From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 44C8C138334 for ; Wed, 14 Nov 2018 11:38:02 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 7FAF3E0B67; Wed, 14 Nov 2018 11:37:57 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 1165AE0B66 for ; Wed, 14 Nov 2018 11:37:57 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 924A6335CCB for ; Wed, 14 Nov 2018 11:37:55 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id E8A18476 for ; Wed, 14 Nov 2018 11:37:51 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1542195385.a593437457757a3aee0bc1ec58a17bfd226271e3.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1009_linux-4.18.10.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: a593437457757a3aee0bc1ec58a17bfd226271e3 X-VCS-Branch: 4.18 Date: Wed, 14 Nov 2018 11:37:51 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 2e5369ec-1d41-455e-8c59-d049b9950080 X-Archives-Hash: 4a057e888e90ac7dadd258f9af9143cb commit: a593437457757a3aee0bc1ec58a17bfd226271e3 Author: Mike Pagano gentoo org> AuthorDate: Wed Sep 26 10:40:05 2018 +0000 Commit: Mike Pagano gentoo org> CommitDate: Wed Nov 14 11:36:25 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a5934374 Linux patch 4.18.10 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1009_linux-4.18.10.patch | 6974 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 6978 insertions(+) diff --git a/0000_README b/0000_README index 6534d27..a9e2bd7 100644 --- a/0000_README +++ b/0000_README @@ -79,6 +79,10 @@ Patch: 1008_linux-4.18.9.patch From: http://www.kernel.org Desc: Linux 4.18.9 +Patch: 1009_linux-4.18.10.patch +From: http://www.kernel.org +Desc: Linux 4.18.10 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1009_linux-4.18.10.patch b/1009_linux-4.18.10.patch new file mode 100644 index 0000000..16ee162 --- /dev/null +++ b/1009_linux-4.18.10.patch @@ -0,0 +1,6974 @@ +diff --git a/Makefile b/Makefile +index 1178348fb9ca..ffab15235ff0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 18 +-SUBLEVEL = 9 ++SUBLEVEL = 10 + EXTRAVERSION = + NAME = Merciless Moray + +@@ -225,10 +225,12 @@ no-dot-config-targets := $(clean-targets) \ + cscope gtags TAGS tags help% %docs check% coccicheck \ + $(version_h) headers_% archheaders archscripts \ + kernelversion %src-pkg ++no-sync-config-targets := $(no-dot-config-targets) install %install + +-config-targets := 0 +-mixed-targets := 0 +-dot-config := 1 ++config-targets := 0 ++mixed-targets := 0 ++dot-config := 1 ++may-sync-config := 1 + + ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),) + ifeq ($(filter-out $(no-dot-config-targets), $(MAKECMDGOALS)),) +@@ -236,6 +238,16 @@ ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),) + endif + endif + ++ifneq ($(filter $(no-sync-config-targets), $(MAKECMDGOALS)),) ++ ifeq ($(filter-out $(no-sync-config-targets), $(MAKECMDGOALS)),) ++ may-sync-config := 0 ++ endif ++endif ++ ++ifneq ($(KBUILD_EXTMOD),) ++ may-sync-config := 0 ++endif ++ + ifeq ($(KBUILD_EXTMOD),) + ifneq ($(filter config %config,$(MAKECMDGOALS)),) + config-targets := 1 +@@ -610,7 +622,7 @@ ARCH_CFLAGS := + include arch/$(SRCARCH)/Makefile + + ifeq ($(dot-config),1) +-ifeq ($(KBUILD_EXTMOD),) ++ifeq ($(may-sync-config),1) + # Read in dependencies to all Kconfig* files, make sure to run syncconfig if + # changes are detected. This should be included after arch/$(SRCARCH)/Makefile + # because some architectures define CROSS_COMPILE there. +@@ -625,8 +637,9 @@ $(KCONFIG_CONFIG) include/config/auto.conf.cmd: ; + include/config/%.conf: $(KCONFIG_CONFIG) include/config/auto.conf.cmd + $(Q)$(MAKE) -f $(srctree)/Makefile syncconfig + else +-# external modules needs include/generated/autoconf.h and include/config/auto.conf +-# but do not care if they are up-to-date. Use auto.conf to trigger the test ++# External modules and some install targets need include/generated/autoconf.h ++# and include/config/auto.conf but do not care if they are up-to-date. ++# Use auto.conf to trigger the test + PHONY += include/config/auto.conf + + include/config/auto.conf: +@@ -638,7 +651,7 @@ include/config/auto.conf: + echo >&2 ; \ + /bin/false) + +-endif # KBUILD_EXTMOD ++endif # may-sync-config + + else + # Dummy target needed, because used as prerequisite +diff --git a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts +index 4dc0b347b1ee..c2dc9d09484a 100644 +--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts ++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts +@@ -189,6 +189,8 @@ + regulator-max-microvolt = <2950000>; + + regulator-boot-on; ++ regulator-system-load = <200000>; ++ regulator-allow-set-load; + }; + + l21 { +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index d3db306a5a70..941b0ffd9806 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -203,6 +203,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 9213c966c224..ec7ea8dca777 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -331,7 +331,7 @@ + reg = <0 0x11002000 0 0x400>; + interrupts = ; + clocks = <&topckgen CLK_TOP_UART_SEL>, +- <&pericfg CLK_PERI_UART1_PD>; ++ <&pericfg CLK_PERI_UART0_PD>; + clock-names = "baud", "bus"; + status = "disabled"; + }; +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index 9ff848792712..78ce3979ef09 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -338,7 +338,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +index 0298bd0d0e1a..caf112629caa 100644 +--- a/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi ++++ b/arch/arm64/boot/dts/socionext/uniphier-ld20.dtsi +@@ -58,6 +58,7 @@ + clocks = <&sys_clk 32>; + enable-method = "psci"; + operating-points-v2 = <&cluster0_opp>; ++ #cooling-cells = <2>; + }; + + cpu2: cpu@100 { +@@ -77,6 +78,7 @@ + clocks = <&sys_clk 33>; + enable-method = "psci"; + operating-points-v2 = <&cluster1_opp>; ++ #cooling-cells = <2>; + }; + }; + +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index 33147aacdafd..dd5b4fab114f 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -670,6 +670,28 @@ static void armv8pmu_disable_event(struct perf_event *event) + raw_spin_unlock_irqrestore(&events->pmu_lock, flags); + } + ++static void armv8pmu_start(struct arm_pmu *cpu_pmu) ++{ ++ unsigned long flags; ++ struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events); ++ ++ raw_spin_lock_irqsave(&events->pmu_lock, flags); ++ /* Enable all counters */ ++ armv8pmu_pmcr_write(armv8pmu_pmcr_read() | ARMV8_PMU_PMCR_E); ++ raw_spin_unlock_irqrestore(&events->pmu_lock, flags); ++} ++ ++static void armv8pmu_stop(struct arm_pmu *cpu_pmu) ++{ ++ unsigned long flags; ++ struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events); ++ ++ raw_spin_lock_irqsave(&events->pmu_lock, flags); ++ /* Disable all counters */ ++ armv8pmu_pmcr_write(armv8pmu_pmcr_read() & ~ARMV8_PMU_PMCR_E); ++ raw_spin_unlock_irqrestore(&events->pmu_lock, flags); ++} ++ + static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu) + { + u32 pmovsr; +@@ -694,6 +716,11 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu) + */ + regs = get_irq_regs(); + ++ /* ++ * Stop the PMU while processing the counter overflows ++ * to prevent skews in group events. ++ */ ++ armv8pmu_stop(cpu_pmu); + for (idx = 0; idx < cpu_pmu->num_events; ++idx) { + struct perf_event *event = cpuc->events[idx]; + struct hw_perf_event *hwc; +@@ -718,6 +745,7 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu) + if (perf_event_overflow(event, &data, regs)) + cpu_pmu->disable(event); + } ++ armv8pmu_start(cpu_pmu); + + /* + * Handle the pending perf events. +@@ -731,28 +759,6 @@ static irqreturn_t armv8pmu_handle_irq(struct arm_pmu *cpu_pmu) + return IRQ_HANDLED; + } + +-static void armv8pmu_start(struct arm_pmu *cpu_pmu) +-{ +- unsigned long flags; +- struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events); +- +- raw_spin_lock_irqsave(&events->pmu_lock, flags); +- /* Enable all counters */ +- armv8pmu_pmcr_write(armv8pmu_pmcr_read() | ARMV8_PMU_PMCR_E); +- raw_spin_unlock_irqrestore(&events->pmu_lock, flags); +-} +- +-static void armv8pmu_stop(struct arm_pmu *cpu_pmu) +-{ +- unsigned long flags; +- struct pmu_hw_events *events = this_cpu_ptr(cpu_pmu->hw_events); +- +- raw_spin_lock_irqsave(&events->pmu_lock, flags); +- /* Disable all counters */ +- armv8pmu_pmcr_write(armv8pmu_pmcr_read() & ~ARMV8_PMU_PMCR_E); +- raw_spin_unlock_irqrestore(&events->pmu_lock, flags); +-} +- + static int armv8pmu_get_event_idx(struct pmu_hw_events *cpuc, + struct perf_event *event) + { +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 5c338ce5a7fa..db5440339ab3 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -277,19 +277,22 @@ static int ptrace_hbp_set_event(unsigned int note_type, + + switch (note_type) { + case NT_ARM_HW_BREAK: +- if (idx < ARM_MAX_BRP) { +- tsk->thread.debug.hbp_break[idx] = bp; +- err = 0; +- } ++ if (idx >= ARM_MAX_BRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_BRP); ++ tsk->thread.debug.hbp_break[idx] = bp; ++ err = 0; + break; + case NT_ARM_HW_WATCH: +- if (idx < ARM_MAX_WRP) { +- tsk->thread.debug.hbp_watch[idx] = bp; +- err = 0; +- } ++ if (idx >= ARM_MAX_WRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_WRP); ++ tsk->thread.debug.hbp_watch[idx] = bp; ++ err = 0; + break; + } + ++out: + return err; + } + +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index f206dafbb0a3..26a058d58d37 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 441faa92c3cd..6e6c0fead776 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 8c456fa691a5..8167ce8e0cdd 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -180,7 +180,7 @@ extern long kvm_spapr_tce_attach_iommu_group(struct kvm *kvm, int tablefd, + if ((tbltmp->it_page_shift <= stt->page_shift) && + (tbltmp->it_offset << tbltmp->it_page_shift == + stt->offset << stt->page_shift) && +- (tbltmp->it_size << tbltmp->it_page_shift == ++ (tbltmp->it_size << tbltmp->it_page_shift >= + stt->size << stt->page_shift)) { + /* + * Reference the table to avoid races with +@@ -296,7 +296,7 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, + { + struct kvmppc_spapr_tce_table *stt = NULL; + struct kvmppc_spapr_tce_table *siter; +- unsigned long npages, size; ++ unsigned long npages, size = args->size; + int ret = -ENOMEM; + int i; + +@@ -304,7 +304,6 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, + (args->offset + args->size > (ULLONG_MAX >> args->page_shift))) + return -EINVAL; + +- size = _ALIGN_UP(args->size, PAGE_SIZE >> 3); + npages = kvmppc_tce_pages(size); + ret = kvmppc_account_memlimit(kvmppc_stt_pages(npages), true); + if (ret) +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index a995513573c2..2ebd5132a29f 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -4562,6 +4562,8 @@ static int kvmppc_book3s_init_hv(void) + pr_err("KVM-HV: Cannot determine method for accessing XICS\n"); + return -ENODEV; + } ++ /* presence of intc confirmed - node can be dropped again */ ++ of_node_put(np); + } + #endif + +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index 0d539c661748..371e33ecc547 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -388,7 +388,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c +index 80b27294c1de..ab9a0ebecc19 100644 +--- a/arch/s390/crypto/paes_s390.c ++++ b/arch/s390/crypto/paes_s390.c +@@ -208,7 +208,7 @@ static int cbc_paes_crypt(struct blkcipher_desc *desc, unsigned long modifier, + walk->dst.virt.addr, walk->src.virt.addr, n); + if (k) + ret = blkcipher_walk_done(desc, walk, nbytes - k); +- if (n < k) { ++ if (k < n) { + if (__cbc_paes_set_key(ctx) != 0) + return blkcipher_walk_done(desc, walk, -EIO); + memcpy(param.key, ctx->pk.protkey, MAXPROTKEYSIZE); +diff --git a/arch/x86/kernel/eisa.c b/arch/x86/kernel/eisa.c +index f260e452e4f8..e8c8c5d78dbd 100644 +--- a/arch/x86/kernel/eisa.c ++++ b/arch/x86/kernel/eisa.c +@@ -7,11 +7,17 @@ + #include + #include + ++#include ++ + static __init int eisa_bus_probe(void) + { +- void __iomem *p = ioremap(0x0FFFD9, 4); ++ void __iomem *p; ++ ++ if (xen_pv_domain() && !xen_initial_domain()) ++ return 0; + +- if (readl(p) == 'E' + ('I'<<8) + ('S'<<16) + ('A'<<24)) ++ p = ioremap(0x0FFFD9, 4); ++ if (p && readl(p) == 'E' + ('I' << 8) + ('S' << 16) + ('A' << 24)) + EISA_bus = 1; + iounmap(p); + return 0; +diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c +index 946455e9cfef..1d2106d83b4e 100644 +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -177,7 +177,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) + + if (pgd_none(*pgd)) { + unsigned long new_p4d_page = __get_free_page(gfp); +- if (!new_p4d_page) ++ if (WARN_ON_ONCE(!new_p4d_page)) + return NULL; + + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); +@@ -196,13 +196,17 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) + static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) + { + gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); +- p4d_t *p4d = pti_user_pagetable_walk_p4d(address); ++ p4d_t *p4d; + pud_t *pud; + ++ p4d = pti_user_pagetable_walk_p4d(address); ++ if (!p4d) ++ return NULL; ++ + BUILD_BUG_ON(p4d_large(*p4d) != 0); + if (p4d_none(*p4d)) { + unsigned long new_pud_page = __get_free_page(gfp); +- if (!new_pud_page) ++ if (WARN_ON_ONCE(!new_pud_page)) + return NULL; + + set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page))); +@@ -216,7 +220,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) + } + if (pud_none(*pud)) { + unsigned long new_pmd_page = __get_free_page(gfp); +- if (!new_pmd_page) ++ if (WARN_ON_ONCE(!new_pmd_page)) + return NULL; + + set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); +@@ -238,9 +242,13 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) + static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address) + { + gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); +- pmd_t *pmd = pti_user_pagetable_walk_pmd(address); ++ pmd_t *pmd; + pte_t *pte; + ++ pmd = pti_user_pagetable_walk_pmd(address); ++ if (!pmd) ++ return NULL; ++ + /* We can't do anything sensible if we hit a large mapping. */ + if (pmd_large(*pmd)) { + WARN_ON(1); +@@ -298,6 +306,10 @@ pti_clone_pmds(unsigned long start, unsigned long end, pmdval_t clear) + p4d_t *p4d; + pud_t *pud; + ++ /* Overflow check */ ++ if (addr < start) ++ break; ++ + pgd = pgd_offset_k(addr); + if (WARN_ON(pgd_none(*pgd))) + return; +@@ -355,6 +367,9 @@ static void __init pti_clone_p4d(unsigned long addr) + pgd_t *kernel_pgd; + + user_p4d = pti_user_pagetable_walk_p4d(addr); ++ if (!user_p4d) ++ return; ++ + kernel_pgd = pgd_offset_k(addr); + kernel_p4d = p4d_offset(kernel_pgd, addr); + *user_p4d = *kernel_p4d; +diff --git a/arch/xtensa/platforms/iss/setup.c b/arch/xtensa/platforms/iss/setup.c +index f4bbb28026f8..58709e89a8ed 100644 +--- a/arch/xtensa/platforms/iss/setup.c ++++ b/arch/xtensa/platforms/iss/setup.c +@@ -78,23 +78,28 @@ static struct notifier_block iss_panic_block = { + + void __init platform_setup(char **p_cmdline) + { ++ static void *argv[COMMAND_LINE_SIZE / sizeof(void *)] __initdata; ++ static char cmdline[COMMAND_LINE_SIZE] __initdata; + int argc = simc_argc(); + int argv_size = simc_argv_size(); + + if (argc > 1) { +- void **argv = alloc_bootmem(argv_size); +- char *cmdline = alloc_bootmem(argv_size); +- int i; ++ if (argv_size > sizeof(argv)) { ++ pr_err("%s: command line too long: argv_size = %d\n", ++ __func__, argv_size); ++ } else { ++ int i; + +- cmdline[0] = 0; +- simc_argv((void *)argv); ++ cmdline[0] = 0; ++ simc_argv((void *)argv); + +- for (i = 1; i < argc; ++i) { +- if (i > 1) +- strcat(cmdline, " "); +- strcat(cmdline, argv[i]); ++ for (i = 1; i < argc; ++i) { ++ if (i > 1) ++ strcat(cmdline, " "); ++ strcat(cmdline, argv[i]); ++ } ++ *p_cmdline = cmdline; + } +- *p_cmdline = cmdline; + } + + atomic_notifier_chain_register(&panic_notifier_list, &iss_panic_block); +diff --git a/block/blk-core.c b/block/blk-core.c +index cbaca5a73f2e..f9d2e1b66e05 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -791,9 +791,13 @@ void blk_cleanup_queue(struct request_queue *q) + * make sure all in-progress dispatch are completed because + * blk_freeze_queue() can only complete all requests, and + * dispatch may still be in-progress since we dispatch requests +- * from more than one contexts ++ * from more than one contexts. ++ * ++ * No need to quiesce queue if it isn't initialized yet since ++ * blk_freeze_queue() should be enough for cases of passthrough ++ * request. + */ +- if (q->mq_ops) ++ if (q->mq_ops && blk_queue_init_done(q)) + blk_mq_quiesce_queue(q); + + /* for synchronous bio-based driver finish in-flight integrity i/o */ +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 56c493c6cd90..f5745acc2d98 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -339,7 +339,8 @@ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio) + return e->type->ops.mq.bio_merge(hctx, bio); + } + +- if (hctx->flags & BLK_MQ_F_SHOULD_MERGE) { ++ if ((hctx->flags & BLK_MQ_F_SHOULD_MERGE) && ++ !list_empty_careful(&ctx->rq_list)) { + /* default per sw-queue merge */ + spin_lock(&ctx->lock); + ret = blk_mq_attempt_merge(q, ctx, bio); +diff --git a/block/blk-settings.c b/block/blk-settings.c +index d1de71124656..24fff4a3d08a 100644 +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -128,7 +128,7 @@ void blk_set_stacking_limits(struct queue_limits *lim) + + /* Inherit limits from component devices */ + lim->max_segments = USHRT_MAX; +- lim->max_discard_segments = 1; ++ lim->max_discard_segments = USHRT_MAX; + lim->max_hw_sectors = UINT_MAX; + lim->max_segment_size = UINT_MAX; + lim->max_sectors = UINT_MAX; +diff --git a/crypto/api.c b/crypto/api.c +index 0ee632bba064..7aca9f86c5f3 100644 +--- a/crypto/api.c ++++ b/crypto/api.c +@@ -229,7 +229,7 @@ static struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, + mask &= ~(CRYPTO_ALG_LARVAL | CRYPTO_ALG_DEAD); + + alg = crypto_alg_lookup(name, type, mask); +- if (!alg) { ++ if (!alg && !(mask & CRYPTO_NOLOAD)) { + request_module("crypto-%s", name); + + if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask & +diff --git a/drivers/base/core.c b/drivers/base/core.c +index df3e1a44707a..3aba4ad8af5c 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -2809,6 +2809,9 @@ void device_shutdown(void) + { + struct device *dev, *parent; + ++ wait_for_device_probe(); ++ device_block_probing(); ++ + spin_lock(&devices_kset->list_lock); + /* + * Walk the devices list backward, shutting down each in turn. +diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c +index f6518067aa7d..f99e5c883368 100644 +--- a/drivers/block/DAC960.c ++++ b/drivers/block/DAC960.c +@@ -21,6 +21,7 @@ + #define DAC960_DriverDate "21 Aug 2007" + + ++#include + #include + #include + #include +@@ -6426,7 +6427,7 @@ static bool DAC960_V2_ExecuteUserCommand(DAC960_Controller_T *Controller, + return true; + } + +-static int dac960_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused dac960_proc_show(struct seq_file *m, void *v) + { + unsigned char *StatusMessage = "OK\n"; + int ControllerNumber; +@@ -6446,14 +6447,16 @@ static int dac960_proc_show(struct seq_file *m, void *v) + return 0; + } + +-static int dac960_initial_status_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused dac960_initial_status_proc_show(struct seq_file *m, ++ void *v) + { + DAC960_Controller_T *Controller = (DAC960_Controller_T *)m->private; + seq_printf(m, "%.*s", Controller->InitialStatusLength, Controller->CombinedStatusBuffer); + return 0; + } + +-static int dac960_current_status_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused dac960_current_status_proc_show(struct seq_file *m, ++ void *v) + { + DAC960_Controller_T *Controller = (DAC960_Controller_T *) m->private; + unsigned char *StatusMessage = +diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c +index a3397664f800..97d6856c9c0f 100644 +--- a/drivers/char/ipmi/ipmi_bt_sm.c ++++ b/drivers/char/ipmi/ipmi_bt_sm.c +@@ -59,8 +59,6 @@ enum bt_states { + BT_STATE_RESET3, + BT_STATE_RESTART, + BT_STATE_PRINTME, +- BT_STATE_CAPABILITIES_BEGIN, +- BT_STATE_CAPABILITIES_END, + BT_STATE_LONG_BUSY /* BT doesn't get hosed :-) */ + }; + +@@ -86,7 +84,6 @@ struct si_sm_data { + int error_retries; /* end of "common" fields */ + int nonzero_status; /* hung BMCs stay all 0 */ + enum bt_states complete; /* to divert the state machine */ +- int BT_CAP_outreqs; + long BT_CAP_req2rsp; + int BT_CAP_retries; /* Recommended retries */ + }; +@@ -137,8 +134,6 @@ static char *state2txt(unsigned char state) + case BT_STATE_RESET3: return("RESET3"); + case BT_STATE_RESTART: return("RESTART"); + case BT_STATE_LONG_BUSY: return("LONG_BUSY"); +- case BT_STATE_CAPABILITIES_BEGIN: return("CAP_BEGIN"); +- case BT_STATE_CAPABILITIES_END: return("CAP_END"); + } + return("BAD STATE"); + } +@@ -185,7 +180,6 @@ static unsigned int bt_init_data(struct si_sm_data *bt, struct si_sm_io *io) + bt->complete = BT_STATE_IDLE; /* end here */ + bt->BT_CAP_req2rsp = BT_NORMAL_TIMEOUT * USEC_PER_SEC; + bt->BT_CAP_retries = BT_NORMAL_RETRY_LIMIT; +- /* BT_CAP_outreqs == zero is a flag to read BT Capabilities */ + return 3; /* We claim 3 bytes of space; ought to check SPMI table */ + } + +@@ -451,7 +445,7 @@ static enum si_sm_result error_recovery(struct si_sm_data *bt, + + static enum si_sm_result bt_event(struct si_sm_data *bt, long time) + { +- unsigned char status, BT_CAP[8]; ++ unsigned char status; + static enum bt_states last_printed = BT_STATE_PRINTME; + int i; + +@@ -504,12 +498,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time) + if (status & BT_H_BUSY) /* clear a leftover H_BUSY */ + BT_CONTROL(BT_H_BUSY); + +- bt->timeout = bt->BT_CAP_req2rsp; +- +- /* Read BT capabilities if it hasn't been done yet */ +- if (!bt->BT_CAP_outreqs) +- BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN, +- SI_SM_CALL_WITHOUT_DELAY); + BT_SI_SM_RETURN(SI_SM_IDLE); + + case BT_STATE_XACTION_START: +@@ -614,37 +602,6 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time) + BT_STATE_CHANGE(BT_STATE_XACTION_START, + SI_SM_CALL_WITH_DELAY); + +- /* +- * Get BT Capabilities, using timing of upper level state machine. +- * Set outreqs to prevent infinite loop on timeout. +- */ +- case BT_STATE_CAPABILITIES_BEGIN: +- bt->BT_CAP_outreqs = 1; +- { +- unsigned char