },
++ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 423 },
+ [V4L2_COLORSPACE_470_SYSTEM_BG][V4L2_XFER_FUNC_SMPTE240M][2] = { 749, 2926, 2926 },
+@@ -882,14 +882,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][5] = { 3056, 800, 800 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3056 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 851, 3033, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 851, 3033, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 3033, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 3033, 851, 851 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 3033 },
+- [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][2] = { 851, 3033, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][3] = { 851, 3033, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][4] = { 3033, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][5] = { 3033, 851, 851 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 3033 },
++ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 507 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 507, 2926, 2926 },
+@@ -922,62 +922,62 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1812, 886, 886 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1812 },
+ [V4L2_COLORSPACE_SRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][1] = { 3033, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][2] = { 1828, 3033, 3033 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][3] = { 1828, 3033, 1063 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][4] = { 2633, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][5] = { 2633, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][6] = { 851, 851, 2979 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
+- [V4L2_COLORSPACE_ADOBERGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][1] = { 2939, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][2] = { 1622, 2939, 2939 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][3] = { 1622, 2939, 781 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][4] = { 2502, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][5] = { 2502, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][6] = { 547, 547, 2881 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_709][7] = { 547, 547, 547 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][0] = { 3056, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][1] = { 3056, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][2] = { 1838, 3056, 3056 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][3] = { 1838, 3056, 1031 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][4] = { 2657, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][5] = { 2657, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][6] = { 800, 800, 3002 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][1] = { 3033, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][2] = { 1828, 3033, 3033 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][3] = { 1828, 3033, 1063 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][4] = { 2633, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][5] = { 2633, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][6] = { 851, 851, 2979 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][1] = { 2926, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][2] = { 1594, 2926, 2926 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][3] = { 1594, 2926, 744 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][4] = { 2484, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][5] = { 2484, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][6] = { 507, 507, 2867 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE240M][7] = { 507, 507, 507 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][0] = { 2125, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][1] = { 2125, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][2] = { 698, 2125, 2125 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][3] = { 698, 2125, 212 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][4] = { 1557, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][5] = { 1557, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][6] = { 130, 130, 2043 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_NONE][7] = { 130, 130, 130 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][0] = { 3175, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][1] = { 3175, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][2] = { 2069, 3175, 3175 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][3] = { 2069, 3175, 1308 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][4] = { 2816, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][5] = { 2816, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][6] = { 1084, 1084, 3127 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_DCI_P3][7] = { 1084, 1084, 1084 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][0] = { 1812, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][1] = { 1812, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][2] = { 1402, 1812, 1812 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][3] = { 1402, 1812, 1022 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][4] = { 1692, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][5] = { 1692, 886, 886 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][6] = { 886, 886, 1797 },
++ [V4L2_COLORSPACE_OPRGB][V4L2_XFER_FUNC_SMPTE2084][7] = { 886, 886, 886 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][0] = { 2939, 2939, 2939 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][1] = { 2877, 2923, 1058 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_709][2] = { 1837, 2840, 2916 },
+@@ -994,14 +994,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][5] = { 2517, 1159, 900 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][6] = { 1042, 870, 2917 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 800 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][1] = { 2976, 3018, 1315 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][2] = { 2024, 2942, 3011 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][3] = { 1930, 2926, 1256 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][4] = { 2563, 1227, 2916 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][5] = { 2494, 1183, 943 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][6] = { 1073, 916, 2894 },
+- [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][1] = { 2976, 3018, 1315 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][2] = { 2024, 2942, 3011 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][3] = { 1930, 2926, 1256 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][4] = { 2563, 1227, 2916 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][5] = { 2494, 1183, 943 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][6] = { 1073, 916, 2894 },
++ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][1] = { 2864, 2910, 1024 },
+ [V4L2_COLORSPACE_BT2020][V4L2_XFER_FUNC_SMPTE240M][2] = { 1811, 2826, 2903 },
+@@ -1050,14 +1050,14 @@ const struct tpg_rbg_color16 tpg_csc_colors[V4L2_COLORSPACE_DCI_P3 + 1][V4L2_XFE
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][5] = { 2880, 998, 902 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][6] = { 816, 823, 2940 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SRGB][7] = { 800, 800, 799 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][0] = { 3033, 3033, 3033 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][1] = { 3029, 3028, 1255 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][2] = { 1406, 2988, 3011 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][3] = { 1398, 2983, 1190 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][4] = { 2860, 1050, 2939 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][5] = { 2857, 1033, 945 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][6] = { 866, 873, 2916 },
+- [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_ADOBERGB][7] = { 851, 851, 851 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][0] = { 3033, 3033, 3033 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][1] = { 3029, 3028, 1255 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][2] = { 1406, 2988, 3011 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][3] = { 1398, 2983, 1190 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][4] = { 2860, 1050, 2939 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][5] = { 2857, 1033, 945 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][6] = { 866, 873, 2916 },
++ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_OPRGB][7] = { 851, 851, 851 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][0] = { 2926, 2926, 2926 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][1] = { 2923, 2921, 957 },
+ [V4L2_COLORSPACE_DCI_P3][V4L2_XFER_FUNC_SMPTE240M][2] = { 1125, 2877, 2902 },
+@@ -1128,7 +1128,7 @@ static const double rec709_to_240m[3][3] = {
+ { 0.0016327, 0.0044133, 0.9939540 },
+ };
+
+-static const double rec709_to_adobergb[3][3] = {
++static const double rec709_to_oprgb[3][3] = {
+ { 0.7151627, 0.2848373, -0.0000000 },
+ { 0.0000000, 1.0000000, 0.0000000 },
+ { -0.0000000, 0.0411705, 0.9588295 },
+@@ -1195,7 +1195,7 @@ static double transfer_rec709_to_rgb(double v)
+ return (v < 0.081) ? v / 4.5 : pow((v + 0.099) / 1.099, 1.0 / 0.45);
+ }
+
+-static double transfer_rgb_to_adobergb(double v)
++static double transfer_rgb_to_oprgb(double v)
+ {
+ return pow(v, 1.0 / 2.19921875);
+ }
+@@ -1251,8 +1251,8 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ case V4L2_COLORSPACE_470_SYSTEM_M:
+ mult_matrix(r, g, b, rec709_to_ntsc1953);
+ break;
+- case V4L2_COLORSPACE_ADOBERGB:
+- mult_matrix(r, g, b, rec709_to_adobergb);
++ case V4L2_COLORSPACE_OPRGB:
++ mult_matrix(r, g, b, rec709_to_oprgb);
+ break;
+ case V4L2_COLORSPACE_BT2020:
+ mult_matrix(r, g, b, rec709_to_bt2020);
+@@ -1284,10 +1284,10 @@ static void csc(enum v4l2_colorspace colorspace, enum v4l2_xfer_func xfer_func,
+ *g = transfer_rgb_to_srgb(*g);
+ *b = transfer_rgb_to_srgb(*b);
+ break;
+- case V4L2_XFER_FUNC_ADOBERGB:
+- *r = transfer_rgb_to_adobergb(*r);
+- *g = transfer_rgb_to_adobergb(*g);
+- *b = transfer_rgb_to_adobergb(*b);
++ case V4L2_XFER_FUNC_OPRGB:
++ *r = transfer_rgb_to_oprgb(*r);
++ *g = transfer_rgb_to_oprgb(*g);
++ *b = transfer_rgb_to_oprgb(*b);
+ break;
+ case V4L2_XFER_FUNC_DCI_P3:
+ *r = transfer_rgb_to_dcip3(*r);
+@@ -1321,7 +1321,7 @@ int main(int argc, char **argv)
+ V4L2_COLORSPACE_470_SYSTEM_BG,
+ 0,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ 0,
+ V4L2_COLORSPACE_DCI_P3,
+@@ -1336,7 +1336,7 @@ int main(int argc, char **argv)
+ "V4L2_COLORSPACE_470_SYSTEM_BG",
+ "",
+ "V4L2_COLORSPACE_SRGB",
+- "V4L2_COLORSPACE_ADOBERGB",
++ "V4L2_COLORSPACE_OPRGB",
+ "V4L2_COLORSPACE_BT2020",
+ "",
+ "V4L2_COLORSPACE_DCI_P3",
+@@ -1345,7 +1345,7 @@ int main(int argc, char **argv)
+ "",
+ "V4L2_XFER_FUNC_709",
+ "V4L2_XFER_FUNC_SRGB",
+- "V4L2_XFER_FUNC_ADOBERGB",
++ "V4L2_XFER_FUNC_OPRGB",
+ "V4L2_XFER_FUNC_SMPTE240M",
+ "V4L2_XFER_FUNC_NONE",
+ "V4L2_XFER_FUNC_DCI_P3",
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index abd4c788dffd..f40ab5704bf0 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1770,7 +1770,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ pos[7] = (chr & (0x01 << 0) ? fg : bg); \
+ } \
+ \
+- pos += (tpg->hflip ? -8 : 8) / hdiv; \
++ pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
+ } \
+ } \
+ } while (0)
+diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c
+index 5731751d3f2a..cd6e7372ef9c 100644
+--- a/drivers/media/i2c/adv7511.c
++++ b/drivers/media/i2c/adv7511.c
+@@ -1355,10 +1355,10 @@ static int adv7511_set_fmt(struct v4l2_subdev *sd,
+ state->xfer_func = format->format.xfer_func;
+
+ switch (format->format.colorspace) {
+- case V4L2_COLORSPACE_ADOBERGB:
++ case V4L2_COLORSPACE_OPRGB:
+ c = HDMI_COLORIMETRY_EXTENDED;
+- ec = y ? HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601 :
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB;
++ ec = y ? HDMI_EXTENDED_COLORIMETRY_OPYCC_601 :
++ HDMI_EXTENDED_COLORIMETRY_OPRGB;
+ break;
+ case V4L2_COLORSPACE_SMPTE170M:
+ c = y ? HDMI_COLORIMETRY_ITU_601 : HDMI_COLORIMETRY_NONE;
+diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c
+index cac2081e876e..2437f72f7caf 100644
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2284,8 +2284,10 @@ static int adv76xx_set_edid(struct v4l2_subdev *sd, struct v4l2_edid *edid)
+ state->aspect_ratio.numerator = 16;
+ state->aspect_ratio.denominator = 9;
+
+- if (!state->edid.present)
++ if (!state->edid.present) {
+ state->edid.blocks = 0;
++ cec_phys_addr_invalidate(state->cec_adap);
++ }
+
+ v4l2_dbg(2, debug, sd, "%s: clear EDID pad %d, edid.present = 0x%x\n",
+ __func__, edid->pad, state->edid.present);
+@@ -2474,7 +2476,7 @@ static int adv76xx_log_status(struct v4l2_subdev *sd)
+ "YCbCr Bt.601 (16-235)", "YCbCr Bt.709 (16-235)",
+ "xvYCC Bt.601", "xvYCC Bt.709",
+ "YCbCr Bt.601 (0-255)", "YCbCr Bt.709 (0-255)",
+- "sYCC", "Adobe YCC 601", "AdobeRGB", "invalid", "invalid",
++ "sYCC", "opYCC 601", "opRGB", "invalid", "invalid",
+ "invalid", "invalid", "invalid"
+ };
+ static const char * const rgb_quantization_range_txt[] = {
+diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
+index fddac32e5051..ceca6be13ca9 100644
+--- a/drivers/media/i2c/adv7842.c
++++ b/drivers/media/i2c/adv7842.c
+@@ -786,8 +786,10 @@ static int edid_write_hdmi_segment(struct v4l2_subdev *sd, u8 port)
+ /* Disable I2C access to internal EDID ram from HDMI DDC ports */
+ rep_write_and_or(sd, 0x77, 0xf3, 0x00);
+
+- if (!state->hdmi_edid.present)
++ if (!state->hdmi_edid.present) {
++ cec_phys_addr_invalidate(state->cec_adap);
+ return 0;
++ }
+
+ pa = cec_get_edid_phys_addr(edid, 256, &spa_loc);
+ err = cec_phys_addr_validate(pa, &pa, NULL);
+diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c
+index 3474ef832c1e..480edeebac60 100644
+--- a/drivers/media/i2c/ov7670.c
++++ b/drivers/media/i2c/ov7670.c
+@@ -1810,17 +1810,24 @@ static int ov7670_probe(struct i2c_client *client,
+ info->pclk_hb_disable = true;
+ }
+
+- info->clk = devm_clk_get(&client->dev, "xclk");
+- if (IS_ERR(info->clk))
+- return PTR_ERR(info->clk);
+- ret = clk_prepare_enable(info->clk);
+- if (ret)
+- return ret;
++ info->clk = devm_clk_get(&client->dev, "xclk"); /* optional */
++ if (IS_ERR(info->clk)) {
++ ret = PTR_ERR(info->clk);
++ if (ret == -ENOENT)
++ info->clk = NULL;
++ else
++ return ret;
++ }
++ if (info->clk) {
++ ret = clk_prepare_enable(info->clk);
++ if (ret)
++ return ret;
+
+- info->clock_speed = clk_get_rate(info->clk) / 1000000;
+- if (info->clock_speed < 10 || info->clock_speed > 48) {
+- ret = -EINVAL;
+- goto clk_disable;
++ info->clock_speed = clk_get_rate(info->clk) / 1000000;
++ if (info->clock_speed < 10 || info->clock_speed > 48) {
++ ret = -EINVAL;
++ goto clk_disable;
++ }
+ }
+
+ ret = ov7670_init_gpio(client, info);
+diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
+index 393bbbbbaad7..865639587a97 100644
+--- a/drivers/media/i2c/tc358743.c
++++ b/drivers/media/i2c/tc358743.c
+@@ -1243,9 +1243,9 @@ static int tc358743_log_status(struct v4l2_subdev *sd)
+ u8 vi_status3 = i2c_rd8(sd, VI_STATUS3);
+ const int deep_color_mode[4] = { 8, 10, 12, 16 };
+ static const char * const input_color_space[] = {
+- "RGB", "YCbCr 601", "Adobe RGB", "YCbCr 709", "NA (4)",
++ "RGB", "YCbCr 601", "opRGB", "YCbCr 709", "NA (4)",
+ "xvYCC 601", "NA(6)", "xvYCC 709", "NA(8)", "sYCC601",
+- "NA(10)", "NA(11)", "NA(12)", "Adobe YCC 601"};
++ "NA(10)", "NA(11)", "NA(12)", "opYCC 601"};
+
+ v4l2_info(sd, "-----Chip status-----\n");
+ v4l2_info(sd, "Chip ID: 0x%02x\n",
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 76e6bed5a1da..805bd9c65940 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_client *c,
+ 27000000, 1, 27000000);
+ v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+ V4L2_CID_TEST_PATTERN,
+- ARRAY_SIZE(tvp5150_test_patterns),
++ ARRAY_SIZE(tvp5150_test_patterns) - 1,
+ 0, 0, tvp5150_test_patterns);
+ sd->ctrl_handler = &core->hdl;
+ if (core->hdl.error) {
+diff --git a/drivers/media/platform/vivid/vivid-core.h b/drivers/media/platform/vivid/vivid-core.h
+index 477c80a4d44c..cd4c8230563c 100644
+--- a/drivers/media/platform/vivid/vivid-core.h
++++ b/drivers/media/platform/vivid/vivid-core.h
+@@ -111,7 +111,7 @@ enum vivid_colorspace {
+ VIVID_CS_170M,
+ VIVID_CS_709,
+ VIVID_CS_SRGB,
+- VIVID_CS_ADOBERGB,
++ VIVID_CS_OPRGB,
+ VIVID_CS_2020,
+ VIVID_CS_DCI_P3,
+ VIVID_CS_240M,
+diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c
+index 6b0bfa091592..e1185f0f6607 100644
+--- a/drivers/media/platform/vivid/vivid-ctrls.c
++++ b/drivers/media/platform/vivid/vivid-ctrls.c
+@@ -348,7 +348,7 @@ static int vivid_vid_cap_s_ctrl(struct v4l2_ctrl *ctrl)
+ V4L2_COLORSPACE_SMPTE170M,
+ V4L2_COLORSPACE_REC709,
+ V4L2_COLORSPACE_SRGB,
+- V4L2_COLORSPACE_ADOBERGB,
++ V4L2_COLORSPACE_OPRGB,
+ V4L2_COLORSPACE_BT2020,
+ V4L2_COLORSPACE_DCI_P3,
+ V4L2_COLORSPACE_SMPTE240M,
+@@ -729,7 +729,7 @@ static const char * const vivid_ctrl_colorspace_strings[] = {
+ "SMPTE 170M",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "BT.2020",
+ "DCI-P3",
+ "SMPTE 240M",
+@@ -752,7 +752,7 @@ static const char * const vivid_ctrl_xfer_func_strings[] = {
+ "Default",
+ "Rec. 709",
+ "sRGB",
+- "AdobeRGB",
++ "opRGB",
+ "SMPTE 240M",
+ "None",
+ "DCI-P3",
+diff --git a/drivers/media/platform/vivid/vivid-vid-out.c b/drivers/media/platform/vivid/vivid-vid-out.c
+index 51fec66d8d45..50248e2176a0 100644
+--- a/drivers/media/platform/vivid/vivid-vid-out.c
++++ b/drivers/media/platform/vivid/vivid-vid-out.c
+@@ -413,7 +413,7 @@ int vivid_try_fmt_vid_out(struct file *file, void *priv,
+ mp->colorspace = V4L2_COLORSPACE_SMPTE170M;
+ } else if (mp->colorspace != V4L2_COLORSPACE_SMPTE170M &&
+ mp->colorspace != V4L2_COLORSPACE_REC709 &&
+- mp->colorspace != V4L2_COLORSPACE_ADOBERGB &&
++ mp->colorspace != V4L2_COLORSPACE_OPRGB &&
+ mp->colorspace != V4L2_COLORSPACE_BT2020 &&
+ mp->colorspace != V4L2_COLORSPACE_SRGB) {
+ mp->colorspace = V4L2_COLORSPACE_REC709;
+diff --git a/drivers/media/usb/dvb-usb-v2/dvbsky.c b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+index 1aa88d94e57f..e28bd8836751 100644
+--- a/drivers/media/usb/dvb-usb-v2/dvbsky.c
++++ b/drivers/media/usb/dvb-usb-v2/dvbsky.c
+@@ -31,6 +31,7 @@ MODULE_PARM_DESC(disable_rc, "Disable inbuilt IR receiver.");
+ DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+ struct dvbsky_state {
++ struct mutex stream_mutex;
+ u8 ibuf[DVBSKY_BUF_LEN];
+ u8 obuf[DVBSKY_BUF_LEN];
+ u8 last_lock;
+@@ -67,17 +68,18 @@ static int dvbsky_usb_generic_rw(struct dvb_usb_device *d,
+
+ static int dvbsky_stream_ctrl(struct dvb_usb_device *d, u8 onoff)
+ {
++ struct dvbsky_state *state = d_to_priv(d);
+ int ret;
+- static u8 obuf_pre[3] = { 0x37, 0, 0 };
+- static u8 obuf_post[3] = { 0x36, 3, 0 };
++ u8 obuf_pre[3] = { 0x37, 0, 0 };
++ u8 obuf_post[3] = { 0x36, 3, 0 };
+
+- mutex_lock(&d->usb_mutex);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_pre, 3, NULL, 0);
++ mutex_lock(&state->stream_mutex);
++ ret = dvbsky_usb_generic_rw(d, obuf_pre, 3, NULL, 0);
+ if (!ret && onoff) {
+ msleep(20);
+- ret = dvb_usbv2_generic_rw_locked(d, obuf_post, 3, NULL, 0);
++ ret = dvbsky_usb_generic_rw(d, obuf_post, 3, NULL, 0);
+ }
+- mutex_unlock(&d->usb_mutex);
++ mutex_unlock(&state->stream_mutex);
+ return ret;
+ }
+
+@@ -606,6 +608,8 @@ static int dvbsky_init(struct dvb_usb_device *d)
+ if (ret)
+ return ret;
+ */
++ mutex_init(&state->stream_mutex);
++
+ state->last_lock = 0;
+
+ return 0;
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index ff5e41ac4723..98d6c8fcd262 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[] = {
+ .input = { {
+ .type = EM28XX_VMUX_COMPOSITE,
+ .vmux = TVP5150_COMPOSITE1,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+
+ }, {
+ .type = EM28XX_VMUX_SVIDEO,
+ .vmux = TVP5150_SVIDEO,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+ } },
+ },
+@@ -3041,6 +3041,9 @@ static int em28xx_hint_board(struct em28xx *dev)
+
+ static void em28xx_card_setup(struct em28xx *dev)
+ {
++ int i, j, idx;
++ bool duplicate_entry;
++
+ /*
+ * If the device can be a webcam, seek for a sensor.
+ * If sensor is not found, then it isn't a webcam.
+@@ -3197,6 +3200,32 @@ static void em28xx_card_setup(struct em28xx *dev)
+ /* Allow override tuner type by a module parameter */
+ if (tuner >= 0)
+ dev->tuner_type = tuner;
++
++ /*
++ * Dynamically generate a list of valid audio inputs for this
++ * specific board, mapping them via enum em28xx_amux.
++ */
++
++ idx = 0;
++ for (i = 0; i < MAX_EM28XX_INPUT; i++) {
++ if (!INPUT(i)->type)
++ continue;
++
++ /* Skip already mapped audio inputs */
++ duplicate_entry = false;
++ for (j = 0; j < idx; j++) {
++ if (INPUT(i)->amux == dev->amux_map[j]) {
++ duplicate_entry = true;
++ break;
++ }
++ }
++ if (duplicate_entry)
++ continue;
++
++ dev->amux_map[idx++] = INPUT(i)->amux;
++ }
++ for (; idx < MAX_EM28XX_INPUT; idx++)
++ dev->amux_map[idx] = EM28XX_AMUX_UNUSED;
+ }
+
+ void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index 68571bf36d28..3bf98ac897ec 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1093,6 +1093,8 @@ int em28xx_start_analog_streaming(struct vb2_queue *vq, unsigned int count)
+
+ em28xx_videodbg("%s\n", __func__);
+
++ dev->v4l2->field_count = 0;
++
+ /*
+ * Make sure streaming is not already in progress for this type
+ * of filehandle (e.g. video, vbi)
+@@ -1471,9 +1473,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ if (!fmt) {
+- em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+- f->fmt.pix.pixelformat);
+- return -EINVAL;
++ fmt = &format[0];
++ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++ f->fmt.pix.pixelformat, fmt->fourcc);
+ }
+
+ if (dev->board.is_em2800) {
+@@ -1666,6 +1668,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ {
+ struct em28xx *dev = video_drvdata(file);
+ unsigned int n;
++ int j;
+
+ n = i->index;
+ if (n >= MAX_EM28XX_INPUT)
+@@ -1685,6 +1688,12 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ if (dev->is_webcam)
+ i->capabilities = 0;
+
++ /* Dynamically generates an audioset bitmask */
++ i->audioset = 0;
++ for (j = 0; j < MAX_EM28XX_INPUT; j++)
++ if (dev->amux_map[j] != EM28XX_AMUX_UNUSED)
++ i->audioset |= 1 << j;
++
+ return 0;
+ }
+
+@@ -1710,11 +1719,24 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
+ return 0;
+ }
+
+-static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++static int em28xx_fill_audio_input(struct em28xx *dev,
++ const char *s,
++ struct v4l2_audio *a,
++ unsigned int index)
+ {
+- struct em28xx *dev = video_drvdata(file);
++ unsigned int idx = dev->amux_map[index];
++
++ /*
++ * With msp3400, almost all mappings use the default (amux = 0).
++ * The only one may use a different value is WinTV USB2, where it
++ * can also be SCART1 input.
++ * As it is very doubtful that we would see new boards with msp3400,
++ * let's just reuse the existing switch.
++ */
++ if (dev->has_msp34xx && idx != EM28XX_AMUX_UNUSED)
++ idx = EM28XX_AMUX_LINE_IN;
+
+- switch (a->index) {
++ switch (idx) {
+ case EM28XX_AMUX_VIDEO:
+ strcpy(a->name, "Television");
+ break;
+@@ -1739,32 +1761,79 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
+ case EM28XX_AMUX_PCM_OUT:
+ strcpy(a->name, "PCM");
+ break;
++ case EM28XX_AMUX_UNUSED:
+ default:
+ return -EINVAL;
+ }
+-
+- a->index = dev->ctl_ainput;
++ a->index = index;
+ a->capability = V4L2_AUDCAP_STEREO;
+
++ em28xx_videodbg("%s: audio input index %d is '%s'\n",
++ s, a->index, a->name);
++
+ return 0;
+ }
+
++static int vidioc_enumaudio(struct file *file, void *fh, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++
++ if (a->index >= MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ return em28xx_fill_audio_input(dev, __func__, a, a->index);
++}
++
++static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
++{
++ struct em28xx *dev = video_drvdata(file);
++ int i;
++
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (dev->ctl_ainput == dev->amux_map[i])
++ return em28xx_fill_audio_input(dev, __func__, a, i);
++
++ /* Should never happen! */
++ return -EINVAL;
++}
++
+ static int vidioc_s_audio(struct file *file, void *priv,
+ const struct v4l2_audio *a)
+ {
+ struct em28xx *dev = video_drvdata(file);
++ int idx, i;
+
+ if (a->index >= MAX_EM28XX_INPUT)
+ return -EINVAL;
+- if (!INPUT(a->index)->type)
++
++ idx = dev->amux_map[a->index];
++
++ if (idx == EM28XX_AMUX_UNUSED)
+ return -EINVAL;
+
+- dev->ctl_ainput = INPUT(a->index)->amux;
+- dev->ctl_aoutput = INPUT(a->index)->aout;
++ dev->ctl_ainput = idx;
++
++ /*
++ * FIXME: This is wrong, as different inputs at em28xx_cards
++ * may have different audio outputs. So, the right thing
++ * to do is to implement VIDIOC_G_AUDOUT/VIDIOC_S_AUDOUT.
++ * With the current board definitions, this would work fine,
++ * as, currently, all boards fit.
++ */
++ for (i = 0; i < MAX_EM28XX_INPUT; i++)
++ if (idx == dev->amux_map[i])
++ break;
++ if (i == MAX_EM28XX_INPUT)
++ return -EINVAL;
++
++ dev->ctl_aoutput = INPUT(i)->aout;
+
+ if (!dev->ctl_aoutput)
+ dev->ctl_aoutput = EM28XX_AOUT_MASTER;
+
++ em28xx_videodbg("%s: set audio input to %d\n", __func__,
++ dev->ctl_ainput);
++
+ return 0;
+ }
+
+@@ -2302,6 +2371,7 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
+ .vidioc_try_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_s_fmt_vbi_cap = vidioc_g_fmt_vbi_cap,
+ .vidioc_enum_framesizes = vidioc_enum_framesizes,
++ .vidioc_enumaudio = vidioc_enumaudio,
+ .vidioc_g_audio = vidioc_g_audio,
+ .vidioc_s_audio = vidioc_s_audio,
+
+diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h
+index 953caac025f2..a551072e62ed 100644
+--- a/drivers/media/usb/em28xx/em28xx.h
++++ b/drivers/media/usb/em28xx/em28xx.h
+@@ -335,6 +335,9 @@ enum em28xx_usb_audio_type {
+ /**
+ * em28xx_amux - describes the type of audio input used by em28xx
+ *
++ * @EM28XX_AMUX_UNUSED:
++ * Used only on em28xx dev->map field, in order to mark an entry
++ * as unused.
+ * @EM28XX_AMUX_VIDEO:
+ * On devices without AC97, this is the only value that it is currently
+ * allowed.
+@@ -369,7 +372,8 @@ enum em28xx_usb_audio_type {
+ * same time, via the alsa mux.
+ */
+ enum em28xx_amux {
+- EM28XX_AMUX_VIDEO,
++ EM28XX_AMUX_UNUSED = -1,
++ EM28XX_AMUX_VIDEO = 0,
+ EM28XX_AMUX_LINE_IN,
+
+ /* Some less-common mixer setups */
+@@ -692,6 +696,8 @@ struct em28xx {
+ unsigned int ctl_input; // selected input
+ unsigned int ctl_ainput;// selected audio input
+ unsigned int ctl_aoutput;// selected audio output
++ enum em28xx_amux amux_map[MAX_EM28XX_INPUT];
++
+ int mute;
+ int volume;
+
+diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c
+index c81faea96fba..c7c600c1f63b 100644
+--- a/drivers/media/v4l2-core/v4l2-dv-timings.c
++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c
+@@ -837,9 +837,9 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ switch (avi->colorimetry) {
+ case HDMI_COLORIMETRY_EXTENDED:
+ switch (avi->extended_colorimetry) {
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+@@ -908,10 +908,10 @@ v4l2_hdmi_rx_colorimetry(const struct hdmi_avi_infoframe *avi,
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+ c.xfer_func = V4L2_XFER_FUNC_SRGB;
+ break;
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- c.colorspace = V4L2_COLORSPACE_ADOBERGB;
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ c.colorspace = V4L2_COLORSPACE_OPRGB;
+ c.ycbcr_enc = V4L2_YCBCR_ENC_601;
+- c.xfer_func = V4L2_XFER_FUNC_ADOBERGB;
++ c.xfer_func = V4L2_XFER_FUNC_OPRGB;
+ break;
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+ c.colorspace = V4L2_COLORSPACE_BT2020;
+diff --git a/drivers/mfd/menelaus.c b/drivers/mfd/menelaus.c
+index 29b7164a823b..d28ebe7ecd21 100644
+--- a/drivers/mfd/menelaus.c
++++ b/drivers/mfd/menelaus.c
+@@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(struct menelaus_chip *m)
+ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ {
+ int alarm = (m->client->irq > 0);
++ int err;
+
+ /* assume 32KDETEN pin is pulled high */
+ if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) {
+@@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ return;
+ }
+
++ m->rtc = devm_rtc_allocate_device(&m->client->dev);
++ if (IS_ERR(m->rtc))
++ return;
++
++ m->rtc->ops = &menelaus_rtc_ops;
++
+ /* support RTC alarm; it can issue wakeups */
+ if (alarm) {
+ if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ,
+@@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(struct menelaus_chip *m)
+ menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control);
+ }
+
+- m->rtc = rtc_device_register(DRIVER_NAME,
+- &m->client->dev,
+- &menelaus_rtc_ops, THIS_MODULE);
+- if (IS_ERR(m->rtc)) {
++ err = rtc_register_device(m->rtc);
++ if (err) {
+ if (alarm) {
+ menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ);
+ device_init_wakeup(&m->client->dev, 0);
+diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h
+index 1c3967f10f55..1f94fb436c3c 100644
+--- a/drivers/misc/genwqe/card_base.h
++++ b/drivers/misc/genwqe/card_base.h
+@@ -408,7 +408,7 @@ struct genwqe_file {
+ struct file *filp;
+
+ struct fasync_struct *async_queue;
+- struct task_struct *owner;
++ struct pid *opener;
+ struct list_head list; /* entry in list of open files */
+
+ spinlock_t map_lock; /* lock for dma_mappings */
+diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
+index 0dd6b5ef314a..66f222f24da3 100644
+--- a/drivers/misc/genwqe/card_dev.c
++++ b/drivers/misc/genwqe/card_dev.c
+@@ -52,7 +52,7 @@ static void genwqe_add_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ {
+ unsigned long flags;
+
+- cfile->owner = current;
++ cfile->opener = get_pid(task_tgid(current));
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_add(&cfile->list, &cd->file_list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -65,6 +65,7 @@ static int genwqe_del_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_del(&cfile->list);
+ spin_unlock_irqrestore(&cd->file_lock, flags);
++ put_pid(cfile->opener);
+
+ return 0;
+ }
+@@ -275,7 +276,7 @@ static int genwqe_kill_fasync(struct genwqe_dev *cd, int sig)
+ return files;
+ }
+
+-static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
++static int genwqe_terminate(struct genwqe_dev *cd)
+ {
+ unsigned int files = 0;
+ unsigned long flags;
+@@ -283,7 +284,7 @@ static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
+
+ spin_lock_irqsave(&cd->file_lock, flags);
+ list_for_each_entry(cfile, &cd->file_list, list) {
+- force_sig(sig, cfile->owner);
++ kill_pid(cfile->opener, SIGKILL, 1);
+ files++;
+ }
+ spin_unlock_irqrestore(&cd->file_lock, flags);
+@@ -1357,7 +1358,7 @@ static int genwqe_inform_and_stop_processes(struct genwqe_dev *cd)
+ dev_warn(&pci_dev->dev,
+ "[%s] send SIGKILL and wait ...\n", __func__);
+
+- rc = genwqe_force_sig(cd, SIGKILL); /* force terminate */
++ rc = genwqe_terminate(cd);
+ if (rc) {
+ /* Give kill_timout more seconds to end processes */
+ for (i = 0; (i < GENWQE_KILL_TIMEOUT) &&
+diff --git a/drivers/misc/ocxl/config.c b/drivers/misc/ocxl/config.c
+index 2e30de9c694a..57a6bb1fd3c9 100644
+--- a/drivers/misc/ocxl/config.c
++++ b/drivers/misc/ocxl/config.c
+@@ -280,7 +280,9 @@ int ocxl_config_check_afu_index(struct pci_dev *dev,
+ u32 val;
+ int rc, templ_major, templ_minor, len;
+
+- pci_write_config_word(dev, fn->dvsec_afu_info_pos, afu_idx);
++ pci_write_config_byte(dev,
++ fn->dvsec_afu_info_pos + OCXL_DVSEC_AFU_INFO_AFU_IDX,
++ afu_idx);
+ rc = read_afu_info(dev, fn, OCXL_DVSEC_TEMPL_VERSION, &val);
+ if (rc)
+ return rc;
+diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
+index d7eaf1eb11e7..003bfba40758 100644
+--- a/drivers/misc/vmw_vmci/vmci_driver.c
++++ b/drivers/misc/vmw_vmci/vmci_driver.c
+@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
+
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
+-MODULE_VERSION("1.1.5.0-k");
++MODULE_VERSION("1.1.6.0-k");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c
+index 1ab6e8737a5f..da1ee2e1ba99 100644
+--- a/drivers/misc/vmw_vmci/vmci_resource.c
++++ b/drivers/misc/vmw_vmci/vmci_resource.c
+@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resource_lookup(struct vmci_handle handle,
+
+ if (r->type == type &&
+ rid == handle.resource &&
+- (cid == handle.context || cid == VMCI_INVALID_ID)) {
++ (cid == handle.context || cid == VMCI_INVALID_ID ||
++ handle.context == VMCI_INVALID_ID)) {
+ resource = r;
+ break;
+ }
+diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
+index 32321bd596d8..c61109f7b793 100644
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -76,6 +76,7 @@ struct sdhci_acpi_slot {
+ size_t priv_size;
+ int (*probe_slot)(struct platform_device *, const char *, const char *);
+ int (*remove_slot)(struct platform_device *);
++ int (*free_slot)(struct platform_device *pdev);
+ int (*setup_host)(struct platform_device *pdev);
+ };
+
+@@ -756,6 +757,9 @@ static int sdhci_acpi_probe(struct platform_device *pdev)
+ err_cleanup:
+ sdhci_cleanup_host(c->host);
+ err_free:
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+ return err;
+ }
+@@ -777,6 +781,10 @@ static int sdhci_acpi_remove(struct platform_device *pdev)
+
+ dead = (sdhci_readl(c->host, SDHCI_INT_STATUS) == ~0);
+ sdhci_remove_host(c->host, dead);
++
++ if (c->slot && c->slot->free_slot)
++ c->slot->free_slot(pdev);
++
+ sdhci_free_host(c->host);
+
+ return 0;
+diff --git a/drivers/mmc/host/sdhci-pci-o2micro.c b/drivers/mmc/host/sdhci-pci-o2micro.c
+index 555970a29c94..34326d95d254 100644
+--- a/drivers/mmc/host/sdhci-pci-o2micro.c
++++ b/drivers/mmc/host/sdhci-pci-o2micro.c
+@@ -367,6 +367,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_chip *chip)
+ pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch);
+ break;
+ case PCI_DEVICE_ID_O2_SEABIRD0:
++ if (chip->pdev->revision == 0x01)
++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER;
++ /* fall through */
+ case PCI_DEVICE_ID_O2_SEABIRD1:
+ /* UnLock WP */
+ ret = pci_read_config_byte(chip->pdev,
+diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c
+index e686fe73159e..a1fd6f6f5414 100644
+--- a/drivers/mtd/nand/raw/atmel/nand-controller.c
++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c
+@@ -2081,6 +2081,10 @@ atmel_hsmc_nand_controller_legacy_init(struct atmel_hsmc_nand_controller *nc)
+ nand_np = dev->of_node;
+ nfc_np = of_find_compatible_node(dev->of_node, NULL,
+ "atmel,sama5d3-nfc");
++ if (!nfc_np) {
++ dev_err(dev, "Could not find device node for sama5d3-nfc\n");
++ return -ENODEV;
++ }
+
+ nc->clk = of_clk_get(nfc_np, 0);
+ if (IS_ERR(nc->clk)) {
+diff --git a/drivers/mtd/nand/raw/denali.c b/drivers/mtd/nand/raw/denali.c
+index c502075e5721..ff955f085351 100644
+--- a/drivers/mtd/nand/raw/denali.c
++++ b/drivers/mtd/nand/raw/denali.c
+@@ -28,6 +28,7 @@
+ MODULE_LICENSE("GPL");
+
+ #define DENALI_NAND_NAME "denali-nand"
++#define DENALI_DEFAULT_OOB_SKIP_BYTES 8
+
+ /* for Indexed Addressing */
+ #define DENALI_INDEXED_CTRL 0x00
+@@ -1106,12 +1107,17 @@ static void denali_hw_init(struct denali_nand_info *denali)
+ denali->revision = swab16(ioread32(denali->reg + REVISION));
+
+ /*
+- * tell driver how many bit controller will skip before
+- * writing ECC code in OOB, this register may be already
+- * set by firmware. So we read this value out.