GetBT_CAP[] = { 0x18, 0x36 }; +- bt->state = BT_STATE_IDLE; +- bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP)); +- } +- bt->complete = BT_STATE_CAPABILITIES_END; +- BT_STATE_CHANGE(BT_STATE_XACTION_START, +- SI_SM_CALL_WITH_DELAY); +- +- case BT_STATE_CAPABILITIES_END: +- i = bt_get_result(bt, BT_CAP, sizeof(BT_CAP)); +- bt_init_data(bt, bt->io); +- if ((i == 8) && !BT_CAP[2]) { +- bt->BT_CAP_outreqs = BT_CAP[3]; +- bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC; +- bt->BT_CAP_retries = BT_CAP[7]; +- } else +- printk(KERN_WARNING "IPMI BT: using default values\n"); +- if (!bt->BT_CAP_outreqs) +- bt->BT_CAP_outreqs = 1; +- printk(KERN_WARNING "IPMI BT: req2rsp=%ld secs retries=%d\n", +- bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries); +- bt->timeout = bt->BT_CAP_req2rsp; +- return SI_SM_CALL_WITHOUT_DELAY; +- + default: /* should never occur */ + return error_recovery(bt, + status, +@@ -655,6 +612,11 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time) + + static int bt_detect(struct si_sm_data *bt) + { ++ unsigned char GetBT_CAP[] = { 0x18, 0x36 }; ++ unsigned char BT_CAP[8]; ++ enum si_sm_result smi_result; ++ int rv; ++ + /* + * It's impossible for the BT status and interrupt registers to be + * all 1's, (assuming a properly functioning, self-initialized BMC) +@@ -665,6 +627,48 @@ static int bt_detect(struct si_sm_data *bt) + if ((BT_STATUS == 0xFF) && (BT_INTMASK_R == 0xFF)) + return 1; + reset_flags(bt); ++ ++ /* ++ * Try getting the BT capabilities here. ++ */ ++ rv = bt_start_transaction(bt, GetBT_CAP, sizeof(GetBT_CAP)); ++ if (rv) { ++ dev_warn(bt->io->dev, ++ "Can't start capabilities transaction: %d\n", rv); ++ goto out_no_bt_cap; ++ } ++ ++ smi_result = SI_SM_CALL_WITHOUT_DELAY; ++ for (;;) { ++ if (smi_result == SI_SM_CALL_WITH_DELAY || ++ smi_result == SI_SM_CALL_WITH_TICK_DELAY) { ++ schedule_timeout_uninterruptible(1); ++ smi_result = bt_event(bt, jiffies_to_usecs(1)); ++ } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) { ++ smi_result = bt_event(bt, 0); ++ } else ++ break; ++ } ++ ++ rv = bt_get_result(bt, BT_CAP, sizeof(BT_CAP)); ++ bt_init_data(bt, bt->io); ++ if (rv < 8) { ++ dev_warn(bt->io->dev, "bt cap response too short: %d\n", rv); ++ goto out_no_bt_cap; ++ } ++ ++ if (BT_CAP[2]) { ++ dev_warn(bt->io->dev, "Error fetching bt cap: %x\n", BT_CAP[2]); ++out_no_bt_cap: ++ dev_warn(bt->io->dev, "using default values\n"); ++ } else { ++ bt->BT_CAP_req2rsp = BT_CAP[6] * USEC_PER_SEC; ++ bt->BT_CAP_retries = BT_CAP[7]; ++ } ++ ++ dev_info(bt->io->dev, "req2rsp=%ld secs retries=%d\n", ++ bt->BT_CAP_req2rsp / USEC_PER_SEC, bt->BT_CAP_retries); ++ + return 0; + } + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 51832b8a2c62..7fc9612070a1 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3381,39 +3381,45 @@ int ipmi_register_smi(const struct ipmi_smi_handlers *handlers, + + rv = handlers->start_processing(send_info, intf); + if (rv) +- goto out; ++ goto out_err; + + rv = __bmc_get_device_id(intf, NULL, &id, NULL, NULL, i); + if (rv) { + dev_err(si_dev, "Unable to get the device id: %d\n", rv); +- goto out; ++ goto out_err_started; + } + + mutex_lock(&intf->bmc_reg_mutex); + rv = __scan_channels(intf, &id); + mutex_unlock(&intf->bmc_reg_mutex); ++ if (rv) ++ goto out_err_bmc_reg; + +- out: +- if (rv) { +- ipmi_bmc_unregister(intf); +- list_del_rcu(&intf->link); +- mutex_unlock(&ipmi_interfaces_mutex); +- synchronize_srcu(&ipmi_interfaces_srcu); +- cleanup_srcu_struct(&intf->users_srcu); +- kref_put(&intf->refcount, intf_free); +- } else { +- /* +- * Keep memory order straight for RCU readers. Make +- * sure everything else is committed to memory before +- * setting intf_num to mark the interface valid. +- */ +- smp_wmb(); +- intf->intf_num = i; +- mutex_unlock(&ipmi_interfaces_mutex); ++ /* ++ * Keep memory order straight for RCU readers. Make ++ * sure everything else is committed to memory before ++ * setting intf_num to mark the interface valid. ++ */ ++ smp_wmb(); ++ intf->intf_num = i; ++ mutex_unlock(&ipmi_interfaces_mutex); + +- /* After this point the interface is legal to use. */ +- call_smi_watchers(i, intf->si_dev); +- } ++ /* After this point the interface is legal to use. */ ++ call_smi_watchers(i, intf->si_dev); ++ ++ return 0; ++ ++ out_err_bmc_reg: ++ ipmi_bmc_unregister(intf); ++ out_err_started: ++ if (intf->handlers->shutdown) ++ intf->handlers->shutdown(intf->send_info); ++ out_err: ++ list_del_rcu(&intf->link); ++ mutex_unlock(&ipmi_interfaces_mutex); ++ synchronize_srcu(&ipmi_interfaces_srcu); ++ cleanup_srcu_struct(&intf->users_srcu); ++ kref_put(&intf->refcount, intf_free); + + return rv; + } +@@ -3504,7 +3510,8 @@ void ipmi_unregister_smi(struct ipmi_smi *intf) + } + srcu_read_unlock(&intf->users_srcu, index); + +- intf->handlers->shutdown(intf->send_info); ++ if (intf->handlers->shutdown) ++ intf->handlers->shutdown(intf->send_info); + + cleanup_smi_msgs(intf); + +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 90ec010bffbd..5faa917df1b6 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -2083,18 +2083,9 @@ static int try_smi_init(struct smi_info *new_smi) + si_to_str[new_smi->io.si_type]); + + WARN_ON(new_smi->io.dev->init_name != NULL); +- kfree(init_name); +- +- return 0; +- +-out_err: +- if (new_smi->intf) { +- ipmi_unregister_smi(new_smi->intf); +- new_smi->intf = NULL; +- } + ++ out_err: + kfree(init_name); +- + return rv; + } + +@@ -2227,6 +2218,8 @@ static void shutdown_smi(void *send_info) + + kfree(smi_info->si_sm); + smi_info->si_sm = NULL; ++ ++ smi_info->intf = NULL; + } + + /* +@@ -2240,10 +2233,8 @@ static void cleanup_one_si(struct smi_info *smi_info) + + list_del(&smi_info->link); + +- if (smi_info->intf) { ++ if (smi_info->intf) + ipmi_unregister_smi(smi_info->intf); +- smi_info->intf = NULL; +- } + + if (smi_info->pdev) { + if (smi_info->pdev_registered) +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 18e4650c233b..265d6a6583bc 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -181,6 +181,8 @@ struct ssif_addr_info { + struct device *dev; + struct i2c_client *client; + ++ struct i2c_client *added_client; ++ + struct mutex clients_mutex; + struct list_head clients; + +@@ -1214,18 +1216,11 @@ static void shutdown_ssif(void *send_info) + complete(&ssif_info->wake_thread); + kthread_stop(ssif_info->thread); + } +- +- /* +- * No message can be outstanding now, we have removed the +- * upper layer and it permitted us to do so. +- */ +- kfree(ssif_info); + } + + static int ssif_remove(struct i2c_client *client) + { + struct ssif_info *ssif_info = i2c_get_clientdata(client); +- struct ipmi_smi *intf; + struct ssif_addr_info *addr_info; + + if (!ssif_info) +@@ -1235,9 +1230,7 @@ static int ssif_remove(struct i2c_client *client) + * After this point, we won't deliver anything asychronously + * to the message handler. We can unregister ourself. + */ +- intf = ssif_info->intf; +- ssif_info->intf = NULL; +- ipmi_unregister_smi(intf); ++ ipmi_unregister_smi(ssif_info->intf); + + list_for_each_entry(addr_info, &ssif_infos, link) { + if (addr_info->client == client) { +@@ -1246,6 +1239,8 @@ static int ssif_remove(struct i2c_client *client) + } + } + ++ kfree(ssif_info); ++ + return 0; + } + +@@ -1648,15 +1643,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) + + out: + if (rv) { +- /* +- * Note that if addr_info->client is assigned, we +- * leave it. The i2c client hangs around even if we +- * return a failure here, and the failure here is not +- * propagated back to the i2c code. This seems to be +- * design intent, strange as it may be. But if we +- * don't leave it, ssif_platform_remove will not remove +- * the client like it should. +- */ ++ addr_info->client = NULL; + dev_err(&client->dev, "Unable to start IPMI SSIF: %d\n", rv); + kfree(ssif_info); + } +@@ -1676,7 +1663,8 @@ static int ssif_adapter_handler(struct device *adev, void *opaque) + if (adev->type != &i2c_adapter_type) + return 0; + +- i2c_new_device(to_i2c_adapter(adev), &addr_info->binfo); ++ addr_info->added_client = i2c_new_device(to_i2c_adapter(adev), ++ &addr_info->binfo); + + if (!addr_info->adapter_name) + return 1; /* Only try the first I2C adapter by default. */ +@@ -1849,7 +1837,7 @@ static int ssif_platform_remove(struct platform_device *dev) + return 0; + + mutex_lock(&ssif_infos_mutex); +- i2c_unregister_device(addr_info->client); ++ i2c_unregister_device(addr_info->added_client); + + list_del(&addr_info->link); + kfree(addr_info); +diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c +index a5d402de5584..20724abd38bd 100644 +--- a/drivers/clk/clk-fixed-factor.c ++++ b/drivers/clk/clk-fixed-factor.c +@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_setup(struct device_node *node) + + clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags, + mult, div); +- if (IS_ERR(clk)) ++ if (IS_ERR(clk)) { ++ /* ++ * If parent clock is not registered, registration would fail. ++ * Clear OF_POPULATED flag so that clock registration can be ++ * attempted again from probe function. ++ */ ++ of_node_clear_flag(node, OF_POPULATED); + return clk; ++ } + + ret = of_clk_add_provider(node, of_clk_src_simple_get, clk); + if (ret) { +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index e2ed078abd90..2d96e7966e94 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2933,6 +2933,7 @@ struct clk *__clk_create_clk(struct clk_hw *hw, const char *dev_id, + return clk; + } + ++/* keep in sync with __clk_put */ + void __clk_free_clk(struct clk *clk) + { + clk_prepare_lock(); +@@ -3312,6 +3313,7 @@ int __clk_get(struct clk *clk) + return 1; + } + ++/* keep in sync with __clk_free_clk */ + void __clk_put(struct clk *clk) + { + struct module *owner; +@@ -3345,6 +3347,7 @@ void __clk_put(struct clk *clk) + + module_put(owner); + ++ kfree_const(clk->con_id); + kfree(clk); + } + +diff --git a/drivers/clk/imx/clk-imx6sll.c b/drivers/clk/imx/clk-imx6sll.c +index 3651c77fbabe..645d8a42007c 100644 +--- a/drivers/clk/imx/clk-imx6sll.c ++++ b/drivers/clk/imx/clk-imx6sll.c +@@ -92,6 +92,7 @@ static void __init imx6sll_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6sll-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + /* Do not bypass PLLs initially */ +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index ba563ba50b40..9f1a40498642 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -142,6 +142,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/clk/mvebu/armada-37xx-periph.c b/drivers/clk/mvebu/armada-37xx-periph.c +index 44e4e27eddad..6f7637b19738 100644 +--- a/drivers/clk/mvebu/armada-37xx-periph.c ++++ b/drivers/clk/mvebu/armada-37xx-periph.c +@@ -429,9 +429,6 @@ static u8 clk_pm_cpu_get_parent(struct clk_hw *hw) + val &= pm_cpu->mask_mux; + } + +- if (val >= num_parents) +- return -EINVAL; +- + return val; + } + +diff --git a/drivers/clk/tegra/clk-bpmp.c b/drivers/clk/tegra/clk-bpmp.c +index a896692b74ec..01dada561c10 100644 +--- a/drivers/clk/tegra/clk-bpmp.c ++++ b/drivers/clk/tegra/clk-bpmp.c +@@ -586,9 +586,15 @@ static struct clk_hw *tegra_bpmp_clk_of_xlate(struct of_phandle_args *clkspec, + unsigned int id = clkspec->args[0], i; + struct tegra_bpmp *bpmp = data; + +- for (i = 0; i < bpmp->num_clocks; i++) +- if (bpmp->clocks[i]->id == id) +- return &bpmp->clocks[i]->hw; ++ for (i = 0; i < bpmp->num_clocks; i++) { ++ struct tegra_bpmp_clk *clk = bpmp->clocks[i]; ++ ++ if (!clk) ++ continue; ++ ++ if (clk->id == id) ++ return &clk->hw; ++ } + + return NULL; + } +diff --git a/drivers/crypto/ccp/psp-dev.c b/drivers/crypto/ccp/psp-dev.c +index 051b8c6bae64..a9c85095bd56 100644 +--- a/drivers/crypto/ccp/psp-dev.c ++++ b/drivers/crypto/ccp/psp-dev.c +@@ -38,6 +38,17 @@ static DEFINE_MUTEX(sev_cmd_mutex); + static struct sev_misc_dev *misc_dev; + static struct psp_device *psp_master; + ++static int psp_cmd_timeout = 100; ++module_param(psp_cmd_timeout, int, 0644); ++MODULE_PARM_DESC(psp_cmd_timeout, " default timeout value, in seconds, for PSP commands"); ++ ++static int psp_probe_timeout = 5; ++module_param(psp_probe_timeout, int, 0644); ++MODULE_PARM_DESC(psp_probe_timeout, " default timeout value, in seconds, during PSP device probe"); ++ ++static bool psp_dead; ++static int psp_timeout; ++ + static struct psp_device *psp_alloc_struct(struct sp_device *sp) + { + struct device *dev = sp->dev; +@@ -82,10 +93,19 @@ done: + return IRQ_HANDLED; + } + +-static void sev_wait_cmd_ioc(struct psp_device *psp, unsigned int *reg) ++static int sev_wait_cmd_ioc(struct psp_device *psp, ++ unsigned int *reg, unsigned int timeout) + { +- wait_event(psp->sev_int_queue, psp->sev_int_rcvd); ++ int ret; ++ ++ ret = wait_event_timeout(psp->sev_int_queue, ++ psp->sev_int_rcvd, timeout * HZ); ++ if (!ret) ++ return -ETIMEDOUT; ++ + *reg = ioread32(psp->io_regs + PSP_CMDRESP); ++ ++ return 0; + } + + static int sev_cmd_buffer_len(int cmd) +@@ -133,12 +153,15 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) + if (!psp) + return -ENODEV; + ++ if (psp_dead) ++ return -EBUSY; ++ + /* Get the physical address of the command buffer */ + phys_lsb = data ? lower_32_bits(__psp_pa(data)) : 0; + phys_msb = data ? upper_32_bits(__psp_pa(data)) : 0; + +- dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x\n", +- cmd, phys_msb, phys_lsb); ++ dev_dbg(psp->dev, "sev command id %#x buffer 0x%08x%08x timeout %us\n", ++ cmd, phys_msb, phys_lsb, psp_timeout); + + print_hex_dump_debug("(in): ", DUMP_PREFIX_OFFSET, 16, 2, data, + sev_cmd_buffer_len(cmd), false); +@@ -154,7 +177,18 @@ static int __sev_do_cmd_locked(int cmd, void *data, int *psp_ret) + iowrite32(reg, psp->io_regs + PSP_CMDRESP); + + /* wait for command completion */ +- sev_wait_cmd_ioc(psp, ®); ++ ret = sev_wait_cmd_ioc(psp, ®, psp_timeout); ++ if (ret) { ++ if (psp_ret) ++ *psp_ret = 0; ++ ++ dev_err(psp->dev, "sev command %#x timed out, disabling PSP \n", cmd); ++ psp_dead = true; ++ ++ return ret; ++ } ++ ++ psp_timeout = psp_cmd_timeout; + + if (psp_ret) + *psp_ret = reg & PSP_CMDRESP_ERR_MASK; +@@ -886,6 +920,8 @@ void psp_pci_init(void) + + psp_master = sp->psp_data; + ++ psp_timeout = psp_probe_timeout; ++ + if (sev_get_api_version()) + goto err; + +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 0f2245e1af2b..97d86dca7e85 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1351,7 +1351,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1367,7 +1367,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 0b5b3abe054e..e26adf67e218 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -625,7 +625,8 @@ struct devfreq *devfreq_add_device(struct device *dev, + err = device_register(&devfreq->dev); + if (err) { + mutex_unlock(&devfreq->lock); +- goto err_dev; ++ put_device(&devfreq->dev); ++ goto err_out; + } + + devfreq->trans_table = +@@ -672,6 +673,7 @@ err_init: + mutex_unlock(&devfreq_list_lock); + + device_unregister(&devfreq->dev); ++ devfreq = NULL; + err_dev: + if (devfreq) + kfree(devfreq); +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index c6589ccf1b9a..d349fedf4ab2 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -899,6 +899,8 @@ static int mv_xor_v2_remove(struct platform_device *pdev) + + platform_msi_domain_free_irqs(&pdev->dev); + ++ tasklet_kill(&xor_dev->irq_tasklet); ++ + clk_disable_unprepare(xor_dev->clk); + + return 0; +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index de0957fe9668..bb6dfa2e1e8a 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2257,13 +2257,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c +index 2a2ccd9c78e4..8305a1ce8a9b 100644 +--- a/drivers/dma/sh/rcar-dmac.c ++++ b/drivers/dma/sh/rcar-dmac.c +@@ -774,8 +774,9 @@ static void rcar_dmac_sync_tcr(struct rcar_dmac_chan *chan) + /* make sure all remaining data was flushed */ + rcar_dmac_chcr_de_barrier(chan); + +- /* back DE */ +- rcar_dmac_chan_write(chan, RCAR_DMACHCR, chcr); ++ /* back DE if remain data exists */ ++ if (rcar_dmac_chan_read(chan, RCAR_DMATCR)) ++ rcar_dmac_chan_write(chan, RCAR_DMACHCR, chcr); + } + + static void rcar_dmac_chan_halt(struct rcar_dmac_chan *chan) +diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c +index b5214c143fee..388a929baf95 100644 +--- a/drivers/firmware/efi/arm-init.c ++++ b/drivers/firmware/efi/arm-init.c +@@ -259,7 +259,6 @@ void __init efi_init(void) + + reserve_regions(); + efi_esrt_init(); +- efi_memmap_unmap(); + + memblock_reserve(params.mmap & PAGE_MASK, + PAGE_ALIGN(params.mmap_size + +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 5889cbea60b8..4712445c3213 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -110,11 +110,13 @@ static int __init arm_enable_runtime_services(void) + { + u64 mapsize; + +- if (!efi_enabled(EFI_BOOT)) { ++ if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) { + pr_info("EFI services will not be available.\n"); + return 0; + } + ++ efi_memmap_unmap(); ++ + if (efi_runtime_disabled()) { + pr_info("EFI runtime services will be disabled.\n"); + return 0; +diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c +index 1ab80e06e7c5..e5d80ebd72b6 100644 +--- a/drivers/firmware/efi/esrt.c ++++ b/drivers/firmware/efi/esrt.c +@@ -326,7 +326,8 @@ void __init efi_esrt_init(void) + + end = esrt_data + size; + pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end); +- efi_mem_reserve(esrt_data, esrt_data_size); ++ if (md.type == EFI_BOOT_SERVICES_DATA) ++ efi_mem_reserve(esrt_data, esrt_data_size); + + pr_debug("esrt-init: loaded.\n"); + } +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index 2e33fd552899..99070e2ac3cd 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -665,6 +665,8 @@ static int pxa_gpio_probe(struct platform_device *pdev) + pchip->irq0 = irq0; + pchip->irq1 = irq1; + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + gpio_reg_base = devm_ioremap(&pdev->dev, res->start, + resource_size(res)); + if (!gpio_reg_base) +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 1a8e20363861..a7e49fef73d4 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -92,7 +92,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_OF_GPIO + struct gpio_desc *of_find_gpio(struct device *dev, +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +index c3744d89352c..ebe79bf00145 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c +@@ -188,9 +188,9 @@ void __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd, + *doorbell_off = kfd->doorbell_id_offset + inx; + + pr_debug("Get kernel queue doorbell\n" +- " doorbell offset == 0x%08X\n" +- " kernel address == %p\n", +- *doorbell_off, (kfd->doorbell_kernel_ptr + inx)); ++ " doorbell offset == 0x%08X\n" ++ " doorbell index == 0x%x\n", ++ *doorbell_off, inx); + + return kfd->doorbell_kernel_ptr + inx; + } +@@ -199,7 +199,8 @@ void kfd_release_kernel_doorbell(struct kfd_dev *kfd, u32 __iomem *db_addr) + { + unsigned int inx; + +- inx = (unsigned int)(db_addr - kfd->doorbell_kernel_ptr); ++ inx = (unsigned int)(db_addr - kfd->doorbell_kernel_ptr) ++ * sizeof(u32) / kfd->device_info->doorbell_size; + + mutex_lock(&kfd->doorbell_mutex); + __clear_bit(inx, kfd->doorbell_available_index); +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 1d80b4f7c681..4694386cc623 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -244,6 +244,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 8a7890b03d97..6ccd59b87403 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -497,6 +497,10 @@ static bool detect_dp( + sink_caps->signal = SIGNAL_TYPE_DISPLAY_PORT_MST; + link->type = dc_connection_mst_branch; + ++ dal_ddc_service_set_transaction_type( ++ link->ddc, ++ sink_caps->transaction_type); ++ + /* + * This call will initiate MST topology discovery. Which + * will detect MST ports and add new DRM connector DRM +diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c +index d567be49c31b..b487774d8041 100644 +--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c ++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c +@@ -1020,7 +1020,7 @@ static int pp_get_display_power_level(void *handle, + static int pp_get_current_clocks(void *handle, + struct amd_pp_clock_info *clocks) + { +- struct amd_pp_simple_clock_info simple_clocks; ++ struct amd_pp_simple_clock_info simple_clocks = { 0 }; + struct pp_clock_info hw_clocks; + struct pp_hwmgr *hwmgr = handle; + int ret = 0; +@@ -1056,7 +1056,10 @@ static int pp_get_current_clocks(void *handle, + clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk; + clocks->min_engine_clock_in_sr = hw_clocks.min_eng_clk; + +- clocks->max_clocks_state = simple_clocks.level; ++ if (simple_clocks.level == 0) ++ clocks->max_clocks_state = PP_DAL_POWERLEVEL_7; ++ else ++ clocks->max_clocks_state = simple_clocks.level; + + if (0 == phm_get_current_shallow_sleep_clocks(hwmgr, &hwmgr->current_ps->hardware, &hw_clocks)) { + clocks->max_engine_clock_in_sr = hw_clocks.max_eng_clk; +@@ -1159,6 +1162,8 @@ static int pp_get_display_mode_validation_clocks(void *handle, + if (!hwmgr || !hwmgr->pm_en ||!clocks) + return -EINVAL; + ++ clocks->level = PP_DAL_POWERLEVEL_7; ++ + mutex_lock(&hwmgr->smu_lock); + + if (phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, PHM_PlatformCaps_DynamicPatchPowerState)) +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index f8e866ceda02..77779adeef28 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -4555,12 +4555,12 @@ static int smu7_get_sclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks) + return -EINVAL; + dep_sclk_table = table_info->vdd_dep_on_sclk; + for (i = 0; i < dep_sclk_table->count; i++) +- clocks->clock[i] = dep_sclk_table->entries[i].clk; ++ clocks->clock[i] = dep_sclk_table->entries[i].clk * 10; + clocks->count = dep_sclk_table->count; + } else if (hwmgr->pp_table_version == PP_TABLE_V0) { + sclk_table = hwmgr->dyn_state.vddc_dependency_on_sclk; + for (i = 0; i < sclk_table->count; i++) +- clocks->clock[i] = sclk_table->entries[i].clk; ++ clocks->clock[i] = sclk_table->entries[i].clk * 10; + clocks->count = sclk_table->count; + } + +@@ -4592,7 +4592,7 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks) + return -EINVAL; + dep_mclk_table = table_info->vdd_dep_on_mclk; + for (i = 0; i < dep_mclk_table->count; i++) { +- clocks->clock[i] = dep_mclk_table->entries[i].clk; ++ clocks->clock[i] = dep_mclk_table->entries[i].clk * 10; + clocks->latency[i] = smu7_get_mem_latency(hwmgr, + dep_mclk_table->entries[i].clk); + } +@@ -4600,7 +4600,7 @@ static int smu7_get_mclks(struct pp_hwmgr *hwmgr, struct amd_pp_clocks *clocks) + } else if (hwmgr->pp_table_version == PP_TABLE_V0) { + mclk_table = hwmgr->dyn_state.vddc_dependency_on_mclk; + for (i = 0; i < mclk_table->count; i++) +- clocks->clock[i] = mclk_table->entries[i].clk; ++ clocks->clock[i] = mclk_table->entries[i].clk * 10; + clocks->count = mclk_table->count; + } + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +index 617557bd8c24..0adfc5392cd3 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c +@@ -1605,17 +1605,17 @@ static int smu8_get_clock_by_type(struct pp_hwmgr *hwmgr, enum amd_pp_clock_type + switch (type) { + case amd_pp_disp_clock: + for (i = 0; i < clocks->count; i++) +- clocks->clock[i] = data->sys_info.display_clock[i]; ++ clocks->clock[i] = data->sys_info.display_clock[i] * 10; + break; + case amd_pp_sys_clock: + table = hwmgr->dyn_state.vddc_dependency_on_sclk; + for (i = 0; i < clocks->count; i++) +- clocks->clock[i] = table->entries[i].clk; ++ clocks->clock[i] = table->entries[i].clk * 10; + break; + case amd_pp_mem_clock: + clocks->count = SMU8_NUM_NBPMEMORYCLOCK; + for (i = 0; i < clocks->count; i++) +- clocks->clock[i] = data->sys_info.nbp_memory_clock[clocks->count - 1 - i]; ++ clocks->clock[i] = data->sys_info.nbp_memory_clock[clocks->count - 1 - i] * 10; + break; + default: + return -1; +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index 963a4dba8213..9109b69cd052 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -160,7 +160,11 @@ nouveau_debugfs_pstate_set(struct file *file, const char __user *ubuf, + args.ustate = value; + } + ++ ret = pm_runtime_get_sync(drm->dev); ++ if (IS_ERR_VALUE(ret) && ret != -EACCES) ++ return ret; + ret = nvif_mthd(ctrl, NVIF_CONTROL_PSTATE_USER, &args, sizeof(args)); ++ pm_runtime_put_autosuspend(drm->dev); + if (ret < 0) + return ret; + +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index f5d3158f0378..c7ec86d6c3c9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -908,8 +908,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv) + get_task_comm(tmpname, current); + snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid)); + +- if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) +- return ret; ++ if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) { ++ ret = -ENOMEM; ++ goto done; ++ } + + ret = nouveau_cli_init(drm, name, cli); + if (ret) +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index 78597da6313a..0e372a190d3f 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -105,6 +109,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c +index 5450a2db1219..2beadb3f79c2 100644 +--- a/drivers/gpu/ipu-v3/ipu-csi.c ++++ b/drivers/gpu/ipu-v3/ipu-csi.c +@@ -318,13 +318,17 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code) + /* + * Fill a CSI bus config struct from mbus_config and mbus_framefmt. + */ +-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, ++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, + struct v4l2_mbus_config *mbus_cfg, + struct v4l2_mbus_framefmt *mbus_fmt) + { ++ int ret; ++ + memset(csicfg, 0, sizeof(*csicfg)); + +- mbus_code_to_bus_cfg(csicfg, mbus_fmt->code); ++ ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code); ++ if (ret < 0) ++ return ret; + + switch (mbus_cfg->type) { + case V4L2_MBUS_PARALLEL: +@@ -356,6 +360,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, + /* will never get here, keep compiler quiet */ + break; + } ++ ++ return 0; + } + + int ipu_csi_init_interface(struct ipu_csi *csi, +@@ -365,8 +371,11 @@ int ipu_csi_init_interface(struct ipu_csi *csi, + struct ipu_csi_bus_config cfg; + unsigned long flags; + u32 width, height, data = 0; ++ int ret; + +- fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt); ++ ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt); ++ if (ret < 0) ++ return ret; + + /* set default sensor frame width and height */ + width = mbus_fmt->width; +@@ -587,11 +596,14 @@ int ipu_csi_set_mipi_datatype(struct ipu_csi *csi, u32 vc, + struct ipu_csi_bus_config cfg; + unsigned long flags; + u32 temp; ++ int ret; + + if (vc > 3) + return -EINVAL; + +- mbus_code_to_bus_cfg(&cfg, mbus_fmt->code); ++ ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&csi->lock, flags); + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index b10fe26c4891..c9a466be7709 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -1178,6 +1178,9 @@ static ssize_t vmbus_chan_attr_show(struct kobject *kobj, + if (!attribute->show) + return -EIO; + ++ if (chan->state != CHANNEL_OPENED_STATE) ++ return -EINVAL; ++ + return attribute->show(chan, buf); + } + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 9bc04c50d45b..1d94ebec027b 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -1027,7 +1027,8 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) + } + + pm_runtime_put(&adev->dev); +- dev_info(dev, "%s initialized\n", (char *)id->data); ++ dev_info(dev, "CPU%d: ETM v%d.%d initialized\n", ++ drvdata->cpu, drvdata->arch >> 4, drvdata->arch & 0xf); + + if (boot_enable) { + coresight_enable(drvdata->csdev); +@@ -1045,23 +1046,19 @@ err_arch_supported: + return ret; + } + ++#define ETM4x_AMBA_ID(pid) \ ++ { \ ++ .id = pid, \ ++ .mask = 0x000fffff, \ ++ } ++ + static const struct amba_id etm4_ids[] = { +- { /* ETM 4.0 - Cortex-A53 */ +- .id = 0x000bb95d, +- .mask = 0x000fffff, +- .data = "ETM 4.0", +- }, +- { /* ETM 4.0 - Cortex-A57 */ +- .id = 0x000bb95e, +- .mask = 0x000fffff, +- .data = "ETM 4.0", +- }, +- { /* ETM 4.0 - A72, Maia, HiSilicon */ +- .id = 0x000bb95a, +- .mask = 0x000fffff, +- .data = "ETM 4.0", +- }, +- { 0, 0}, ++ ETM4x_AMBA_ID(0x000bb95d), /* Cortex-A53 */ ++ ETM4x_AMBA_ID(0x000bb95e), /* Cortex-A57 */ ++ ETM4x_AMBA_ID(0x000bb95a), /* Cortex-A72 */ ++ ETM4x_AMBA_ID(0x000bb959), /* Cortex-A73 */ ++ ETM4x_AMBA_ID(0x000bb9da), /* Cortex-A35 */ ++ {}, + }; + + static struct amba_driver etm4x_driver = { +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 01b7457fe8fc..459ef930d98c 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -40,8 +40,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -86,9 +87,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 29e834aab539..b673718952f6 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -108,7 +108,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev, + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev, +@@ -126,7 +126,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev, + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev, u32 mode) +@@ -179,6 +179,9 @@ static int coresight_enable_link(struct coresight_device *csdev, + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c +index 715b6fdb4989..5c8ea4e9203c 100644 +--- a/drivers/i2c/busses/i2c-aspeed.c ++++ b/drivers/i2c/busses/i2c-aspeed.c +@@ -111,22 +111,22 @@ + #define ASPEED_I2CD_DEV_ADDR_MASK GENMASK(6, 0) + + enum aspeed_i2c_master_state { ++ ASPEED_I2C_MASTER_INACTIVE, + ASPEED_I2C_MASTER_START, + ASPEED_I2C_MASTER_TX_FIRST, + ASPEED_I2C_MASTER_TX, + ASPEED_I2C_MASTER_RX_FIRST, + ASPEED_I2C_MASTER_RX, + ASPEED_I2C_MASTER_STOP, +- ASPEED_I2C_MASTER_INACTIVE, + }; + + enum aspeed_i2c_slave_state { ++ ASPEED_I2C_SLAVE_STOP, + ASPEED_I2C_SLAVE_START, + ASPEED_I2C_SLAVE_READ_REQUESTED, + ASPEED_I2C_SLAVE_READ_PROCESSED, + ASPEED_I2C_SLAVE_WRITE_REQUESTED, + ASPEED_I2C_SLAVE_WRITE_RECEIVED, +- ASPEED_I2C_SLAVE_STOP, + }; + + struct aspeed_i2c_bus { +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index dafcb6f019b3..2702ead01a03 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -722,6 +722,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -748,18 +749,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/hw/mlx5/cong.c b/drivers/infiniband/hw/mlx5/cong.c +index 985fa2637390..7e4e358a4fd8 100644 +--- a/drivers/infiniband/hw/mlx5/cong.c ++++ b/drivers/infiniband/hw/mlx5/cong.c +@@ -359,9 +359,6 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count, + int ret; + char lbuf[11]; + +- if (*pos) +- return 0; +- + ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var); + if (ret) + return ret; +@@ -370,11 +367,7 @@ static ssize_t get_param(struct file *filp, char __user *buf, size_t count, + if (ret < 0) + return ret; + +- if (copy_to_user(buf, lbuf, ret)) +- return -EFAULT; +- +- *pos += ret; +- return ret; ++ return simple_read_from_buffer(buf, count, pos, lbuf, ret); + } + + static const struct file_operations dbg_cc_fops = { +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 90a9c461cedc..308456d28afb 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -271,16 +271,16 @@ static ssize_t size_write(struct file *filp, const char __user *buf, + { + struct mlx5_cache_ent *ent = filp->private_data; + struct mlx5_ib_dev *dev = ent->dev; +- char lbuf[20]; ++ char lbuf[20] = {0}; + u32 var; + int err; + int c; + +- if (copy_from_user(lbuf, buf, sizeof(lbuf))) ++ count = min(count, sizeof(lbuf) - 1); ++ if (copy_from_user(lbuf, buf, count)) + return -EFAULT; + + c = order2idx(dev, ent->order); +- lbuf[sizeof(lbuf) - 1] = 0; + + if (sscanf(lbuf, "%u", &var) != 1) + return -EINVAL; +@@ -310,19 +310,11 @@ static ssize_t size_read(struct file *filp, char __user *buf, size_t count, + char lbuf[20]; + int err; + +- if (*pos) +- return 0; +- + err = snprintf(lbuf, sizeof(lbuf), "%d\n", ent->size); + if (err < 0) + return err; + +- if (copy_to_user(buf, lbuf, err)) +- return -EFAULT; +- +- *pos += err; +- +- return err; ++ return simple_read_from_buffer(buf, count, pos, lbuf, err); + } + + static const struct file_operations size_fops = { +@@ -337,16 +329,16 @@ static ssize_t limit_write(struct file *filp, const char __user *buf, + { + struct mlx5_cache_ent *ent = filp->private_data; + struct mlx5_ib_dev *dev = ent->dev; +- char lbuf[20]; ++ char lbuf[20] = {0}; + u32 var; + int err; + int c; + +- if (copy_from_user(lbuf, buf, sizeof(lbuf))) ++ count = min(count, sizeof(lbuf) - 1); ++ if (copy_from_user(lbuf, buf, count)) + return -EFAULT; + + c = order2idx(dev, ent->order); +- lbuf[sizeof(lbuf) - 1] = 0; + + if (sscanf(lbuf, "%u", &var) != 1) + return -EINVAL; +@@ -372,19 +364,11 @@ static ssize_t limit_read(struct file *filp, char __user *buf, size_t count, + char lbuf[20]; + int err; + +- if (*pos) +- return 0; +- + err = snprintf(lbuf, sizeof(lbuf), "%d\n", ent->limit); + if (err < 0) + return err; + +- if (copy_to_user(buf, lbuf, err)) +- return -EFAULT; +- +- *pos += err; +- +- return err; ++ return simple_read_from_buffer(buf, count, pos, lbuf, err); + } + + static const struct file_operations limit_fops = { +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index dfba44a40f0b..fe45d6cad6cd 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -225,9 +225,14 @@ static int hdr_check(struct rxe_pkt_info *pkt) + goto err1; + } + ++ if (unlikely(qpn == 0)) { ++ pr_warn_once("QP 0 not supported"); ++ goto err1; ++ } ++ + if (qpn != IB_MULTICAST_QPN) { +- index = (qpn == 0) ? port->qp_smi_index : +- ((qpn == 1) ? port->qp_gsi_index : qpn); ++ index = (qpn == 1) ? port->qp_gsi_index : qpn; ++ + qp = rxe_pool_get_index(&rxe->qp_pool, index); + if (unlikely(!qp)) { + pr_warn_ratelimited("no qp matches qpn 0x%x\n", qpn); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 6535d9beb24d..a620701f9d41 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1028,12 +1028,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 26cde95bc0f3..7630d5ed2b41 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1787,7 +1787,8 @@ int ipoib_dev_init(struct net_device *dev, struct ib_device *ca, int port) + goto out_free_pd; + } + +- if (ipoib_neigh_hash_init(priv) < 0) { ++ ret = ipoib_neigh_hash_init(priv); ++ if (ret) { + pr_warn("%s failed to init neigh hash\n", dev->name); + goto out_dev_uninit; + } +diff --git a/drivers/input/joystick/pxrc.c b/drivers/input/joystick/pxrc.c +index 07a0dbd3ced2..cfb410cf0789 100644 +--- a/drivers/input/joystick/pxrc.c ++++ b/drivers/input/joystick/pxrc.c +@@ -120,48 +120,51 @@ static void pxrc_close(struct input_dev *input) + mutex_unlock(&pxrc->pm_mutex); + } + ++static void pxrc_free_urb(void *_pxrc) ++{ ++ struct pxrc *pxrc = _pxrc; ++ ++ usb_free_urb(pxrc->urb); ++} ++ + static int pxrc_usb_init(struct pxrc *pxrc) + { + struct usb_endpoint_descriptor *epirq; + unsigned int pipe; +- int retval; ++ int error; + + /* Set up the endpoint information */ + /* This device only has an interrupt endpoint */ +- retval = usb_find_common_endpoints(pxrc->intf->cur_altsetting, +- NULL, NULL, &epirq, NULL); +- if (retval) { +- dev_err(&pxrc->intf->dev, +- "Could not find endpoint\n"); +- goto error; ++ error = usb_find_common_endpoints(pxrc->intf->cur_altsetting, ++ NULL, NULL, &epirq, NULL); ++ if (error) { ++ dev_err(&pxrc->intf->dev, "Could not find endpoint\n"); ++ return error; + } + + pxrc->bsize = usb_endpoint_maxp(epirq); + pxrc->epaddr = epirq->bEndpointAddress; + pxrc->data = devm_kmalloc(&pxrc->intf->dev, pxrc->bsize, GFP_KERNEL); +- if (!pxrc->data) { +- retval = -ENOMEM; +- goto error; +- } ++ if (!pxrc->data) ++ return -ENOMEM; + + usb_set_intfdata(pxrc->intf, pxrc); + usb_make_path(pxrc->udev, pxrc->phys, sizeof(pxrc->phys)); + strlcat(pxrc->phys, "/input0", sizeof(pxrc->phys)); + + pxrc->urb = usb_alloc_urb(0, GFP_KERNEL); +- if (!pxrc->urb) { +- retval = -ENOMEM; +- goto error; +- } ++ if (!pxrc->urb) ++ return -ENOMEM; ++ ++ error = devm_add_action_or_reset(&pxrc->intf->dev, pxrc_free_urb, pxrc); ++ if (error) ++ return error; + + pipe = usb_rcvintpipe(pxrc->udev, pxrc->epaddr), + usb_fill_int_urb(pxrc->urb, pxrc->udev, pipe, pxrc->data, pxrc->bsize, + pxrc_usb_irq, pxrc, 1); + +-error: +- return retval; +- +- ++ return 0; + } + + static int pxrc_input_init(struct pxrc *pxrc) +@@ -197,7 +200,7 @@ static int pxrc_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { + struct pxrc *pxrc; +- int retval; ++ int error; + + pxrc = devm_kzalloc(&intf->dev, sizeof(*pxrc), GFP_KERNEL); + if (!pxrc) +@@ -207,29 +210,20 @@ static int pxrc_probe(struct usb_interface *intf, + pxrc->udev = usb_get_dev(interface_to_usbdev(intf)); + pxrc->intf = intf; + +- retval = pxrc_usb_init(pxrc); +- if (retval) +- goto error; ++ error = pxrc_usb_init(pxrc); ++ if (error) ++ return error; + +- retval = pxrc_input_init(pxrc); +- if (retval) +- goto err_free_urb; ++ error = pxrc_input_init(pxrc); ++ if (error) ++ return error; + + return 0; +- +-err_free_urb: +- usb_free_urb(pxrc->urb); +- +-error: +- return retval; + } + + static void pxrc_disconnect(struct usb_interface *intf) + { +- struct pxrc *pxrc = usb_get_intfdata(intf); +- +- usb_free_urb(pxrc->urb); +- usb_set_intfdata(intf, NULL); ++ /* All driver resources are devm-managed. */ + } + + static int pxrc_suspend(struct usb_interface *intf, pm_message_t message) +diff --git a/drivers/input/touchscreen/rohm_bu21023.c b/drivers/input/touchscreen/rohm_bu21023.c +index bda0500c9b57..714affdd742f 100644 +--- a/drivers/input/touchscreen/rohm_bu21023.c ++++ b/drivers/input/touchscreen/rohm_bu21023.c +@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf, + msg[1].len = len; + msg[1].buf = buf; + +- i2c_lock_adapter(adap); ++ i2c_lock_bus(adap, I2C_LOCK_SEGMENT); + + for (i = 0; i < 2; i++) { + if (__i2c_transfer(adap, &msg[i], 1) < 0) { +@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf, + } + } + +- i2c_unlock_adapter(adap); ++ i2c_unlock_bus(adap, I2C_LOCK_SEGMENT); + + return ret; + } +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index b73c6a7bf7f2..b7076aa24d6b 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1302,6 +1302,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c +index 50e3a9fcf43e..b5948ba6b3b3 100644 +--- a/drivers/iommu/io-pgtable-arm-v7s.c ++++ b/drivers/iommu/io-pgtable-arm-v7s.c +@@ -192,6 +192,7 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + { + struct io_pgtable_cfg *cfg = &data->iop.cfg; + struct device *dev = cfg->iommu_dev; ++ phys_addr_t phys; + dma_addr_t dma; + size_t size = ARM_V7S_TABLE_SIZE(lvl); + void *table = NULL; +@@ -200,6 +201,10 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + table = (void *)__get_dma_pages(__GFP_ZERO, get_order(size)); + else if (lvl == 2) + table = kmem_cache_zalloc(data->l2_tables, gfp | GFP_DMA); ++ phys = virt_to_phys(table); ++ if (phys != (arm_v7s_iopte)phys) ++ /* Doesn't fit in PTE */ ++ goto out_free; + if (table && !(cfg->quirks & IO_PGTABLE_QUIRK_NO_DMA)) { + dma = dma_map_single(dev, table, size, DMA_TO_DEVICE); + if (dma_mapping_error(dev, dma)) +@@ -209,7 +214,7 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp, + * address directly, so if the DMA layer suggests otherwise by + * translating or truncating them, that bodes very badly... + */ +- if (dma != virt_to_phys(table)) ++ if (dma != phys) + goto out_unmap; + } + kmemleak_ignore(table); +diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c +index 010a254305dd..88641b4560bc 100644 +--- a/drivers/iommu/io-pgtable-arm.c ++++ b/drivers/iommu/io-pgtable-arm.c +@@ -237,7 +237,8 @@ static void *__arm_lpae_alloc_pages(size_t size, gfp_t gfp, + void *pages; + + VM_BUG_ON((gfp & __GFP_HIGHMEM)); +- p = alloc_pages_node(dev_to_node(dev), gfp | __GFP_ZERO, order); ++ p = alloc_pages_node(dev ? dev_to_node(dev) : NUMA_NO_NODE, ++ gfp | __GFP_ZERO, order); + if (!p) + return NULL; + +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index feb1664815b7..6e2882cda55d 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -47,6 +47,7 @@ struct ipmmu_features { + unsigned int number_of_contexts; + bool setup_imbuscr; + bool twobit_imttbcr_sl0; ++ bool reserved_context; + }; + + struct ipmmu_vmsa_device { +@@ -916,6 +917,7 @@ static const struct ipmmu_features ipmmu_features_default = { + .number_of_contexts = 1, /* software only tested with one context */ + .setup_imbuscr = true, + .twobit_imttbcr_sl0 = false, ++ .reserved_context = false, + }; + + static const struct ipmmu_features ipmmu_features_r8a7795 = { +@@ -924,6 +926,7 @@ static const struct ipmmu_features ipmmu_features_r8a7795 = { + .number_of_contexts = 8, + .setup_imbuscr = false, + .twobit_imttbcr_sl0 = true, ++ .reserved_context = true, + }; + + static const struct of_device_id ipmmu_of_ids[] = { +@@ -1017,6 +1020,11 @@ static int ipmmu_probe(struct platform_device *pdev) + } + + ipmmu_device_reset(mmu); ++ ++ if (mmu->features->reserved_context) { ++ dev_info(&pdev->dev, "IPMMU context 0 is reserved\n"); ++ set_bit(0, mmu->ctx); ++ } + } + + /* +diff --git a/drivers/lightnvm/pblk-init.c b/drivers/lightnvm/pblk-init.c +index b57f764d6a16..93ebba6dcc25 100644 +--- a/drivers/lightnvm/pblk-init.c ++++ b/drivers/lightnvm/pblk-init.c +@@ -716,10 +716,11 @@ static int pblk_setup_line_meta_12(struct pblk *pblk, struct pblk_line *line, + + /* + * In 1.2 spec. chunk state is not persisted by the device. Thus +- * some of the values are reset each time pblk is instantiated. ++ * some of the values are reset each time pblk is instantiated, ++ * so we have to assume that the block is closed. + */ + if (lun_bb_meta[line->id] == NVM_BLK_T_FREE) +- chunk->state = NVM_CHK_ST_FREE; ++ chunk->state = NVM_CHK_ST_CLOSED; + else + chunk->state = NVM_CHK_ST_OFFLINE; + +diff --git a/drivers/lightnvm/pblk-recovery.c b/drivers/lightnvm/pblk-recovery.c +index 3a5069183859..d83466b3821b 100644 +--- a/drivers/lightnvm/pblk-recovery.c ++++ b/drivers/lightnvm/pblk-recovery.c +@@ -742,9 +742,10 @@ static int pblk_recov_check_line_version(struct pblk *pblk, + return 1; + } + +-#ifdef NVM_DEBUG ++#ifdef CONFIG_NVM_PBLK_DEBUG + if (header->version_minor > EMETA_VERSION_MINOR) +- pr_info("pblk: newer line minor version found: %d\n", line_v); ++ pr_info("pblk: newer line minor version found: %d\n", ++ header->version_minor); + #endif + + return 0; +diff --git a/drivers/md/dm-verity-target.c b/drivers/md/dm-verity-target.c +index 12decdbd722d..fc65f0dedf7f 100644 +--- a/drivers/md/dm-verity-target.c ++++ b/drivers/md/dm-verity-target.c +@@ -99,10 +99,26 @@ static int verity_hash_update(struct dm_verity *v, struct ahash_request *req, + { + struct scatterlist sg; + +- sg_init_one(&sg, data, len); +- ahash_request_set_crypt(req, &sg, NULL, len); +- +- return crypto_wait_req(crypto_ahash_update(req), wait); ++ if (likely(!is_vmalloc_addr(data))) { ++ sg_init_one(&sg, data, len); ++ ahash_request_set_crypt(req, &sg, NULL, len); ++ return crypto_wait_req(crypto_ahash_update(req), wait); ++ } else { ++ do { ++ int r; ++ size_t this_step = min_t(size_t, len, PAGE_SIZE - offset_in_page(data)); ++ flush_kernel_vmap_range((void *)data, this_step); ++ sg_init_table(&sg, 1); ++ sg_set_page(&sg, vmalloc_to_page(data), this_step, offset_in_page(data)); ++ ahash_request_set_crypt(req, &sg, NULL, this_step); ++ r = crypto_wait_req(crypto_ahash_update(req), wait); ++ if (unlikely(r)) ++ return r; ++ data += this_step; ++ len -= this_step; ++ } while (len); ++ return 0; ++ } + } + + /* +diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c +index f32ec7342ef0..5653e8eebe2b 100644 +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -1377,6 +1377,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c +index b3f762578f7f..1722cdab0daf 100644 +--- a/drivers/media/i2c/ov5645.c ++++ b/drivers/media/i2c/ov5645.c +@@ -510,8 +510,8 @@ static const struct reg_value ov5645_setting_full[] = { + }; + + static const s64 link_freq[] = { +- 222880000, +- 334320000 ++ 224000000, ++ 336000000 + }; + + static const struct ov5645_mode_info ov5645_mode_info_data[] = { +@@ -520,7 +520,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = { + .height = 960, + .data = ov5645_setting_sxga, + .data_size = ARRAY_SIZE(ov5645_setting_sxga), +- .pixel_clock = 111440000, ++ .pixel_clock = 112000000, + .link_freq = 0 /* an index in link_freq[] */ + }, + { +@@ -528,7 +528,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = { + .height = 1080, + .data = ov5645_setting_1080p, + .data_size = ARRAY_SIZE(ov5645_setting_1080p), +- .pixel_clock = 167160000, ++ .pixel_clock = 168000000, + .link_freq = 1 /* an index in link_freq[] */ + }, + { +@@ -536,7 +536,7 @@ static const struct ov5645_mode_info ov5645_mode_info_data[] = { + .height = 1944, + .data = ov5645_setting_full, + .data_size = ARRAY_SIZE(ov5645_setting_full), +- .pixel_clock = 167160000, ++ .pixel_clock = 168000000, + .link_freq = 1 /* an index in link_freq[] */ + }, + }; +@@ -1145,7 +1145,8 @@ static int ov5645_probe(struct i2c_client *client, + return ret; + } + +- if (xclk_freq != 23880000) { ++ /* external clock must be 24MHz, allow 1% tolerance */ ++ if (xclk_freq < 23760000 || xclk_freq > 24240000) { + dev_err(dev, "external clock frequency %u is not supported\n", + xclk_freq); + return -EINVAL; +diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c +index 0ea8dd44026c..3a06c000f97b 100644 +--- a/drivers/media/pci/tw686x/tw686x-video.c ++++ b/drivers/media/pci/tw686x/tw686x-video.c +@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev) + return err; + } + ++ /* Initialize vc->dev and vc->ch for the error path */ ++ for (ch = 0; ch < max_channels(dev); ch++) { ++ struct tw686x_video_channel *vc = &dev->video_channels[ch]; ++ ++ vc->dev = dev; ++ vc->ch = ch; ++ } ++ + for (ch = 0; ch < max_channels(dev); ch++) { + struct tw686x_video_channel *vc = &dev->video_channels[ch]; + struct video_device *vdev; +@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev) + spin_lock_init(&vc->qlock); + INIT_LIST_HEAD(&vc->vidq_queued); + +- vc->dev = dev; +- vc->ch = ch; +- + /* default settings */ + err = tw686x_set_standard(vc, V4L2_STD_NTSC); + if (err) +diff --git a/drivers/mfd/88pm860x-i2c.c b/drivers/mfd/88pm860x-i2c.c +index 84e313107233..7b9052ea7413 100644 +--- a/drivers/mfd/88pm860x-i2c.c ++++ b/drivers/mfd/88pm860x-i2c.c +@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_client *i2c, int reg, + unsigned char zero; + int ret; + +- i2c_lock_adapter(i2c->adapter); ++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + read_device(i2c, 0xFA, 0, &zero); + read_device(i2c, 0xFB, 0, &zero); + read_device(i2c, 0xFF, 0, &zero); + ret = write_device(i2c, reg, 1, &data); + read_device(i2c, 0xFE, 0, &zero); + read_device(i2c, 0xFC, 0, &zero); +- i2c_unlock_adapter(i2c->adapter); ++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + return ret; + } + EXPORT_SYMBOL(pm860x_page_reg_write); +@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_client *i2c, int reg, + unsigned char zero = 0; + int ret; + +- i2c_lock_adapter(i2c->adapter); ++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + read_device(i2c, 0xfa, 0, &zero); + read_device(i2c, 0xfb, 0, &zero); + read_device(i2c, 0xff, 0, &zero); + ret = read_device(i2c, reg, count, buf); + read_device(i2c, 0xFE, 0, &zero); + read_device(i2c, 0xFC, 0, &zero); +- i2c_unlock_adapter(i2c->adapter); ++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + return ret; + } + EXPORT_SYMBOL(pm860x_page_bulk_read); +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index eeb7eef62174..38f90e179927 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c +index fb83d1375638..50d82c3d032a 100644 +--- a/drivers/misc/ibmvmc.c ++++ b/drivers/misc/ibmvmc.c +@@ -2131,7 +2131,7 @@ static int ibmvmc_init_crq_queue(struct crq_server_adapter *adapter) + retrc = plpar_hcall_norets(H_REG_CRQ, + vdev->unit_address, + queue->msg_token, PAGE_SIZE); +- retrc = rc; ++ rc = retrc; + + if (rc == H_RESOURCE) + rc = ibmvmc_reset_crq_queue(adapter); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index 0208c4b027c5..fa0236a5e59a 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -267,7 +267,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length, 0); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c +index b1133739fb4b..692b2f9a18cb 100644 +--- a/drivers/misc/mei/bus.c ++++ b/drivers/misc/mei/bus.c +@@ -505,17 +505,15 @@ int mei_cldev_enable(struct mei_cl_device *cldev) + + cl = cldev->cl; + ++ mutex_lock(&bus->device_lock); + if (cl->state == MEI_FILE_UNINITIALIZED) { +- mutex_lock(&bus->device_lock); + ret = mei_cl_link(cl); +- mutex_unlock(&bus->device_lock); + if (ret) +- return ret; ++ goto out; + /* update pointers */ + cl->cldev = cldev; + } + +- mutex_lock(&bus->device_lock); + if (mei_cl_is_connected(cl)) { + ret = 0; + goto out; +@@ -600,9 +598,8 @@ int mei_cldev_disable(struct mei_cl_device *cldev) + if (err < 0) + dev_err(bus->dev, "Could not disconnect from the ME client\n"); + +-out: + mei_cl_bus_module_put(cldev); +- ++out: + /* Flush queues and remove any pending read */ + mei_cl_flush_queues(cl, NULL); + mei_cl_unlink(cl); +@@ -860,12 +857,13 @@ static void mei_cl_bus_dev_release(struct device *dev) + + mei_me_cl_put(cldev->me_cl); + mei_dev_bus_put(cldev->bus); ++ mei_cl_unlink(cldev->cl); + kfree(cldev->cl); + kfree(cldev); + } + + static const struct device_type mei_cl_device_type = { +- .release = mei_cl_bus_dev_release, ++ .release = mei_cl_bus_dev_release, + }; + + /** +diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c +index fe6595fe94f1..995ff1b7e7b5 100644 +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -1140,15 +1140,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) + + props_res = (struct hbm_props_response *)mei_msg; + +- if (props_res->status) { ++ if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) { ++ dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n", ++ props_res->me_addr); ++ } else if (props_res->status) { + dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n", + props_res->status, + mei_hbm_status_str(props_res->status)); + return -EPROTO; ++ } else { ++ mei_hbm_me_cl_add(dev, props_res); + } + +- mei_hbm_me_cl_add(dev, props_res); +- + /* request property for the next client */ + if (mei_hbm_prop_req(dev, props_res->me_addr + 1)) + return -EIO; +diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c +index 09cb89645d06..2cfec33178c1 100644 +--- a/drivers/mmc/host/meson-mx-sdio.c ++++ b/drivers/mmc/host/meson-mx-sdio.c +@@ -517,19 +517,23 @@ static struct mmc_host_ops meson_mx_mmc_ops = { + static struct platform_device *meson_mx_mmc_slot_pdev(struct device *parent) + { + struct device_node *slot_node; ++ struct platform_device *pdev; + + /* + * TODO: the MMC core framework currently does not support + * controllers with multiple slots properly. So we only register + * the first slot for now + */ +- slot_node = of_find_compatible_node(parent->of_node, NULL, "mmc-slot"); ++ slot_node = of_get_compatible_child(parent->of_node, "mmc-slot"); + if (!slot_node) { + dev_warn(parent, "no 'mmc-slot' sub-node found\n"); + return ERR_PTR(-ENOENT); + } + +- return of_platform_device_create(slot_node, NULL, parent); ++ pdev = of_platform_device_create(slot_node, NULL, parent); ++ of_node_put(slot_node); ++ ++ return pdev; + } + + static int meson_mx_mmc_add_host(struct meson_mx_mmc_host *host) +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index 071693ebfe18..68760d4a5d3d 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -2177,6 +2177,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev) + dma_release_channel(host->tx_chan); + dma_release_channel(host->rx_chan); + ++ dev_pm_clear_wake_irq(host->dev); + pm_runtime_dont_use_autosuspend(host->dev); + pm_runtime_put_sync(host->dev); + pm_runtime_disable(host->dev); +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 4ffa6b173a21..8332f56e6c0d 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include "sdhci-pltfm.h" + #include "sdhci-esdhc.h" +@@ -427,6 +428,11 @@ static void esdhc_of_adma_workaround(struct sdhci_host *host, u32 intmask) + static int esdhc_of_enable_dma(struct sdhci_host *host) + { + u32 value; ++ struct device *dev = mmc_dev(host->mmc); ++ ++ if (of_device_is_compatible(dev->of_node, "fsl,ls1043a-esdhc") || ++ of_device_is_compatible(dev->of_node, "fsl,ls1046a-esdhc")) ++ dma_set_mask_and_coherent(dev, DMA_BIT_MASK(40)); + + value = sdhci_readl(host, ESDHC_DMA_SYSCTL); + value |= ESDHC_DMA_SNOOP; +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index 970d38f68939..137df06b9b6e 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -334,7 +334,8 @@ static const struct sdhci_pltfm_data sdhci_tegra30_pdata = { + SDHCI_QUIRK_NO_HISPD_BIT | + SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | + SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_BROKEN_HS200, + .ops = &tegra_sdhci_ops, + }; + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 1c828e0e9905..a7b5602ef6f7 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3734,14 +3734,21 @@ int sdhci_setup_host(struct sdhci_host *host) + mmc_gpio_get_cd(host->mmc) < 0) + mmc->caps |= MMC_CAP_NEEDS_POLL; + +- /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */ + if (!IS_ERR(mmc->supply.vqmmc)) { + ret = regulator_enable(mmc->supply.vqmmc); ++ ++ /* If vqmmc provides no 1.8V signalling, then there's no UHS */ + if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000, + 1950000)) + host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | + SDHCI_SUPPORT_SDR50 | + SDHCI_SUPPORT_DDR50); ++ ++ /* In eMMC case vqmmc might be a fixed 1.8V regulator */ ++ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000, ++ 3600000)) ++ host->flags &= ~SDHCI_SIGNALING_330; ++ + if (ret) { + pr_warn("%s: Failed to enable vqmmc regulator: %d\n", + mmc_hostname(mmc), ret); +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index cd67c85cc87d..02389528f622 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c +index cc1e4f820e64..533094233659 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-desc.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-desc.c +@@ -289,7 +289,7 @@ static int xgbe_alloc_pages(struct xgbe_prv_data *pdata, + struct page *pages = NULL; + dma_addr_t pages_dma; + gfp_t gfp; +- int order, ret; ++ int order; + + again: + order = alloc_order; +@@ -316,10 +316,9 @@ again: + /* Map the pages */ + pages_dma = dma_map_page(pdata->dev, pages, 0, + PAGE_SIZE << order, DMA_FROM_DEVICE); +- ret = dma_mapping_error(pdata->dev, pages_dma); +- if (ret) { ++ if (dma_mapping_error(pdata->dev, pages_dma)) { + put_page(pages); +- return ret; ++ return -ENOMEM; + } + + pa->pages = pages; +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +index 929d485a3a2f..e088dedc1747 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c +@@ -493,6 +493,9 @@ static void cn23xx_pf_setup_global_output_regs(struct octeon_device *oct) + for (q_no = srn; q_no < ern; q_no++) { + reg_val = octeon_read_csr(oct, CN23XX_SLI_OQ_PKT_CONTROL(q_no)); + ++ /* clear IPTR */ ++ reg_val &= ~CN23XX_PKT_OUTPUT_CTL_IPTR; ++ + /* set DPTR */ + reg_val |= CN23XX_PKT_OUTPUT_CTL_DPTR; + +diff --git a/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c b/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c +index 9338a0008378..1f8b7f651254 100644 +--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c ++++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_vf_device.c +@@ -165,6 +165,9 @@ static void cn23xx_vf_setup_global_output_regs(struct octeon_device *oct) + reg_val = + octeon_read_csr(oct, CN23XX_VF_SLI_OQ_PKT_CONTROL(q_no)); + ++ /* clear IPTR */ ++ reg_val &= ~CN23XX_PKT_OUTPUT_CTL_IPTR; ++ + /* set DPTR */ + reg_val |= CN23XX_PKT_OUTPUT_CTL_DPTR; + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 6d7404f66f84..c9a061e707c4 