+- * if this value is 0, just let it be.
++ * Set how many bytes should be skipped before writing data in OOB.
++ * If a non-zero value has already been set (by firmware or something),
++ * just use it. Otherwise, set the driver default.
+ */
+ denali->oob_skip_bytes = ioread32(denali->reg + SPARE_AREA_SKIP_BYTES);
++ if (!denali->oob_skip_bytes) {
++ denali->oob_skip_bytes = DENALI_DEFAULT_OOB_SKIP_BYTES;
++ iowrite32(denali->oob_skip_bytes,
++ denali->reg + SPARE_AREA_SKIP_BYTES);
++ }
++
+ denali_detect_max_banks(denali);
+ iowrite32(0x0F, denali->reg + RB_PIN_ENABLED);
+ iowrite32(CHIP_EN_DONT_CARE__FLAG, denali->reg + CHIP_ENABLE_DONT_CARE);
+diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
+index c88588815ca1..a3477cbf6115 100644
+--- a/drivers/mtd/nand/raw/marvell_nand.c
++++ b/drivers/mtd/nand/raw/marvell_nand.c
+@@ -691,7 +691,7 @@ static irqreturn_t marvell_nfc_isr(int irq, void *dev_id)
+
+ marvell_nfc_disable_int(nfc, st & NDCR_ALL_INT);
+
+- if (!(st & (NDSR_RDDREQ | NDSR_WRDREQ | NDSR_WRCMDREQ)))
++ if (st & (NDSR_RDY(0) | NDSR_RDY(1)))
+ complete(&nfc->complete);
+
+ return IRQ_HANDLED;
+diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
+index 7d9620c7ff6c..1ff3430f82c8 100644
+--- a/drivers/mtd/spi-nor/fsl-quadspi.c
++++ b/drivers/mtd/spi-nor/fsl-quadspi.c
+@@ -478,6 +478,7 @@ static int fsl_qspi_get_seqid(struct fsl_qspi *q, u8 cmd)
+ {
+ switch (cmd) {
+ case SPINOR_OP_READ_1_1_4:
++ case SPINOR_OP_READ_1_1_4_4B:
+ return SEQID_READ;
+ case SPINOR_OP_WREN:
+ return SEQID_WREN;
+@@ -543,6 +544,9 @@ fsl_qspi_runcmd(struct fsl_qspi *q, u8 cmd, unsigned int addr, int len)
+
+ /* trigger the LUT now */
+ seqid = fsl_qspi_get_seqid(q, cmd);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, (seqid << QUADSPI_IPCR_SEQID_SHIFT) | len,
+ base + QUADSPI_IPCR);
+
+@@ -671,7 +675,7 @@ static void fsl_qspi_set_map_addr(struct fsl_qspi *q)
+ * causes the controller to clear the buffer, and use the sequence pointed
+ * by the QUADSPI_BFGENCR[SEQID] to initiate a read from the flash.
+ */
+-static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
++static int fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+ {
+ void __iomem *base = q->iobase;
+ int seqid;
+@@ -696,8 +700,13 @@ static void fsl_qspi_init_ahb_read(struct fsl_qspi *q)
+
+ /* Set the default lut sequence for AHB Read. */
+ seqid = fsl_qspi_get_seqid(q, q->nor[0].read_opcode);
++ if (seqid < 0)
++ return seqid;
++
+ qspi_writel(q, seqid << QUADSPI_BFGENCR_SEQID_SHIFT,
+ q->iobase + QUADSPI_BFGENCR);
++
++ return 0;
+ }
+
+ /* This function was used to prepare and enable QSPI clock */
+@@ -805,9 +814,7 @@ static int fsl_qspi_nor_setup_last(struct fsl_qspi *q)
+ fsl_qspi_init_lut(q);
+
+ /* Init for AHB read */
+- fsl_qspi_init_ahb_read(q);
+-
+- return 0;
++ return fsl_qspi_init_ahb_read(q);
+ }
+
+ static const struct of_device_id fsl_qspi_dt_ids[] = {
+diff --git a/drivers/mtd/spi-nor/intel-spi-pci.c b/drivers/mtd/spi-nor/intel-spi-pci.c
+index c0976f2e3dd1..872b40922608 100644
+--- a/drivers/mtd/spi-nor/intel-spi-pci.c
++++ b/drivers/mtd/spi-nor/intel-spi-pci.c
+@@ -65,6 +65,7 @@ static void intel_spi_pci_remove(struct pci_dev *pdev)
+ static const struct pci_device_id intel_spi_pci_ids[] = {
+ { PCI_VDEVICE(INTEL, 0x18e0), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0x19e0), (unsigned long)&bxt_info },
++ { PCI_VDEVICE(INTEL, 0x34a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa1a4), (unsigned long)&bxt_info },
+ { PCI_VDEVICE(INTEL, 0xa224), (unsigned long)&bxt_info },
+ { },
+diff --git a/drivers/net/dsa/mv88e6xxx/phy.c b/drivers/net/dsa/mv88e6xxx/phy.c
+index 46af8052e535..152a65d46e0b 100644
+--- a/drivers/net/dsa/mv88e6xxx/phy.c
++++ b/drivers/net/dsa/mv88e6xxx/phy.c
+@@ -110,6 +110,9 @@ int mv88e6xxx_phy_page_write(struct mv88e6xxx_chip *chip, int phy,
+ err = mv88e6xxx_phy_page_get(chip, phy, page);
+ if (!err) {
+ err = mv88e6xxx_phy_write(chip, phy, MV88E6XXX_PHY_PAGE, page);
++ if (!err)
++ err = mv88e6xxx_phy_write(chip, phy, reg, val);
++
+ mv88e6xxx_phy_page_put(chip, phy);
+ }
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index 34af5f1569c8..de0e24d912fe 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -342,7 +342,7 @@ static struct device_node *bcmgenet_mii_of_find_mdio(struct bcmgenet_priv *priv)
+ if (!compat)
+ return NULL;
+
+- priv->mdio_dn = of_find_compatible_node(dn, NULL, compat);
++ priv->mdio_dn = of_get_compatible_child(dn, compat);
+ kfree(compat);
+ if (!priv->mdio_dn) {
+ dev_err(kdev, "unable to find MDIO bus node\n");
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 9d69621f5ab4..542f16074dc9 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1907,6 +1907,7 @@ static int is_valid_clean_head(struct hns3_enet_ring *ring, int h)
+ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ {
+ struct net_device *netdev = ring->tqp->handle->kinfo.netdev;
++ struct hns3_nic_priv *priv = netdev_priv(netdev);
+ struct netdev_queue *dev_queue;
+ int bytes, pkts;
+ int head;
+@@ -1953,7 +1954,8 @@ bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget)
+ * sees the new next_to_clean.
+ */
+ smp_mb();
+- if (netif_tx_queue_stopped(dev_queue)) {
++ if (netif_tx_queue_stopped(dev_queue) &&
++ !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) {
+ netif_tx_wake_queue(dev_queue);
+ ring->stats.restart_queue++;
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+index 11620e003a8e..967a625c040d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+@@ -310,7 +310,7 @@ static void hns3_self_test(struct net_device *ndev,
+ h->flags & HNAE3_SUPPORT_MAC_LOOPBACK;
+
+ if (if_running)
+- dev_close(ndev);
++ ndev->netdev_ops->ndo_stop(ndev);
+
+ #if IS_ENABLED(CONFIG_VLAN_8021Q)
+ /* Disable the vlan filter for selftest does not support it */
+@@ -348,7 +348,7 @@ static void hns3_self_test(struct net_device *ndev,
+ #endif
+
+ if (if_running)
+- dev_open(ndev);
++ ndev->netdev_ops->ndo_open(ndev);
+ }
+
+ static int hns3_get_sset_count(struct net_device *netdev, int stringset)
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index 955f0e3d5c95..b4c0597a392d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -79,6 +79,7 @@ static int hclge_ieee_getets(struct hnae3_handle *h, struct ieee_ets *ets)
+ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ u8 *tc, bool *changed)
+ {
++ bool has_ets_tc = false;
+ u32 total_ets_bw = 0;
+ u8 max_tc = 0;
+ u8 i;
+@@ -106,13 +107,14 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,
+ *changed = true;
+
+ total_ets_bw += ets->tc_tx_bw[i];
+- break;
++ has_ets_tc = true;
++ break;
+ default:
+ return -EINVAL;
+ }
+ }
+
+- if (total_ets_bw != BW_PERCENT)
++ if (has_ets_tc && total_ets_bw != BW_PERCENT)
+ return -EINVAL;
+
+ *tc = max_tc + 1;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+index 13f43b74fd6d..9f2bea64c522 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c
+@@ -1669,11 +1669,13 @@ static int hclge_tx_buffer_calc(struct hclge_dev *hdev,
+ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ struct hclge_pkt_buf_alloc *buf_alloc)
+ {
+- u32 rx_all = hdev->pkt_buf_size;
++#define HCLGE_BUF_SIZE_UNIT 128
++ u32 rx_all = hdev->pkt_buf_size, aligned_mps;
+ int no_pfc_priv_num, pfc_priv_num;
+ struct hclge_priv_buf *priv;
+ int i;
+
++ aligned_mps = round_up(hdev->mps, HCLGE_BUF_SIZE_UNIT);
+ rx_all -= hclge_get_tx_buff_alloced(buf_alloc);
+
+ /* When DCB is not supported, rx private
+@@ -1692,13 +1694,13 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+ if (hdev->hw_tc_map & BIT(i)) {
+ priv->enable = 1;
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+- priv->wl.low = hdev->mps;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.low = aligned_mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high +
+ HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = 2 * hdev->mps;
++ priv->wl.high = 2 * aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ } else {
+@@ -1730,11 +1732,11 @@ static int hclge_rx_buffer_calc(struct hclge_dev *hdev,
+
+ if (hdev->tm_info.hw_pfc_map & BIT(i)) {
+ priv->wl.low = 128;
+- priv->wl.high = priv->wl.low + hdev->mps;
++ priv->wl.high = priv->wl.low + aligned_mps;
+ priv->buf_size = priv->wl.high + HCLGE_DEFAULT_DV;
+ } else {
+ priv->wl.low = 0;
+- priv->wl.high = hdev->mps;
++ priv->wl.high = aligned_mps;
+ priv->buf_size = priv->wl.high;
+ }
+ }
+@@ -2396,6 +2398,9 @@ static int hclge_get_mac_phy_link(struct hclge_dev *hdev)
+ int mac_state;
+ int link_stat;
+
++ if (test_bit(HCLGE_STATE_DOWN, &hdev->state))
++ return 0;
++
+ mac_state = hclge_get_mac_link_status(hdev);
+
+ if (hdev->hw.mac.phydev) {
+@@ -3789,6 +3794,8 @@ static void hclge_ae_stop(struct hnae3_handle *handle)
+ struct hclge_dev *hdev = vport->back;
+ int i;
+
++ set_bit(HCLGE_STATE_DOWN, &hdev->state);
++
+ del_timer_sync(&hdev->service_timer);
+ cancel_work_sync(&hdev->service_task);
+ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state);
+@@ -4679,9 +4686,17 @@ static int hclge_set_vf_vlan_common(struct hclge_dev *hdev, int vfid,
+ "Add vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+ } else {
++#define HCLGE_VF_VLAN_DEL_NO_FOUND 1
+ if (!req0->resp_code)
+ return 0;
+
++ if (req0->resp_code == HCLGE_VF_VLAN_DEL_NO_FOUND) {
++ dev_warn(&hdev->pdev->dev,
++ "vlan %d filter is not in vf vlan table\n",
++ vlan);
++ return 0;
++ }
++
+ dev_err(&hdev->pdev->dev,
+ "Kill vf vlan filter fail, ret =%d.\n",
+ req0->resp_code);
+@@ -4725,6 +4740,9 @@ static int hclge_set_vlan_filter_hw(struct hclge_dev *hdev, __be16 proto,
+ u16 vport_idx, vport_num = 0;
+ int ret;
+
++ if (is_kill && !vlan_id)
++ return 0;
++
+ ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id,
+ 0, proto);
+ if (ret) {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index 12aa1f1b99ef..6090a7cd83e1 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -299,6 +299,9 @@ void hclgevf_update_link_status(struct hclgevf_dev *hdev, int link_state)
+
+ client = handle->client;
+
++ link_state =
++ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state;
++
+ if (link_state != hdev->hw.mac.link) {
+ client->ops->link_status_change(handle, !!link_state);
+ hdev->hw.mac.link = link_state;
+@@ -1439,6 +1442,8 @@ static void hclgevf_ae_stop(struct hnae3_handle *handle)
+ struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle);
+ int i, queue_id;
+
++ set_bit(HCLGEVF_STATE_DOWN, &hdev->state);
++
+ for (i = 0; i < hdev->num_tqps; i++) {
+ /* Ring disable */
+ queue_id = hclgevf_get_queue_id(handle->kinfo.tqp[i]);
+diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h
+index ed071ea75f20..ce12824a8325 100644
+--- a/drivers/net/ethernet/intel/ice/ice.h
++++ b/drivers/net/ethernet/intel/ice/ice.h
+@@ -39,9 +39,9 @@
+ extern const char ice_drv_ver[];
+ #define ICE_BAR0 0
+ #define ICE_DFLT_NUM_DESC 128
+-#define ICE_MIN_NUM_DESC 8
+-#define ICE_MAX_NUM_DESC 8160
+ #define ICE_REQ_DESC_MULTIPLE 32
++#define ICE_MIN_NUM_DESC ICE_REQ_DESC_MULTIPLE
++#define ICE_MAX_NUM_DESC 8160
+ #define ICE_DFLT_TRAFFIC_CLASS BIT(0)
+ #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16)
+ #define ICE_ETHTOOL_FWVER_LEN 32
+diff --git a/drivers/net/ethernet/intel/ice/ice_controlq.c b/drivers/net/ethernet/intel/ice/ice_controlq.c
+index 62be72fdc8f3..e783976c401d 100644
+--- a/drivers/net/ethernet/intel/ice/ice_controlq.c
++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c
+@@ -518,22 +518,31 @@ shutdown_sq_out:
+
+ /**
+ * ice_aq_ver_check - Check the reported AQ API version.
+- * @fw_branch: The "branch" of FW, typically describes the device type
+- * @fw_major: The major version of the FW API
+- * @fw_minor: The minor version increment of the FW API
++ * @hw: pointer to the hardware structure
+ *
+ * Checks if the driver should load on a given AQ API version.
+ *
+ * Return: 'true' iff the driver should attempt to load. 'false' otherwise.
+ */
+-static bool ice_aq_ver_check(u8 fw_branch, u8 fw_major, u8 fw_minor)
++static bool ice_aq_ver_check(struct ice_hw *hw)
+ {
+- if (fw_branch != EXP_FW_API_VER_BRANCH)
+- return false;
+- if (fw_major != EXP_FW_API_VER_MAJOR)
+- return false;
+- if (fw_minor != EXP_FW_API_VER_MINOR)
++ if (hw->api_maj_ver > EXP_FW_API_VER_MAJOR) {
++ /* Major API version is newer than expected, don't load */
++ dev_warn(ice_hw_to_dev(hw),
++ "The driver for the device stopped because the NVM image is newer than expected. You must install the most recent version of the network driver.\n");
+ return false;
++ } else if (hw->api_maj_ver == EXP_FW_API_VER_MAJOR) {
++ if (hw->api_min_ver > (EXP_FW_API_VER_MINOR + 2))
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected a newer version of the NVM image than expected. Please install the most recent version of the network driver.\n");
++ else if ((hw->api_min_ver + 2) < EXP_FW_API_VER_MINOR)
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ } else {
++ /* Major API version is older than expected, log a warning */
++ dev_info(ice_hw_to_dev(hw),
++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n");
++ }
+ return true;
+ }
+
+@@ -588,8 +597,7 @@ static enum ice_status ice_init_check_adminq(struct ice_hw *hw)
+ if (status)
+ goto init_ctrlq_free_rq;
+
+- if (!ice_aq_ver_check(hw->api_branch, hw->api_maj_ver,
+- hw->api_min_ver)) {
++ if (!ice_aq_ver_check(hw)) {
+ status = ICE_ERR_FW_API_VER;
+ goto init_ctrlq_free_rq;
+ }
+diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+index c71a9b528d6d..9d6754f65a1a 100644
+--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
+@@ -478,9 +478,11 @@ ice_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_max_pending = ICE_MAX_NUM_DESC;
+ ring->rx_pending = vsi->rx_rings[0]->count;
+ ring->tx_pending = vsi->tx_rings[0]->count;
+- ring->rx_mini_pending = ICE_MIN_NUM_DESC;
++
++ /* Rx mini and jumbo rings are not supported */
+ ring->rx_mini_max_pending = 0;
+ ring->rx_jumbo_max_pending = 0;
++ ring->rx_mini_pending = 0;
+ ring->rx_jumbo_pending = 0;
+ }
+
+@@ -498,14 +500,23 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring)
+ ring->tx_pending < ICE_MIN_NUM_DESC ||
+ ring->rx_pending > ICE_MAX_NUM_DESC ||
+ ring->rx_pending < ICE_MIN_NUM_DESC) {
+- netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n",
++ netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d] (increment %d)\n",
+ ring->tx_pending, ring->rx_pending,
+- ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC);
++ ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC,
++ ICE_REQ_DESC_MULTIPLE);
+ return -EINVAL;
+ }
+
+ new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_tx_cnt != ring->tx_pending)
++ netdev_info(netdev,
++ "Requested Tx descriptor count rounded up to %d\n",
++ new_tx_cnt);
+ new_rx_cnt = ALIGN(ring->rx_pending, ICE_REQ_DESC_MULTIPLE);
++ if (new_rx_cnt != ring->rx_pending)
++ netdev_info(netdev,
++ "Requested Rx descriptor count rounded up to %d\n",
++ new_rx_cnt);
+
+ /* if nothing to do return success */
+ if (new_tx_cnt == vsi->tx_rings[0]->count &&
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+index da4322e4daed..add124e0381d 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -676,6 +676,9 @@ static int ixgbe_ipsec_add_sa(struct xfrm_state *xs)
+ } else {
+ struct tx_sa tsa;
+
++ if (adapter->num_vfs)
++ return -EOPNOTSUPP;
++
+ /* find the first unused index */
+ ret = ixgbe_ipsec_find_empty_idx(ipsec, false);
+ if (ret < 0) {
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 59416eddd840..ce28d474b929 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -3849,6 +3849,10 @@ static void ixgbevf_tx_csum(struct ixgbevf_ring *tx_ring,
+ skb_checksum_help(skb);
+ goto no_csum;
+ }
++
++ if (first->protocol == htons(ETH_P_IP))
++ type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4;
++
+ /* update TX checksum flag */
+ first->tx_flags |= IXGBE_TX_FLAGS_CSUM;
+ vlan_macip_lens = skb_checksum_start_offset(skb) -
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/action.c b/drivers/net/ethernet/netronome/nfp/flower/action.c
+index 4a6d2db75071..417fbcc64f00 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/action.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/action.c
+@@ -314,12 +314,14 @@ nfp_fl_set_ip4(const struct tc_action *action, int idx, u32 off,
+
+ switch (off) {
+ case offsetof(struct iphdr, daddr):
+- set_ip_addr->ipv4_dst_mask = mask;
+- set_ip_addr->ipv4_dst = exact;
++ set_ip_addr->ipv4_dst_mask |= mask;
++ set_ip_addr->ipv4_dst &= ~mask;
++ set_ip_addr->ipv4_dst |= exact & mask;
+ break;
+ case offsetof(struct iphdr, saddr):
+- set_ip_addr->ipv4_src_mask = mask;
+- set_ip_addr->ipv4_src = exact;
++ set_ip_addr->ipv4_src_mask |= mask;
++ set_ip_addr->ipv4_src &= ~mask;
++ set_ip_addr->ipv4_src |= exact & mask;
+ break;
+ default:
+ return -EOPNOTSUPP;
+@@ -333,11 +335,12 @@ nfp_fl_set_ip4(const struct tc_action *action, int idx, u32 off,
+ }
+
+ static void
+-nfp_fl_set_ip6_helper(int opcode_tag, int idx, __be32 exact, __be32 mask,
++nfp_fl_set_ip6_helper(int opcode_tag, u8 word, __be32 exact, __be32 mask,
+ struct nfp_fl_set_ipv6_addr *ip6)
+ {
+- ip6->ipv6[idx % 4].mask = mask;
+- ip6->ipv6[idx % 4].exact = exact;
++ ip6->ipv6[word].mask |= mask;
++ ip6->ipv6[word].exact &= ~mask;
++ ip6->ipv6[word].exact |= exact & mask;
+
+ ip6->reserved = cpu_to_be16(0);
+ ip6->head.jump_id = opcode_tag;
+@@ -350,6 +353,7 @@ nfp_fl_set_ip6(const struct tc_action *action, int idx, u32 off,
+ struct nfp_fl_set_ipv6_addr *ip_src)
+ {
+ __be32 exact, mask;
++ u8 word;
+
+ /* We are expecting tcf_pedit to return a big endian value */
+ mask = (__force __be32)~tcf_pedit_mask(action, idx);
+@@ -358,17 +362,20 @@ nfp_fl_set_ip6(const struct tc_action *action, int idx, u32 off,
+ if (exact & ~mask)
+ return -EOPNOTSUPP;
+
+- if (off < offsetof(struct ipv6hdr, saddr))
++ if (off < offsetof(struct ipv6hdr, saddr)) {
+ return -EOPNOTSUPP;
+- else if (off < offsetof(struct ipv6hdr, daddr))
+- nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, idx,
++ } else if (off < offsetof(struct ipv6hdr, daddr)) {
++ word = (off - offsetof(struct ipv6hdr, saddr)) / sizeof(exact);
++ nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_SRC, word,
+ exact, mask, ip_src);
+- else if (off < offsetof(struct ipv6hdr, daddr) +
+- sizeof(struct in6_addr))
+- nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, idx,
++ } else if (off < offsetof(struct ipv6hdr, daddr) +
++ sizeof(struct in6_addr)) {
++ word = (off - offsetof(struct ipv6hdr, daddr)) / sizeof(exact);
++ nfp_fl_set_ip6_helper(NFP_FL_ACTION_OPCODE_SET_IPV6_DST, word,
+ exact, mask, ip_dst);
+- else
++ } else {
+ return -EOPNOTSUPP;
++ }
+
+ return 0;
+ }
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+index db463e20a876..e9a4179e7e48 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c
+@@ -96,6 +96,7 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ if (count < 2)
+@@ -114,8 +115,12 @@ nfp_devlink_port_split(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index,
+- eth_port.port_lanes / count);
++ /* Special case the 100G CXP -> 2x40G split */
++ lanes = eth_port.port_lanes / count;
++ if (eth_port.lanes == 10 && count == 2)
++ lanes = 8 / count;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+@@ -128,6 +133,7 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ {
+ struct nfp_pf *pf = devlink_priv(devlink);
+ struct nfp_eth_table_port eth_port;
++ unsigned int lanes;
+ int ret;
+
+ mutex_lock(&pf->lock);
+@@ -143,7 +149,12 @@ nfp_devlink_port_unsplit(struct devlink *devlink, unsigned int port_index,
+ goto out;
+ }
+
+- ret = nfp_devlink_set_lanes(pf, eth_port.index, eth_port.port_lanes);
++ /* Special case the 100G CXP -> 2x40G unsplit */
++ lanes = eth_port.port_lanes;
++ if (eth_port.port_lanes == 8)
++ lanes = 10;
++
++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes);
+ out:
+ mutex_unlock(&pf->lock);
+
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
+index b48f76182049..10b075bc5959 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -380,8 +380,6 @@ static void fm93c56a_select(struct ql3_adapter *qdev)
+
+ qdev->eeprom_cmd_data = AUBURN_EEPROM_CS_1;
+ ql_write_nvram_reg(qdev, spir, ISP_NVRAM_MASK | qdev->eeprom_cmd_data);
+- ql_write_nvram_reg(qdev, spir,
+- ((ISP_NVRAM_MASK << 16) | qdev->eeprom_cmd_data));
+ }
+
+ /*
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index f18087102d40..41bcbdd355f0 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7539,20 +7539,12 @@ static int rtl_alloc_irq(struct rtl8169_private *tp)
+ {
+ unsigned int flags;
+
+- switch (tp->mac_version) {
+- case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06:
++ if (tp->mac_version <= RTL_GIGA_MAC_VER_06) {
+ RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+ RTL_W8(tp, Config2, RTL_R8(tp, Config2) & ~MSIEnable);
+ RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ flags = PCI_IRQ_LEGACY;
+- break;
+- case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_40:
+- /* This version was reported to have issues with resume
+- * from suspend when using MSI-X
+- */
+- flags = PCI_IRQ_LEGACY | PCI_IRQ_MSI;
+- break;
+- default:
++ } else {
+ flags = PCI_IRQ_ALL_TYPES;
+ }
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index e080d3e7c582..4d7d53fbc0ef 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -945,6 +945,9 @@ static void netsec_uninit_pkt_dring(struct netsec_priv *priv, int id)
+ dring->head = 0;
+ dring->tail = 0;
+ dring->pkt_cnt = 0;
++
++ if (id == NETSEC_RING_TX)
++ netdev_reset_queue(priv->ndev);
+ }
+
+ static void netsec_free_dring(struct netsec_priv *priv, int id)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+index f9a61f90cfbc..0f660af01a4b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+@@ -714,8 +714,9 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ return -ENODEV;
+ }
+
+- mdio_internal = of_find_compatible_node(mdio_mux, NULL,
++ mdio_internal = of_get_compatible_child(mdio_mux,
+ "allwinner,sun8i-h3-mdio-internal");
++ of_node_put(mdio_mux);
+ if (!mdio_internal) {
+ dev_err(priv->device, "Cannot get internal_mdio node\n");
+ return -ENODEV;
+@@ -729,13 +730,20 @@ static int get_ephy_nodes(struct stmmac_priv *priv)
+ gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL);
+ if (IS_ERR(gmac->rst_ephy)) {
+ ret = PTR_ERR(gmac->rst_ephy);
+- if (ret == -EPROBE_DEFER)
++ if (ret == -EPROBE_DEFER) {
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return ret;
++ }
+ continue;
+ }
+ dev_info(priv->device, "Found internal PHY node\n");
++ of_node_put(iphynode);
++ of_node_put(mdio_internal);
+ return 0;
+ }
++
++ of_node_put(mdio_internal);
+ return -ENODEV;
+ }
+
+diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c
+index 4f390fa557e4..8ec02f1a3be8 100644
+--- a/drivers/net/net_failover.c
++++ b/drivers/net/net_failover.c
+@@ -602,6 +602,9 @@ static int net_failover_slave_unregister(struct net_device *slave_dev,
+ primary_dev = rtnl_dereference(nfo_info->primary_dev);
+ standby_dev = rtnl_dereference(nfo_info->standby_dev);
+
++ if (WARN_ON_ONCE(slave_dev != primary_dev && slave_dev != standby_dev))
++ return -ENODEV;
++
+ vlan_vids_del_by_dev(slave_dev, failover_dev);
+ dev_uc_unsync(slave_dev, failover_dev);
+ dev_mc_unsync(slave_dev, failover_dev);
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 5827fccd4f29..44a0770de142 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -907,6 +907,9 @@ void phylink_start(struct phylink *pl)
+ phylink_an_mode_str(pl->link_an_mode),
+ phy_modes(pl->link_config.interface));
+
++ /* Always set the carrier off */
++ netif_carrier_off(pl->netdev);
++
+ /* Apply the link configuration to the MAC when starting. This allows
+ * a fixed-link to start with the correct parameters, and also
+ * ensures that we set the appropriate advertisement for Serdes links.
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 725dd63f8413..546081993ecf 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -2304,6 +2304,8 @@ static void tun_setup(struct net_device *dev)
+ static int tun_validate(struct nlattr *tb[], struct nlattr *data[],
+ struct netlink_ext_ack *extack)
+ {
++ if (!data)
++ return 0;
+ return -EINVAL;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 2319f79b34f0..e6d23b6895bd 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -1869,6 +1869,12 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
+ if (ret)
+ dev_kfree_skb_any(skb);
+
++ if (ret == -EAGAIN) {
++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n",
++ cmd_id);
++ queue_work(ar->workqueue, &ar->restart_work);
++ }
++
+ return ret;
+ }
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+index d8b79cb72b58..e7584b842dce 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw bw)
+ return BRCMU_CHSPEC_D11AC_BW_40;
+ case BRCMU_CHAN_BW_80:
+ return BRCMU_CHSPEC_D11AC_BW_80;
++ case BRCMU_CHAN_BW_160:
++ return BRCMU_CHSPEC_D11AC_BW_160;
+ default:
+ WARN_ON(1);
+ }
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
+ break;
+ }
+ break;
+- case BRCMU_CHSPEC_D11AC_BW_8080:
+ case BRCMU_CHSPEC_D11AC_BW_160:
++ switch (ch->sb) {
++ case BRCMU_CHAN_SB_LLL:
++ ch->control_ch_num -= CH_70MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LLU:
++ ch->control_ch_num -= CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUL:
++ ch->control_ch_num -= CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_LUU:
++ ch->control_ch_num -= CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULL:
++ ch->control_ch_num += CH_10MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_ULU:
++ ch->control_ch_num += CH_30MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUL:
++ ch->control_ch_num += CH_50MHZ_APART;
++ break;
++ case BRCMU_CHAN_SB_UUU:
++ ch->control_ch_num += CH_70MHZ_APART;
++ break;
++ default:
++ WARN_ON_ONCE(1);
++ break;
++ }
++ break;
++ case BRCMU_CHSPEC_D11AC_BW_8080:
+ default:
+ WARN_ON_ONCE(1);
+ break;
+diff --git a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+index 7b9a77981df1..75b2a0438cfa 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB 0x01
+ #define CH_LOWER_SB 0x02
+ #define CH_EWA_VALID 0x04
++#define CH_70MHZ_APART 14
++#define CH_50MHZ_APART 10
+ #define CH_30MHZ_APART 6
+ #define CH_20MHZ_APART 4
+ #define CH_10MHZ_APART 2
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 866c91c923be..dd674dcf1a0a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -669,8 +669,12 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+ enabled = !!(wifi_pkg->package.elements[1].integer.value);
+ n_profiles = wifi_pkg->package.elements[2].integer.value;
+
+- /* in case of BIOS bug */
+- if (n_profiles <= 0) {
++ /*
++ * Check the validity of n_profiles. The EWRD profiles start
++ * from index 1, so the maximum value allowed here is
++ * ACPI_SAR_PROFILES_NUM - 1.
++ */
++ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) {
+ ret = -EINVAL;
+ goto out_free;
+ }
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index a6e072234398..da45dc972889 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1232,12 +1232,15 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
+ iwl_mvm_del_aux_sta(mvm);
+
+ /*
+- * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete()
+- * won't be called in this case).
++ * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the
++ * hw (as restart_complete() won't be called in this case) and mac80211
++ * won't execute the restart.
+ * But make sure to cleanup interfaces that have gone down before/during
+ * HW restart was requested.
+ */
+- if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))
++ if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
++ test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED,
++ &mvm->status))
+ ieee80211_iterate_interfaces(mvm->hw, 0,
+ iwl_mvm_cleanup_iterator, mvm);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 642da10b0b7f..fccb3a4f9d57 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1218,7 +1218,11 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ !(info->flags & IEEE80211_TX_STAT_AMPDU))
+ return;
+
+- rs_rate_from_ucode_rate(tx_resp_hwrate, info->band, &tx_resp_rate);
++ if (rs_rate_from_ucode_rate(tx_resp_hwrate, info->band,
++ &tx_resp_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ #ifdef CONFIG_MAC80211_DEBUGFS
+ /* Disable last tx check if we are debugging with fixed rate but
+@@ -1269,7 +1273,10 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ */
+ table = &lq_sta->lq;
+ lq_hwrate = le32_to_cpu(table->rs_table[0]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band, &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ /* Here we actually compare this rate to the latest LQ command */
+ if (lq_color != LQ_FLAG_COLOR_GET(table->flags)) {
+@@ -1371,8 +1378,12 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ /* Collect data for each rate used during failed TX attempts */
+ for (i = 0; i <= retries; ++i) {
+ lq_hwrate = le32_to_cpu(table->rs_table[i]);
+- rs_rate_from_ucode_rate(lq_hwrate, info->band,
+- &lq_rate);
++ if (rs_rate_from_ucode_rate(lq_hwrate, info->band,
++ &lq_rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
++
+ /*
+ * Only collect stats if retried rate is in the same RS
+ * table as active/search.
+@@ -3241,7 +3252,10 @@ static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,
+ for (i = 0; i < num_rates; i++)
+ lq_cmd->rs_table[i] = ucode_rate_le32;
+
+- rs_rate_from_ucode_rate(ucode_rate, band, &rate);
++ if (rs_rate_from_ucode_rate(ucode_rate, band, &rate)) {
++ WARN_ON_ONCE(1);
++ return;
++ }
+
+ if (is_mimo(&rate))
+ lq_cmd->mimo_delim = num_rates - 1;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index cf2591f2ac23..2d35b70de2ab 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -1385,6 +1385,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ while (!skb_queue_empty(&skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&skbs);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct ieee80211_hdr *hdr = (void *)skb->data;
+ bool flushed = false;
+
+ skb_freed++;
+@@ -1429,11 +1430,11 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
+ info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
+ info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
+- /* W/A FW bug: seq_ctl is wrong when the status isn't success */
+- if (status != TX_STATUS_SUCCESS) {
+- struct ieee80211_hdr *hdr = (void *)skb->data;
++ /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */
++ if (ieee80211_is_back_req(hdr->frame_control))
++ seq_ctl = 0;
++ else if (status != TX_STATUS_SUCCESS)
+ seq_ctl = le16_to_cpu(hdr->seq_ctrl);
+- }
+
+ if (unlikely(!seq_ctl)) {
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index d15f5ba2dc77..cb5631c85d16 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1050,6 +1050,14 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
+ kfree(trans_pcie->rxq);
+ }
+
++static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq,
++ struct iwl_rb_allocator *rba)
++{
++ spin_lock(&rba->lock);
++ list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
++ spin_unlock(&rba->lock);
++}
++
+ /*
+ * iwl_pcie_rx_reuse_rbd - Recycle used RBDs
+ *
+@@ -1081,9 +1089,7 @@ static void iwl_pcie_rx_reuse_rbd(struct iwl_trans *trans,
+ if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) {
+ /* Move the 2 RBDs to the allocator ownership.
+ Allocator has another 6 from pool for the request completion*/
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+
+ atomic_inc(&rba->req_pending);
+ queue_work(rba->alloc_wq, &rba->rx_alloc);
+@@ -1261,10 +1267,18 @@ restart:
+ IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r);
+
+ while (i != r) {
++ struct iwl_rb_allocator *rba = &trans_pcie->rba;
+ struct iwl_rx_mem_buffer *rxb;
+-
+- if (unlikely(rxq->used_count == rxq->queue_size / 2))
++ /* number of RBDs still waiting for page allocation */
++ u32 rb_pending_alloc =
++ atomic_read(&trans_pcie->rba.req_pending) *
++ RX_CLAIM_REQ_ALLOC;
++
++ if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 &&
++ !emergency)) {
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ emergency = true;
++ }
+
+ if (trans->cfg->mq_rx_supported) {
+ /*
+@@ -1307,17 +1321,13 @@ restart:
+ iwl_pcie_rx_allocator_get(trans, rxq);
+
+ if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) {
+- struct iwl_rb_allocator *rba = &trans_pcie->rba;
+-
+ /* Add the remaining empty RBDs for allocator use */
+- spin_lock(&rba->lock);
+- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty);
+- spin_unlock(&rba->lock);
++ iwl_pcie_rx_move_to_allocator(rxq, rba);
+ } else if (emergency) {
+ count++;
+ if (count == 8) {
+ count = 0;
+- if (rxq->used_count < rxq->queue_size / 3)
++ if (rb_pending_alloc < rxq->queue_size / 3)
+ emergency = false;
+
+ rxq->read = i;
+diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c
+index ffea610f67e2..10ba94c2b35b 100644
+--- a/drivers/net/wireless/marvell/libertas/if_usb.c
++++ b/drivers/net/wireless/marvell/libertas/if_usb.c
+@@ -456,8 +456,6 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
+ MRVDRV_ETH_RX_PACKET_BUFFER_SIZE, callbackfn,
+ cardp);
+
+- cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
+-
+ lbs_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
+ if ((ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC))) {
+ lbs_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+index 8985446570bd..190c699d6e3b 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+@@ -725,8 +725,7 @@ __mt76x2_mac_set_beacon(struct mt76x2_dev *dev, u8 bcn_idx, struct sk_buff *skb)
+ if (skb) {
+ ret = mt76_write_beacon(dev, beacon_addr, skb);
+ if (!ret)
+- dev->beacon_data_mask |= BIT(bcn_idx) &
+- dev->beacon_mask;
++ dev->beacon_data_mask |= BIT(bcn_idx);
+ } else {
+ dev->beacon_data_mask &= ~BIT(bcn_idx);
+ for (i = 0; i < beacon_len; i += 4)
+diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
+index 6ce6b754df12..45a1b86491b6 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
+@@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct urb *urb)
+ if (urb->status)
+ goto out;
+
+- if (urb->actual_length <= 0) {
+- rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__);
++ if (urb->actual_length <= 0 ||
++ urb->actual_length > rx_cb->rx_skb->len) {
++ rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n",
++ __func__, urb->actual_length);
+ goto out;
+ }
+ if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) {
+ rsi_dbg(INFO_ZONE, "Max RX packets reached\n");
+ goto out;
+ }
+- skb_put(rx_cb->rx_skb, urb->actual_length);
++ skb_trim(rx_cb->rx_skb, urb->actual_length);
+ skb_queue_tail(&dev->rx_q, rx_cb->rx_skb);
+
+ rsi_set_event(&dev->rx_thread.event);
+@@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ if (!skb)
+ return -ENOMEM;
+ skb_reserve(skb, MAX_DWORD_ALIGN_BYTES);
++ skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES);
+ dword_align_bytes = (unsigned long)skb->data & 0x3f;
+ if (dword_align_bytes > 0)
+ skb_push(skb, dword_align_bytes);
+@@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num)
+ usb_rcvbulkpipe(dev->usbdev,
+ dev->bulkin_endpoint_addr[ep_num - 1]),
+ urb->transfer_buffer,
+- RSI_MAX_RX_USB_PKT_SIZE,
++ skb->len,
+ rsi_rx_done_handler,
+ rx_cb);
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 91162f8e0366..9a22056e8d9e 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,
+ struct device_node *matched_node;
+ int ret;
+
+- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart");
++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart");
+ if (!matched_node) {
+- matched_node = of_find_compatible_node(node, NULL,
+- "mrvl,nfc-uart");
++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart");
+ if (!matched_node)
+ return -ENODEV;
+ }
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 8aae6dcc839f..9148015ed803 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -488,6 +488,8 @@ static void nd_async_device_register(void *d, async_cookie_t cookie)
+ put_device(dev);
+ }
+ put_device(dev);
++ if (dev->parent)
++ put_device(dev->parent);
+ }
+
+ static void nd_async_device_unregister(void *d, async_cookie_t cookie)
+@@ -507,6 +509,8 @@ void __nd_device_register(struct device *dev)
+ if (!dev)
+ return;
+ dev->bus = &nvdimm_bus_type;
++ if (dev->parent)
++ get_device(dev->parent);
+ get_device(dev);
+ async_schedule_domain(nd_async_device_register, dev,
+ &nd_async_domain);
+diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
+index 8b1fd7f1a224..2245cfb8c6ab 100644
+--- a/drivers/nvdimm/pmem.c
++++ b/drivers/nvdimm/pmem.c
+@@ -393,9 +393,11 @@ static int pmem_attach_disk(struct device *dev,
+ addr = devm_memremap_pages(dev, &pmem->pgmap);
+ pmem->pfn_flags |= PFN_MAP;
+ memcpy(&bb_res, &pmem->pgmap.res, sizeof(bb_res));
+- } else
++ } else {
+ addr = devm_memremap(dev, pmem->phys_addr,
+ pmem->size, ARCH_MEMREMAP_PMEM);
++ memcpy(&bb_res, &nsio->res, sizeof(bb_res));
++ }
+
+ /*
+ * At release time the queue must be frozen before
+diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
+index c30d5af02cc2..63cb01ef4ef0 100644
+--- a/drivers/nvdimm/region_devs.c
++++ b/drivers/nvdimm/region_devs.c
+@@ -545,10 +545,17 @@ static ssize_t region_badblocks_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+ struct nd_region *nd_region = to_nd_region(dev);
++ ssize_t rc;
+
+- return badblocks_show(&nd_region->bb, buf, 0);
+-}
++ device_lock(dev);
++ if (dev->driver)
++ rc = badblocks_show(&nd_region->bb, buf, 0);
++ else
++ rc = -ENXIO;
++ device_unlock(dev);
+
++ return rc;
++}
+ static DEVICE_ATTR(badblocks, 0444, region_badblocks_show, NULL);
+
+ static ssize_t resource_show(struct device *dev,
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index bf65501e6ed6..f1f375fb362b 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3119,8 +3119,8 @@ static void nvme_ns_remove(struct nvme_ns *ns)
+ }
+
+ mutex_lock(&ns->ctrl->subsys->lock);
+- nvme_mpath_clear_current_path(ns);
+ list_del_rcu(&ns->siblings);
++ nvme_mpath_clear_current_path(ns);
+ mutex_unlock(&ns->ctrl->subsys->lock);
+
+ down_write(&ns->ctrl->namespaces_rwsem);
+diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
+index 514d1dfc5630..122b52d0ebfd 100644
+--- a/drivers/nvmem/core.c
++++ b/drivers/nvmem/core.c
+@@ -518,11 +518,17 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
+ goto err_device_del;
+ }
+
+- if (config->cells)
+- nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (config->cells) {
++ rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
++ if (rval)
++ goto err_teardown_compat;
++ }
+
+ return nvmem;
+
++err_teardown_compat:
++ if (config->compat)
++ device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
+ err_device_del:
+ device_del(&nvmem->dev);
+ err_put_device:
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 7af0ddec936b..20988c426650 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -425,6 +425,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np)
+ dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+ count, pstate_count);
+ ret = -ENOENT;
++ _dev_pm_opp_remove_table(opp_table, dev, false);
+ goto put_opp_table;
+ }
+
+diff --git a/drivers/pci/controller/dwc/pci-dra7xx.c b/drivers/pci/controller/dwc/pci-dra7xx.c
+index 345aab56ce8b..78ed6cc8d521 100644
+--- a/drivers/pci/controller/dwc/pci-dra7xx.c
++++ b/drivers/pci/controller/dwc/pci-dra7xx.c
+@@ -542,7 +542,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ };
+
+ /*
+- * dra7xx_pcie_ep_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
++ * dra7xx_pcie_unaligned_memaccess: workaround for AM572x/AM571x Errata i870
+ * @dra7xx: the dra7xx device where the workaround should be applied
+ *
+ * Access to the PCIe slave port that are not 32-bit aligned will result
+@@ -552,7 +552,7 @@ static const struct of_device_id of_dra7xx_pcie_match[] = {
+ *
+ * To avoid this issue set PCIE_SS1_AXI2OCP_LEGACY_MODE_ENABLE to 1.
+ */
+-static int dra7xx_pcie_ep_unaligned_memaccess(struct device *dev)
++static int dra7xx_pcie_unaligned_memaccess(struct device *dev)
+ {
+ int ret;
+ struct device_node *np = dev->of_node;
+@@ -704,6 +704,11 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_RC);
++
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
++ if (ret)
++ dev_err(dev, "WA for Errata i870 not applied\n");
++
+ ret = dra7xx_add_pcie_port(dra7xx, pdev);
+ if (ret < 0)
+ goto err_gpio;
+@@ -717,7 +722,7 @@ static int __init dra7xx_pcie_probe(struct platform_device *pdev)
+ dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE,
+ DEVICE_TYPE_EP);
+
+- ret = dra7xx_pcie_ep_unaligned_memaccess(dev);
++ ret = dra7xx_pcie_unaligned_memaccess(dev);
+ if (ret)
+ goto err_gpio;
+
+diff --git a/drivers/pci/controller/pcie-cadence-ep.c b/drivers/pci/controller/pcie-cadence-ep.c
+index e3fe4124e3af..a67dc91261f5 100644
+--- a/drivers/pci/controller/pcie-cadence-ep.c
++++ b/drivers/pci/controller/pcie-cadence-ep.c
+@@ -259,7 +259,6 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ u8 intx, bool is_asserted)
+ {
+ struct cdns_pcie *pcie = &ep->pcie;
+- u32 r = ep->max_regions - 1;
+ u32 offset;
+ u16 status;
+ u8 msg_code;
+@@ -269,8 +268,8 @@ static void cdns_pcie_ep_assert_intx(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, r,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, 0,
+ ep->irq_phys_addr);
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY;
+ ep->irq_pci_fn = fn;
+@@ -348,8 +347,8 @@ static int cdns_pcie_ep_send_msi_irq(struct cdns_pcie_ep *ep, u8 fn,
+ /* Set the outbound region if needed. */
+ if (unlikely(ep->irq_pci_addr != (pci_addr & ~pci_addr_mask) ||
+ ep->irq_pci_fn != fn)) {
+- /* Last region was reserved for IRQ writes. */
+- cdns_pcie_set_outbound_region(pcie, fn, ep->max_regions - 1,
++ /* First region was reserved for IRQ writes. */
++ cdns_pcie_set_outbound_region(pcie, fn, 0,
+ false,
+ ep->irq_phys_addr,
+ pci_addr & ~pci_addr_mask,
+@@ -510,6 +509,8 @@ static int cdns_pcie_ep_probe(struct platform_device *pdev)
+ goto free_epc_mem;
+ }
+ ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE;
++ /* Reserve region 0 for IRQs */
++ set_bit(0, &ep->ob_region_map);
+
+ return 0;
+
+diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
+index 861dda69f366..c5ff6ca65eab 100644
+--- a/drivers/pci/controller/pcie-mediatek.c
++++ b/drivers/pci/controller/pcie-mediatek.c
+@@ -337,6 +337,17 @@ static struct mtk_pcie_port *mtk_pcie_find_port(struct pci_bus *bus,
+ {
+ struct mtk_pcie *pcie = bus->sysdata;
+ struct mtk_pcie_port *port;
++ struct pci_dev *dev = NULL;
++
++ /*
++ * Walk the bus hierarchy to get the devfn value
++ * of the port in the root bus.
++ */
++ while (bus && bus->number) {
++ dev = bus->self;
++ bus = dev->bus;
++ devfn = dev->devfn;
++ }
+
+ list_for_each_entry(port, &pcie->ports, list)
+ if (port->slot == PCI_SLOT(devfn))
+diff --git a/drivers/pci/controller/vmd.c b/drivers/pci/controller/vmd.c
+index 942b64fc7f1f..fd2dbd7eed7b 100644
+--- a/drivers/pci/controller/vmd.c
++++ b/drivers/pci/controller/vmd.c
+@@ -197,9 +197,20 @@ static struct vmd_irq_list *vmd_next_irq(struct vmd_dev *vmd, struct msi_desc *d
+ int i, best = 1;
+ unsigned long flags;
+
+- if (pci_is_bridge(msi_desc_to_pci_dev(desc)) || vmd->msix_count == 1)
++ if (vmd->msix_count == 1)
+ return &vmd->irqs[0];
+
++ /*
++ * White list for fast-interrupt handlers. All others will share the
++ * "slow" interrupt vector.
++ */
++ switch (msi_desc_to_pci_dev(desc)->class) {
++ case PCI_CLASS_STORAGE_EXPRESS:
++ break;
++ default:
++ return &vmd->irqs[0];
++ }
++
+ raw_spin_lock_irqsave(&list_lock, flags);
+ for (i = 1; i < vmd->msix_count; i++)
+ if (vmd->irqs[i].count < vmd->irqs[best].count)
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 4d88afdfc843..f7b7cb7189eb 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -958,7 +958,6 @@ static int __pci_enable_msix(struct pci_dev *dev, struct msix_entry *entries,
+ }
+ }
+ }
+- WARN_ON(!!dev->msix_enabled);
+
+ /* Check whether driver already requested for MSI irq */
+ if (dev->msi_enabled) {
+@@ -1028,8 +1027,6 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (!pci_msi_supported(dev, minvec))
+ return -EINVAL;
+
+- WARN_ON(!!dev->msi_enabled);
+-
+ /* Check whether driver already requested MSI-X irqs */
+ if (dev->msix_enabled) {
+ pci_info(dev, "can't enable MSI (MSI-X already enabled)\n");
+@@ -1039,6 +1036,9 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msi_enabled))
++ return -EINVAL;
++
+ nvec = pci_msi_vec_count(dev);
+ if (nvec < 0)
+ return nvec;
+@@ -1087,6 +1087,9 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
+ if (maxvec < minvec)
+ return -ERANGE;
+
++ if (WARN_ON_ONCE(dev->msix_enabled))
++ return -EINVAL;
++
+ for (;;) {
+ if (affd) {
+ nvec = irq_calc_affinity_vectors(minvec, nvec, affd);
+diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
+index 5d1698265da5..d2b04ab37308 100644
+--- a/drivers/pci/pci-acpi.c
++++ b/drivers/pci/pci-acpi.c
+@@ -779,19 +779,33 @@ static void pci_acpi_setup(struct device *dev)
+ return;
+
+ device_set_wakeup_capable(dev, true);
++ /*
++ * For bridges that can do D3 we enable wake automatically (as
++ * we do for the power management itself in that case). The
++ * reason is that the bridge may have additional methods such as
++ * _DSW that need to be called.
++ */
++ if (pci_dev->bridge_d3)
++ device_wakeup_enable(dev);
++
+ acpi_pci_wakeup(pci_dev, false);
+ }
+
+ static void pci_acpi_cleanup(struct device *dev)
+ {
+ struct acpi_device *adev = ACPI_COMPANION(dev);
++ struct pci_dev *pci_dev = to_pci_dev(dev);
+
+ if (!adev)
+ return;
+
+ pci_acpi_remove_pm_notifier(adev);
+- if (adev->wakeup.flags.valid)
++ if (adev->wakeup.flags.valid) {
++ if (pci_dev->bridge_d3)
++ device_wakeup_disable(dev);
++
+ device_set_wakeup_capable(dev, false);
++ }
+ }
+
+ static bool pci_acpi_bus_match(struct device *dev)
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index c687c817b47d..6322c3f446bc 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -991,7 +991,7 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
+ * All PCIe functions are in one slot, remove one function will remove
+ * the whole slot, so just wait until we are the last function left.
+ */
+- if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
++ if (!list_empty(&parent->subordinate->devices))
+ goto out;
+
+ link = parent->link_state;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index d1e2d175c10b..a4d11d14b196 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3177,7 +3177,11 @@ static void disable_igfx_irq(struct pci_dev *dev)
+
+ pci_iounmap(dev, regs);
+ }
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0042, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0046, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x004a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0106, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+
+diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
+index 5e3d0dced2b8..b08945a7bbfd 100644
+--- a/drivers/pci/remove.c
++++ b/drivers/pci/remove.c
+@@ -26,9 +26,6 @@ static void pci_stop_dev(struct pci_dev *dev)
+
+ pci_dev_assign_added(dev, false);
+ }
+-
+- if (dev->bus->self)
+- pcie_aspm_exit_link_state(dev);
+ }
+
+ static void pci_destroy_dev(struct pci_dev *dev)
+@@ -42,6 +39,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
+ list_del(&dev->bus_list);
+ up_write(&pci_bus_sem);
+
++ pcie_aspm_exit_link_state(dev);
+ pci_bridge_d3_update(dev);
+ pci_free_resources(dev);
+ put_device(&dev->dev);
+diff --git a/drivers/pcmcia/ricoh.h b/drivers/pcmcia/ricoh.h
+index 01098c841f87..8ac7b138c094 100644
+--- a/drivers/pcmcia/ricoh.h
++++ b/drivers/pcmcia/ricoh.h
+@@ -119,6 +119,10 @@
+ #define RL5C4XX_MISC_CONTROL 0x2F /* 8 bit */
+ #define RL5C4XX_ZV_ENABLE 0x08
+
++/* Misc Control 3 Register */
++#define RL5C4XX_MISC3 0x00A2 /* 16 bit */
++#define RL5C47X_MISC3_CB_CLKRUN_DIS BIT(1)
++
+ #ifdef __YENTA_H
+
+ #define rl_misc(socket) ((socket)->private[0])
+@@ -156,6 +160,35 @@ static void ricoh_set_zv(struct yenta_socket *socket)
+ }
+ }
+
++static void ricoh_set_clkrun(struct yenta_socket *socket, bool quiet)
++{
++ u16 misc3;
++
++ /*
++ * RL5C475II likely has this setting, too, however no datasheet
++ * is publicly available for this chip
++ */
++ if (socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C476 &&
++ socket->dev->device != PCI_DEVICE_ID_RICOH_RL5C478)
++ return;
++
++ if (socket->dev->revision < 0x80)
++ return;
++
++ misc3 = config_readw(socket, RL5C4XX_MISC3);
++ if (misc3 & RL5C47X_MISC3_CB_CLKRUN_DIS) {
++ if (!quiet)
++ dev_dbg(&socket->dev->dev,
++ "CLKRUN feature already disabled\n");
++ } else if (disable_clkrun) {
++ if (!quiet)
++ dev_info(&socket->dev->dev,
++ "Disabling CLKRUN feature\n");
++ misc3 |= RL5C47X_MISC3_CB_CLKRUN_DIS;
++ config_writew(socket, RL5C4XX_MISC3, misc3);
++ }
++}
++
+ static void ricoh_save_state(struct yenta_socket *socket)
+ {
+ rl_misc(socket) = config_readw(socket, RL5C4XX_MISC);
+@@ -172,6 +205,7 @@ static void ricoh_restore_state(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_16BIT_IO_0, rl_io(socket));
+ config_writew(socket, RL5C4XX_16BIT_MEM_0, rl_mem(socket));
+ config_writew(socket, RL5C4XX_CONFIG, rl_config(socket));
++ ricoh_set_clkrun(socket, true);
+ }
+
+
+@@ -197,6 +231,7 @@ static int ricoh_override(struct yenta_socket *socket)
+ config_writew(socket, RL5C4XX_CONFIG, config);
+
+ ricoh_set_zv(socket);
++ ricoh_set_clkrun(socket, false);
+
+ return 0;
+ }
+diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
+index ab3da2262f0f..ac6a3f46b1e6 100644
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -26,7 +26,8 @@
+
+ static bool disable_clkrun;
+ module_param(disable_clkrun, bool, 0444);
+-MODULE_PARM_DESC(disable_clkrun, "If PC card doesn't function properly, please try this option");
++MODULE_PARM_DESC(disable_clkrun,
++ "If PC card doesn't function properly, please try this option (TI and Ricoh bridges only)");
+
+ static bool isa_probe = 1;
+ module_param(isa_probe, bool, 0444);
+diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+index 6556dbeae65e..ac251c62bc66 100644
+--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c
+@@ -319,6 +319,8 @@ static int pmic_mpp_set_mux(struct pinctrl_dev *pctldev, unsigned function,
+ pad->function = function;
+
+ ret = pmic_mpp_write_mode_ctl(state, pad);
++ if (ret < 0)
++ return ret;
+
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+@@ -343,13 +345,12 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN;
++ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+ switch (pad->pullup) {
+- case PMIC_MPP_PULL_UP_OPEN:
+- arg = 0;
+- break;
+ case PMIC_MPP_PULL_UP_0P6KOHM:
+ arg = 600;
+ break;
+@@ -364,13 +365,17 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ }
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = !pad->is_enabled;
++ if (pad->is_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_POWER_SOURCE:
+ arg = pad->power_source;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pad->input_enabled;
++ if (!pad->input_enabled)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ arg = pad->out_value;
+@@ -382,7 +387,9 @@ static int pmic_mpp_config_get(struct pinctrl_dev *pctldev,
+ arg = pad->amux_input;
+ break;
+ case PMIC_MPP_CONF_PAIRED:
+- arg = pad->paired;
++ if (!pad->paired)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+ arg = pad->drive_strength;
+@@ -455,7 +462,7 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ pad->dtest = arg;
+ break;
+ case PIN_CONFIG_DRIVE_STRENGTH:
+- arg = pad->drive_strength;
++ pad->drive_strength = arg;
+ break;
+ case PMIC_MPP_CONF_AMUX_ROUTE:
+ if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4)
+@@ -502,6 +509,10 @@ static int pmic_mpp_config_set(struct pinctrl_dev *pctldev, unsigned int pin,
+ if (ret < 0)
+ return ret;
+
++ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength);
++ if (ret < 0)
++ return ret;
++
+ val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT;
+
+ return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val);
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index f53e32a9d8fc..0e153bae322e 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -260,22 +260,32 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+
+ switch (param) {
+ case PIN_CONFIG_BIAS_DISABLE:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_NP;
++ if (pin->bias != PM8XXX_GPIO_BIAS_NP)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_DOWN:
+- arg = pin->bias == PM8XXX_GPIO_BIAS_PD;
++ if (pin->bias != PM8XXX_GPIO_BIAS_PD)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_BIAS_PULL_UP:
+- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30;
++ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PM8XXX_QCOM_PULL_UP_STRENGTH:
+ arg = pin->pull_up_strength;
+ break;
+ case PIN_CONFIG_BIAS_HIGH_IMPEDANCE:
+- arg = pin->disable;
++ if (!pin->disable)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_INPUT_ENABLE:
+- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT;
++ if (pin->mode != PM8XXX_GPIO_MODE_INPUT)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_OUTPUT:
+ if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT)
+@@ -290,10 +300,14 @@ static int pm8xxx_pin_config_get(struct pinctrl_dev *pctldev,
+ arg = pin->output_strength;
+ break;
+ case PIN_CONFIG_DRIVE_PUSH_PULL:
+- arg = !pin->open_drain;
++ if (pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ case PIN_CONFIG_DRIVE_OPEN_DRAIN:
+- arg = pin->open_drain;
++ if (!pin->open_drain)
++ return -EINVAL;
++ arg = 1;
+ break;
+ default:
+ return -EINVAL;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index 4d9bf9b3e9f3..26ebedc1f6d3 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -1079,10 +1079,9 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ * We suppose that we won't have any more functions than pins,
+ * we'll reallocate that later anyway
+ */
+- pctl->functions = devm_kcalloc(&pdev->dev,
+- pctl->ngroups,
+- sizeof(*pctl->functions),
+- GFP_KERNEL);
++ pctl->functions = kcalloc(pctl->ngroups,
++ sizeof(*pctl->functions),
++ GFP_KERNEL);
+ if (!pctl->functions)
+ return -ENOMEM;
+
+@@ -1133,8 +1132,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+
+ func_item = sunxi_pinctrl_find_function_by_name(pctl,
+ func->name);
+- if (!func_item)
++ if (!func_item) {
++ kfree(pctl->functions);
+ return -EINVAL;
++ }
+
+ if (!func_item->groups) {
+ func_item->groups =
+@@ -1142,8 +1143,10 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev)
+ func_item->ngroups,
+ sizeof(*func_item->groups),
+ GFP_KERNEL);
+- if (!func_item->groups)
++ if (!func_item->groups) {
++ kfree(pctl->functions);
+ return -ENOMEM;
++ }
+ }
+
+ func_grp = func_item->groups;
+diff --git a/drivers/power/supply/twl4030_charger.c b/drivers/power/supply/twl4030_charger.c
+index bbcaee56db9d..b6a7d9f74cf3 100644
+--- a/drivers/power/supply/twl4030_charger.c
++++ b/drivers/power/supply/twl4030_charger.c
+@@ -996,12 +996,13 @@ static int twl4030_bci_probe(struct platform_device *pdev)
+ if (bci->dev->of_node) {
+ struct device_node *phynode;
+
+- phynode = of_find_compatible_node(bci->dev->of_node->parent,
+- NULL, "ti,twl4030-usb");
++ phynode = of_get_compatible_child(bci->dev->of_node->parent,
++ "ti,twl4030-usb");
+ if (phynode) {
+ bci->usb_nb.notifier_call = twl4030_bci_usb_ncb;
+ bci->transceiver = devm_usb_get_phy_by_node(
+ bci->dev, phynode, &bci->usb_nb);
++ of_node_put(phynode);
+ if (IS_ERR(bci->transceiver)) {
+ ret = PTR_ERR(bci->transceiver);
+ if (ret == -EPROBE_DEFER)
+diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c
+index 6437bbeebc91..e026a7817013 100644
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -1114,8 +1114,10 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ channel->edge = edge;
+ channel->name = kstrdup(name, GFP_KERNEL);
+- if (!channel->name)
+- return ERR_PTR(-ENOMEM);
++ if (!channel->name) {
++ ret = -ENOMEM;
++ goto free_channel;
++ }
+
+ spin_lock_init(&channel->tx_lock);
+ spin_lock_init(&channel->recv_lock);
+@@ -1165,6 +1167,7 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed
+
+ free_name_and_channel:
+ kfree(channel->name);
++free_channel:
+ kfree(channel);
+
+ return ERR_PTR(ret);
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index cd3a2411bc2f..df0c5776d49b 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -50,6 +50,7 @@
+ /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
+ #include <linux/mc146818rtc.h>
+
++#ifdef CONFIG_ACPI
+ /*
+ * Use ACPI SCI to replace HPET interrupt for RTC Alarm event
+ *
+@@ -61,6 +62,18 @@
+ static bool use_acpi_alarm;
+ module_param(use_acpi_alarm, bool, 0444);
+
++static inline int cmos_use_acpi_alarm(void)
++{
++ return use_acpi_alarm;
++}
++#else /* !CONFIG_ACPI */
++
++static inline int cmos_use_acpi_alarm(void)
++{
++ return 0;
++}
++#endif
++
+ struct cmos_rtc {
+ struct rtc_device *rtc;
+ struct device *dev;
+@@ -167,9 +180,9 @@ static inline int hpet_unregister_irq_handler(irq_handler_t handler)
+ #endif
+
+ /* Don't use HPET for RTC Alarm event if ACPI Fixed event is used */
+-static int use_hpet_alarm(void)
++static inline int use_hpet_alarm(void)
+ {
+- return is_hpet_enabled() && !use_acpi_alarm;
++ return is_hpet_enabled() && !cmos_use_acpi_alarm();
+ }
+
+ /*----------------------------------------------------------------*/
+@@ -340,7 +353,7 @@ static void cmos_irq_enable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_set_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_on)
+ cmos->wake_on(cmos->dev);
+ }
+@@ -358,7 +371,7 @@ static void cmos_irq_disable(struct cmos_rtc *cmos, unsigned char mask)
+ if (use_hpet_alarm())
+ hpet_mask_rtc_irq_bit(mask);
+
+- if ((mask & RTC_AIE) && use_acpi_alarm) {
++ if ((mask & RTC_AIE) && cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(cmos->dev);
+ }
+@@ -980,7 +993,7 @@ static int cmos_suspend(struct device *dev)
+ }
+ spin_unlock_irq(&rtc_lock);
+
+- if ((tmp & RTC_AIE) && !use_acpi_alarm) {
++ if ((tmp & RTC_AIE) && !cmos_use_acpi_alarm()) {
+ cmos->enabled_wake = 1;
+ if (cmos->wake_on)
+ cmos->wake_on(dev);
+@@ -1031,7 +1044,7 @@ static void cmos_check_wkalrm(struct device *dev)
+ * ACPI RTC wake event is cleared after resume from STR,
+ * ACK the rtc irq here
+ */
+- if (t_now >= cmos->alarm_expires && use_acpi_alarm) {
++ if (t_now >= cmos->alarm_expires && cmos_use_acpi_alarm()) {
+ cmos_interrupt(0, (void *)cmos->rtc);
+ return;
+ }
+@@ -1053,7 +1066,7 @@ static int __maybe_unused cmos_resume(struct device *dev)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char tmp;
+
+- if (cmos->enabled_wake && !use_acpi_alarm) {
++ if (cmos->enabled_wake && !cmos_use_acpi_alarm()) {
+ if (cmos->wake_off)
+ cmos->wake_off(dev);
+ else
+@@ -1132,7 +1145,7 @@ static u32 rtc_handler(void *context)
+ * Or else, ACPI SCI is enabled during suspend/resume only,
+ * update rtc irq in that case.
+ */
+- if (use_acpi_alarm)
++ if (cmos_use_acpi_alarm())
+ cmos_interrupt(0, (void *)cmos->rtc);
+ else {
+ /* Fix me: can we use cmos_interrupt() here as well? */
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index e9ec4160d7f6..83fa875b89cd 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -1372,7 +1372,6 @@ static void ds1307_clks_register(struct ds1307 *ds1307)
+ static const struct regmap_config regmap_config = {
+ .reg_bits = 8,
+ .val_bits = 8,
+- .max_register = 0x9,
+ };
+
+ static int ds1307_probe(struct i2c_client *client,
+diff --git a/drivers/scsi/esp_scsi.c b/drivers/scsi/esp_scsi.c
+index c3fc34b9964d..9e5d3f7d29ae 100644
+--- a/drivers/scsi/esp_scsi.c
++++ b/drivers/scsi/esp_scsi.c
+@@ -1338,6 +1338,7 @@ static int esp_data_bytes_sent(struct esp *esp, struct esp_cmd_entry *ent,
+
+ bytes_sent = esp->data_dma_len;
+ bytes_sent -= ecount;
++ bytes_sent -= esp->send_cmd_residual;
+
+ /*
+ * The am53c974 has a DMA 'pecularity'. The doc states:
+diff --git a/drivers/scsi/esp_scsi.h b/drivers/scsi/esp_scsi.h
+index 8163dca2071b..a77772777a30 100644
+--- a/drivers/scsi/esp_scsi.h
++++ b/drivers/scsi/esp_scsi.h
+@@ -540,6 +540,8 @@ struct esp {
+
+ void *dma;
+ int dmarev;
++
++ u32 send_cmd_residual;
+ };
+
+ /* A front-end driver for the ESP chip should do the following in
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index a94fb9f8bb44..3b3af1459008 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -4140,9 +4140,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *pIocbIn,
+ }
+ lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd);
+
+- spin_lock_irqsave(&phba->hbalock, flags);
+- lpfc_cmd->pCmd = NULL;
+- spin_unlock_irqrestore(&phba->hbalock, flags);
++ /* If pCmd was set to NULL from abort path, do not call scsi_done */
++ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) {
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP,
++ "0711 FCP cmd already NULL, sid: 0x%06x, "
++ "did: 0x%06x, oxid: 0x%04x\n",
++ vport->fc_myDID,
++ (pnode) ? pnode->nlp_DID : 0,
++ phba->sli_rev == LPFC_SLI_REV4 ?
++ lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff);
++ return;
++ }
+
+ /* The sdev is not guaranteed to be valid post scsi_done upcall. */
+ cmd->scsi_done(cmd);
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 6f3c00a233ec..4f8d459d2378 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -3790,6 +3790,7 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ struct hbq_dmabuf *dmabuf;
+ struct lpfc_cq_event *cq_event;
+ unsigned long iflag;
++ int count = 0;
+
+ spin_lock_irqsave(&phba->hbalock, iflag);
+ phba->hba_flag &= ~HBA_SP_QUEUE_EVT;
+@@ -3811,16 +3812,22 @@ lpfc_sli_handle_slow_ring_event_s4(struct lpfc_hba *phba,
+ if (irspiocbq)
+ lpfc_sli_sp_handle_rspiocb(phba, pring,
+ irspiocbq);
++ count++;
+ break;
+ case CQE_CODE_RECEIVE:
+ case CQE_CODE_RECEIVE_V1:
+ dmabuf = container_of(cq_event, struct hbq_dmabuf,
+ cq_event);
+ lpfc_sli4_handle_received_buffer(phba, dmabuf);
++ count++;
+ break;
+ default:
+ break;
+ }
++
++ /* Limit the number of events to 64 to avoid soft lockups */
++ if (count == 64)
++ break;
+ }
+ }
+
+diff --git a/drivers/scsi/mac_esp.c b/drivers/scsi/mac_esp.c
+index eb551f3cc471..71879f2207e0 100644
+--- a/drivers/scsi/mac_esp.c
++++ b/drivers/scsi/mac_esp.c
+@@ -427,6 +427,8 @@ static void mac_esp_send_pio_cmd(struct esp *esp, u32 addr, u32 esp_count,
+ scsi_esp_cmd(esp, ESP_CMD_TI);
+ }
+ }
++
++ esp->send_cmd_residual = esp_count;
+ }
+
+ static int mac_esp_irq_pending(struct esp *esp)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 8e84e3fb648a..2d6f6414a2a2 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -7499,6 +7499,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+ get_user(user_sense_off, &cioc->sense_off))
+ return -EFAULT;
+
++ if (local_sense_off != user_sense_off)
++ return -EINVAL;
++
+ if (local_sense_len) {
+ void __user **sense_ioc_ptr =
+ (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off);
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 397081d320b1..83f71c266c66 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1677,8 +1677,9 @@ static void __ufshcd_release(struct ufs_hba *hba)
+
+ hba->clk_gating.state = REQ_CLKS_OFF;
+ trace_ufshcd_clk_gating(dev_name(hba->dev), hba->clk_gating.state);
+- schedule_delayed_work(&hba->clk_gating.gate_work,
+- msecs_to_jiffies(hba->clk_gating.delay_ms));
++ queue_delayed_work(hba->clk_gating.clk_gating_workq,
++ &hba->clk_gating.gate_work,
++ msecs_to_jiffies(hba->clk_gating.delay_ms));
+ }
+
+ void ufshcd_release(struct ufs_hba *hba)
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index 8a3678c2e83c..97bb5989aa21 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -212,6 +212,11 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "failed to parse qcom,vmid\n");
+ goto remove_cdev;
+ } else if (!ret) {
++ if (!qcom_scm_is_available()) {
++ ret = -EPROBE_DEFER;
++ goto remove_cdev;
++ }
++
+ perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ perms[0].perm = QCOM_SCM_PERM_RW;
+ perms[1].vmid = vmid;
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 2d6f3fcf3211..ed71a4c9c8b2 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc)
+ if (!pmc->soc->has_tsense_reset)
+ return;
+
+- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+ return;
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 8612525fa4e3..584bcb018a62 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -89,7 +89,7 @@
+ #define BSPI_BPP_MODE_SELECT_MASK BIT(8)
+ #define BSPI_BPP_ADDR_SELECT_MASK BIT(16)
+
+-#define BSPI_READ_LENGTH 512
++#define BSPI_READ_LENGTH 256
+
+ /* MSPI register offsets */
+ #define MSPI_SPCR0_LSB 0x000
+@@ -355,7 +355,7 @@ static int bcm_qspi_bspi_set_flex_mode(struct bcm_qspi *qspi,
+ int bpc = 0, bpp = 0;
+ u8 command = op->cmd.opcode;
+ int width = op->cmd.buswidth ? op->cmd.buswidth : SPI_NBITS_SINGLE;
+- int addrlen = op->addr.nbytes * 8;
++ int addrlen = op->addr.nbytes;
+ int flex_mode = 1;
+
+ dev_dbg(&qspi->pdev->dev, "set flex mode w %x addrlen %x hp %d\n",
+diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
+index f1526757aaf6..79fc3940245a 100644
+--- a/drivers/spi/spi-ep93xx.c
++++ b/drivers/spi/spi-ep93xx.c
+@@ -246,6 +246,19 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ return -EINPROGRESS;
+ }
+
++static enum dma_transfer_direction
++ep93xx_dma_data_to_trans_dir(enum dma_data_direction dir)
++{
++ switch (dir) {
++ case DMA_TO_DEVICE:
++ return DMA_MEM_TO_DEV;
++ case DMA_FROM_DEVICE:
++ return DMA_DEV_TO_MEM;
++ default:
++ return DMA_TRANS_NONE;
++ }
++}
++
+ /**
+ * ep93xx_spi_dma_prepare() - prepares a DMA transfer
+ * @master: SPI master
+@@ -257,7 +270,7 @@ static int ep93xx_spi_read_write(struct spi_master *master)
+ */
+ static struct dma_async_tx_descriptor *
+ ep93xx_spi_dma_prepare(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct spi_transfer *xfer = master->cur_msg->state;
+@@ -277,9 +290,9 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ buswidth = DMA_SLAVE_BUSWIDTH_1_BYTE;
+
+ memset(&conf, 0, sizeof(conf));
+- conf.direction = dir;
++ conf.direction = ep93xx_dma_data_to_trans_dir(dir);
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ buf = xfer->rx_buf;
+ sgt = &espi->rx_sgt;
+@@ -343,7 +356,8 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ if (!nents)
+ return ERR_PTR(-ENOMEM);
+
+- txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK);
++ txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, conf.direction,
++ DMA_CTRL_ACK);
+ if (!txd) {
+ dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir);
+ return ERR_PTR(-ENOMEM);
+@@ -360,13 +374,13 @@ ep93xx_spi_dma_prepare(struct spi_master *master,
+ * unmapped.
+ */
+ static void ep93xx_spi_dma_finish(struct spi_master *master,
+- enum dma_transfer_direction dir)
++ enum dma_data_direction dir)
+ {
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_chan *chan;
+ struct sg_table *sgt;
+
+- if (dir == DMA_DEV_TO_MEM) {
++ if (dir == DMA_FROM_DEVICE) {
+ chan = espi->dma_rx;
+ sgt = &espi->rx_sgt;
+ } else {
+@@ -381,8 +395,8 @@ static void ep93xx_spi_dma_callback(void *callback_param)
+ {
+ struct spi_master *master = callback_param;
+
+- ep93xx_spi_dma_finish(master, DMA_MEM_TO_DEV);
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_TO_DEVICE);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+
+ spi_finalize_current_transfer(master);
+ }
+@@ -392,15 +406,15 @@ static int ep93xx_spi_dma_transfer(struct spi_master *master)
+ struct ep93xx_spi *espi = spi_master_get_devdata(master);
+ struct dma_async_tx_descriptor *rxd, *txd;
+
+- rxd = ep93xx_spi_dma_prepare(master, DMA_DEV_TO_MEM);
++ rxd = ep93xx_spi_dma_prepare(master, DMA_FROM_DEVICE);
+ if (IS_ERR(rxd)) {
+ dev_err(&master->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd));
+ return PTR_ERR(rxd);
+ }
+
+- txd = ep93xx_spi_dma_prepare(master, DMA_MEM_TO_DEV);
++ txd = ep93xx_spi_dma_prepare(master, DMA_TO_DEVICE);
+ if (IS_ERR(txd)) {
+- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM);
++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE);
+ dev_err(&master->dev, "DMA TX failed: %ld\n", PTR_ERR(txd));
+ return PTR_ERR(txd);
+ }
+diff --git a/drivers/spi/spi-gpio.c b/drivers/spi/spi-gpio.c
+index 3b518ead504e..b82b47152b18 100644
+--- a/drivers/spi/spi-gpio.c
++++ b/drivers/spi/spi-gpio.c
+@@ -282,9 +282,11 @@ static int spi_gpio_request(struct device *dev,
+ spi_gpio->miso = devm_gpiod_get_optional(dev, "miso", GPIOD_IN);
+ if (IS_ERR(spi_gpio->miso))
+ return PTR_ERR(spi_gpio->miso);
+- if (!spi_gpio->miso)
+- /* HW configuration without MISO pin */
+- *mflags |= SPI_MASTER_NO_RX;
++ /*
++ * No setting SPI_MASTER_NO_RX here - if there is only a MOSI
++ * pin connected the host can still do RX by changing the
++ * direction of the line.
++ */
+
+ spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW);
+ if (IS_ERR(spi_gpio->sck))
+@@ -408,7 +410,7 @@ static int spi_gpio_probe(struct platform_device *pdev)
+ spi_gpio->bitbang.master = master;
+ spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
+
+- if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
++ if ((master_flags & SPI_MASTER_NO_TX) == 0) {
+ spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
+ spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
+diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
+index 990770dfa5cf..ec0c24e873cd 100644
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -328,10 +328,25 @@ EXPORT_SYMBOL_GPL(spi_mem_exec_op);
+ int spi_mem_adjust_op_size(struct spi_mem *mem, struct spi_mem_op *op)
+ {
+ struct spi_controller *ctlr = mem->spi->controller;
++ size_t len;
++
++ len = sizeof(op->cmd.opcode) + op->addr.nbytes + op->dummy.nbytes;
+
+ if (ctlr->mem_ops && ctlr->mem_ops->adjust_op_size)
+ return ctlr->mem_ops->adjust_op_size(mem, op);
+
++ if (!ctlr->mem_ops || !ctlr->mem_ops->exec_op) {
++ if (len > spi_max_transfer_size(mem->spi))
++ return -EINVAL;
++
++ op->data.nbytes = min3((size_t)op->data.nbytes,
++ spi_max_transfer_size(mem->spi),
++ spi_max_message_size(mem->spi) -
++ len);
++ if (!op->data.nbytes)
++ return -EINVAL;
++ }
++
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(spi_mem_adjust_op_size);
+diff --git a/drivers/tc/tc.c b/drivers/tc/tc.c
+index 3be9519654e5..cf3fad2cb871 100644
+--- a/drivers/tc/tc.c
++++ b/drivers/tc/tc.c
+@@ -2,7 +2,7 @@
+ * TURBOchannel bus services.
+ *
+ * Copyright (c) Harald Koerfgen, 1998
+- * Copyright (c) 2001, 2003, 2005, 2006 Maciej W. Rozycki
++ * Copyright (c) 2001, 2003, 2005, 2006, 2018 Maciej W. Rozycki
+ * Copyright (c) 2005 James Simmons
+ *
+ * This file is subject to the terms and conditions of the GNU
+@@ -10,6 +10,7 @@
+ * directory of this archive for more details.
+ */
+ #include <linux/compiler.h>
++#include <linux/dma-mapping.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
+ #include <linux/ioport.h>
+@@ -92,6 +93,11 @@ static void __init tc_bus_add_devices(struct tc_bus *tbus)
+ tdev->dev.bus = &tc_bus_type;
+ tdev->slot = slot;
+
++ /* TURBOchannel has 34-bit DMA addressing (16GiB space). */
++ tdev->dma_mask = DMA_BIT_MASK(34);
++ tdev->dev.dma_mask = &tdev->dma_mask;
++ tdev->dev.coherent_dma_mask = DMA_BIT_MASK(34);
++
+ for (i = 0; i < 8; i++) {
+ tdev->firmware[i] =
+ readb(module + offset + TC_FIRM_VER + 4 * i);
+diff --git a/drivers/thermal/da9062-thermal.c b/drivers/thermal/da9062-thermal.c
+index dd8dd947b7f0..01b0cb994457 100644
+--- a/drivers/thermal/da9062-thermal.c
++++ b/drivers/thermal/da9062-thermal.c
+@@ -106,7 +106,7 @@ static void da9062_thermal_poll_on(struct work_struct *work)
+ THERMAL_EVENT_UNSPECIFIED);
+
+ delay = msecs_to_jiffies(thermal->zone->passive_delay);
+- schedule_delayed_work(&thermal->work, delay);
++ queue_delayed_work(system_freezable_wq, &thermal->work, delay);
+ return;
+ }
+
+@@ -125,7 +125,7 @@ static irqreturn_t da9062_thermal_irq_handler(int irq, void *data)
+ struct da9062_thermal *thermal = data;
+
+ disable_irq_nosync(thermal->irq);
+- schedule_delayed_work(&thermal->work, 0);
++ queue_delayed_work(system_freezable_wq, &thermal->work, 0);
+
+ return IRQ_HANDLED;
+ }
+diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
+index e77e63070e99..5844e26bd372 100644
+--- a/drivers/thermal/rcar_thermal.c
++++ b/drivers/thermal/rcar_thermal.c
+@@ -465,6 +465,7 @@ static int rcar_thermal_remove(struct platform_device *pdev)
+
+ rcar_thermal_for_each_priv(priv, common) {
+ rcar_thermal_irq_disable(priv);
++ cancel_delayed_work_sync(&priv->work);
+ if (priv->chip->use_of_thermal)
+ thermal_remove_hwmon_sysfs(priv->zone);
+ else
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index b4ba2b1dab76..f4d0ef695225 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -130,6 +130,11 @@ static void kgdboc_unregister_kbd(void)
+
+ static int kgdboc_option_setup(char *opt)
+ {
++ if (!opt) {
++ pr_err("kgdboc: config string not provided\n");
++ return -EINVAL;
++ }
++
+ if (strlen(opt) >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdboc: config string too long\n");
+ return -ENOSPC;
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 6c58ad1abd7e..d5b2efae82fc 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -275,6 +275,8 @@ static struct class uio_class = {
+ .dev_groups = uio_groups,
+ };
+
++bool uio_class_registered;
++
+ /*
+ * device functions
+ */
+@@ -877,6 +879,9 @@ static int init_uio_class(void)
+ printk(KERN_ERR "class_register failed for uio\n");
+ goto err_class_register;
+ }
++
++ uio_class_registered = true;
++
+ return 0;
+
+ err_class_register:
+@@ -887,6 +892,7 @@ exit:
+
+ static void release_uio_class(void)
+ {
++ uio_class_registered = false;
+ class_unregister(&uio_class);
+ uio_major_cleanup();
+ }
+@@ -913,6 +919,9 @@ int __uio_register_device(struct module *owner,
+ struct uio_device *idev;
+ int ret = 0;
+
++ if (!uio_class_registered)
++ return -EPROBE_DEFER;
++
+ if (!parent || !info || !info->name || !info->version)
+ return -EINVAL;
+
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 7e7428e48bfa..4f8b8179ec96 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci);
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
+diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c
+index 6e2cdd7b93d4..05a68f035d19 100644
+--- a/drivers/usb/dwc2/hcd.c
++++ b/drivers/usb/dwc2/hcd.c
+@@ -4394,6 +4394,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+ struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd);
+ struct usb_bus *bus = hcd_to_bus(hcd);
+ unsigned long flags;
++ int ret;
+
+ dev_dbg(hsotg->dev, "DWC OTG HCD START\n");
+
+@@ -4409,6 +4410,13 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ dwc2_hcd_reinit(hsotg);
+
++ /* enable external vbus supply before resuming root hub */
++ spin_unlock_irqrestore(&hsotg->lock, flags);
++ ret = dwc2_vbus_supply_init(hsotg);
++ if (ret)
++ return ret;
++ spin_lock_irqsave(&hsotg->lock, flags);
++
+ /* Initialize and connect root hub if one is not already attached */
+ if (bus->root_hub) {
+ dev_dbg(hsotg->dev, "DWC OTG HCD Has Root Hub\n");
+@@ -4418,7 +4426,7 @@ static int _dwc2_hcd_start(struct usb_hcd *hcd)
+
+ spin_unlock_irqrestore(&hsotg->lock, flags);
+
+- return dwc2_vbus_supply_init(hsotg);
++ return 0;
+ }
+
+ /*
+diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c
+index 17147b8c771e..8f267be1745d 100644
+--- a/drivers/usb/gadget/udc/atmel_usba_udc.c
++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c
+@@ -2017,6 +2017,8 @@ static struct usba_ep * atmel_udc_of_init(struct platform_device *pdev,
+
+ udc->errata = match->data;
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc");
++ if (IS_ERR(udc->pmc))
++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9rl-pmc");
+ if (IS_ERR(udc->pmc))
+ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc");
+ if (udc->errata && IS_ERR(udc->pmc))
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 5b5f1c8b47c9..104b80c28636 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2377,6 +2377,9 @@ static ssize_t renesas_usb3_b_device_write(struct file *file,
+ else
+ usb3->forced_b_device = false;
+
++ if (usb3->workaround_for_vbus)
++ usb3_disconnect(usb3);
++
+ /* Let this driver call usb3_connect() anyway */
+ usb3_check_id(usb3);
+
+diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
+index e98673954020..ec6739ef3129 100644
+--- a/drivers/usb/host/ohci-at91.c
++++ b/drivers/usb/host/ohci-at91.c
+@@ -551,6 +551,8 @@ static int ohci_hcd_at91_drv_probe(struct platform_device *pdev)
+ pdata->overcurrent_pin[i] =
+ devm_gpiod_get_index_optional(&pdev->dev, "atmel,oc",
+ i, GPIOD_IN);
++ if (!pdata->overcurrent_pin[i])
++ continue;
+ if (IS_ERR(pdata->overcurrent_pin[i])) {
+ err = PTR_ERR(pdata->overcurrent_pin[i]);
+ dev_err(&pdev->dev, "unable to claim gpio \"overcurrent\": %d\n", err);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index a4b95d019f84..1f7eeee2ebca 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -900,6 +900,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ set_bit(wIndex, &bus_state->resuming_ports);
+ bus_state->resume_done[wIndex] = timeout;
+ mod_timer(&hcd->rh_timer, timeout);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ }
+ /* Has resume been signalled for USB_RESUME_TIME yet? */
+ } else if (time_after_eq(jiffies,
+@@ -940,6 +941,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ clear_bit(wIndex, &bus_state->rexit_ports);
+ }
+
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ bus_state->port_c_suspend |= 1 << wIndex;
+ bus_state->suspended_ports &= ~(1 << wIndex);
+ } else {
+@@ -962,6 +964,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
+ bus_state->resume_done[wIndex] = 0;
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+
+
+@@ -1337,6 +1340,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ goto error;
+
+ set_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_start_port_resume(&hcd->self, wIndex);
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_RESUME);
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1345,6 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ xhci_set_link_state(xhci, ports[wIndex],
+ XDEV_U0);
+ clear_bit(wIndex, &bus_state->resuming_ports);
++ usb_hcd_end_port_resume(&hcd->self, wIndex);
+ }
+ bus_state->port_c_suspend |= 1 << wIndex;
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f0a99aa0ac58..cd4659703647 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1602,6 +1602,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+ mod_timer(&hcd->rh_timer,
+ bus_state->resume_done[hcd_portnum]);
++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
+ bogus_port_status = true;
+ }
+ }
+diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm.c
+index d1d20252bad8..a7e231ccb0a1 100644
+--- a/drivers/usb/typec/tcpm.c
++++ b/drivers/usb/typec/tcpm.c
+@@ -1383,8 +1383,8 @@ static enum pdo_err tcpm_caps_err(struct tcpm_port *port, const u32 *pdo,
+ if (pdo_apdo_type(pdo[i]) != APDO_TYPE_PPS)
+ break;
+
+- if (pdo_pps_apdo_max_current(pdo[i]) <
+- pdo_pps_apdo_max_current(pdo[i - 1]))
++ if (pdo_pps_apdo_max_voltage(pdo[i]) <
++ pdo_pps_apdo_max_voltage(pdo[i - 1]))
+ return PDO_ERR_PPS_APDO_NOT_SORTED;
+ else if (pdo_pps_apdo_min_voltage(pdo[i]) ==
+ pdo_pps_apdo_min_voltage(pdo[i - 1]) &&
+@@ -4018,6 +4018,9 @@ static int tcpm_pps_set_op_curr(struct tcpm_port *port, u16 op_curr)
+ goto port_unlock;
+ }
+
++ /* Round down operating current to align with PPS valid steps */
++ op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.op_curr = op_curr;
+ port->pps_status = 0;
+@@ -4071,6 +4074,9 @@ static int tcpm_pps_set_out_volt(struct tcpm_port *port, u16 out_volt)
+ goto port_unlock;
+ }
+
++ /* Round down output voltage to align with PPS valid steps */
++ out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP);
++
+ reinit_completion(&port->pps_complete);
+ port->pps_data.out_volt = out_volt;
+ port->pps_status = 0;
+diff --git a/drivers/usb/usbip/vudc_main.c b/drivers/usb/usbip/vudc_main.c
+index 3fc22037a82f..390733e6937e 100644
+--- a/drivers/usb/usbip/vudc_main.c
++++ b/drivers/usb/usbip/vudc_main.c
+@@ -73,6 +73,10 @@ static int __init init(void)
+ cleanup:
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
+ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+@@ -89,7 +93,11 @@ static void __exit cleanup(void)
+
+ list_for_each_entry_safe(udc_dev, udc_dev2, &vudc_devices, dev_entry) {
+ list_del(&udc_dev->dev_entry);
+- platform_device_unregister(udc_dev->pdev);
++ /*
++ * Just do platform_device_del() here, put_vudc_device()
++ * calls the platform_device_put()
++ */
++ platform_device_del(udc_dev->pdev);
+ put_vudc_device(udc_dev);
+ }
+ platform_driver_unregister(&vudc_driver);
+diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c
+index 38716eb50408..8a3e8f61b991 100644
+--- a/drivers/video/hdmi.c
++++ b/drivers/video/hdmi.c
+@@ -592,10 +592,10 @@ hdmi_extended_colorimetry_get_name(enum hdmi_extended_colorimetry ext_col)
+ return "xvYCC 709";
+ case HDMI_EXTENDED_COLORIMETRY_S_YCC_601:
+ return "sYCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601:
+- return "Adobe YCC 601";
+- case HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB:
+- return "Adobe RGB";
++ case HDMI_EXTENDED_COLORIMETRY_OPYCC_601:
++ return "opYCC 601";
++ case HDMI_EXTENDED_COLORIMETRY_OPRGB:
++ return "opRGB";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM:
+ return "BT.2020 Constant Luminance";
+ case HDMI_EXTENDED_COLORIMETRY_BT2020:
+diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
+index 83fc9aab34e8..3099052e1243 100644
+--- a/drivers/w1/masters/omap_hdq.c
++++ b/drivers/w1/masters/omap_hdq.c
+@@ -763,6 +763,8 @@ static int omap_hdq_remove(struct platform_device *pdev)
+ /* remove module dependency */
+ pm_runtime_disable(&pdev->dev);
+
++ w1_remove_master_device(&omap_w1_master);
++
+ return 0;
+ }
+
+diff --git a/drivers/xen/privcmd-buf.c b/drivers/xen/privcmd-buf.c
+index df1ed37c3269..de01a6d0059d 100644
+--- a/drivers/xen/privcmd-buf.c
++++ b/drivers/xen/privcmd-buf.c
+@@ -21,15 +21,9 @@
+
+ MODULE_LICENSE("GPL");
+
+-static unsigned int limit = 64;
+-module_param(limit, uint, 0644);
+-MODULE_PARM_DESC(limit, "Maximum number of pages that may be allocated by "
+- "the privcmd-buf device per open file");
+-
+ struct privcmd_buf_private {
+ struct mutex lock;
+ struct list_head list;
+- unsigned int allocated;
+ };
+
+ struct privcmd_buf_vma_private {
+@@ -60,13 +54,10 @@ static void privcmd_buf_vmapriv_free(struct privcmd_buf_vma_private *vma_priv)
+ {
+ unsigned int i;
+
+- vma_priv->file_priv->allocated -= vma_priv->n_pages;
+-
+ list_del(&vma_priv->list);
+
+ for (i = 0; i < vma_priv->n_pages; i++)
+- if (vma_priv->pages[i])
+- __free_page(vma_priv->pages[i]);
++ __free_page(vma_priv->pages[i]);
+
+ kfree(vma_priv);
+ }
+@@ -146,8 +137,7 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned int i;
+ int ret = 0;
+
+- if (!(vma->vm_flags & VM_SHARED) || count > limit ||
+- file_priv->allocated + count > limit)
++ if (!(vma->vm_flags & VM_SHARED))
+ return -EINVAL;
+
+ vma_priv = kzalloc(sizeof(*vma_priv) + count * sizeof(void *),
+@@ -155,19 +145,15 @@ static int privcmd_buf_mmap(struct file *file, struct vm_area_struct *vma)
+ if (!vma_priv)
+ return -ENOMEM;
+
+- vma_priv->n_pages = count;
+- count = 0;
+- for (i = 0; i < vma_priv->n_pages; i++) {
++ for (i = 0; i < count; i++) {
+ vma_priv->pages[i] = alloc_page(GFP_KERNEL | __GFP_ZERO);
+ if (!vma_priv->pages[i])
+ break;
+- count++;
++ vma_priv->n_pages++;
+ }
+
+ mutex_lock(&file_priv->lock);
+
+- file_priv->allocated += count;
+-
+ vma_priv->file_priv = file_priv;
+ vma_priv->users = 1;
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index a6f9ba85dc4b..aa081f806728 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -303,6 +303,9 @@ xen_swiotlb_alloc_coherent(struct device *hwdev, size_t size,
+ */
+ flags &= ~(__GFP_DMA | __GFP_HIGHMEM);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ /* On ARM this function returns an ioremap'ped virtual address for
+ * which virt_to_phys doesn't return the corresponding physical
+ * address. In fact on ARM virt_to_phys only works for kernel direct
+@@ -351,6 +354,9 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ * physical address */
+ phys = xen_bus_to_phys(dev_addr);
+
++ /* Convert the size to actually allocated. */
++ size = 1UL << (order + XEN_PAGE_SHIFT);
++
+ if (((dev_addr + size - 1 <= dma_mask)) ||
+ range_straddles_page_boundary(phys, size))
+ xen_destroy_contiguous_region(phys, order);
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 294f35ce9e46..cf8ef8cee5a0 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -75,12 +75,15 @@ static void watch_target(struct xenbus_watch *watch,
+
+ if (!watch_fired) {
+ watch_fired = true;
+- err = xenbus_scanf(XBT_NIL, "memory", "static-max", "%llu",
+- &static_max);
+- if (err != 1)
+- static_max = new_target;
+- else
++
++ if ((xenbus_scanf(XBT_NIL, "memory", "static-max",
++ "%llu", &static_max) == 1) ||
++ (xenbus_scanf(XBT_NIL, "memory", "memory_static_max",
++ "%llu", &static_max) == 1))
+ static_max >>= PAGE_SHIFT - 10;
++ else
++ static_max = new_target;
++
+ target_diff = (xen_pv_domain() || xen_initial_domain()) ? 0
+ : static_max - balloon_stats.target_pages;
+ }
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 4bc326df472e..4a7ae216977d 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1054,9 +1054,26 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)
+ parent_start = parent->start;
+
++ /*
++ * If we are COWing a node/leaf from the extent, chunk or device trees,
++ * make sure that we do not finish block group creation of pending block
++ * groups. We do this to avoid a deadlock.
++ * COWing can result in allocation of a new chunk, and flushing pending
++ * block groups (btrfs_create_pending_block_groups()) can be triggered
++ * when finishing allocation of a new chunk. Creation of a pending block
++ * group modifies the extent, chunk and device trees, therefore we could
++ * deadlock with ourselves since we are holding a lock on an extent
++ * buffer that btrfs_create_pending_block_groups() may try to COW later.
++ */
++ if (root == fs_info->extent_root ||
++ root == fs_info->chunk_root ||
++ root == fs_info->dev_root)
++ trans->can_flush_pending_bgs = false;
++
+ cow = btrfs_alloc_tree_block(trans, root, parent_start,
+ root->root_key.objectid, &disk_key, level,
+ search_start, empty_size);
++ trans->can_flush_pending_bgs = true;
+ if (IS_ERR(cow))
+ return PTR_ERR(cow);
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index d20b244623f2..e129a595f811 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -445,6 +445,7 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
++ ASSERT(0);
+ ret = BTRFS_IOCTL_DEV_REPLACE_RESULT_ALREADY_STARTED;
+ goto leave;
+ }
+@@ -487,6 +488,10 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
+ btrfs_dev_replace_write_lock(dev_replace);
++ dev_replace->replace_state =
++ BTRFS_IOCTL_DEV_REPLACE_STATE_NEVER_STARTED;
++ dev_replace->srcdev = NULL;
++ dev_replace->tgtdev = NULL;
+ goto leave;
+ }
+
+@@ -508,8 +513,6 @@ int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ return ret;
+
+ leave:
+- dev_replace->srcdev = NULL;
+- dev_replace->tgtdev = NULL;
+ btrfs_dev_replace_write_unlock(dev_replace);
+ btrfs_destroy_dev_replace_tgtdev(fs_info, tgt_device);
+ return ret;
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 4ab0bccfa281..e67de6a9805b 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2490,6 +2490,9 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ insert_reserved);
+ else
+ BUG();
++ if (ret && insert_reserved)
++ btrfs_pin_extent(trans->fs_info, node->bytenr,
++ node->num_bytes, 1);
+ return ret;
+ }
+
+@@ -3034,7 +3037,6 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head;
+ int ret;
+ int run_all = count == (unsigned long)-1;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+ /* We'll clean this up in btrfs_cleanup_transaction */
+ if (trans->aborted)
+@@ -3051,7 +3053,6 @@ again:
+ #ifdef SCRAMBLE_DELAYED_REFS
+ delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);
+ #endif
+- trans->can_flush_pending_bgs = false;
+ ret = __btrfs_run_delayed_refs(trans, count);
+ if (ret < 0) {
+ btrfs_abort_transaction(trans, ret);
+@@ -3082,7 +3083,6 @@ again:
+ goto again;
+ }
+ out:
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
+ return 0;
+ }
+
+@@ -4664,6 +4664,7 @@ again:
+ goto out;
+ } else {
+ ret = 1;
++ space_info->max_extent_size = 0;
+ }
+
+ space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
+@@ -4685,11 +4686,9 @@ out:
+ * the block groups that were made dirty during the lifetime of the
+ * transaction.
+ */
+- if (trans->can_flush_pending_bgs &&
+- trans->chunk_bytes_reserved >= (u64)SZ_2M) {
++ if (trans->chunk_bytes_reserved >= (u64)SZ_2M)
+ btrfs_create_pending_block_groups(trans);
+- btrfs_trans_release_chunk_metadata(trans);
+- }
++
+ return ret;
+ }
+
+@@ -6581,6 +6580,7 @@ static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+ space_info->bytes_readonly += num_bytes;
+ cache->reserved -= num_bytes;
+ space_info->bytes_reserved -= num_bytes;
++ space_info->max_extent_size = 0;
+
+ if (delalloc)
+ cache->delalloc_bytes -= num_bytes;
+@@ -7412,6 +7412,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info,
+ struct btrfs_block_group_cache *block_group = NULL;
+ u64 search_start = 0;
+ u64 max_extent_size = 0;
++ u64 max_free_space = 0;
+ u64 empty_cluster = 0;
+ struct btrfs_space_info *space_info;
+ int loop = 0;
+@@ -7707,8 +7708,8 @@ unclustered_alloc:
+ spin_lock(&ctl->tree_lock);
+ if (ctl->free_space <
+ num_bytes + empty_cluster + empty_size) {
+- if (ctl->free_space > max_extent_size)
+- max_extent_size = ctl->free_space;
++ max_free_space = max(max_free_space,
++ ctl->free_space);
+ spin_unlock(&ctl->tree_lock);
+ goto loop;
+ }
+@@ -7877,6 +7878,8 @@ loop:
+ }
+ out:
+ if (ret == -ENOSPC) {
++ if (!max_extent_size)
++ max_extent_size = max_free_space;
+ spin_lock(&space_info->lock);
+ space_info->max_extent_size = max_extent_size;
+ spin_unlock(&space_info->lock);
+@@ -8158,21 +8161,14 @@ static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans,
+ }
+
+ path = btrfs_alloc_path();
+- if (!path) {
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
++ if (!path)
+ return -ENOMEM;
+- }
+
+ path->leave_spinning = 1;
+ ret = btrfs_insert_empty_item(trans, fs_info->extent_root, path,
+ &extent_key, size);
+ if (ret) {
+ btrfs_free_path(path);
+- btrfs_free_and_pin_reserved_extent(fs_info,
+- extent_key.objectid,
+- fs_info->nodesize);
+ return ret;
+ }
+
+@@ -8301,6 +8297,19 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ if (IS_ERR(buf))
+ return buf;
+
++ /*
++ * Extra safety check in case the extent tree is corrupted and extent
++ * allocator chooses to use a tree block which is already used and
++ * locked.
++ */
++ if (buf->lock_owner == current->pid) {
++ btrfs_err_rl(fs_info,
++"tree block %llu owner %llu already locked by pid=%d, extent tree corruption detected",
++ buf->start, btrfs_header_owner(buf), current->pid);
++ free_extent_buffer(buf);
++ return ERR_PTR(-EUCLEAN);
++ }
++
+ btrfs_set_header_generation(buf, trans->transid);
+ btrfs_set_buffer_lockdep_class(root->root_key.objectid, buf, level);
+ btrfs_tree_lock(buf);
+@@ -8938,15 +8947,14 @@ static noinline int walk_up_proc(struct btrfs_trans_handle *trans,
+ if (eb == root->node) {
+ if (wc->flags[level] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = eb->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(eb));
++ else if (root->root_key.objectid != btrfs_header_owner(eb))
++ goto owner_mismatch;
+ } else {
+ if (wc->flags[level + 1] & BTRFS_BLOCK_FLAG_FULL_BACKREF)
+ parent = path->nodes[level + 1]->start;
+- else
+- BUG_ON(root->root_key.objectid !=
+- btrfs_header_owner(path->nodes[level + 1]));
++ else if (root->root_key.objectid !=
++ btrfs_header_owner(path->nodes[level + 1]))
++ goto owner_mismatch;
+ }
+
+ btrfs_free_tree_block(trans, root, eb, parent, wc->refs[level] == 1);
+@@ -8954,6 +8962,11 @@ out:
+ wc->refs[level] = 0;
+ wc->flags[level] = 0;
+ return 0;
++
++owner_mismatch:
++ btrfs_err_rl(fs_info, "unexpected tree owner, have %llu expect %llu",
++ btrfs_header_owner(eb), root->root_key.objectid);
++ return -EUCLEAN;
+ }
+
+ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
+@@ -9007,6 +9020,8 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
+ ret = walk_up_proc(trans, root, path, wc);
+ if (ret > 0)
+ return 0;
++ if (ret < 0)
++ return ret;
+
+ if (path->locks[level]) {
+ btrfs_tree_unlock_rw(path->nodes[level],
+@@ -9772,6 +9787,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
+
+ block_group = btrfs_lookup_first_block_group(info, last);
+ while (block_group) {
++ wait_block_group_cache_done(block_group);
+ spin_lock(&block_group->lock);
+ if (block_group->iref)
+ break;
+@@ -10184,15 +10200,19 @@ error:
+ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
+- struct btrfs_block_group_cache *block_group, *tmp;
++ struct btrfs_block_group_cache *block_group;
+ struct btrfs_root *extent_root = fs_info->extent_root;
+ struct btrfs_block_group_item item;
+ struct btrfs_key key;
+ int ret = 0;
+- bool can_flush_pending_bgs = trans->can_flush_pending_bgs;
+
+- trans->can_flush_pending_bgs = false;
+- list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list) {
++ if (!trans->can_flush_pending_bgs)
++ return;
++
++ while (!list_empty(&trans->new_bgs)) {
++ block_group = list_first_entry(&trans->new_bgs,
++ struct btrfs_block_group_cache,
++ bg_list);
+ if (ret)
+ goto next;
+
+@@ -10214,7 +10234,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans)
+ next:
+ list_del_init(&block_group->bg_list);
+ }
+- trans->can_flush_pending_bgs = can_flush_pending_bgs;
++ btrfs_trans_release_chunk_metadata(trans);
+ }
+
+ int btrfs_make_block_group(struct btrfs_trans_handle *trans,
+@@ -10869,14 +10889,16 @@ int btrfs_error_unpin_extent_range(struct btrfs_fs_info *fs_info,
+ * We don't want a transaction for this since the discard may take a
+ * substantial amount of time. We don't require that a transaction be
+ * running, but we do need to take a running transaction into account
+- * to ensure that we're not discarding chunks that were released in
+- * the current transaction.