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -1753,7 +1753,10 @@ static int gmac_open(struct net_device *netdev) + phy_start(netdev->phydev); + + err = geth_resize_freeq(port); +- if (err) { ++ /* It's fine if it's just busy, the other port has set up ++ * the freeq in that case. ++ */ ++ if (err && (err != -EBUSY)) { + netdev_err(netdev, "could not resize freeq\n"); + goto err_stop_phy; + } +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index ff92ab1daeb8..1e9d882c04ef 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter, + port_res->max_vfs += le16_to_cpu(pcie->num_vfs); + } + } +- return status; ++ goto err; + } + + pcie = be_get_pcie_desc(resp->func_param, desc_count, +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 25a73bb2e642..9d69621f5ab4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3081,7 +3081,6 @@ static int hns3_client_init(struct hnae3_handle *handle) + priv->dev = &pdev->dev; + priv->netdev = netdev; + priv->ae_handle = handle; +- priv->ae_handle->reset_level = HNAE3_NONE_RESET; + priv->ae_handle->last_reset_time = jiffies; + priv->tx_timeout_count = 0; + +@@ -3102,6 +3101,11 @@ static int hns3_client_init(struct hnae3_handle *handle) + /* Carrier off reporting is important to ethtool even BEFORE open */ + netif_carrier_off(netdev); + ++ if (handle->flags & HNAE3_SUPPORT_VF) ++ handle->reset_level = HNAE3_VF_RESET; ++ else ++ handle->reset_level = HNAE3_FUNC_RESET; ++ + ret = hns3_get_ring_config(priv); + if (ret) { + ret = -ENOMEM; +@@ -3418,7 +3422,7 @@ static int hns3_reset_notify_down_enet(struct hnae3_handle *handle) + struct net_device *ndev = kinfo->netdev; + + if (!netif_running(ndev)) +- return -EIO; ++ return 0; + + return hns3_nic_net_stop(ndev); + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 6fd7ea8074b0..13f43b74fd6d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2825,15 +2825,13 @@ static void hclge_clear_reset_cause(struct hclge_dev *hdev) + static void hclge_reset(struct hclge_dev *hdev) + { + /* perform reset of the stack & ae device for a client */ +- ++ rtnl_lock(); + hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); + + if (!hclge_reset_wait(hdev)) { +- rtnl_lock(); + hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + hclge_reset_ae_dev(hdev->ae_dev); + hclge_notify_client(hdev, HNAE3_INIT_CLIENT); +- rtnl_unlock(); + + hclge_clear_reset_cause(hdev); + } else { +@@ -2843,6 +2841,7 @@ static void hclge_reset(struct hclge_dev *hdev) + } + + hclge_notify_client(hdev, HNAE3_UP_CLIENT); ++ rtnl_unlock(); + } + + static void hclge_reset_event(struct hnae3_handle *handle) +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 0319ed9ef8b8..f7f08e3fa761 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -5011,6 +5011,12 @@ static int mvpp2_probe(struct platform_device *pdev) + (unsigned long)of_device_get_match_data(&pdev->dev); + } + ++ /* multi queue mode isn't supported on PPV2.1, fallback to single ++ * mode ++ */ ++ if (priv->hw_version == MVPP21) ++ queue_mode = MVPP2_QDIST_SINGLE_MODE; ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(base)) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 384c1fa49081..f167f4eec3ff 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -452,6 +452,7 @@ const char *mlx5_command_str(int command) + MLX5_COMMAND_STR_CASE(SET_HCA_CAP); + MLX5_COMMAND_STR_CASE(QUERY_ISSI); + MLX5_COMMAND_STR_CASE(SET_ISSI); ++ MLX5_COMMAND_STR_CASE(SET_DRIVER_VERSION); + MLX5_COMMAND_STR_CASE(CREATE_MKEY); + MLX5_COMMAND_STR_CASE(QUERY_MKEY); + MLX5_COMMAND_STR_CASE(DESTROY_MKEY); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index b994b80d5714..922811fb66e7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -132,11 +132,11 @@ void mlx5_add_device(struct mlx5_interface *intf, struct mlx5_priv *priv) + delayed_event_start(priv); + + dev_ctx->context = intf->add(dev); +- set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state); +- if (intf->attach) +- set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state); +- + if (dev_ctx->context) { ++ set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state); ++ if (intf->attach) ++ set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state); ++ + spin_lock_irq(&priv->ctx_lock); + list_add_tail(&dev_ctx->list, &priv->ctx_list); + +@@ -211,12 +211,17 @@ static void mlx5_attach_interface(struct mlx5_interface *intf, struct mlx5_priv + if (intf->attach) { + if (test_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state)) + goto out; +- intf->attach(dev, dev_ctx->context); ++ if (intf->attach(dev, dev_ctx->context)) ++ goto out; ++ + set_bit(MLX5_INTERFACE_ATTACHED, &dev_ctx->state); + } else { + if (test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state)) + goto out; + dev_ctx->context = intf->add(dev); ++ if (!dev_ctx->context) ++ goto out; ++ + set_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 91f1209886ff..4c53957c918c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -658,6 +658,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports) + if (err) + goto miss_rule_err; + ++ kvfree(flow_group_in); + return 0; + + miss_rule_err: +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 6ddb2565884d..0031c510ab68 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1649,6 +1649,33 @@ static u64 matched_fgs_get_version(struct list_head *match_head) + return version; + } + ++static struct fs_fte * ++lookup_fte_locked(struct mlx5_flow_group *g, ++ u32 *match_value, ++ bool take_write) ++{ ++ struct fs_fte *fte_tmp; ++ ++ if (take_write) ++ nested_down_write_ref_node(&g->node, FS_LOCK_PARENT); ++ else ++ nested_down_read_ref_node(&g->node, FS_LOCK_PARENT); ++ fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, match_value, ++ rhash_fte); ++ if (!fte_tmp || !tree_get_node(&fte_tmp->node)) { ++ fte_tmp = NULL; ++ goto out; ++ } ++ ++ nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD); ++out: ++ if (take_write) ++ up_write_ref_node(&g->node); ++ else ++ up_read_ref_node(&g->node); ++ return fte_tmp; ++} ++ + static struct mlx5_flow_handle * + try_add_to_existing_fg(struct mlx5_flow_table *ft, + struct list_head *match_head, +@@ -1671,10 +1698,6 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, + if (IS_ERR(fte)) + return ERR_PTR(-ENOMEM); + +- list_for_each_entry(iter, match_head, list) { +- nested_down_read_ref_node(&iter->g->node, FS_LOCK_PARENT); +- } +- + search_again_locked: + version = matched_fgs_get_version(match_head); + /* Try to find a fg that already contains a matching fte */ +@@ -1682,20 +1705,9 @@ search_again_locked: + struct fs_fte *fte_tmp; + + g = iter->g; +- fte_tmp = rhashtable_lookup_fast(&g->ftes_hash, spec->match_value, +- rhash_fte); +- if (!fte_tmp || !tree_get_node(&fte_tmp->node)) ++ fte_tmp = lookup_fte_locked(g, spec->match_value, take_write); ++ if (!fte_tmp) + continue; +- +- nested_down_write_ref_node(&fte_tmp->node, FS_LOCK_CHILD); +- if (!take_write) { +- list_for_each_entry(iter, match_head, list) +- up_read_ref_node(&iter->g->node); +- } else { +- list_for_each_entry(iter, match_head, list) +- up_write_ref_node(&iter->g->node); +- } +- + rule = add_rule_fg(g, spec->match_value, + flow_act, dest, dest_num, fte_tmp); + up_write_ref_node(&fte_tmp->node); +@@ -1704,19 +1716,6 @@ search_again_locked: + return rule; + } + +- /* No group with matching fte found. Try to add a new fte to any +- * matching fg. +- */ +- +- if (!take_write) { +- list_for_each_entry(iter, match_head, list) +- up_read_ref_node(&iter->g->node); +- list_for_each_entry(iter, match_head, list) +- nested_down_write_ref_node(&iter->g->node, +- FS_LOCK_PARENT); +- take_write = true; +- } +- + /* Check the ft version, for case that new flow group + * was added while the fgs weren't locked + */ +@@ -1728,27 +1727,30 @@ search_again_locked: + /* Check the fgs version, for case the new FTE with the + * same values was added while the fgs weren't locked + */ +- if (version != matched_fgs_get_version(match_head)) ++ if (version != matched_fgs_get_version(match_head)) { ++ take_write = true; + goto search_again_locked; ++ } + + list_for_each_entry(iter, match_head, list) { + g = iter->g; + + if (!g->node.active) + continue; ++ ++ nested_down_write_ref_node(&g->node, FS_LOCK_PARENT); ++ + err = insert_fte(g, fte); + if (err) { ++ up_write_ref_node(&g->node); + if (err == -ENOSPC) + continue; +- list_for_each_entry(iter, match_head, list) +- up_write_ref_node(&iter->g->node); + kmem_cache_free(steering->ftes_cache, fte); + return ERR_PTR(err); + } + + nested_down_write_ref_node(&fte->node, FS_LOCK_CHILD); +- list_for_each_entry(iter, match_head, list) +- up_write_ref_node(&iter->g->node); ++ up_write_ref_node(&g->node); + rule = add_rule_fg(g, spec->match_value, + flow_act, dest, dest_num, fte); + up_write_ref_node(&fte->node); +@@ -1757,8 +1759,6 @@ search_again_locked: + } + rule = ERR_PTR(-ENOENT); + out: +- list_for_each_entry(iter, match_head, list) +- up_write_ref_node(&iter->g->node); + kmem_cache_free(steering->ftes_cache, fte); + return rule; + } +@@ -1797,6 +1797,8 @@ search_again_locked: + if (err) { + if (take_write) + up_write_ref_node(&ft->node); ++ else ++ up_read_ref_node(&ft->node); + return ERR_PTR(err); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index d39b0b7011b2..9f39aeca863f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -331,9 +331,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev) + add_timer(&health->timer); + } + +-void mlx5_stop_health_poll(struct mlx5_core_dev *dev) ++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health) + { + struct mlx5_core_health *health = &dev->priv.health; ++ unsigned long flags; ++ ++ if (disable_health) { ++ spin_lock_irqsave(&health->wq_lock, flags); ++ set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags); ++ set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags); ++ spin_unlock_irqrestore(&health->wq_lock, flags); ++ } + + del_timer_sync(&health->timer); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 615005e63819..76e6ca87db11 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -874,8 +874,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + priv->numa_node = dev_to_node(&dev->pdev->dev); + + priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root); +- if (!priv->dbg_root) ++ if (!priv->dbg_root) { ++ dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n"); + return -ENOMEM; ++ } + + err = mlx5_pci_enable_device(dev); + if (err) { +@@ -924,7 +926,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + pci_clear_master(dev->pdev); + release_bar(dev->pdev); + mlx5_pci_disable_device(dev); +- debugfs_remove(priv->dbg_root); ++ debugfs_remove_recursive(priv->dbg_root); + } + + static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv) +@@ -1266,7 +1268,7 @@ err_cleanup_once: + mlx5_cleanup_once(dev); + + err_stop_poll: +- mlx5_stop_health_poll(dev); ++ mlx5_stop_health_poll(dev, boot); + if (mlx5_cmd_teardown_hca(dev)) { + dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n"); + goto out_err; +@@ -1325,7 +1327,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv, + mlx5_free_