++ * to ensure that we're not discarding chunks that were released or
++ * allocated in the current transaction.
+ *
+ * Holding the chunks lock will prevent other threads from allocating
+ * or releasing chunks, but it won't prevent a running transaction
+ * from committing and releasing the memory that the pending chunks
+ * list head uses. For that, we need to take a reference to the
+- * transaction.
++ * transaction and hold the commit root sem. We only need to hold
++ * it while performing the free space search since we have already
++ * held back allocations.
+ */
+ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ u64 minlen, u64 *trimmed)
+@@ -10886,6 +10908,10 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ *trimmed = 0;
+
++ /* Discard not supported = nothing to do. */
++ if (!blk_queue_discard(bdev_get_queue(device->bdev)))
++ return 0;
++
+ /* Not writeable = nothing to do. */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ return 0;
+@@ -10903,9 +10929,13 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+
+ ret = mutex_lock_interruptible(&fs_info->chunk_mutex);
+ if (ret)
+- return ret;
++ break;
+
+- down_read(&fs_info->commit_root_sem);
++ ret = down_read_killable(&fs_info->commit_root_sem);
++ if (ret) {
++ mutex_unlock(&fs_info->chunk_mutex);
++ break;
++ }
+
+ spin_lock(&fs_info->trans_lock);
+ trans = fs_info->running_transaction;
+@@ -10913,13 +10943,17 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ refcount_inc(&trans->use_count);
+ spin_unlock(&fs_info->trans_lock);
+
++ if (!trans)
++ up_read(&fs_info->commit_root_sem);
++
+ ret = find_free_dev_extent_start(trans, device, minlen, start,
+ &start, &len);
+- if (trans)
++ if (trans) {
++ up_read(&fs_info->commit_root_sem);
+ btrfs_put_transaction(trans);
++ }
+
+ if (ret) {
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+ if (ret == -ENOSPC)
+ ret = 0;
+@@ -10927,7 +10961,6 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ }
+
+ ret = btrfs_issue_discard(device->bdev, start, len, &bytes);
+- up_read(&fs_info->commit_root_sem);
+ mutex_unlock(&fs_info->chunk_mutex);
+
+ if (ret)
+@@ -10947,6 +10980,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ return ret;
+ }
+
++/*
++ * Trim the whole filesystem by:
++ * 1) trimming the free space in each block group
++ * 2) trimming the unallocated space on each device
++ *
++ * This will also continue trimming even if a block group or device encounters
++ * an error. The return value will be the last error, or 0 if nothing bad
++ * happens.
++ */
+ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ {
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -10956,18 +10998,14 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 start;
+ u64 end;
+ u64 trimmed = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
++ u64 bg_failed = 0;
++ u64 dev_failed = 0;
++ int bg_ret = 0;
++ int dev_ret = 0;
+ int ret = 0;
+
+- /*
+- * try to trim all FS space, our block group may start from non-zero.
+- */
+- if (range->len == total_bytes)
+- cache = btrfs_lookup_first_block_group(fs_info, range->start);
+- else
+- cache = btrfs_lookup_block_group(fs_info, range->start);
+-
+- while (cache) {
++ cache = btrfs_lookup_first_block_group(fs_info, range->start);
++ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+ break;
+@@ -10981,13 +11019,15 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ if (!block_group_cache_done(cache)) {
+ ret = cache_block_group(cache, 0);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ ret = wait_block_group_cache_done(cache);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+ ret = btrfs_trim_block_group(cache,
+@@ -10998,28 +11038,40 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+
+ trimmed += group_trimmed;
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+-
+- cache = next_block_group(fs_info, cache);
+ }
+
++ if (bg_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu block group(s), last error %d",
++ bg_failed, bg_ret);
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+- devices = &fs_info->fs_devices->alloc_list;
+- list_for_each_entry(device, devices, dev_alloc_list) {
++ devices = &fs_info->fs_devices->devices;
++ list_for_each_entry(device, devices, dev_list) {
+ ret = btrfs_trim_free_extents(device, range->minlen,
+ &group_trimmed);
+- if (ret)
++ if (ret) {
++ dev_failed++;
++ dev_ret = ret;
+ break;
++ }
+
+ trimmed += group_trimmed;
+ }
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ if (dev_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu device(s), last error %d",
++ dev_failed, dev_ret);
+ range->len = trimmed;
+- return ret;
++ if (bg_ret)
++ return bg_ret;
++ return dev_ret;
+ }
+
+ /*
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 51e77d72068a..22c2f38cd9b3 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -534,6 +534,14 @@ int btrfs_dirty_pages(struct inode *inode, struct page **pages,
+
+ end_of_last_block = start_pos + num_bytes - 1;
+
++ /*
++ * The pages may have already been dirty, clear out old accounting so
++ * we can set things up properly
++ */
++ clear_extent_bit(&BTRFS_I(inode)->io_tree, start_pos, end_of_last_block,
++ EXTENT_DIRTY | EXTENT_DELALLOC |
++ EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG, 0, 0, cached);
++
+ if (!btrfs_is_free_space_inode(BTRFS_I(inode))) {
+ if (start_pos >= isize &&
+ !(BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)) {
+@@ -1504,18 +1512,27 @@ lock_and_cleanup_extent_if_need(struct btrfs_inode *inode, struct page **pages,
+ }
+ if (ordered)
+ btrfs_put_ordered_extent(ordered);
+- clear_extent_bit(&inode->io_tree, start_pos, last_pos,
+- EXTENT_DIRTY | EXTENT_DELALLOC |
+- EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG,
+- 0, 0, cached_state);
++
+ *lockstart = start_pos;
+ *lockend = last_pos;
+ ret = 1;
+ }
+
++ /*
++ * It's possible the pages are dirty right now, but we don't want
++ * to clean them yet because copy_from_user may catch a page fault
++ * and we might have to fall back to one page at a time. If that
++ * happens, we'll unlock these pages and we'd have a window where
++ * reclaim could sneak in and drop the once-dirty page on the floor
++ * without writing it.
++ *
++ * We have the pages locked and the extent range locked, so there's
++ * no way someone can start IO on any dirty pages in this range.
++ *
++ * We'll call btrfs_dirty_pages() later on, and that will flip around
++ * delalloc bits and dirty the pages as required.
++ */
+ for (i = 0; i < num_pages; i++) {
+- if (clear_page_dirty_for_io(pages[i]))
+- account_page_redirty(pages[i]);
+ set_page_extent_mapped(pages[i]);
+ WARN_ON(!PageLocked(pages[i]));
+ }
+@@ -2065,6 +2082,14 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ goto out;
+
+ inode_lock(inode);
++
++ /*
++ * We take the dio_sem here because the tree log stuff can race with
++ * lockless dio writes and get an extent map logged for an extent we
++ * never waited on. We need it this high up for lockdep reasons.
++ */
++ down_write(&BTRFS_I(inode)->dio_sem);
++
+ atomic_inc(&root->log_batch);
+ full_sync = test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+ &BTRFS_I(inode)->runtime_flags);
+@@ -2116,6 +2141,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ ret = start_ordered_ops(inode, start, end);
+ }
+ if (ret) {
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2171,6 +2197,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * checked called fsync.
+ */
+ ret = filemap_check_wb_err(inode->i_mapping, file->f_wb_err);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2189,6 +2216,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ trans = btrfs_start_transaction(root, 0);
+ if (IS_ERR(trans)) {
+ ret = PTR_ERR(trans);
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+ goto out;
+ }
+@@ -2210,6 +2238,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ * file again, but that will end up using the synchronization
+ * inside btrfs_sync_log to keep things safe.
+ */
++ up_write(&BTRFS_I(inode)->dio_sem);
+ inode_unlock(inode);
+
+ /*
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index d5f80cb300be..a5f18333aa8c 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -10,6 +10,7 @@
+ #include <linux/math64.h>
+ #include <linux/ratelimit.h>
+ #include <linux/error-injection.h>
++#include <linux/sched/mm.h>
+ #include "ctree.h"
+ #include "free-space-cache.h"
+ #include "transaction.h"
+@@ -47,6 +48,7 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ struct btrfs_free_space_header *header;
+ struct extent_buffer *leaf;
+ struct inode *inode = NULL;
++ unsigned nofs_flag;
+ int ret;
+
+ key.objectid = BTRFS_FREE_SPACE_OBJECTID;
+@@ -68,7 +70,13 @@ static struct inode *__lookup_free_space_inode(struct btrfs_root *root,
+ btrfs_disk_key_to_cpu(&location, &disk_key);
+ btrfs_release_path(path);
+
++ /*
++ * We are often under a trans handle at this point, so we need to make
++ * sure NOFS is set to keep us from deadlocking.
++ */
++ nofs_flag = memalloc_nofs_save();
+ inode = btrfs_iget(fs_info->sb, &location, root, NULL);
++ memalloc_nofs_restore(nofs_flag);
+ if (IS_ERR(inode))
+ return inode;
+ if (is_bad_inode(inode)) {
+@@ -1686,6 +1694,8 @@ static inline void __bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+ bitmap_clear(info->bitmap, start, count);
+
+ info->bytes -= bytes;
++ if (info->max_extent_size > ctl->unit)
++ info->max_extent_size = 0;
+ }
+
+ static void bitmap_clear_bits(struct btrfs_free_space_ctl *ctl,
+@@ -1769,6 +1779,13 @@ static int search_bitmap(struct btrfs_free_space_ctl *ctl,
+ return -1;
+ }
+
++static inline u64 get_max_extent_size(struct btrfs_free_space *entry)
++{
++ if (entry->bitmap)
++ return entry->max_extent_size;
++ return entry->bytes;
++}
++
+ /* Cache the size of the max extent in bytes */
+ static struct btrfs_free_space *
+ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+@@ -1790,8 +1807,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ for (node = &entry->offset_index; node; node = rb_next(node)) {
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ if (entry->bytes < *bytes) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1809,8 +1826,8 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ }
+
+ if (entry->bytes < *bytes + align_off) {
+- if (entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ continue;
+ }
+
+@@ -1822,8 +1839,10 @@ find_free_space(struct btrfs_free_space_ctl *ctl, u64 *offset, u64 *bytes,
+ *offset = tmp;
+ *bytes = size;
+ return entry;
+- } else if (size > *max_extent_size) {
+- *max_extent_size = size;
++ } else {
++ *max_extent_size =
++ max(get_max_extent_size(entry),
++ *max_extent_size);
+ }
+ continue;
+ }
+@@ -2447,6 +2466,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ struct rb_node *n;
+ int count = 0;
+
++ spin_lock(&ctl->tree_lock);
+ for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) {
+ info = rb_entry(n, struct btrfs_free_space, offset_index);
+ if (info->bytes >= bytes && !block_group->ro)
+@@ -2455,6 +2475,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ info->offset, info->bytes,
+ (info->bitmap) ? "yes" : "no");
+ }
++ spin_unlock(&ctl->tree_lock);
+ btrfs_info(fs_info, "block group has cluster?: %s",
+ list_empty(&block_group->cluster_list) ? "no" : "yes");
+ btrfs_info(fs_info,
+@@ -2683,8 +2704,8 @@ static u64 btrfs_alloc_from_bitmap(struct btrfs_block_group_cache *block_group,
+
+ err = search_bitmap(ctl, entry, &search_start, &search_bytes, true);
+ if (err) {
+- if (search_bytes > *max_extent_size)
+- *max_extent_size = search_bytes;
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+ return 0;
+ }
+
+@@ -2721,8 +2742,9 @@ u64 btrfs_alloc_from_cluster(struct btrfs_block_group_cache *block_group,
+
+ entry = rb_entry(node, struct btrfs_free_space, offset_index);
+ while (1) {
+- if (entry->bytes < bytes && entry->bytes > *max_extent_size)
+- *max_extent_size = entry->bytes;
++ if (entry->bytes < bytes)
++ *max_extent_size = max(get_max_extent_size(entry),
++ *max_extent_size);
+
+ if (entry->bytes < bytes ||
+ (!entry->bitmap && entry->offset < min_start)) {
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index d3736fbf6774..dc0f9d089b19 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -507,6 +507,7 @@ again:
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_NOFS);
+ if (!pages) {
+ /* just bail out to the uncompressed code */
++ nr_pages = 0;
+ goto cont;
+ }
+
+@@ -2950,6 +2951,7 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ bool truncated = false;
+ bool range_locked = false;
+ bool clear_new_delalloc_bytes = false;
++ bool clear_reserved_extent = true;
+
+ if (!test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags) &&
+@@ -3053,10 +3055,12 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ logical_len, logical_len,
+ compress_type, 0, 0,
+ BTRFS_FILE_EXTENT_REG);
+- if (!ret)
++ if (!ret) {
++ clear_reserved_extent = false;
+ btrfs_release_delalloc_bytes(fs_info,
+ ordered_extent->start,
+ ordered_extent->disk_len);
++ }
+ }
+ unpin_extent_cache(&BTRFS_I(inode)->extent_tree,
+ ordered_extent->file_offset, ordered_extent->len,
+@@ -3117,8 +3121,13 @@ out:
+ * wrong we need to return the space for this ordered extent
+ * back to the allocator. We only free the extent in the
+ * truncated case if we didn't write out the extent at all.
++ *
++ * If we made it past insert_reserved_file_extent before we
++ * errored out then we don't need to do this as the accounting
++ * has already been done.
+ */
+ if ((ret || !logical_len) &&
++ clear_reserved_extent &&
+ !test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags) &&
+ !test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags))
+ btrfs_free_reserved_extent(fs_info,
+@@ -5293,11 +5302,13 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ struct extent_state *cached_state = NULL;
+ u64 start;
+ u64 end;
++ unsigned state_flags;
+
+ node = rb_first(&io_tree->state);
+ state = rb_entry(node, struct extent_state, rb_node);
+ start = state->start;
+ end = state->end;
++ state_flags = state->state;
+ spin_unlock(&io_tree->lock);
+
+ lock_extent_bits(io_tree, start, end, &cached_state);
+@@ -5310,7 +5321,7 @@ static void evict_inode_truncate_pages(struct inode *inode)
+ *
+ * Note, end is the bytenr of last byte, so we need + 1 here.
+ */
+- if (state->state & EXTENT_DELALLOC)
++ if (state_flags & EXTENT_DELALLOC)
+ btrfs_qgroup_free_data(inode, NULL, start, end - start + 1);
+
+ clear_extent_bit(io_tree, start, end,
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index ef7159646615..c972920701a3 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -496,7 +496,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ struct fstrim_range range;
+ u64 minlen = ULLONG_MAX;
+ u64 num_devices = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ int ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -520,11 +519,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ return -EOPNOTSUPP;
+ if (copy_from_user(&range, arg, sizeof(range)))
+ return -EFAULT;
+- if (range.start > total_bytes ||
+- range.len < fs_info->sb->s_blocksize)
++
++ /*
++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of
++ * block group is in the logical address space, which can be any
++ * sectorsize aligned bytenr in the range [0, U64_MAX].
++ */
++ if (range.len < fs_info->sb->s_blocksize)
+ return -EINVAL;
+
+- range.len = min(range.len, total_bytes - range.start);
+ range.minlen = max(range.minlen, minlen);
+ ret = btrfs_trim_fs(fs_info, &range);
+ if (ret < 0)
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index c25dc47210a3..7407f5a5d682 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2856,6 +2856,7 @@ qgroup_rescan_zero_tracking(struct btrfs_fs_info *fs_info)
+ qgroup->rfer_cmpr = 0;
+ qgroup->excl = 0;
+ qgroup->excl_cmpr = 0;
++ qgroup_dirty(fs_info, qgroup);
+ }
+ spin_unlock(&fs_info->qgroup_lock);
+ }
+@@ -3065,6 +3066,10 @@ static int __btrfs_qgroup_release_data(struct inode *inode,
+ int trace_op = QGROUP_RELEASE;
+ int ret;
+
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED,
++ &BTRFS_I(inode)->root->fs_info->flags))
++ return 0;
++
+ /* In release case, we shouldn't have @reserved */
+ WARN_ON(!free && reserved);
+ if (free && reserved)
+diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
+index d60dd06445ce..cad73ed7aebc 100644
+--- a/fs/btrfs/qgroup.h
++++ b/fs/btrfs/qgroup.h
+@@ -261,6 +261,8 @@ void btrfs_qgroup_free_refroot(struct btrfs_fs_info *fs_info,
+ static inline void btrfs_qgroup_free_delayed_ref(struct btrfs_fs_info *fs_info,
+ u64 ref_root, u64 num_bytes)
+ {
++ if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags))
++ return;
+ trace_btrfs_qgroup_free_delayed_ref(fs_info, ref_root, num_bytes);
+ btrfs_qgroup_free_refroot(fs_info, ref_root, num_bytes,
+ BTRFS_QGROUP_RSV_DATA);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index be94c65bb4d2..5ee49b796815 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1321,7 +1321,7 @@ static void __del_reloc_root(struct btrfs_root *root)
+ struct mapping_node *node = NULL;
+ struct reloc_control *rc = fs_info->reloc_ctl;
+
+- if (rc) {
++ if (rc && root->node) {
+ spin_lock(&rc->reloc_root_tree.lock);
+ rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+ root->node->start);
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index ff5f6c719976..9ee0aca134fc 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1930,6 +1930,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
++ btrfs_trans_release_metadata(trans);
++ trans->block_rsv = NULL;
++
+ /* make a pass through all the delayed refs we have so far
+ * any runnings procs may add more while we are here
+ */
+@@ -1939,9 +1942,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ return ret;
+ }
+
+- btrfs_trans_release_metadata(trans);
+- trans->block_rsv = NULL;
+-
+ cur_trans = trans->transaction;
+
+ /*
+@@ -2281,15 +2281,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+
+ kmem_cache_free(btrfs_trans_handle_cachep, trans);
+
+- /*
+- * If fs has been frozen, we can not handle delayed iputs, otherwise
+- * it'll result in deadlock about SB_FREEZE_FS.
+- */
+- if (current != fs_info->transaction_kthread &&
+- current != fs_info->cleaner_kthread &&
+- !test_bit(BTRFS_FS_FROZEN, &fs_info->flags))
+- btrfs_run_delayed_iputs(fs_info);
+-
+ return ret;
+
+ scrub_continue:
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 84b00a29d531..8b3f14a1adf0 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -258,6 +258,13 @@ struct walk_control {
+ /* what stage of the replay code we're currently in */
+ int stage;
+
++ /*
++ * Ignore any items from the inode currently being processed. Needs
++ * to be set every time we find a BTRFS_INODE_ITEM_KEY and we are in
++ * the LOG_WALK_REPLAY_INODES stage.
++ */
++ bool ignore_cur_inode;
++
+ /* the root we are currently replaying */
+ struct btrfs_root *replay_dest;
+
+@@ -2492,6 +2499,20 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+
+ inode_item = btrfs_item_ptr(eb, i,
+ struct btrfs_inode_item);
++ /*
++ * If we have a tmpfile (O_TMPFILE) that got fsync'ed
++ * and never got linked before the fsync, skip it, as
++ * replaying it is pointless since it would be deleted
++ * later. We skip logging tmpfiles, but it's always
++ * possible we are replaying a log created with a kernel
++ * that used to log tmpfiles.
++ */
++ if (btrfs_inode_nlink(eb, inode_item) == 0) {
++ wc->ignore_cur_inode = true;
++ continue;
++ } else {
++ wc->ignore_cur_inode = false;
++ }
+ ret = replay_xattr_deletes(wc->trans, root, log,
+ path, key.objectid);
+ if (ret)
+@@ -2529,16 +2550,8 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ root->fs_info->sectorsize);
+ ret = btrfs_drop_extents(wc->trans, root, inode,
+ from, (u64)-1, 1);
+- /*
+- * If the nlink count is zero here, the iput
+- * will free the inode. We bump it to make
+- * sure it doesn't get freed until the link
+- * count fixup is done.
+- */
+ if (!ret) {
+- if (inode->i_nlink == 0)
+- inc_nlink(inode);
+- /* Update link count and nbytes. */
++ /* Update the inode's nbytes. */
+ ret = btrfs_update_inode(wc->trans,
+ root, inode);
+ }
+@@ -2553,6 +2566,9 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb,
+ break;
+ }
+
++ if (wc->ignore_cur_inode)
++ continue;
++
+ if (key.type == BTRFS_DIR_INDEX_KEY &&
+ wc->stage == LOG_WALK_REPLAY_DIR_INDEX) {
+ ret = replay_one_dir_item(wc->trans, root, path,
+@@ -3209,9 +3225,12 @@ static void free_log_tree(struct btrfs_trans_handle *trans,
+ };
+
+ ret = walk_log_tree(trans, log, &wc);
+- /* I don't think this can happen but just in case */
+- if (ret)
+- btrfs_abort_transaction(trans, ret);
++ if (ret) {
++ if (trans)
++ btrfs_abort_transaction(trans, ret);
++ else
++ btrfs_handle_fs_error(log->fs_info, ret, NULL);
++ }
+
+ while (1) {
+ ret = find_first_extent_bit(&log->dirty_log_pages,
+@@ -4505,7 +4524,6 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,
+
+ INIT_LIST_HEAD(&extents);
+
+- down_write(&inode->dio_sem);
+ write_lock(&tree->lock);
+ test_gen = root->fs_info->last_trans_committed;
+ logged_start = start;
+@@ -4586,7 +4604,6 @@ process:
+ }
+ WARN_ON(!list_empty(&extents));
+ write_unlock(&tree->lock);
+- up_write(&inode->dio_sem);
+
+ btrfs_release_path(path);
+ if (!ret)
+@@ -4784,7 +4801,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ ASSERT(len == i_size ||
+ (len == fs_info->sectorsize &&
+ btrfs_file_extent_compression(leaf, extent) !=
+- BTRFS_COMPRESS_NONE));
++ BTRFS_COMPRESS_NONE) ||
++ (len < i_size && i_size < fs_info->sectorsize));
+ return 0;
+ }
+
+@@ -5718,9 +5736,33 @@ static int btrfs_log_all_parents(struct btrfs_trans_handle *trans,
+
+ dir_inode = btrfs_iget(fs_info->sb, &inode_key,
+ root, NULL);
+- /* If parent inode was deleted, skip it. */
+- if (IS_ERR(dir_inode))
+- continue;
++ /*
++ * If the parent inode was deleted, return an error to
++ * fallback to a transaction commit. This is to prevent
++ * getting an inode that was moved from one parent A to
++ * a parent B, got its former parent A deleted and then
++ * it got fsync'ed, from existing at both parents after
++ * a log replay (and the old parent still existing).
++ * Example:
++ *
++ * mkdir /mnt/A
++ * mkdir /mnt/B
++ * touch /mnt/B/bar
++ * sync
++ * mv /mnt/B/bar /mnt/A/bar
++ * mv -T /mnt/A /mnt/B
++ * fsync /mnt/B/bar
++ * <power fail>
++ *
++ * If we ignore the old parent B which got deleted,
++ * after a log replay we would have file bar linked
++ * at both parents and the old parent B would still
++ * exist.
++ */
++ if (IS_ERR(dir_inode)) {
++ ret = PTR_ERR(dir_inode);
++ goto out;
++ }
+
+ if (ctx)
+ ctx->log_new_dentries = false;
+@@ -5794,7 +5836,13 @@ static int btrfs_log_inode_parent(struct btrfs_trans_handle *trans,
+ if (ret)
+ goto end_no_trans;
+
+- if (btrfs_inode_in_log(inode, trans->transid)) {
++ /*
++ * Skip already logged inodes or inodes corresponding to tmpfiles
++ * (since logging them is pointless, a link count of 0 means they
++ * will never be accessible).
++ */
++ if (btrfs_inode_in_log(inode, trans->transid) ||
++ inode->vfs_inode.i_nlink == 0) {
+ ret = BTRFS_NO_LOG_SYNC;
+ goto end_no_trans;
+ }
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index b20297988fe0..c1261b7fd292 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -383,6 +383,9 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ atomic_set(&totBufAllocCount, 0);
+ atomic_set(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
++ atomic_set(&tcpSesReconnectCount, 0);
++ atomic_set(&tconInfoReconnectCount, 0);
++
+ spin_lock(&GlobalMid_Lock);
+ GlobalMaxActiveXid = 0;
+ GlobalCurrentXid = 0;
+diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c
+index b611fc2e8984..7f01c6e60791 100644
+--- a/fs/cifs/cifs_spnego.c
++++ b/fs/cifs/cifs_spnego.c
+@@ -147,8 +147,10 @@ cifs_get_spnego_key(struct cifs_ses *sesInfo)
+ sprintf(dp, ";sec=krb5");
+ else if (server->sec_mskerberos)
+ sprintf(dp, ";sec=mskrb5");
+- else
+- goto out;
++ else {
++ cifs_dbg(VFS, "unknown or missing server auth type, use krb5\n");
++ sprintf(dp, ";sec=krb5");
++ }
+
+ dp = description + strlen(description);
+ sprintf(dp, ";uid=0x%x",
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index d279fa5472db..334b2b3d21a3 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -779,7 +779,15 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
+ } else if (rc == -EREMOTE) {
+ cifs_create_dfs_fattr(&fattr, sb);
+ rc = 0;
+- } else if (rc == -EACCES && backup_cred(cifs_sb)) {
++ } else if ((rc == -EACCES) && backup_cred(cifs_sb) &&
++ (strcmp(server->vals->version_string, SMB1_VERSION_STRING)
++ == 0)) {
++ /*
++ * For SMB2 and later the backup intent flag is already
++ * sent if needed on open and there is no path based
++ * FindFirst operation to use to retry with
++ */
++
+ srchinf = kzalloc(sizeof(struct cifs_search_info),
+ GFP_KERNEL);
+ if (srchinf == NULL) {
+diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
+index f408994fc632..6e000392e4a4 100644
+--- a/fs/cramfs/inode.c
++++ b/fs/cramfs/inode.c
+@@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct super_block *sb, unsigned int offset,
+ continue;
+ blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT;
+ blk_offset += offset;
+- if (blk_offset + len > BUFFER_SIZE)
++ if (blk_offset > BUFFER_SIZE ||
++ blk_offset + len > BUFFER_SIZE)
+ continue;
+ return read_buffers[i] + blk_offset;
+ }
+diff --git a/fs/crypto/fscrypt_private.h b/fs/crypto/fscrypt_private.h
+index 39c20ef26db4..79debfc9cef9 100644
+--- a/fs/crypto/fscrypt_private.h
++++ b/fs/crypto/fscrypt_private.h
+@@ -83,10 +83,6 @@ static inline bool fscrypt_valid_enc_modes(u32 contents_mode,
+ filenames_mode == FS_ENCRYPTION_MODE_AES_256_CTS)
+ return true;
+
+- if (contents_mode == FS_ENCRYPTION_MODE_SPECK128_256_XTS &&
+- filenames_mode == FS_ENCRYPTION_MODE_SPECK128_256_CTS)
+- return true;
+-
+ return false;
+ }
+
+diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
+index e997ca51192f..7874c9bb2fc5 100644
+--- a/fs/crypto/keyinfo.c
++++ b/fs/crypto/keyinfo.c
+@@ -174,16 +174,6 @@ static struct fscrypt_mode {
+ .cipher_str = "cts(cbc(aes))",
+ .keysize = 16,
+ },
+- [FS_ENCRYPTION_MODE_SPECK128_256_XTS] = {
+- .friendly_name = "Speck128/256-XTS",
+- .cipher_str = "xts(speck128)",
+- .keysize = 64,
+- },
+- [FS_ENCRYPTION_MODE_SPECK128_256_CTS] = {
+- .friendly_name = "Speck128/256-CTS-CBC",
+- .cipher_str = "cts(cbc(speck128))",
+- .keysize = 32,
+- },
+ };
+
+ static struct fscrypt_mode *
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index aa1ce53d0c87..7fcc11fcbbbd 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1387,7 +1387,8 @@ struct ext4_sb_info {
+ u32 s_min_batch_time;
+ struct block_device *journal_bdev;
+ #ifdef CONFIG_QUOTA
+- char *s_qf_names[EXT4_MAXQUOTAS]; /* Names of quota files with journalled quota */
++ /* Names of quota files with journalled quota */
++ char __rcu *s_qf_names[EXT4_MAXQUOTAS];
+ int s_jquota_fmt; /* Format of quota to use */
+ #endif
+ unsigned int s_want_extra_isize; /* New inodes should reserve # bytes */
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 7b4736022761..9c4bac18cc6c 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -863,7 +863,7 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping,
+ handle_t *handle;
+ struct page *page;
+ struct ext4_iloc iloc;
+- int retries;
++ int retries = 0;
+
+ ret = ext4_get_inode_loc(inode, &iloc);
+ if (ret)
+diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
+index a7074115d6f6..0edee31913d1 100644
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -67,7 +67,6 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ ei1 = EXT4_I(inode1);
+ ei2 = EXT4_I(inode2);
+
+- swap(inode1->i_flags, inode2->i_flags);
+ swap(inode1->i_version, inode2->i_version);
+ swap(inode1->i_blocks, inode2->i_blocks);
+ swap(inode1->i_bytes, inode2->i_bytes);
+@@ -85,6 +84,21 @@ static void swap_inode_data(struct inode *inode1, struct inode *inode2)
+ i_size_write(inode2, isize);
+ }
+
++static void reset_inode_seed(struct inode *inode)
++{
++ struct ext4_inode_info *ei = EXT4_I(inode);
++ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
++ __le32 inum = cpu_to_le32(inode->i_ino);
++ __le32 gen = cpu_to_le32(inode->i_generation);
++ __u32 csum;
++
++ if (!ext4_has_metadata_csum(inode->i_sb))
++ return;
++
++ csum = ext4_chksum(sbi, sbi->s_csum_seed, (__u8 *)&inum, sizeof(inum));
++ ei->i_csum_seed = ext4_chksum(sbi, csum, (__u8 *)&gen, sizeof(gen));
++}
++
+ /**
+ * Swap the information from the given @inode and the inode
+ * EXT4_BOOT_LOADER_INO. It will basically swap i_data and all other
+@@ -102,10 +116,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ struct inode *inode_bl;
+ struct ext4_inode_info *ei_bl;
+
+- if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode))
++ if (inode->i_nlink != 1 || !S_ISREG(inode->i_mode) ||
++ IS_SWAPFILE(inode) || IS_ENCRYPTED(inode) ||
++ ext4_has_inline_data(inode))
+ return -EINVAL;
+
+- if (!inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
++ if (IS_RDONLY(inode) || IS_APPEND(inode) || IS_IMMUTABLE(inode) ||
++ !inode_owner_or_capable(inode) || !capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+ inode_bl = ext4_iget(sb, EXT4_BOOT_LOADER_INO);
+@@ -120,13 +137,13 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ * that only 1 swap_inode_boot_loader is running. */
+ lock_two_nondirectories(inode, inode_bl);
+
+- truncate_inode_pages(&inode->i_data, 0);
+- truncate_inode_pages(&inode_bl->i_data, 0);
+-
+ /* Wait for all existing dio workers */
+ inode_dio_wait(inode);
+ inode_dio_wait(inode_bl);
+
++ truncate_inode_pages(&inode->i_data, 0);
++ truncate_inode_pages(&inode_bl->i_data, 0);
++
+ handle = ext4_journal_start(inode_bl, EXT4_HT_MOVE_EXTENTS, 2);
+ if (IS_ERR(handle)) {
+ err = -EINVAL;
+@@ -159,6 +176,8 @@ static long swap_inode_boot_loader(struct super_block *sb,
+
+ inode->i_generation = prandom_u32();
+ inode_bl->i_generation = prandom_u32();
++ reset_inode_seed(inode);
++ reset_inode_seed(inode_bl);
+
+ ext4_discard_preallocations(inode);
+
+@@ -169,6 +188,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ inode->i_ino, err);
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
++ ext4_mark_inode_dirty(handle, inode);
+ } else {
+ err = ext4_mark_inode_dirty(handle, inode_bl);
+ if (err < 0) {
+@@ -178,6 +198,7 @@ static long swap_inode_boot_loader(struct super_block *sb,
+ /* Revert all changes: */
+ swap_inode_data(inode, inode_bl);
+ ext4_mark_inode_dirty(handle, inode);
++ ext4_mark_inode_dirty(handle, inode_bl);
+ }
+ }
+ ext4_journal_stop(handle);
+@@ -339,19 +360,14 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ if (projid_eq(kprojid, EXT4_I(inode)->i_projid))
+ return 0;
+
+- err = mnt_want_write_file(filp);
+- if (err)
+- return err;
+-
+ err = -EPERM;
+- inode_lock(inode);
+ /* Is it quota file? Do not allow user to mess with it */
+ if (ext4_is_quota_file(inode))
+- goto out_unlock;
++ return err;
+
+ err = ext4_get_inode_loc(inode, &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+
+ raw_inode = ext4_raw_inode(&iloc);
+ if (!EXT4_FITS_IN_INODE(raw_inode, ei, i_projid)) {
+@@ -359,20 +375,20 @@ static int ext4_ioctl_setproject(struct file *filp, __u32 projid)
+ EXT4_SB(sb)->s_want_extra_isize,
+ &iloc);
+ if (err)
+- goto out_unlock;
++ return err;
+ } else {
+ brelse(iloc.bh);
+ }
+
+- dquot_initialize(inode);
++ err = dquot_initialize(inode);
++ if (err)
++ return err;
+
+ handle = ext4_journal_start(inode, EXT4_HT_QUOTA,
+ EXT4_QUOTA_INIT_BLOCKS(sb) +
+ EXT4_QUOTA_DEL_BLOCKS(sb) + 3);
+- if (IS_ERR(handle)) {
+- err = PTR_ERR(handle);
+- goto out_unlock;
+- }
++ if (IS_ERR(handle))
++ return PTR_ERR(handle);
+
+ err = ext4_reserve_inode_write(handle, inode, &iloc);
+ if (err)
+@@ -400,9 +416,6 @@ out_dirty:
+ err = rc;
+ out_stop:
+ ext4_journal_stop(handle);
+-out_unlock:
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ return err;
+ }
+ #else
+@@ -626,6 +639,30 @@ group_add_out:
+ return err;
+ }
+
++static int ext4_ioctl_check_project(struct inode *inode, struct fsxattr *fa)
++{
++ /*
++ * Project Quota ID state is only allowed to change from within the init
++ * namespace. Enforce that restriction only if we are trying to change
++ * the quota ID state. Everything else is allowed in user namespaces.
++ */
++ if (current_user_ns() == &init_user_ns)
++ return 0;
++
++ if (__kprojid_val(EXT4_I(inode)->i_projid) != fa->fsx_projid)
++ return -EINVAL;
++
++ if (ext4_test_inode_flag(inode, EXT4_INODE_PROJINHERIT)) {
++ if (!(fa->fsx_xflags & FS_XFLAG_PROJINHERIT))
++ return -EINVAL;
++ } else {
++ if (fa->fsx_xflags & FS_XFLAG_PROJINHERIT)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -1025,19 +1062,19 @@ resizefs_out:
+ return err;
+
+ inode_lock(inode);
++ err = ext4_ioctl_check_project(inode, &fa);
++ if (err)
++ goto out;
+ flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
+ (flags & EXT4_FL_XFLAG_VISIBLE);
+ err = ext4_ioctl_setflags(inode, flags);
+- inode_unlock(inode);
+- mnt_drop_write_file(filp);
+ if (err)
+- return err;
+-
++ goto out;
+ err = ext4_ioctl_setproject(filp, fa.fsx_projid);
+- if (err)
+- return err;
+-
+- return 0;
++out:
++ inode_unlock(inode);
++ mnt_drop_write_file(filp);
++ return err;
+ }
+ case EXT4_IOC_SHUTDOWN:
+ return ext4_shutdown(sb, arg);
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index 8e17efdcbf11..887353875060 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -518,9 +518,13 @@ mext_check_arguments(struct inode *orig_inode,
+ orig_inode->i_ino, donor_inode->i_ino);
+ return -EINVAL;
+ }
+- if (orig_eof < orig_start + *len - 1)
++ if (orig_eof <= orig_start)
++ *len = 0;
++ else if (orig_eof < orig_start + *len - 1)
+ *len = orig_eof - orig_start;
+- if (donor_eof < donor_start + *len - 1)
++ if (donor_eof <= donor_start)
++ *len = 0;
++ else if (donor_eof < donor_start + *len - 1)
+ *len = donor_eof - donor_start;
+ if (!*len) {
+ ext4_debug("ext4 move extent: len should not be 0 "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index a7a0fffc3ae8..8d91d50ccf42 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -895,6 +895,18 @@ static inline void ext4_quota_off_umount(struct super_block *sb)
+ for (type = 0; type < EXT4_MAXQUOTAS; type++)
+ ext4_quota_off(sb, type);
+ }
++
++/*
++ * This is a helper function which is used in the mount/remount
++ * codepaths (which holds s_umount) to fetch the quota file name.
++ */
++static inline char *get_qf_name(struct super_block *sb,
++ struct ext4_sb_info *sbi,
++ int type)
++{
++ return rcu_dereference_protected(sbi->s_qf_names[type],
++ lockdep_is_held(&sb->s_umount));
++}
+ #else
+ static inline void ext4_quota_off_umount(struct super_block *sb)
+ {
+@@ -946,7 +958,7 @@ static void ext4_put_super(struct super_block *sb)
+ percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
+ #ifdef CONFIG_QUOTA
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+- kfree(sbi->s_qf_names[i]);
++ kfree(get_qf_name(sb, sbi, i));
+ #endif
+
+ /* Debugging code just in case the in-memory inode orphan list
+@@ -1511,11 +1523,10 @@ static const char deprecated_msg[] =
+ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *qname;
++ char *qname, *old_qname = get_qf_name(sb, sbi, qtype);
+ int ret = -1;
+
+- if (sb_any_quota_loaded(sb) &&
+- !sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && !old_qname) {
+ ext4_msg(sb, KERN_ERR,
+ "Cannot change journaled "
+ "quota options when quota turned on");
+@@ -1532,8 +1543,8 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "Not enough memory for storing quotafile name");
+ return -1;
+ }
+- if (sbi->s_qf_names[qtype]) {
+- if (strcmp(sbi->s_qf_names[qtype], qname) == 0)
++ if (old_qname) {
++ if (strcmp(old_qname, qname) == 0)
+ ret = 1;
+ else
+ ext4_msg(sb, KERN_ERR,
+@@ -1546,7 +1557,7 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ "quotafile must be on filesystem root");
+ goto errout;
+ }
+- sbi->s_qf_names[qtype] = qname;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], qname);
+ set_opt(sb, QUOTA);
+ return 1;
+ errout:
+@@ -1558,15 +1569,16 @@ static int clear_qf_name(struct super_block *sb, int qtype)
+ {
+
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *old_qname = get_qf_name(sb, sbi, qtype);
+
+- if (sb_any_quota_loaded(sb) &&
+- sbi->s_qf_names[qtype]) {
++ if (sb_any_quota_loaded(sb) && old_qname) {
+ ext4_msg(sb, KERN_ERR, "Cannot change journaled quota options"
+ " when quota turned on");
+ return -1;
+ }
+- kfree(sbi->s_qf_names[qtype]);
+- sbi->s_qf_names[qtype] = NULL;
++ rcu_assign_pointer(sbi->s_qf_names[qtype], NULL);
++ synchronize_rcu();
++ kfree(old_qname);
+ return 1;
+ }
+ #endif
+@@ -1941,7 +1953,7 @@ static int parse_options(char *options, struct super_block *sb,
+ int is_remount)
+ {
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
+- char *p;
++ char *p, __maybe_unused *usr_qf_name, __maybe_unused *grp_qf_name;
+ substring_t args[MAX_OPT_ARGS];
+ int token;
+
+@@ -1972,11 +1984,13 @@ static int parse_options(char *options, struct super_block *sb,
+ "Cannot enable project quota enforcement.");
+ return 0;
+ }
+- if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+- if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
++ usr_qf_name = get_qf_name(sb, sbi, USRQUOTA);
++ grp_qf_name = get_qf_name(sb, sbi, GRPQUOTA);
++ if (usr_qf_name || grp_qf_name) {
++ if (test_opt(sb, USRQUOTA) && usr_qf_name)
+ clear_opt(sb, USRQUOTA);
+
+- if (test_opt(sb, GRPQUOTA) && sbi->s_qf_names[GRPQUOTA])
++ if (test_opt(sb, GRPQUOTA) && grp_qf_name)
+ clear_opt(sb, GRPQUOTA);
+
+ if (test_opt(sb, GRPQUOTA) || test_opt(sb, USRQUOTA)) {
+@@ -2010,6 +2024,7 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ {
+ #if defined(CONFIG_QUOTA)
+ struct ext4_sb_info *sbi = EXT4_SB(sb);
++ char *usr_qf_name, *grp_qf_name;
+
+ if (sbi->s_jquota_fmt) {
+ char *fmtname = "";
+@@ -2028,11 +2043,14 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ seq_printf(seq, ",jqfmt=%s", fmtname);
+ }
+
+- if (sbi->s_qf_names[USRQUOTA])
+- seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
+-
+- if (sbi->s_qf_names[GRPQUOTA])
+- seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
++ rcu_read_lock();
++ usr_qf_name = rcu_dereference(sbi->s_qf_names[USRQUOTA]);
++ grp_qf_name = rcu_dereference(sbi->s_qf_names[GRPQUOTA]);
++ if (usr_qf_name)
++ seq_show_option(seq, "usrjquota", usr_qf_name);
++ if (grp_qf_name)
++ seq_show_option(seq, "grpjquota", grp_qf_name);
++ rcu_read_unlock();
+ #endif
+ }
+
+@@ -5081,6 +5099,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ int err = 0;
+ #ifdef CONFIG_QUOTA
+ int i, j;
++ char *to_free[EXT4_MAXQUOTAS];
+ #endif
+ char *orig_data = kstrdup(data, GFP_KERNEL);
+
+@@ -5097,8 +5116,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++)
+ if (sbi->s_qf_names[i]) {
+- old_opts.s_qf_names[i] = kstrdup(sbi->s_qf_names[i],
+- GFP_KERNEL);
++ char *qf_name = get_qf_name(sb, sbi, i);
++
++ old_opts.s_qf_names[i] = kstrdup(qf_name, GFP_KERNEL);
+ if (!old_opts.s_qf_names[i]) {
+ for (j = 0; j < i; j++)
+ kfree(old_opts.s_qf_names[j]);
+@@ -5327,9 +5347,12 @@ restore_opts:
+ #ifdef CONFIG_QUOTA
+ sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+ for (i = 0; i < EXT4_MAXQUOTAS; i++) {
+- kfree(sbi->s_qf_names[i]);
+- sbi->s_qf_names[i] = old_opts.s_qf_names[i];
++ to_free[i] = get_qf_name(sb, sbi, i);
++ rcu_assign_pointer(sbi->s_qf_names[i], old_opts.s_qf_names[i]);
+ }
++ synchronize_rcu();
++ for (i = 0; i < EXT4_MAXQUOTAS; i++)
++ kfree(to_free[i]);
+ #endif
+ kfree(orig_data);
+ return err;
+@@ -5520,7 +5543,7 @@ static int ext4_write_info(struct super_block *sb, int type)
+ */
+ static int ext4_quota_on_mount(struct super_block *sb, int type)
+ {
+- return dquot_quota_on_mount(sb, EXT4_SB(sb)->s_qf_names[type],
++ return dquot_quota_on_mount(sb, get_qf_name(sb, EXT4_SB(sb), type),
+ EXT4_SB(sb)->s_jquota_fmt, type);
+ }
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index b61954d40c25..e397515261dc 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -80,7 +80,8 @@ static void __read_end_io(struct bio *bio)
+ /* PG_error was set if any post_read step failed */
+ if (bio->bi_status || PageError(page)) {
+ ClearPageUptodate(page);
+- SetPageError(page);
++ /* will re-read again later */
++ ClearPageError(page);
+ } else {
+ SetPageUptodate(page);
+ }
+@@ -453,12 +454,16 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ bio_put(bio);
+ return -EFAULT;
+ }
+- bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+- __submit_bio(fio->sbi, bio, fio->type);
++ if (fio->io_wbc && !is_read_io(fio->op))
++ wbc_account_io(fio->io_wbc, page, PAGE_SIZE);
++
++ bio_set_op_attrs(bio, fio->op, fio->op_flags);
+
+ if (!is_read_io(fio->op))
+ inc_page_count(fio->sbi, WB_DATA_TYPE(fio->page));
++
++ __submit_bio(fio->sbi, bio, fio->type);
+ return 0;
+ }
+
+@@ -580,6 +585,7 @@ static int f2fs_submit_page_read(struct inode *inode, struct page *page,
+ bio_put(bio);
+ return -EFAULT;
+ }
++ ClearPageError(page);
+ __submit_bio(F2FS_I_SB(inode), bio, DATA);
+ return 0;
+ }
+@@ -1524,6 +1530,7 @@ submit_and_realloc:
+ if (bio_add_page(bio, page, blocksize, 0) < blocksize)
+ goto submit_and_realloc;
+
++ ClearPageError(page);
+ last_block_in_bio = block_nr;
+ goto next_page;
+ set_error_page:
+@@ -2494,10 +2501,6 @@ static int f2fs_set_data_page_dirty(struct page *page)
+ if (!PageUptodate(page))
+ SetPageUptodate(page);
+
+- /* don't remain PG_checked flag which was set during GC */
+- if (is_cold_data(page))
+- clear_cold_data(page);
+-
+ if (f2fs_is_atomic_file(inode) && !f2fs_is_commit_atomic_write(inode)) {
+ if (!IS_ATOMIC_WRITTEN_PAGE(page)) {
+ f2fs_register_inmem_page(inode, page);
+diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c
+index 231b77ef5a53..a70cd2580eae 100644
+--- a/fs/f2fs/extent_cache.c
++++ b/fs/f2fs/extent_cache.c
+@@ -308,14 +308,13 @@ static unsigned int __free_extent_tree(struct f2fs_sb_info *sbi,
+ return count - atomic_read(&et->node_cnt);
+ }
+
+-static void __drop_largest_extent(struct inode *inode,
++static void __drop_largest_extent(struct extent_tree *et,
+ pgoff_t fofs, unsigned int len)
+ {
+- struct extent_info *largest = &F2FS_I(inode)->extent_tree->largest;
+-
+- if (fofs < largest->fofs + largest->len && fofs + len > largest->fofs) {
+- largest->len = 0;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ if (fofs < et->largest.fofs + et->largest.len &&
++ fofs + len > et->largest.fofs) {
++ et->largest.len = 0;
++ et->largest_updated = true;
+ }
+ }
+
+@@ -416,12 +415,11 @@ out:
+ return ret;
+ }
+
+-static struct extent_node *__try_merge_extent_node(struct inode *inode,
++static struct extent_node *__try_merge_extent_node(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct extent_node *prev_ex,
+ struct extent_node *next_ex)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_node *en = NULL;
+
+ if (prev_ex && __is_back_mergeable(ei, &prev_ex->ei)) {
+@@ -443,7 +441,7 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ spin_lock(&sbi->extent_lock);
+ if (!list_empty(&en->list)) {
+@@ -454,12 +452,11 @@ static struct extent_node *__try_merge_extent_node(struct inode *inode,
+ return en;
+ }
+
+-static struct extent_node *__insert_extent_tree(struct inode *inode,
++static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi,
+ struct extent_tree *et, struct extent_info *ei,
+ struct rb_node **insert_p,
+ struct rb_node *insert_parent)
+ {
+- struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct rb_node **p;
+ struct rb_node *parent = NULL;
+ struct extent_node *en = NULL;
+@@ -476,7 +473,7 @@ do_insert:
+ if (!en)
+ return NULL;
+
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+
+ /* update in global extent list */
+ spin_lock(&sbi->extent_lock);
+@@ -497,6 +494,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ struct rb_node **insert_p = NULL, *insert_parent = NULL;
+ unsigned int end = fofs + len;
+ unsigned int pos = (unsigned int)fofs;
++ bool updated = false;
+
+ if (!et)
+ return;
+@@ -517,7 +515,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ * drop largest extent before lookup, in case it's already
+ * been shrunk from extent tree
+ */
+- __drop_largest_extent(inode, fofs, len);
++ __drop_largest_extent(et, fofs, len);
+
+ /* 1. lookup first extent node in range [fofs, fofs + len - 1] */
+ en = (struct extent_node *)f2fs_lookup_rb_tree_ret(&et->root,
+@@ -550,7 +548,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ set_extent_info(&ei, end,
+ end - dei.fofs + dei.blk,
+ org_end - end);
+- en1 = __insert_extent_tree(inode, et, &ei,
++ en1 = __insert_extent_tree(sbi, et, &ei,
+ NULL, NULL);
+ next_en = en1;
+ } else {
+@@ -570,7 +568,7 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ }
+
+ if (parts)
+- __try_update_largest_extent(inode, et, en);
++ __try_update_largest_extent(et, en);
+ else
+ __release_extent_node(sbi, et, en);
+
+@@ -590,15 +588,16 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (blkaddr) {
+
+ set_extent_info(&ei, fofs, blkaddr, len);
+- if (!__try_merge_extent_node(inode, et, &ei, prev_en, next_en))
+- __insert_extent_tree(inode, et, &ei,
++ if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en))
++ __insert_extent_tree(sbi, et, &ei,
+ insert_p, insert_parent);
+
+ /* give up extent_cache, if split and small updates happen */
+ if (dei.len >= 1 &&
+ prev.len < F2FS_MIN_EXTENT_LEN &&
+ et->largest.len < F2FS_MIN_EXTENT_LEN) {
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ et->largest.len = 0;
++ et->largest_updated = true;
+ set_inode_flag(inode, FI_NO_EXTENT);
+ }
+ }
+@@ -606,7 +605,15 @@ static void f2fs_update_extent_tree_range(struct inode *inode,
+ if (is_inode_flag_set(inode, FI_NO_EXTENT))
+ __free_extent_tree(sbi, et);
+
++ if (et->largest_updated) {
++ et->largest_updated = false;
++ updated = true;
++ }
++
+ write_unlock(&et->lock);
++
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ unsigned int f2fs_shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink)
+@@ -705,6 +712,7 @@ void f2fs_drop_extent_tree(struct inode *inode)
+ {
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct extent_tree *et = F2FS_I(inode)->extent_tree;
++ bool updated = false;
+
+ if (!f2fs_may_extent_tree(inode))
+ return;
+@@ -713,8 +721,13 @@ void f2fs_drop_extent_tree(struct inode *inode)
+
+ write_lock(&et->lock);
+ __free_extent_tree(sbi, et);
+- __drop_largest_extent(inode, 0, UINT_MAX);
++ if (et->largest.len) {
++ et->largest.len = 0;
++ updated = true;
++ }
+ write_unlock(&et->lock);
++ if (updated)
++ f2fs_mark_inode_dirty_sync(inode, true);
+ }
+
+ void f2fs_destroy_extent_tree(struct inode *inode)
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index b6f2dc8163e1..181aade161e8 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -556,6 +556,7 @@ struct extent_tree {
+ struct list_head list; /* to be used by sbi->zombie_list */
+ rwlock_t lock; /* protect extent info rb-tree */
+ atomic_t node_cnt; /* # of extent node in rb-tree*/
++ bool largest_updated; /* largest extent updated */
+ };
+
+ /*
+@@ -736,12 +737,12 @@ static inline bool __is_front_mergeable(struct extent_info *cur,
+ }
+
+ extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
+-static inline void __try_update_largest_extent(struct inode *inode,
+- struct extent_tree *et, struct extent_node *en)
++static inline void __try_update_largest_extent(struct extent_tree *et,
++ struct extent_node *en)
+ {
+ if (en->ei.len > et->largest.len) {
+ et->largest = en->ei;
+- f2fs_mark_inode_dirty_sync(inode, true);
++ et->largest_updated = true;
+ }
+ }
+
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index cf0f944fcaea..4a2e75bce36a 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -287,6 +287,12 @@ static int do_read_inode(struct inode *inode)
+ if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
+ __recover_inline_status(inode, node_page);
+
++ /* try to recover cold bit for non-dir inode */
++ if (!S_ISDIR(inode->i_mode) && !is_cold_node(node_page)) {
++ set_cold_node(node_page, false);
++ set_page_dirty(node_page);
++ }
++
+ /* get rdev by using inline_info */
+ __get_inode_rdev(inode, ri);
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index 52ed02b0327c..ec22e7c5b37e 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -2356,7 +2356,7 @@ retry:
+ if (!PageUptodate(ipage))
+ SetPageUptodate(ipage);
+ fill_node_footer(ipage, ino, ino, 0, true);
+- set_cold_node(page, false);
++ set_cold_node(ipage, false);
+
+ src = F2FS_INODE(page);
+ dst = F2FS_INODE(ipage);
+@@ -2379,6 +2379,13 @@ retry:
+ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
+ i_projid))
+ dst->i_projid = src->i_projid;
++
++ if (f2fs_sb_has_inode_crtime(sbi->sb) &&
++ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize),
++ i_crtime_nsec)) {
++ dst->i_crtime = src->i_crtime;
++ dst->i_crtime_nsec = src->i_crtime_nsec;
++ }
+ }
+
+ new_ni = old_ni;
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index ad70e62c5da4..a69a2c5c6682 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -221,6 +221,7 @@ static void recover_inode(struct inode *inode, struct page *page)
+ inode->i_mtime.tv_nsec = le32_to_cpu(raw->i_mtime_nsec);
+
+ F2FS_I(inode)->i_advise = raw->i_advise;
++ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags);
+
+ recover_inline_flags(inode, raw);
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 742147cbe759..a3e90e6f72a8 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1820,7 +1820,9 @@ static int f2fs_quota_off(struct super_block *sb, int type)
+ if (!inode || !igrab(inode))
+ return dquot_quota_off(sb, type);
+
+- f2fs_quota_sync(sb, type);
++ err = f2fs_quota_sync(sb, type);
++ if (err)
++ goto out_put;
+
+ err = dquot_quota_off(sb, type);
+ if (err || f2fs_sb_has_quota_ino(sb))
+@@ -1839,9 +1841,20 @@ out_put:
+ void f2fs_quota_off_umount(struct super_block *sb)
+ {
+ int type;
++ int err;
++
++ for (type = 0; type < MAXQUOTAS; type++) {
++ err = f2fs_quota_off(sb, type);
++ if (err) {
++ int ret = dquot_quota_off(sb, type);
+
+- for (type = 0; type < MAXQUOTAS; type++)
+- f2fs_quota_off(sb, type);
++ f2fs_msg(sb, KERN_ERR,
++ "Fail to turn off disk quota "
++ "(type: %d, err: %d, ret:%d), Please "
++ "run fsck to fix it.", type, err, ret);
++ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK);
++ }
++ }
+ }
+
+ static int f2fs_get_projid(struct inode *inode, kprojid_t *projid)
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index c2469833b4fb..6b84ef6ccff3 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1333,6 +1333,9 @@ static struct dentry *gfs2_mount_meta(struct file_system_type *fs_type,
+ struct path path;
+ int error;
+
++ if (!dev_name || !*dev_name)
++ return ERR_PTR(-EINVAL);
++
+ error = kern_path(dev_name, LOOKUP_FOLLOW, &path);
+ if (error) {
+ pr_warn("path_lookup on %s returned error %d\n",
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index c125d662777c..26f8d7e46462 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -251,8 +251,8 @@ restart:
+ bh = jh2bh(jh);
+
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+@@ -333,8 +333,8 @@ restart2:
+ jh = transaction->t_checkpoint_io_list;
+ bh = jh2bh(jh);
+ if (buffer_locked(bh)) {
+- spin_unlock(&journal->j_list_lock);
+ get_bh(bh);
++ spin_unlock(&journal->j_list_lock);
+ wait_on_buffer(bh);
+ /* the journal_head may have gone by now */
+ BUFFER_TRACE(bh, "brelse");
+diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
+index 87bdf0f4cba1..902a7dd10e5c 100644
+--- a/fs/jffs2/super.c
++++ b/fs/jffs2/super.c
+@@ -285,10 +285,8 @@ static int jffs2_fill_super(struct super_block *sb, void *data, int silent)
+ sb->s_fs_info = c;
+
+ ret = jffs2_parse_options(c, data);
+- if (ret) {
+- kfree(c);
++ if (ret)
+ return -EINVAL;
+- }
+
+ /* Initialize JFFS2 superblock locks, the further initialization will
+ * be done later */
+diff --git a/fs/lockd/host.c b/fs/lockd/host.c
+index d35cd6be0675..93fb7cf0b92b 100644
+--- a/fs/lockd/host.c
++++ b/fs/lockd/host.c
+@@ -341,7 +341,7 @@ struct nlm_host *nlmsvc_lookup_host(const struct svc_rqst *rqstp,
+ };
+ struct lockd_net *ln = net_generic(net, lockd_net_id);
+
+- dprintk("lockd: %s(host='%*s', vers=%u, proto=%s)\n", __func__,
++ dprintk("lockd: %s(host='%.*s', vers=%u, proto=%s)\n", __func__,
+ (int)hostname_len, hostname, rqstp->rq_vers,
+ (rqstp->rq_prot == IPPROTO_UDP ? "udp" : "tcp"));
+
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index d7124fb12041..5df68d79d661 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -935,10 +935,10 @@ EXPORT_SYMBOL_GPL(nfs4_set_ds_client);
+
+ /*
+ * Session has been established, and the client marked ready.
+- * Set the mount rsize and wsize with negotiated fore channel
+- * attributes which will be bound checked in nfs_server_set_fsinfo.
++ * Limit the mount rsize, wsize and dtsize using negotiated fore
++ * channel attributes.
+ */
+-static void nfs4_session_set_rwsize(struct nfs_server *server)
++static void nfs4_session_limit_rwsize(struct nfs_server *server)
+ {
+ #ifdef CONFIG_NFS_V4_1
+ struct nfs4_session *sess;
+@@ -951,9 +951,11 @@ static void nfs4_session_set_rwsize(struct nfs_server *server)
+ server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead;
+ server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead;
+
+- if (!server->rsize || server->rsize > server_resp_sz)
++ if (server->dtsize > server_resp_sz)
++ server->dtsize = server_resp_sz;
++ if (server->rsize > server_resp_sz)
+ server->rsize = server_resp_sz;
+- if (!server->wsize || server->wsize > server_rqst_sz)
++ if (server->wsize > server_rqst_sz)
+ server->wsize = server_rqst_sz;
+ #endif /* CONFIG_NFS_V4_1 */
+ }
+@@ -1000,12 +1002,12 @@ static int nfs4_server_common_setup(struct nfs_server *server,
+ (unsigned long long) server->fsid.minor);
+ nfs_display_fhandle(mntfh, "Pseudo-fs root FH");
+
+- nfs4_session_set_rwsize(server);
+-
+ error = nfs_probe_fsinfo(server, mntfh, fattr);
+ if (error < 0)
+ goto out;
+
++ nfs4_session_limit_rwsize(server);
++
+ if (server->namelen == 0 || server->namelen > NFS4_MAXNAMLEN)
+ server->namelen = NFS4_MAXNAMLEN;
+
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 67d19cd92e44..7e6425791388 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1110,6 +1110,20 @@ static int nfs_pageio_add_request_mirror(struct nfs_pageio_descriptor *desc,
+ return ret;
+ }
+
++static void nfs_pageio_error_cleanup(struct nfs_pageio_descriptor *desc)
++{
++ u32 midx;
++ struct nfs_pgio_mirror *mirror;
++
++ if (!desc->pg_error)
++ return;
++
++ for (midx = 0; midx < desc->pg_mirror_count; midx++) {
++ mirror = &desc->pg_mirrors[midx];
++ desc->pg_completion_ops->error_cleanup(&mirror->pg_list);
++ }
++}
++
+ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ struct nfs_page *req)
+ {
+@@ -1160,25 +1174,11 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
+ return 1;
+
+ out_failed:
+- /*
+- * We might have failed before sending any reqs over wire.
+- * Clean up rest of the reqs in mirror pg_list.
+- */
+- if (desc->pg_error) {
+- struct nfs_pgio_mirror *mirror;
+- void (*func)(struct list_head *);
+-
+- /* remember fatal errors */
+- if (nfs_error_is_fatal(desc->pg_error))
+- nfs_context_set_write_error(req->wb_context,
+- desc->pg_error);
+-
+- func = desc->pg_completion_ops->error_cleanup;
+- for (midx = 0; midx < desc->pg_mirror_count; midx++) {
+- mirror = &desc->pg_mirrors[midx];
+- func(&mirror->pg_list);
+- }
+- }
++ /* remember fatal errors */
++ if (nfs_error_is_fatal(desc->pg_error))
++ nfs_context_set_write_error(req->wb_context,
++ desc->pg_error);
++ nfs_pageio_error_cleanup(desc);
+ return 0;
+ }
+
+@@ -1250,6 +1250,8 @@ void nfs_pageio_complete(struct nfs_pageio_descriptor *desc)
+ for (midx = 0; midx < desc->pg_mirror_count; midx++)
+ nfs_pageio_complete_mirror(desc, midx);
+
++ if (desc->pg_error < 0)
++ nfs_pageio_error_cleanup(desc);
+ if (desc->pg_ops->pg_cleanup)
+ desc->pg_ops->pg_cleanup(desc);
+ nfs_pageio_cleanup_mirroring(desc);
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 4a17fad93411..18fa7fd3bae9 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -4361,7 +4361,7 @@ nfs4_set_delegation(struct nfs4_client *clp, struct svc_fh *fh,
+
+ fl = nfs4_alloc_init_lease(dp, NFS4_OPEN_DELEGATE_READ);
+ if (!fl)
+- goto out_stid;
++ goto out_clnt_odstate;
+
+ status = vfs_setlease(fp->fi_deleg_file, fl->fl_type, &fl, NULL);
+ if (fl)
+@@ -4386,7 +4386,6 @@ out_unlock:
+ vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp);
+ out_clnt_odstate:
+ put_clnt_odstate(dp->dl_clnt_odstate);
+-out_stid:
+ nfs4_put_stid(&dp->dl_stid);
+ out_delegees:
+ put_deleg_file(fp);
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index ababdbfab537..f43ea1aad542 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -96,6 +96,9 @@ void fsnotify_unmount_inodes(struct super_block *sb)
+
+ if (iput_inode)
+ iput(iput_inode);
++ /* Wait for outstanding inode references from connectors */
++ wait_var_event(&sb->s_fsnotify_inode_refs,
++ !atomic_long_read(&sb->s_fsnotify_inode_refs));
+ }
+
+ /*
+diff --git a/fs/notify/mark.c b/fs/notify/mark.c
+index 61f4c5fa34c7..75394ae96673 100644
+--- a/fs/notify/mark.c
++++ b/fs/notify/mark.c
+@@ -161,15 +161,18 @@ static void fsnotify_connector_destroy_workfn(struct work_struct *work)
+ }
+ }
+
+-static struct inode *fsnotify_detach_connector_from_object(
+- struct fsnotify_mark_connector *conn)
++static void *fsnotify_detach_connector_from_object(
++ struct fsnotify_mark_connector *conn,
++ unsigned int *type)
+ {
+ struct inode *inode = NULL;
+
++ *type = conn->type;
+ if (conn->type == FSNOTIFY_OBJ_TYPE_INODE) {
+ inode = conn->inode;
+ rcu_assign_pointer(inode->i_fsnotify_marks, NULL);
+ inode->i_fsnotify_mask = 0;
++ atomic_long_inc(&inode->i_sb->s_fsnotify_inode_refs);
+ conn->inode = NULL;
+ conn->type = FSNOTIFY_OBJ_TYPE_DETACHED;
+ } else if (conn->type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) {
+@@ -193,10 +196,29 @@ static void fsnotify_final_mark_destroy(struct fsnotify_mark *mark)
+ fsnotify_put_group(group);
+ }
+
++/* Drop object reference originally held by a connector */
++static void fsnotify_drop_object(unsigned int type, void *objp)
++{
++ struct inode *inode;
++ struct super_block *sb;
++
++ if (!objp)
++ return;
++ /* Currently only inode references are passed to be dropped */
++ if (WARN_ON_ONCE(type != FSNOTIFY_OBJ_TYPE_INODE))
++ return;
++ inode = objp;
++ sb = inode->i_sb;
++ iput(inode);
++ if (atomic_long_dec_and_test(&sb->s_fsnotify_inode_refs))
++ wake_up_var(&sb->s_fsnotify_inode_refs);
++}
++
+ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ {
+ struct fsnotify_mark_connector *conn;
+- struct inode *inode = NULL;
++ void *objp = NULL;
++ unsigned int type = FSNOTIFY_OBJ_TYPE_DETACHED;
+ bool free_conn = false;
+
+ /* Catch marks that were actually never attached to object */
+@@ -216,7 +238,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ conn = mark->connector;
+ hlist_del_init_rcu(&mark->obj_list);
+ if (hlist_empty(&conn->list)) {
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ free_conn = true;
+ } else {
+ __fsnotify_recalc_mask(conn);
+@@ -224,7 +246,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
+ mark->connector = NULL;
+ spin_unlock(&conn->lock);
+
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+
+ if (free_conn) {
+ spin_lock(&destroy_lock);
+@@ -702,7 +724,8 @@ void fsnotify_destroy_marks(struct fsnotify_mark_connector __rcu **connp)
+ {
+ struct fsnotify_mark_connector *conn;
+ struct fsnotify_mark *mark, *old_mark = NULL;
+- struct inode *inode;
++ void *objp;
++ unsigned int type;
+
+ conn = fsnotify_grab_connector(connp);
+ if (!conn)
+@@ -728,11 +751,11 @@ void fsnotify_destroy_marks(struct fsnotify_mark_connector __rcu **connp)
+ * mark references get dropped. It would lead to strange results such
+ * as delaying inode deletion or blocking unmount.
+ */
+- inode = fsnotify_detach_connector_from_object(conn);
++ objp = fsnotify_detach_connector_from_object(conn, &type);
+ spin_unlock(&conn->lock);
+ if (old_mark)
+ fsnotify_put_mark(old_mark);
+- iput(inode);
++ fsnotify_drop_object(type, objp);
+ }
+
+ /*
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index dfd73a4616ce..3437da437099 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -767,6 +767,8 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+ smaps_walk.private = mss;
+
+ #ifdef CONFIG_SHMEM
++ /* In case of smaps_rollup, reset the value from previous vma */
++ mss->check_shmem_swap = false;
+ if (vma->vm_file && shmem_mapping(vma->vm_file->f_mapping)) {
+ /*
+ * For shared or readonly shmem mappings we know that all
+@@ -782,7 +784,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
+
+ if (!shmem_swapped || (vma->vm_flags & VM_SHARED) ||
+ !(vma->vm_flags & VM_WRITE)) {
+- mss->swap = shmem_swapped;
++ mss->swap += shmem_swapped;
+ } else {
+ mss->check_shmem_swap = true;
+ smaps_walk.pte_hole = smaps_pte_hole;
+diff --git a/include/crypto/speck.h b/include/crypto/speck.h
+deleted file mode 100644
+index 73cfc952d405..000000000000
+--- a/include/crypto/speck.h
++++ /dev/null
+@@ -1,62 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/*
+- * Common values for the Speck algorithm
+- */
+-
+-#ifndef _CRYPTO_SPECK_H
+-#define _CRYPTO_SPECK_H
+-
+-#include <linux/types.h>
+-
+-/* Speck128 */
+-
+-#define SPECK128_BLOCK_SIZE 16
+-
+-#define SPECK128_128_KEY_SIZE 16
+-#define SPECK128_128_NROUNDS 32
+-
+-#define SPECK128_192_KEY_SIZE 24
+-#define SPECK128_192_NROUNDS 33
+-
+-#define SPECK128_256_KEY_SIZE 32
+-#define SPECK128_256_NROUNDS 34
+-
+-struct speck128_tfm_ctx {
+- u64 round_keys[SPECK128_256_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck128_encrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck128_decrypt(const struct speck128_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck128_setkey(struct speck128_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-/* Speck64 */
+-
+-#define SPECK64_BLOCK_SIZE 8
+-
+-#define SPECK64_96_KEY_SIZE 12
+-#define SPECK64_96_NROUNDS 26
+-
+-#define SPECK64_128_KEY_SIZE 16
+-#define SPECK64_128_NROUNDS 27
+-
+-struct speck64_tfm_ctx {
+- u32 round_keys[SPECK64_128_NROUNDS];
+- int nrounds;
+-};
+-
+-void crypto_speck64_encrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-void crypto_speck64_decrypt(const struct speck64_tfm_ctx *ctx,
+- u8 *out, const u8 *in);
+-
+-int crypto_speck64_setkey(struct speck64_tfm_ctx *ctx, const u8 *key,
+- unsigned int keysize);
+-
+-#endif /* _CRYPTO_SPECK_H */
+diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
+index a57a8aa90ffb..2b0d02458a18 100644
+--- a/include/drm/drm_atomic.h
++++ b/include/drm/drm_atomic.h
+@@ -153,6 +153,17 @@ struct __drm_planes_state {
+ struct __drm_crtcs_state {
+ struct drm_crtc *ptr;
+ struct drm_crtc_state *state, *old_state, *new_state;
++
++ /**
++ * @commit:
++ *
++ * A reference to the CRTC commit object that is kept for use by
++ * drm_atomic_helper_wait_for_flip_done() after
++ * drm_atomic_helper_commit_hw_done() is called. This ensures that a
++ * concurrent commit won't free a commit object that is still in use.
++ */
++ struct drm_crtc_commit *commit;
++
+ s32 __user *out_fence_ptr;
+ u64 last_vblank_count;
+ };
+diff --git a/include/linux/compat.h b/include/linux/compat.h
+index c68acc47da57..47041c7fed28 100644
+--- a/include/linux/compat.h
++++ b/include/linux/compat.h
+@@ -103,6 +103,9 @@ typedef struct compat_sigaltstack {
+ compat_size_t ss_size;
+ } compat_stack_t;
+ #endif
++#ifndef COMPAT_MINSIGSTKSZ
++#define COMPAT_MINSIGSTKSZ MINSIGSTKSZ
++#endif
+
+ #define compat_jiffies_to_clock_t(x) \
+ (((unsigned long)(x) * COMPAT_USER_HZ) / HZ)
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index e73363bd8646..cf23c128ac46 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1416,6 +1416,9 @@ struct super_block {
+ /* Number of inodes with nlink == 0 but still referenced */
+ atomic_long_t s_remove_count;
+
++ /* Pending fsnotify inode refs */
++ atomic_long_t s_fsnotify_inode_refs;
++
+ /* Being remounted read-only */
+ int s_readonly_remount;
+
+diff --git a/include/linux/hdmi.h b/include/linux/hdmi.h
+index d271ff23984f..4f3febc0f971 100644
+--- a/include/linux/hdmi.h
++++ b/include/linux/hdmi.h
+@@ -101,8 +101,8 @@ enum hdmi_extended_colorimetry {
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_601,
+ HDMI_EXTENDED_COLORIMETRY_XV_YCC_709,
+ HDMI_EXTENDED_COLORIMETRY_S_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_YCC_601,
+- HDMI_EXTENDED_COLORIMETRY_ADOBE_RGB,
++ HDMI_EXTENDED_COLORIMETRY_OPYCC_601,
++ HDMI_EXTENDED_COLORIMETRY_OPRGB,
+
+ /* The following EC values are only defined in CEA-861-F. */
+ HDMI_EXTENDED_COLORIMETRY_BT2020_CONST_LUM,
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index 3c5200137b24..42ba31da534f 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -36,7 +36,7 @@ enum siginfo_layout {
+ SIL_SYS,
+ };
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code);
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code);
+
+ /*
+ * Define some primitives to manipulate sigset_t.
+diff --git a/include/linux/tc.h b/include/linux/tc.h
+index f92511e57cdb..a60639f37963 100644
+--- a/include/linux/tc.h
++++ b/include/linux/tc.h
+@@ -84,6 +84,7 @@ struct tc_dev {
+ device. */
+ struct device dev; /* Generic device interface. */
+ struct resource resource; /* Address space of this device. */
++ u64 dma_mask; /* DMA addressable range. */
+ char vendor[9];
+ char name[9];
+ char firmware[9];
+diff --git a/include/media/cec.h b/include/media/cec.h
+index 580ab1042898..71cc0272b053 100644
+--- a/include/media/cec.h
++++ b/include/media/cec.h
+@@ -63,7 +63,6 @@ struct cec_data {
+ struct delayed_work work;
+ struct completion c;
+ u8 attempts;
+- bool new_initiator;
+ bool blocking;
+ bool completed;
+ };
+@@ -174,6 +173,7 @@ struct cec_adapter {
+ bool is_configuring;
+ bool is_configured;
+ bool cec_pin_is_high;
++ u8 last_initiator;
+ u32 monitor_all_cnt;
+ u32 monitor_pin_cnt;
+ u32 follower_cnt;
+@@ -451,4 +451,74 @@ static inline void cec_phys_addr_invalidate(struct cec_adapter *adap)
+ cec_s_phys_addr(adap, CEC_PHYS_ADDR_INVALID, false);
+ }
+
++/**
++ * cec_get_edid_spa_location() - find location of the Source Physical Address
++ *
++ * @edid: the EDID
++ * @size: the size of the EDID
++ *
++ * This EDID is expected to be a CEA-861 compliant, which means that there are
++ * at least two blocks and one or more of the extensions blocks are CEA-861
++ * blocks.
++ *
++ * The returned location is guaranteed to be <= size-2.
++ *
++ * This is an inline function since it is used by both CEC and V4L2.
++ * Ideally this would go in a module shared by both, but it is overkill to do
++ * that for just a single function.
++ */
++static inline unsigned int cec_get_edid_spa_location(const u8 *edid,
++ unsigned int size)
++{
++ unsigned int blocks = size / 128;
++ unsigned int block;
++ u8 d;
++
++ /* Sanity check: at least 2 blocks and a multiple of the block size */
++ if (blocks < 2 || size % 128)
++ return 0;
++
++ /*
++ * If there are fewer extension blocks than the size, then update
++ * 'blocks'. It is allowed to have more extension blocks than the size,
++ * since some hardware can only read e.g. 256 bytes of the EDID, even
++ * though more blocks are present. The first CEA-861 extension block
++ * should normally be in block 1 anyway.
++ */
++ if (edid[0x7e] + 1 < blocks)
++ blocks = edid[0x7e] + 1;
++
++ for (block = 1; block < blocks; block++) {
++ unsigned int offset = block * 128;
++
++ /* Skip any non-CEA-861 extension blocks */
++ if (edid[offset] != 0x02 || edid[offset + 1] != 0x03)
++ continue;
++
++ /* search Vendor Specific Data Block (tag 3) */
++ d = edid[offset + 2] & 0x7f;
++ /* Check if there are Data Blocks */
++ if (d <= 4)
++ continue;
++ if (d > 4) {
++ unsigned int i = offset + 4;
++ unsigned int end = offset + d;
++
++ /* Note: 'end' is always < 'size' */
++ do {
++ u8 tag = edid[i] >> 5;
++ u8 len = edid[i] & 0x1f;
++
++ if (tag == 3 && len >= 5 && i + len <= end &&
++ edid[i + 1] == 0x03 &&
++ edid[i + 2] == 0x0c &&
++ edid[i + 3] == 0x00)
++ return i + 4;
++ i += len + 1;
++ } while (i < end);
++ }
++ }
++ return 0;
++}
++
+ #endif /* _MEDIA_CEC_H */
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index 6c003995347a..59185fbbd202 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -1296,21 +1296,27 @@ struct ib_qp_attr {
+ };
+
+ enum ib_wr_opcode {
+- IB_WR_RDMA_WRITE,
+- IB_WR_RDMA_WRITE_WITH_IMM,
+- IB_WR_SEND,
+- IB_WR_SEND_WITH_IMM,
+- IB_WR_RDMA_READ,
+- IB_WR_ATOMIC_CMP_AND_SWP,
+- IB_WR_ATOMIC_FETCH_AND_ADD,
+- IB_WR_LSO,
+- IB_WR_SEND_WITH_INV,
+- IB_WR_RDMA_READ_WITH_INV,
+- IB_WR_LOCAL_INV,
+- IB_WR_REG_MR,
+- IB_WR_MASKED_ATOMIC_CMP_AND_SWP,
+- IB_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++ /* These are shared with userspace */
++ IB_WR_RDMA_WRITE = IB_UVERBS_WR_RDMA_WRITE,
++ IB_WR_RDMA_WRITE_WITH_IMM = IB_UVERBS_WR_RDMA_WRITE_WITH_IMM,
++ IB_WR_SEND = IB_UVERBS_WR_SEND,
++ IB_WR_SEND_WITH_IMM = IB_UVERBS_WR_SEND_WITH_IMM,
++ IB_WR_RDMA_READ = IB_UVERBS_WR_RDMA_READ,
++ IB_WR_ATOMIC_CMP_AND_SWP = IB_UVERBS_WR_ATOMIC_CMP_AND_SWP,
++ IB_WR_ATOMIC_FETCH_AND_ADD = IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD,
++ IB_WR_LSO = IB_UVERBS_WR_TSO,
++ IB_WR_SEND_WITH_INV = IB_UVERBS_WR_SEND_WITH_INV,
++ IB_WR_RDMA_READ_WITH_INV = IB_UVERBS_WR_RDMA_READ_WITH_INV,
++ IB_WR_LOCAL_INV = IB_UVERBS_WR_LOCAL_INV,
++ IB_WR_MASKED_ATOMIC_CMP_AND_SWP =
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP,
++ IB_WR_MASKED_ATOMIC_FETCH_AND_ADD =
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD,
++
++ /* These are kernel only and can not be issued by userspace */
++ IB_WR_REG_MR = 0x20,
+ IB_WR_REG_SIG_MR,
++
+ /* reserve values for low level drivers' internal use.
+ * These values will not be used at all in the ib core layer.
+ */
+diff --git a/include/uapi/linux/cec.h b/include/uapi/linux/cec.h
+index 20fe091b7e96..bc2a1b98d9dd 100644
+--- a/include/uapi/linux/cec.h
++++ b/include/uapi/linux/cec.h
+@@ -152,10 +152,13 @@ static inline void cec_msg_set_reply_to(struct cec_msg *msg,
+ #define CEC_TX_STATUS_LOW_DRIVE (1 << 3)
+ #define CEC_TX_STATUS_ERROR (1 << 4)
+ #define CEC_TX_STATUS_MAX_RETRIES (1 << 5)
++#define CEC_TX_STATUS_ABORTED (1 << 6)
++#define CEC_TX_STATUS_TIMEOUT (1 << 7)
+
+ #define CEC_RX_STATUS_OK (1 << 0)
+ #define CEC_RX_STATUS_TIMEOUT (1 << 1)
+ #define CEC_RX_STATUS_FEATURE_ABORT (1 << 2)
++#define CEC_RX_STATUS_ABORTED (1 << 3)
+
+ static inline int cec_msg_status_is_ok(const struct cec_msg *msg)
+ {
+diff --git a/include/uapi/linux/fs.h b/include/uapi/linux/fs.h
+index 73e01918f996..a441ea1bfe6d 100644
+--- a/include/uapi/linux/fs.h
++++ b/include/uapi/linux/fs.h
+@@ -279,8 +279,8 @@ struct fsxattr {
+ #define FS_ENCRYPTION_MODE_AES_256_CTS 4
+ #define FS_ENCRYPTION_MODE_AES_128_CBC 5
+ #define FS_ENCRYPTION_MODE_AES_128_CTS 6
+-#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7
+-#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8
++#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* Removed, do not use. */
++#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* Removed, do not use. */
+
+ struct fscrypt_policy {
+ __u8 version;
+diff --git a/include/uapi/linux/ndctl.h b/include/uapi/linux/ndctl.h
+index 7e27070b9440..2f2c43d633c5 100644
+--- a/include/uapi/linux/ndctl.h
++++ b/include/uapi/linux/ndctl.h
+@@ -128,37 +128,31 @@ enum {
+
+ static inline const char *nvdimm_bus_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_ARS_CAP] = "ars_cap",
+- [ND_CMD_ARS_START] = "ars_start",
+- [ND_CMD_ARS_STATUS] = "ars_status",
+- [ND_CMD_CLEAR_ERROR] = "clear_error",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_ARS_CAP: return "ars_cap";
++ case ND_CMD_ARS_START: return "ars_start";
++ case ND_CMD_ARS_STATUS: return "ars_status";
++ case ND_CMD_CLEAR_ERROR: return "clear_error";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ static inline const char *nvdimm_cmd_name(unsigned cmd)
+ {
+- static const char * const names[] = {
+- [ND_CMD_SMART] = "smart",
+- [ND_CMD_SMART_THRESHOLD] = "smart_thresh",
+- [ND_CMD_DIMM_FLAGS] = "flags",
+- [ND_CMD_GET_CONFIG_SIZE] = "get_size",
+- [ND_CMD_GET_CONFIG_DATA] = "get_data",
+- [ND_CMD_SET_CONFIG_DATA] = "set_data",
+- [ND_CMD_VENDOR_EFFECT_LOG_SIZE] = "effect_size",
+- [ND_CMD_VENDOR_EFFECT_LOG] = "effect_log",
+- [ND_CMD_VENDOR] = "vendor",
+- [ND_CMD_CALL] = "cmd_call",
+- };
+-
+- if (cmd < ARRAY_SIZE(names) && names[cmd])
+- return names[cmd];
+- return "unknown";
++ switch (cmd) {
++ case ND_CMD_SMART: return "smart";
++ case ND_CMD_SMART_THRESHOLD: return "smart_thresh";
++ case ND_CMD_DIMM_FLAGS: return "flags";
++ case ND_CMD_GET_CONFIG_SIZE: return "get_size";
++ case ND_CMD_GET_CONFIG_DATA: return "get_data";
++ case ND_CMD_SET_CONFIG_DATA: return "set_data";
++ case ND_CMD_VENDOR_EFFECT_LOG_SIZE: return "effect_size";
++ case ND_CMD_VENDOR_EFFECT_LOG: return "effect_log";
++ case ND_CMD_VENDOR: return "vendor";
++ case ND_CMD_CALL: return "cmd_call";
++ default: return "unknown";
++ }
+ }
+
+ #define ND_IOCTL 'N'
+diff --git a/include/uapi/linux/videodev2.h b/include/uapi/linux/videodev2.h
+index 600877be5c22..082dc1439a50 100644
+--- a/include/uapi/linux/videodev2.h
++++ b/include/uapi/linux/videodev2.h
+@@ -225,8 +225,8 @@ enum v4l2_colorspace {
+ /* For RGB colorspaces such as produces by most webcams. */
+ V4L2_COLORSPACE_SRGB = 8,
+
+- /* AdobeRGB colorspace */
+- V4L2_COLORSPACE_ADOBERGB = 9,
++ /* opRGB colorspace */
++ V4L2_COLORSPACE_OPRGB = 9,
+
+ /* BT.2020 colorspace, used for UHDTV. */
+ V4L2_COLORSPACE_BT2020 = 10,
+@@ -258,7 +258,7 @@ enum v4l2_xfer_func {
+ *
+ * V4L2_COLORSPACE_SRGB, V4L2_COLORSPACE_JPEG: V4L2_XFER_FUNC_SRGB
+ *
+- * V4L2_COLORSPACE_ADOBERGB: V4L2_XFER_FUNC_ADOBERGB
++ * V4L2_COLORSPACE_OPRGB: V4L2_XFER_FUNC_OPRGB
+ *
+ * V4L2_COLORSPACE_SMPTE240M: V4L2_XFER_FUNC_SMPTE240M
+ *
+@@ -269,7 +269,7 @@ enum v4l2_xfer_func {
+ V4L2_XFER_FUNC_DEFAULT = 0,
+ V4L2_XFER_FUNC_709 = 1,
+ V4L2_XFER_FUNC_SRGB = 2,
+- V4L2_XFER_FUNC_ADOBERGB = 3,
++ V4L2_XFER_FUNC_OPRGB = 3,
+ V4L2_XFER_FUNC_SMPTE240M = 4,
+ V4L2_XFER_FUNC_NONE = 5,
+ V4L2_XFER_FUNC_DCI_P3 = 6,
+@@ -281,7 +281,7 @@ enum v4l2_xfer_func {
+ * This depends on the colorspace.
+ */
+ #define V4L2_MAP_XFER_FUNC_DEFAULT(colsp) \
+- ((colsp) == V4L2_COLORSPACE_ADOBERGB ? V4L2_XFER_FUNC_ADOBERGB : \
++ ((colsp) == V4L2_COLORSPACE_OPRGB ? V4L2_XFER_FUNC_OPRGB : \
+ ((colsp) == V4L2_COLORSPACE_SMPTE240M ? V4L2_XFER_FUNC_SMPTE240M : \
+ ((colsp) == V4L2_COLORSPACE_DCI_P3 ? V4L2_XFER_FUNC_DCI_P3 : \
+ ((colsp) == V4L2_COLORSPACE_RAW ? V4L2_XFER_FUNC_NONE : \
+@@ -295,7 +295,7 @@ enum v4l2_ycbcr_encoding {
+ *
+ * V4L2_COLORSPACE_SMPTE170M, V4L2_COLORSPACE_470_SYSTEM_M,
+ * V4L2_COLORSPACE_470_SYSTEM_BG, V4L2_COLORSPACE_SRGB,
+- * V4L2_COLORSPACE_ADOBERGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
++ * V4L2_COLORSPACE_OPRGB and V4L2_COLORSPACE_JPEG: V4L2_YCBCR_ENC_601
+ *
+ * V4L2_COLORSPACE_REC709 and V4L2_COLORSPACE_DCI_P3: V4L2_YCBCR_ENC_709
+ *
+@@ -382,6 +382,17 @@ enum v4l2_quantization {
+ (((is_rgb_or_hsv) || (colsp) == V4L2_COLORSPACE_JPEG) ? \
+ V4L2_QUANTIZATION_FULL_RANGE : V4L2_QUANTIZATION_LIM_RANGE))
+
++/*
++ * Deprecated names for opRGB colorspace (IEC 61966-2-5)
++ *
++ * WARNING: Please don't use these deprecated defines in your code, as
++ * there is a chance we have to remove them in the future.
++ */
++#ifndef __KERNEL__
++#define V4L2_COLORSPACE_ADOBERGB V4L2_COLORSPACE_OPRGB
++#define V4L2_XFER_FUNC_ADOBERGB V4L2_XFER_FUNC_OPRGB
++#endif
++
+ enum v4l2_priority {
+ V4L2_PRIORITY_UNSET = 0, /* not initialized */
+ V4L2_PRIORITY_BACKGROUND = 1,
+diff --git a/include/uapi/rdma/ib_user_verbs.h b/include/uapi/rdma/ib_user_verbs.h
+index 4f9991de8e3a..8345ca799ad8 100644
+--- a/include/uapi/rdma/ib_user_verbs.h
++++ b/include/uapi/rdma/ib_user_verbs.h
+@@ -762,10 +762,28 @@ struct ib_uverbs_sge {
+ __u32 lkey;
+ };
+
++enum ib_uverbs_wr_opcode {
++ IB_UVERBS_WR_RDMA_WRITE = 0,
++ IB_UVERBS_WR_RDMA_WRITE_WITH_IMM = 1,
++ IB_UVERBS_WR_SEND = 2,
++ IB_UVERBS_WR_SEND_WITH_IMM = 3,
++ IB_UVERBS_WR_RDMA_READ = 4,
++ IB_UVERBS_WR_ATOMIC_CMP_AND_SWP = 5,
++ IB_UVERBS_WR_ATOMIC_FETCH_AND_ADD = 6,
++ IB_UVERBS_WR_LOCAL_INV = 7,
++ IB_UVERBS_WR_BIND_MW = 8,
++ IB_UVERBS_WR_SEND_WITH_INV = 9,
++ IB_UVERBS_WR_TSO = 10,
++ IB_UVERBS_WR_RDMA_READ_WITH_INV = 11,
++ IB_UVERBS_WR_MASKED_ATOMIC_CMP_AND_SWP = 12,
++ IB_UVERBS_WR_MASKED_ATOMIC_FETCH_AND_ADD = 13,
++ /* Review enum ib_wr_opcode before modifying this */
++};
++
+ struct ib_uverbs_send_wr {
+ __aligned_u64 wr_id;
+ __u32 num_sge;
+- __u32 opcode;
++ __u32 opcode; /* see enum ib_uverbs_wr_opcode */
+ __u32 send_flags;
+ union {
+ __be32 imm_data;
+diff --git a/kernel/bounds.c b/kernel/bounds.c
+index c373e887c066..9795d75b09b2 100644
+--- a/kernel/bounds.c
++++ b/kernel/bounds.c
+@@ -13,7 +13,7 @@
+ #include <linux/log2.h>
+ #include <linux/spinlock_types.h>
+
+-void foo(void)
++int main(void)
+ {
+ /* The enum constants to put into include/generated/bounds.h */
+ DEFINE(NR_PAGEFLAGS, __NR_PAGEFLAGS);
+@@ -23,4 +23,6 @@ void foo(void)
+ #endif
+ DEFINE(SPINLOCK_SIZE, sizeof(spinlock_t));
+ /* End of constants */
++
++ return 0;
+ }
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index a31a1ba0f8ea..0f5d2e66cd6b 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -683,6 +683,17 @@ err_put:
+ return err;
+ }
+
++static void maybe_wait_bpf_programs(struct bpf_map *map)
++{
++ /* Wait for any running BPF programs to complete so that
++ * userspace, when we return to it, knows that all programs
++ * that could be running use the new map value.
++ */
++ if (map->map_type == BPF_MAP_TYPE_HASH_OF_MAPS ||
++ map->map_type == BPF_MAP_TYPE_ARRAY_OF_MAPS)
++ synchronize_rcu();
++}
++
+ #define BPF_MAP_UPDATE_ELEM_LAST_FIELD flags
+
+ static int map_update_elem(union bpf_attr *attr)
+@@ -769,6 +780,7 @@ static int map_update_elem(union bpf_attr *attr)
+ }
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ free_value:
+ kfree(value);
+@@ -821,6 +833,7 @@ static int map_delete_elem(union bpf_attr *attr)
+ rcu_read_unlock();
+ __this_cpu_dec(bpf_prog_active);
+ preempt_enable();
++ maybe_wait_bpf_programs(map);
+ out:
+ kfree(key);
+ err_put:
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index b000686fa1a1..d565ec6af97c 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -553,7 +553,9 @@ static void __mark_reg_not_init(struct bpf_reg_state *reg);
+ */
+ static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm)
+ {
+- reg->id = 0;
++ /* Clear id, off, and union(map_ptr, range) */
++ memset(((u8 *)reg) + sizeof(reg->type), 0,
++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type));
+ reg->var_off = tnum_const(imm);
+ reg->smin_value = (s64)imm;
+ reg->smax_value = (s64)imm;
+@@ -572,7 +574,6 @@ static void __mark_reg_known_zero(struct bpf_reg_state *reg)
+ static void __mark_reg_const_zero(struct bpf_reg_state *reg)
+ {
+ __mark_reg_known(reg, 0);
+- reg->off = 0;
+ reg->type = SCALAR_VALUE;
+ }
+
+@@ -683,9 +684,12 @@ static void __mark_reg_unbounded(struct bpf_reg_state *reg)
+ /* Mark a register as having a completely unknown (scalar) value. */
+ static void __mark_reg_unknown(struct bpf_reg_state *reg)
+ {
++ /*
++ * Clear type, id, off, and union(map_ptr, range) and
++ * padding between 'type' and union
++ */
++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off));
+ reg->type = SCALAR_VALUE;
+- reg->id = 0;
+- reg->off = 0;
+ reg->var_off = tnum_unknown;
+ reg->frameno = 0;
+ __mark_reg_unbounded(reg);
+@@ -1726,9 +1730,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
+ else
+ mark_reg_known_zero(env, regs,
+ value_regno);
+- regs[value_regno].id = 0;
+- regs[value_regno].off = 0;
+- regs[value_regno].range = 0;
+ regs[value_regno].type = reg_type;
+ }
+
+@@ -2549,7 +2550,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+- regs[BPF_REG_0].off = 0;
+ /* remember map_ptr, so that check_map_access()
+ * can check 'value_size' boundary of memory access
+ * to map element returned from bpf_map_lookup_elem()
+diff --git a/kernel/bpf/xskmap.c b/kernel/bpf/xskmap.c
+index b3c557476a8d..c98501a04742 100644
+--- a/kernel/bpf/xskmap.c
++++ b/kernel/bpf/xskmap.c
+@@ -191,11 +191,8 @@ static int xsk_map_update_elem(struct bpf_map *map, void *key, void *value,
+ sock_hold(sock->sk);
+
+ old_xs = xchg(&m->xsk_map[i], xs);
+- if (old_xs) {
+- /* Make sure we've flushed everything. */
+- synchronize_net();
++ if (old_xs)
+ sock_put((struct sock *)old_xs);
+- }
+
+ sockfd_put(sock);
+ return 0;
+@@ -211,11 +208,8 @@ static int xsk_map_delete_elem(struct bpf_map *map, void *key)
+ return -EINVAL;
+
+ old_xs = xchg(&m->xsk_map[k], NULL);
+- if (old_xs) {
+- /* Make sure we've flushed everything. */
+- synchronize_net();
++ if (old_xs)
+ sock_put((struct sock *)old_xs);
+- }
+
+ return 0;
+ }
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 517907b082df..3ec5a37e3068 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2033,6 +2033,12 @@ static void cpuhp_online_cpu_device(unsigned int cpu)
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { };
++
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+@@ -2059,8 +2065,10 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret)
++ if (!ret) {
+ cpu_smt_control = ctrlval;
++ arch_smt_update();
++ }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2071,6 +2079,7 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
++ arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c
+index d987dcd1bd56..54a33337680f 100644
+--- a/kernel/dma/contiguous.c
++++ b/kernel/dma/contiguous.c
+@@ -49,7 +49,11 @@ static phys_addr_t limit_cmdline;
+
+ static int __init early_cma(char *p)
+ {
+- pr_debug("%s(%s)\n", __func__, p);
++ if (!p) {
++ pr_err("Config string not provided\n");
++ return -EINVAL;
++ }
++
+ size_cmdline = memparse(p, &p);
+ if (*p != '@')
+ return 0;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 9a8b7ba9aa88..c4e31f44a0ff 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -920,6 +920,9 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action)
+
+ local_bh_disable();
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ local_bh_enable();
+ return ret;
+@@ -936,6 +939,9 @@ static irqreturn_t irq_thread_fn(struct irq_desc *desc,
+ irqreturn_t ret;
+
+ ret = action->thread_fn(action->irq, action->dev_id);
++ if (ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
++
+ irq_finalize_oneshot(desc, action);
+ return ret;
+ }
+@@ -1013,8 +1019,6 @@ static int irq_thread(void *data)
+ irq_thread_check_affinity(desc, action);
+
+ action_ret = handler_fn(desc, action);
+- if (action_ret == IRQ_HANDLED)
+- atomic_inc(&desc->threads_handled);
+ if (action_ret == IRQ_WAKE_THREAD)
+ irq_wake_secondary(desc, action);
+
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index f3183ad10d96..07f912b765db 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -700,9 +700,10 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ }
+
+ /* Cancel unoptimizing for reusing */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ struct optimized_kprobe *op;
++ int ret;
+
+ BUG_ON(!kprobe_unused(ap));
+ /*
+@@ -714,8 +715,12 @@ static void reuse_unused_kprobe(struct kprobe *ap)
+ /* Enable the probe again */
+ ap->flags &= ~KPROBE_FLAG_DISABLED;
+ /* Optimize it again (remove from op->list) */
+- BUG_ON(!kprobe_optready(ap));
++ ret = kprobe_optready(ap);
++ if (ret)
++ return ret;
++
+ optimize_kprobe(ap);
++ return 0;
+ }
+
+ /* Remove optimized instructions */
+@@ -940,11 +945,16 @@ static void __disarm_kprobe(struct kprobe *p, bool reopt)
+ #define kprobe_disarmed(p) kprobe_disabled(p)
+ #define wait_for_kprobe_optimizer() do {} while (0)
+
+-/* There should be no unused kprobes can be reused without optimization */
+-static void reuse_unused_kprobe(struct kprobe *ap)
++static int reuse_unused_kprobe(struct kprobe *ap)
+ {
++ /*
++ * If the optimized kprobe is NOT supported, the aggr kprobe is
++ * released at the same time that the last aggregated kprobe is
++ * unregistered.
++ * Thus there should be no chance to reuse unused kprobe.
++ */
+ printk(KERN_ERR "Error: There should be no unused kprobe here.\n");
+- BUG_ON(kprobe_unused(ap));
++ return -EINVAL;
+ }
+
+ static void free_aggr_kprobe(struct kprobe *p)
+@@ -1343,9 +1353,12 @@ static int register_aggr_kprobe(struct kprobe *orig_p, struct kprobe *p)
+ goto out;
+ }
+ init_aggr_kprobe(ap, orig_p);
+- } else if (kprobe_unused(ap))
++ } else if (kprobe_unused(ap)) {
+ /* This probe is going to die. Rescue it */
+- reuse_unused_kprobe(ap);
++ ret = reuse_unused_kprobe(ap);
++ if (ret)
++ goto out;
++ }
+
+ if (kprobe_gone(ap)) {
+ /*
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 5fa4d3138bf1..aa6ebb799f16 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4148,7 +4148,7 @@ void lock_contended(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+@@ -4168,7 +4168,7 @@ void lock_acquired(struct lockdep_map *lock, unsigned long ip)
+ {
+ unsigned long flags;
+
+- if (unlikely(!lock_stat))
++ if (unlikely(!lock_stat || !debug_locks))
+ return;
+
+ if (unlikely(current->lockdep_recursion))
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index 1d1513215c22..72de8cc5a13e 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -1047,7 +1047,12 @@ static void __init log_buf_len_update(unsigned size)
+ /* save requested log_buf_len since it's too early to process it */
+ static int __init log_buf_len_setup(char *str)
+ {
+- unsigned size = memparse(str, &str);
++ unsigned int size;
++
++ if (!str)
++ return -EINVAL;
++
++ size = memparse(str, &str);
+
+ log_buf_len_update(size);
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index b27b9509ea89..9e4f550e4797 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4321,7 +4321,7 @@ dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+ * put back on, and if we advance min_vruntime, we'll be placed back
+ * further than we started -- ie. we'll be penalized.
+ */
+- if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) == DEQUEUE_SAVE)
++ if ((flags & (DEQUEUE_SAVE | DEQUEUE_MOVE)) != DEQUEUE_SAVE)
+ update_min_vruntime(cfs_rq);
+ }
+
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 8d8a940422a8..dce9859f6547 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -1009,7 +1009,7 @@ static int __send_signal(int sig, struct siginfo *info, struct task_struct *t,
+
+ result = TRACE_SIGNAL_IGNORED;
+ if (!prepare_signal(sig, t,
+- from_ancestor_ns || (info == SEND_SIG_FORCED)))
++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED)))
+ goto ret;
+
+ pending = group ? &t->signal->shared_pending : &t->pending;
+@@ -2804,7 +2804,7 @@ COMPAT_SYSCALL_DEFINE2(rt_sigpending, compat_sigset_t __user *, uset,
+ }
+ #endif
+
+-enum siginfo_layout siginfo_layout(int sig, int si_code)
++enum siginfo_layout siginfo_layout(unsigned sig, int si_code)
+ {
+ enum siginfo_layout layout = SIL_KILL;
+ if ((si_code > SI_USER) && (si_code < SI_KERNEL)) {
+@@ -3417,7 +3417,8 @@ int do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
+ }
+
+ static int
+-do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
++do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp,
++ size_t min_ss_size)
+ {
+ struct task_struct *t = current;
+
+@@ -3447,7 +3448,7 @@ do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp)
+ ss_size = 0;
+ ss_sp = NULL;
+ } else {
+- if (unlikely(ss_size < MINSIGSTKSZ))
++ if (unlikely(ss_size < min_ss_size))
+ return -ENOMEM;
+ }
+
+@@ -3465,7 +3466,8 @@ SYSCALL_DEFINE2(sigaltstack,const stack_t __user *,uss, stack_t __user *,uoss)
+ if (uss && copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+ err = do_sigaltstack(uss ? &new : NULL, uoss ? &old : NULL,
+- current_user_stack_pointer());
++ current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ if (!err && uoss && copy_to_user(uoss, &old, sizeof(stack_t)))
+ err = -EFAULT;
+ return err;
+@@ -3476,7 +3478,8 @@ int restore_altstack(const stack_t __user *uss)
+ stack_t new;
+ if (copy_from_user(&new, uss, sizeof(stack_t)))
+ return -EFAULT;
+- (void)do_sigaltstack(&new, NULL, current_user_stack_pointer());
++ (void)do_sigaltstack(&new, NULL, current_user_stack_pointer(),
++ MINSIGSTKSZ);
+ /* squash all but EFAULT for now */
+ return 0;
+ }
+@@ -3510,7 +3513,8 @@ static int do_compat_sigaltstack(const compat_stack_t __user *uss_ptr,
+ uss.ss_size = uss32.ss_size;
+ }
+ ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss,
+- compat_user_stack_pointer());
++ compat_user_stack_pointer(),
++ COMPAT_MINSIGSTKSZ);
+ if (ret >= 0 && uoss_ptr) {
+ compat_stack_t old;
+ memset(&old, 0, sizeof(old));
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 6c78bc2b7fff..b3482eed270c 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -1072,8 +1072,10 @@ static int create_synth_event(int argc, char **argv)
+ event = NULL;
+ ret = -EEXIST;
+ goto out;
+- } else if (delete_event)
++ } else if (delete_event) {
++ ret = -ENOENT;
+ goto out;
++ }
+
+ if (argc < 2) {
+ ret = -EINVAL;
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index e5222b5fb4fe..923414a246e9 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -974,10 +974,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
+ goto out;
+
+- ret = sort_idmaps(&new_map);
+- if (ret < 0)
+- goto out;
+-
+ ret = -EPERM;
+ /* Map the lower ids from the parent user namespace to the
+ * kernel global id space.
+@@ -1004,6 +1000,14 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ e->lower_first = lower_first;
+ }
+
++ /*
++ * If we want to use binary search for lookup, this clones the extent
++ * array and sorts both copies.
++ */
++ ret = sort_idmaps(&new_map);
++ if (ret < 0)
++ goto out;
++
+ /* Install the map */
+ if (new_map.nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
+ memcpy(map->extent, new_map.extent,
+diff --git a/lib/debug_locks.c b/lib/debug_locks.c
+index 96c4c633d95e..124fdf238b3d 100644
+--- a/lib/debug_locks.c
++++ b/lib/debug_locks.c
+@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent);
+ */
+ int debug_locks_off(void)
+ {
+- if (__debug_locks_off()) {
++ if (debug_locks && __debug_locks_off()) {
+ if (!debug_locks_silent) {
+ console_verbose();
+ return 1;
+diff --git a/mm/hmm.c b/mm/hmm.c
+index f9d1d89dec4d..49e3db686348 100644
+--- a/mm/hmm.c
++++ b/mm/hmm.c
+@@ -91,16 +91,6 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ spin_lock_init(&hmm->lock);
+ hmm->mm = mm;
+
+- /*
+- * We should only get here if hold the mmap_sem in write mode ie on
+- * registration of first mirror through hmm_mirror_register()
+- */
+- hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
+- if (__mmu_notifier_register(&hmm->mmu_notifier, mm)) {
+- kfree(hmm);
+- return NULL;
+- }
+-
+ spin_lock(&mm->page_table_lock);
+ if (!mm->hmm)
+ mm->hmm = hmm;
+@@ -108,12 +98,27 @@ static struct hmm *hmm_register(struct mm_struct *mm)
+ cleanup = true;
+ spin_unlock(&mm->page_table_lock);
+
+- if (cleanup) {
+- mmu_notifier_unregister(&hmm->mmu_notifier, mm);
+- kfree(hmm);
+- }
++ if (cleanup)
++ goto error;
++
++ /*
++ * We should only get here if hold the mmap_sem in write mode ie on
++ * registration of first mirror through hmm_mirror_register()
++ */
++ hmm->mmu_notifier.ops = &hmm_mmu_notifier_ops;
++ if (__mmu_notifier_register(&hmm->mmu_notifier, mm))
++ goto error_mm;
+
+ return mm->hmm;
++
++error_mm:
++ spin_lock(&mm->page_table_lock);
++ if (mm->hmm == hmm)
++ mm->hmm = NULL;
++ spin_unlock(&mm->page_table_lock);
++error:
++ kfree(hmm);
++ return NULL;
+ }
+
+ void hmm_mm_destroy(struct mm_struct *mm)
+@@ -275,12 +280,13 @@ void hmm_mirror_unregister(struct hmm_mirror *mirror)
+ if (!should_unregister || mm == NULL)
+ return;
+
++ mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
++
+ spin_lock(&mm->page_table_lock);
+ if (mm->hmm == hmm)
+ mm->hmm = NULL;
+ spin_unlock(&mm->page_table_lock);
+
+- mmu_notifier_unregister_no_release(&hmm->mmu_notifier, mm);
+ kfree(hmm);
+ }
+ EXPORT_SYMBOL(hmm_mirror_unregister);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index f469315a6a0f..5b38fbef9441 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3678,6 +3678,12 @@ int huge_add_to_page_cache(struct page *page, struct address_space *mapping,
+ return err;
+ ClearPagePrivate(page);
+
++ /*
++ * set page dirty so that it will not be removed from cache/file
++ * by non-hugetlbfs specific code paths.
++ */
++ set_page_dirty(page);
++
+ spin_lock(&inode->i_lock);
+ inode->i_blocks += blocks_per_huge_page(h);
+ spin_unlock(&inode->i_lock);
+diff --git a/mm/page_vma_mapped.c b/mm/page_vma_mapped.c
+index ae3c2a35d61b..11df03e71288 100644
+--- a/mm/page_vma_mapped.c
++++ b/mm/page_vma_mapped.c
+@@ -21,7 +21,29 @@ static bool map_pte(struct page_vma_mapped_walk *pvmw)
+ if (!is_swap_pte(*pvmw->pte))
+ return false;
+ } else {
+- if (!pte_present(*pvmw->pte))
++ /*
++ * We get here when we are trying to unmap a private
++ * device page from the process address space. Such
++ * page is not CPU accessible and thus is mapped as
++ * a special swap entry, nonetheless it still does
++ * count as a valid regular mapping for the page (and
++ * is accounted as such in page maps count).
++ *
++ * So handle this special case as if it was a normal
++ * page mapping ie lock CPU page table and returns
++ * true.
++ *
++ * For more details on device private memory see HMM
++ * (include/linux/hmm.h or mm/hmm.c).
++ */
++ if (is_swap_pte(*pvmw->pte)) {
++ swp_entry_t entry;
++
++ /* Handle un-addressable ZONE_DEVICE memory */
++ entry = pte_to_swp_entry(*pvmw->pte);
++ if (!is_device_private_entry(entry))
++ return false;
++ } else if (!pte_present(*pvmw->pte))
+ return false;
+ }
+ }
+diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c
+index 5e4f04004a49..7bf833598615 100644
+--- a/net/core/netclassid_cgroup.c
++++ b/net/core/netclassid_cgroup.c
+@@ -106,6 +106,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft,
+ iterate_fd(p->files, 0, update_classid_sock,
+ (void *)(unsigned long)cs->classid);
+ task_unlock(p);
++ cond_resched();
+ }
+ css_task_iter_end(&it);
+
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index 82178cc69c96..777fa3b7fb13 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -1512,7 +1512,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
+ *
+ * Description:
+ * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
+- * to the start of the CIPSO option on success, NULL if one if not found.
++ * to the start of the CIPSO option on success, NULL if one is not found.
+ *
+ */
+ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+@@ -1522,10 +1522,8 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ int optlen;
+ int taglen;
+
+- for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
++ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
+ switch (optptr[0]) {
+- case IPOPT_CIPSO:
+- return optptr;
+ case IPOPT_END:
+ return NULL;
+ case IPOPT_NOOP:
+@@ -1534,6 +1532,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
+ default:
+ taglen = optptr[1];
+ }
++ if (!taglen || taglen > optlen)
++ return NULL;
++ if (optptr[0] == IPOPT_CIPSO)
++ return optptr;
++
+ optlen -= taglen;
+ optptr += taglen;
+ }
+diff --git a/net/netfilter/xt_nat.c b/net/netfilter/xt_nat.c
+index 8af9707f8789..ac91170fc8c8 100644
+--- a/net/netfilter/xt_nat.c
++++ b/net/netfilter/xt_nat.c
+@@ -216,6 +216,8 @@ static struct xt_target xt_nat_target_reg[] __read_mostly = {
+ {
+ .name = "DNAT",
+ .revision = 2,
++ .checkentry = xt_nat_checkentry,
++ .destroy = xt_nat_destroy,
+ .target = xt_dnat_target_v2,
+ .targetsize = sizeof(struct nf_nat_range2),
+ .table = "nat",
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index 57f71765febe..ce852f8c1d27 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1306,7 +1306,6 @@ check_loop_fn(struct Qdisc *q, unsigned long cl, struct qdisc_walker *w)
+
+ const struct nla_policy rtm_tca_policy[TCA_MAX + 1] = {
+ [TCA_KIND] = { .type = NLA_STRING },
+- [TCA_OPTIONS] = { .type = NLA_NESTED },
+ [TCA_RATE] = { .type = NLA_BINARY,
+ .len = sizeof(struct tc_estimator) },
+ [TCA_STAB] = { .type = NLA_NESTED },
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 5185efb9027b..83ccd0221c98 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -989,7 +989,7 @@ static void call_xpt_users(struct svc_xprt *xprt)
+ spin_lock(&xprt->xpt_lock);
+ while (!list_empty(&xprt->xpt_users)) {
+ u = list_first_entry(&xprt->xpt_users, struct svc_xpt_user, list);
+- list_del(&u->list);
++ list_del_init(&u->list);
+ u->callback(u);
+ }
+ spin_unlock(&xprt->xpt_lock);
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+index a68180090554..b9827665ff35 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -248,6 +248,7 @@ static void
+ xprt_rdma_bc_close(struct rpc_xprt *xprt)
+ {
+ dprintk("svcrdma: %s: xprt %p\n", __func__, xprt);
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ static void
+diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c
+index 143ce2579ba9..98cbc7b060ba 100644
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -468,6 +468,12 @@ xprt_rdma_close(struct rpc_xprt *xprt)
+ xprt->reestablish_timeout = 0;
+ xprt_disconnect_done(xprt);
+ rpcrdma_ep_disconnect(ep, ia);
++
++ /* Prepare @xprt for the next connection by reinitializing
++ * its credit grant to one (see RFC 8166, Section 3.3.3).
++ */
++ r_xprt->rx_buf.rb_credits = 1;
++ xprt->cwnd = RPC_CWNDSHIFT;
+ }
+
+ /**
+diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
+index 4e937cd7c17d..661504042d30 100644
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -744,6 +744,8 @@ static int xsk_create(struct net *net, struct socket *sock, int protocol,
+ sk->sk_destruct = xsk_destruct;
+ sk_refcnt_debug_inc(sk);
+
++ sock_set_flag(sk, SOCK_RCU_FREE);
++
+ xs = xdp_sk(sk);
+ mutex_init(&xs->mutex);
+ spin_lock_init(&xs->tx_completion_lock);
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 526e6814ed4b..1d2e0a90c0ca 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -625,9 +625,9 @@ static void xfrm_hash_rebuild(struct work_struct *work)
+ break;
+ }
+ if (newpos)
+- hlist_add_behind(&policy->bydst, newpos);
++ hlist_add_behind_rcu(&policy->bydst, newpos);
+ else
+- hlist_add_head(&policy->bydst, chain);
++ hlist_add_head_rcu(&policy->bydst, chain);
+ }
+
+ spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
+@@ -766,9 +766,9 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
+ break;
+ }
+ if (newpos)
+- hlist_add_behind(&policy->bydst, newpos);
++ hlist_add_behind_rcu(&policy->bydst, newpos);
+ else
+- hlist_add_head(&policy->bydst, chain);
++ hlist_add_head_rcu(&policy->bydst, chain);
+ __xfrm_policy_link(policy, dir);
+
+ /* After previous checking, family can either be AF_INET or AF_INET6 */
+diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
+index ae9d5c766a3c..cfb8cc3b975e 100644
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -42,14 +42,14 @@ static int __init default_canonical_fmt_setup(char *str)
+ __setup("ima_canonical_fmt", default_canonical_fmt_setup);
+
+ static int valid_policy = 1;
+-#define TMPBUFLEN 12
++
+ static ssize_t ima_show_htable_value(char __user *buf, size_t count,
+ loff_t *ppos, atomic_long_t *val)
+ {
+- char tmpbuf[TMPBUFLEN];
++ char tmpbuf[32]; /* greater than largest 'long' string value */
+ ssize_t len;
+
+- len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
++ len = scnprintf(tmpbuf, sizeof(tmpbuf), "%li\n", atomic_long_read(val));
+ return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
+ }
+
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 2b5ee5fbd652..4680a217d0fa 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1509,6 +1509,11 @@ static int selinux_genfs_get_sid(struct dentry *dentry,
+ }
+ rc = security_genfs_sid(&selinux_state, sb->s_type->name,
+ path, tclass, sid);
++ if (rc == -ENOENT) {
++ /* No match in policy, mark as unlabeled. */
++ *sid = SECINITSID_UNLABELED;
++ rc = 0;
++ }
+ }
+ free_page((unsigned long)buffer);
+ return rc;
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 8b6cd5a79bfa..a81d815c81f3 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -420,6 +420,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ struct smk_audit_info ad, *saip = NULL;
+ struct task_smack *tsp;
+ struct smack_known *tracer_known;
++ const struct cred *tracercred;
+
+ if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
+ smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
+@@ -428,7 +429,8 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ }
+
+ rcu_read_lock();
+- tsp = __task_cred(tracer)->security;
++ tracercred = __task_cred(tracer);
++ tsp = tracercred->security;
+ tracer_known = smk_of_task(tsp);
+
+ if ((mode & PTRACE_MODE_ATTACH) &&
+@@ -438,7 +440,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer,
+ rc = 0;
+ else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
+ rc = -EACCES;
+- else if (capable(CAP_SYS_PTRACE))
++ else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
+ rc = 0;
+ else
+ rc = -EACCES;
+@@ -1840,6 +1842,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ {
+ struct smack_known *skp;
+ struct smack_known *tkp = smk_of_task(tsk->cred->security);
++ const struct cred *tcred;
+ struct file *file;
+ int rc;
+ struct smk_audit_info ad;
+@@ -1853,8 +1856,12 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
+ skp = file->f_security;
+ rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
+ rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
+- if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
++
++ rcu_read_lock();
++ tcred = __task_cred(tsk);
++ if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
+ rc = 0;
++ rcu_read_unlock();
+
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, tsk);
+diff --git a/sound/pci/ca0106/ca0106.h b/sound/pci/ca0106/ca0106.h
+index 04402c14cb23..9847b669cf3c 100644
+--- a/sound/pci/ca0106/ca0106.h
++++ b/sound/pci/ca0106/ca0106.h
+@@ -582,7 +582,7 @@
+ #define SPI_PL_BIT_R_R (2<<7) /* right channel = right */
+ #define SPI_PL_BIT_R_C (3<<7) /* right channel = (L+R)/2 */
+ #define SPI_IZD_REG 2
+-#define SPI_IZD_BIT (1<<4) /* infinite zero detect */
++#define SPI_IZD_BIT (0<<4) /* infinite zero detect */
+
+ #define SPI_FMT_REG 3
+ #define SPI_FMT_BIT_RJ (0<<0) /* right justified mode */
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index a68e75b00ea3..53c3cd28bc99 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -160,6 +160,7 @@ struct azx {
+ unsigned int msi:1;
+ unsigned int probing:1; /* codec probing phase */
+ unsigned int snoop:1;
++ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */
+ unsigned int align_buffer_size:1;
+ unsigned int region_requested:1;
+ unsigned int disabled:1; /* disabled by vga_switcheroo */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 28dc5e124995..6f6703e53a05 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -410,7 +410,7 @@ static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool
+ #ifdef CONFIG_SND_DMA_SGBUF
+ if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
+ struct snd_sg_buf *sgbuf = dmab->private_data;
+- if (chip->driver_type == AZX_DRIVER_CMEDIA)
++ if (!chip->uc_buffer)
+ return; /* deal with only CORB/RIRB buffers */
+ if (on)
+ set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
+@@ -1636,6 +1636,7 @@ static void azx_check_snoop_available(struct azx *chip)
+ dev_info(chip->card->dev, "Force to %s mode by module option\n",
+ snoop ? "snoop" : "non-snoop");
+ chip->snoop = snoop;
++ chip->uc_buffer = !snoop;
+ return;
+ }
+
+@@ -1656,8 +1657,12 @@ static void azx_check_snoop_available(struct azx *chip)
+ snoop = false;
+
+ chip->snoop = snoop;
+- if (!snoop)
++ if (!snoop) {
+ dev_info(chip->card->dev, "Force to non-snoop mode\n");
++ /* C-Media requires non-cached pages only for CORB/RIRB */
++ if (chip->driver_type != AZX_DRIVER_CMEDIA)
++ chip->uc_buffer = true;
++ }
+ }
+
+ static void azx_probe_work(struct work_struct *work)
+@@ -2096,7 +2101,7 @@ static void pcm_mmap_prepare(struct snd_pcm_substream *substream,
+ #ifdef CONFIG_X86
+ struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
+ struct azx *chip = apcm->chip;
+- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA)
++ if (chip->uc_buffer)
+ area->vm_page_prot = pgprot_writecombine(area->vm_page_prot);
+ #endif
+ }
+@@ -2215,8 +2220,12 @@ static struct snd_pci_quirk power_save_blacklist[] = {
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1581607 */
+ SND_PCI_QUIRK(0x1558, 0x3501, "Clevo W35xSS_370SS", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x1028, 0x0497, "Dell Precision T3600", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
+ /* Note the P55A-UD3 and Z87-D3HP share the subsys id for the HDA dev */
+ SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P55A-UD3 / Z87-D3HP", 0),
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */
++ SND_PCI_QUIRK(0x8086, 0x2040, "Intel DZ77BH-55K", 0),
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=199607 */
+ SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0),
+ /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 1a8a2d440fbd..7d6c3cebb0e3 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -980,6 +980,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
++ SND_PCI_QUIRK(0x17aa, 0x3905, "Lenovo G50-30", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 08b6369f930b..23dd4bb026d1 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6799,6 +6799,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x1a, 0x02a11040},
+ {0x1b, 0x01014020},
+ {0x21, 0x0221101f}),
++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
++ {0x14, 0x90170110},
++ {0x19, 0x02a11030},
++ {0x1a, 0x02a11040},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION,
+ {0x14, 0x90170110},
+ {0x19, 0x02a11020},
+@@ -7690,6 +7696,8 @@ enum {
+ ALC662_FIXUP_ASUS_Nx50,
+ ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ ALC668_FIXUP_ASUS_Nx51,
++ ALC668_FIXUP_MIC_COEF,
++ ALC668_FIXUP_ASUS_G751,
+ ALC891_FIXUP_HEADSET_MODE,
+ ALC891_FIXUP_DELL_MIC_NO_PRESENCE,
+ ALC662_FIXUP_ACER_VERITON,
+@@ -7959,6 +7967,23 @@ static const struct hda_fixup alc662_fixups[] = {
+ .chained = true,
+ .chain_id = ALC668_FIXUP_ASUS_Nx51_HEADSET_MODE,
+ },
++ [ALC668_FIXUP_MIC_COEF] = {
++ .type = HDA_FIXUP_VERBS,
++ .v.verbs = (const struct hda_verb[]) {
++ { 0x20, AC_VERB_SET_COEF_INDEX, 0xc3 },
++ { 0x20, AC_VERB_SET_PROC_COEF, 0x4000 },
++ {}
++ },
++ },
++ [ALC668_FIXUP_ASUS_G751] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x16, 0x0421101f }, /* HP */
++ {}
++ },
++ .chained = true,
++ .chain_id = ALC668_FIXUP_MIC_COEF
++ },
+ [ALC891_FIXUP_HEADSET_MODE] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_headset_mode,
+@@ -8032,6 +8057,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
+ SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
++ SND_PCI_QUIRK(0x1043, 0x12ff, "ASUS G751", ALC668_FIXUP_ASUS_G751),
+ SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ SND_PCI_QUIRK(0x1043, 0x177d, "ASUS N551", ALC668_FIXUP_ASUS_Nx51),
+diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
+index d5035f2f2b2b..ce508b4cc85c 100644
+--- a/sound/soc/codecs/sta32x.c
++++ b/sound/soc/codecs/sta32x.c
+@@ -879,6 +879,9 @@ static int sta32x_probe(struct snd_soc_component *component)
+ struct sta32x_priv *sta32x = snd_soc_component_get_drvdata(component);
+ struct sta32x_platform_data *pdata = sta32x->pdata;
+ int i, ret = 0, thermal = 0;
++
++ sta32x->component = component;
++
+ ret = regulator_bulk_enable(ARRAY_SIZE(sta32x->supplies),
+ sta32x->supplies);
+ if (ret != 0) {
+diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
+index fcdc716754b6..bde2effde861 100644
+--- a/sound/soc/intel/skylake/skl-topology.c
++++ b/sound/soc/intel/skylake/skl-topology.c
+@@ -2458,6 +2458,7 @@ static int skl_tplg_get_token(struct device *dev,
+
+ case SKL_TKN_U8_CORE_ID:
+ mconfig->core_id = tkn_elem->value;
++ break;
+
+ case SKL_TKN_U8_MOD_TYPE:
+ mconfig->m_type = tkn_elem->value;
+diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config
+index 67b042738ed7..986151732d68 100644
+--- a/tools/perf/Makefile.config
++++ b/tools/perf/Makefile.config
+@@ -831,7 +831,7 @@ ifndef NO_JVMTI
+ JDIR=$(shell /usr/sbin/update-java-alternatives -l | head -1 | awk '{print $$3}')
+ else
+ ifneq (,$(wildcard /usr/sbin/alternatives))
+- JDIR=$(shell alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g')
++ JDIR=$(shell /usr/sbin/alternatives --display java | tail -1 | cut -d' ' -f 5 | sed 's%/jre/bin/java.%%g')
+ endif
+ endif
+ ifndef JDIR
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index c04dc7b53797..82a3c8be19ee 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -981,6 +981,7 @@ int cmd_report(int argc, const char **argv)
+ .id_index = perf_event__process_id_index,
+ .auxtrace_info = perf_event__process_auxtrace_info,
+ .auxtrace = perf_event__process_auxtrace,
++ .event_update = perf_event__process_event_update,
+ .feature = process_feature_event,
+ .ordered_events = true,
+ .ordering_requires_timestamps = true,
+diff --git a/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json b/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json
+index d40498f2cb1e..635c09fda1d9 100644
+--- a/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json
++++ b/tools/perf/pmu-events/arch/x86/ivytown/uncore-power.json
+@@ -188,7 +188,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES",
+- "Filter": "filter_band0=1200",
++ "Filter": "filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -199,7 +199,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES",
+- "Filter": "filter_band1=2000",
++ "Filter": "filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -210,7 +210,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES",
+- "Filter": "filter_band2=3000",
++ "Filter": "filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -221,7 +221,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES",
+- "Filter": "filter_band3=4000",
++ "Filter": "filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+@@ -232,7 +232,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band0=1200",
++ "Filter": "edge=1,filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -243,7 +243,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band1=2000",
++ "Filter": "edge=1,filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -254,7 +254,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band2=4000",
++ "Filter": "edge=1,filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -265,7 +265,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band3=4000",
++ "Filter": "edge=1,filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+diff --git a/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json b/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json
+index 16034bfd06dd..8755693d86c6 100644
+--- a/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json
++++ b/tools/perf/pmu-events/arch/x86/jaketown/uncore-power.json
+@@ -187,7 +187,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_CYCLES",
+- "Filter": "filter_band0=1200",
++ "Filter": "filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -198,7 +198,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_CYCLES",
+- "Filter": "filter_band1=2000",
++ "Filter": "filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -209,7 +209,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_CYCLES",
+- "Filter": "filter_band2=3000",
++ "Filter": "filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -220,7 +220,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_CYCLES",
+- "Filter": "filter_band3=4000",
++ "Filter": "filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+@@ -231,7 +231,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xb",
+ "EventName": "UNC_P_FREQ_GE_1200MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band0=1200",
++ "Filter": "edge=1,filter_band0=12",
+ "MetricExpr": "(UNC_P_FREQ_GE_1200MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_1200mhz_cycles %",
+ "PerPkg": "1",
+@@ -242,7 +242,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xc",
+ "EventName": "UNC_P_FREQ_GE_2000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band1=2000",
++ "Filter": "edge=1,filter_band1=20",
+ "MetricExpr": "(UNC_P_FREQ_GE_2000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_2000mhz_cycles %",
+ "PerPkg": "1",
+@@ -253,7 +253,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xd",
+ "EventName": "UNC_P_FREQ_GE_3000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band2=4000",
++ "Filter": "edge=1,filter_band2=30",
+ "MetricExpr": "(UNC_P_FREQ_GE_3000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_3000mhz_cycles %",
+ "PerPkg": "1",
+@@ -264,7 +264,7 @@
+ "Counter": "0,1,2,3",
+ "EventCode": "0xe",
+ "EventName": "UNC_P_FREQ_GE_4000MHZ_TRANSITIONS",
+- "Filter": "edge=1,filter_band3=4000",
++ "Filter": "edge=1,filter_band3=40",
+ "MetricExpr": "(UNC_P_FREQ_GE_4000MHZ_CYCLES / UNC_P_CLOCKTICKS) * 100.",
+ "MetricName": "freq_ge_4000mhz_cycles %",
+ "PerPkg": "1",
+diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+index 3013ac8f83d0..cab7b0aea6ea 100755
+--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh
+@@ -48,7 +48,7 @@ trace_libc_inet_pton_backtrace() {
+ *)
+ eventattr='max-stack=3'
+ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected
+- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected
++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected
+ ;;
+ esac
+
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index 0c8ecf0c78a4..6f3db78efe39 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -1074,6 +1074,7 @@ void *cpu_map_data__alloc(struct cpu_map *map, size_t *size, u16 *type, int *max
+ }
+
+ *size += sizeof(struct cpu_map_data);
++ *size = PERF_ALIGN(*size, sizeof(u64));
+ return zalloc(*size);
+ }
+
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 6324afba8fdd..86ad1389ff5a 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -1078,6 +1078,9 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts,
+ attr->exclude_user = 1;
+ }
+
++ if (evsel->own_cpus)
++ evsel->attr.read_format |= PERF_FORMAT_ID;
++
+ /*
+ * Apply event specific term settings,
+ * it overloads any global configuration.
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 3ba6a1742f91..02580f3ded1a 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -936,13 +936,14 @@ static void pmu_format_value(unsigned long *format, __u64 value, __u64 *v,
+
+ static __u64 pmu_format_max_value(const unsigned long *format)
+ {
+- __u64 w = 0;
+- int fbit;
+-
+- for_each_set_bit(fbit, format, PERF_PMU_FORMAT_BITS)
+- w |= (1ULL << fbit);
++ int w;
+
+- return w;
++ w = bitmap_weight(format, PERF_PMU_FORMAT_BITS);
++ if (!w)
++ return 0;
++ if (w < 64)
++ return (1ULL << w) - 1;
++ return -1;
+ }
+
+ /*
+diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
+index 09d6746e6ec8..e767c4a9d4d2 100644
+--- a/tools/perf/util/srcline.c
++++ b/tools/perf/util/srcline.c
+@@ -85,6 +85,9 @@ static struct symbol *new_inline_sym(struct dso *dso,
+ struct symbol *inline_sym;
+ char *demangled = NULL;
+
++ if (!funcname)
++ funcname = "??";
++
+ if (dso) {
+ demangled = dso__demangle_sym(dso, 0, funcname);
+ if (demangled)
+diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
+index 3d1cf5bf7f18..9005fbe0780e 100644
+--- a/tools/perf/util/strbuf.c
++++ b/tools/perf/util/strbuf.c
+@@ -98,19 +98,25 @@ static int strbuf_addv(struct strbuf *sb, const char *fmt, va_list ap)
+
+ va_copy(ap_saved, ap);
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap);
+- if (len < 0)
++ if (len < 0) {
++ va_end(ap_saved);
+ return len;
++ }
+ if (len > strbuf_avail(sb)) {
+ ret = strbuf_grow(sb, len);
+- if (ret)
++ if (ret) {
++ va_end(ap_saved);
+ return ret;
++ }
+ len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved);
+ va_end(ap_saved);
+ if (len > strbuf_avail(sb)) {
+ pr_debug("this should not happen, your vsnprintf is broken");
++ va_end(ap_saved);
+ return -EINVAL;
+ }
+ }
++ va_end(ap_saved);
+ return strbuf_setlen(sb, sb->len + len);
+ }
+
+diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
+index 7b0ca7cbb7de..8ad8e755127b 100644
+--- a/tools/perf/util/trace-event-info.c
++++ b/tools/perf/util/trace-event-info.c
+@@ -531,12 +531,14 @@ struct tracing_data *tracing_data_get(struct list_head *pattrs,
+ "/tmp/perf-XXXXXX");
+ if (!mkstemp(tdata->temp_file)) {
+ pr_debug("Can't make temp file");
++ free(tdata);
+ return NULL;
+ }
+
+ temp_fd = open(tdata->temp_file, O_RDWR);
+ if (temp_fd < 0) {
+ pr_debug("Can't read '%s'", tdata->temp_file);
++ free(tdata);
+ return NULL;
+ }
+
+diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
+index 40b425949aa3..2d50e4384c72 100644
+--- a/tools/perf/util/trace-event-read.c
++++ b/tools/perf/util/trace-event-read.c
+@@ -349,9 +349,12 @@ static int read_event_files(struct pevent *pevent)
+ for (x=0; x < count; x++) {
+ size = read8(pevent);
+ ret = read_event_file(pevent, sys, size);
+- if (ret)
++ if (ret) {
++ free(sys);
+ return ret;
++ }
+ }
++ free(sys);
+ }
+ return 0;
+ }
+diff --git a/tools/power/cpupower/utils/cpufreq-info.c b/tools/power/cpupower/utils/cpufreq-info.c
+index df43cd45d810..ccd08dd00996 100644
+--- a/tools/power/cpupower/utils/cpufreq-info.c
++++ b/tools/power/cpupower/utils/cpufreq-info.c
+@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int cpu)
+ printf(_(" Boost States: %d\n"), b_states);
+ printf(_(" Total States: %d\n"), pstate_no);
+ for (i = 0; i < pstate_no; i++) {
++ if (!pstates[i])
++ continue;
+ if (i < b_states)
+ printf(_(" Pstate-Pb%d: %luMHz (boost state)"
+ "\n"), i, pstates[i]);
+diff --git a/tools/power/cpupower/utils/helpers/amd.c b/tools/power/cpupower/utils/helpers/amd.c
+index bb41cdd0df6b..9607ada5b29a 100644
+--- a/tools/power/cpupower/utils/helpers/amd.c
++++ b/tools/power/cpupower/utils/helpers/amd.c
+@@ -33,7 +33,7 @@ union msr_pstate {
+ unsigned vid:8;
+ unsigned iddval:8;
+ unsigned idddiv:2;
+- unsigned res1:30;
++ unsigned res1:31;
+ unsigned en:1;
+ } fam17h_bits;
+ unsigned long long val;
+@@ -119,6 +119,11 @@ int decode_pstates(unsigned int cpu, unsigned int cpu_family,
+ }
+ if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val))
+ return -1;
++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en))
++ continue;
++ else if (!pstate.bits.en)
++ continue;
++
+ pstates[i] = get_cof(cpu_family, pstate);
+ }
+ *no = i;
+diff --git a/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh b/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh
+index 1893d0f59ad7..059b7e81b922 100755
+--- a/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh
++++ b/tools/testing/selftests/drivers/usb/usbip/usbip_test.sh
+@@ -143,6 +143,10 @@ echo "Import devices from localhost - should work"
+ src/usbip attach -r localhost -b $busid;
+ echo "=============================================================="
+
++# Wait for sysfs file to be updated. Without this sleep, usbip port
++# shows no imported devices.
++sleep 3;
++
+ echo "List imported devices - expect to see imported devices";
+ src/usbip port;
+ echo "=============================================================="
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+index cef11377dcbd..c604438df13b 100644
+--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc
+@@ -35,18 +35,18 @@ fi
+
+ reset_trigger
+
+-echo "Test create synthetic event with an error"
+-echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
++echo "Test remove synthetic event"
++echo '!wakeup_latency u64 lat pid_t pid char comm[16]' >> synthetic_events
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Created wakeup_latency synthetic event with an invalid format"
++ fail "Failed to delete wakeup_latency synthetic event"
+ fi
+
+ reset_trigger
+
+-echo "Test remove synthetic event"
+-echo '!wakeup_latency u64 lat pid_t pid char comm[16]' > synthetic_events
++echo "Test create synthetic event with an error"
++echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null
+ if [ -d events/synthetic/wakeup_latency ]; then
+- fail "Failed to delete wakeup_latency synthetic event"
++ fail "Created wakeup_latency synthetic event with an invalid format"
+ fi
+
+ do_reset
+diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+new file mode 100644
+index 000000000000..88e6c3f43006
+--- /dev/null
++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-syntax.tc
+@@ -0,0 +1,80 @@
++#!/bin/sh
++# SPDX-License-Identifier: GPL-2.0
++# description: event trigger - test synthetic_events syntax parser
++
++do_reset() {
++ reset_trigger
++ echo > set_event
++ clear_trace
++}
++
++fail() { #msg
++ do_reset
++ echo $1
++ exit_fail
++}
++
++if [ ! -f set_event ]; then
++ echo "event tracing is not supported"
++ exit_unsupported
++fi
++
++if [ ! -f synthetic_events ]; then
++ echo "synthetic event is not supported"
++ exit_unsupported
++fi
++
++reset_tracer
++do_reset
++
++echo "Test synthetic_events syntax parser"
++
++echo > synthetic_events
++
++# synthetic event must have a field
++! echo "myevent" >> synthetic_events
++echo "myevent u64 var1" >> synthetic_events
++
++# synthetic event must be found in synthetic_events
++grep "myevent[[:space:]]u64 var1" synthetic_events
++
++# it is not possible to add same name event
++! echo "myevent u64 var2" >> synthetic_events
++
++# Non-append open will cleanup all events and add new one
++echo "myevent u64 var2" > synthetic_events
++
++# multiple fields with different spaces
++echo "myevent u64 var1; u64 var2;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ; u64 var2 ;" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++echo "myevent u64 var1 ;u64 var2" > synthetic_events
++grep "myevent[[:space:]]u64 var1; u64 var2" synthetic_events
++
++# test field types
++echo "myevent u32 var" > synthetic_events
++echo "myevent u16 var" > synthetic_events
++echo "myevent u8 var" > synthetic_events
++echo "myevent s64 var" > synthetic_events
++echo "myevent s32 var" > synthetic_events
++echo "myevent s16 var" > synthetic_events
++echo "myevent s8 var" > synthetic_events
++
++echo "myevent char var" > synthetic_events
++echo "myevent int var" > synthetic_events
++echo "myevent long var" > synthetic_events
++echo "myevent pid_t var" > synthetic_events
++
++echo "myevent unsigned char var" > synthetic_events
++echo "myevent unsigned int var" > synthetic_events
++echo "myevent unsigned long var" > synthetic_events
++grep "myevent[[:space:]]unsigned long var" synthetic_events
++
++# test string type
++echo "myevent char var[10]" > synthetic_events
++grep "myevent[[:space:]]char\[10\] var" synthetic_events
++
++do_reset
++
++exit 0
+diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c
+index cad14cd0ea92..b5277106df1f 100644
+--- a/tools/testing/selftests/net/reuseport_bpf.c
++++ b/tools/testing/selftests/net/reuseport_bpf.c
+@@ -437,14 +437,19 @@ void enable_fastopen(void)
+ }
+ }
+
+-static struct rlimit rlim_old, rlim_new;
++static struct rlimit rlim_old;
+
+ static __attribute__((constructor)) void main_ctor(void)
+ {
+ getrlimit(RLIMIT_MEMLOCK, &rlim_old);
+- rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
+- rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
+- setrlimit(RLIMIT_MEMLOCK, &rlim_new);
++
++ if (rlim_old.rlim_cur != RLIM_INFINITY) {
++ struct rlimit rlim_new;
++
++ rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20);
++ rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20);
++ setrlimit(RLIMIT_MEMLOCK, &rlim_new);
++ }
+ }
+
+ static __attribute__((destructor)) void main_dtor(void)
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+index 327fa943c7f3..dbdffa2e2c82 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c
+@@ -67,8 +67,8 @@ trans:
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+ : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2), [gpr_4]"i"(GPR_4),
+- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a),
+- [flt_2] "r" (&b), [flt_4] "r" (&d)
++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a),
++ [flt_4] "b" (&d)
+ : "memory", "r5", "r6", "r7",
+ "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
+ "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23",
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 04e554cae3a2..f8c2b9e7c19c 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1244,8 +1244,6 @@ static void cpu_init_hyp_mode(void *dummy)
+
+ __cpu_init_hyp_mode(pgd_ptr, hyp_stack_ptr, vector_ptr);
+ __cpu_init_stage2();
+-
+- kvm_arm_init_debug();
+ }
+
+ static void cpu_hyp_reset(void)
+@@ -1269,6 +1267,8 @@ static void cpu_hyp_reinit(void)
+ cpu_init_hyp_mode(NULL);
+ }
+
++ kvm_arm_init_debug();
++
+ if (vgic_present)
+ kvm_vgic_init_cpu_hardware();
+ }
+diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
+index fd8c88463928..fbba603caf1b 100644
+--- a/virt/kvm/arm/mmu.c
++++ b/virt/kvm/arm/mmu.c
+@@ -1201,8 +1201,14 @@ static bool transparent_hugepage_adjust(kvm_pfn_t *pfnp, phys_addr_t *ipap)
+ {
+ kvm_pfn_t pfn = *pfnp;
+ gfn_t gfn = *ipap >> PAGE_SHIFT;
++ struct page *page = pfn_to_page(pfn);
+
+- if (PageTransCompoundMap(pfn_to_page(pfn))) {
++ /*
++ * PageTransCompoungMap() returns true for THP and
++ * hugetlbfs. Make sure the adjustment is done only for THP
++ * pages.
++ */
++ if (!PageHuge(page) && PageTransCompoundMap(page)) {
+ unsigned long mask;
+ /*
+ * The address we faulted on is backed by a transparent huge
next reply other threads:[~2018-11-13 21:17 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-13 21:17 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2018-11-21 12:28 [gentoo-commits] proj/linux-patches:4.18 commit in: / Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 11:40 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-11 1:51 Mike Pagano
2018-11-10 21:33 Mike Pagano
2018-11-04 17:33 Alice Ferrazzi
2018-10-20 12:36 Mike Pagano
2018-10-18 10:27 Mike Pagano
2018-10-13 16:32 Mike Pagano
2018-10-10 11:16 Mike Pagano
2018-10-04 10:44 Mike Pagano
2018-09-29 13:36 Mike Pagano
2018-09-26 10:40 Mike Pagano
2018-09-19 22:41 Mike Pagano
2018-09-15 10:12 Mike Pagano
2018-09-09 11:25 Mike Pagano
2018-09-05 15:30 Mike Pagano
2018-08-24 11:46 Mike Pagano
2018-08-22 9:59 Alice Ferrazzi
2018-08-18 18:13 Mike Pagano
2018-08-17 19:44 Mike Pagano
2018-08-17 19:28 Mike Pagano
2018-08-16 11:45 Mike Pagano
2018-08-15 16:36 Mike Pagano
2018-08-12 23:21 Mike Pagano
2018-08-12 23:15 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1542143816.baff7bbd22061d6307a998016251982c843d4cb7.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox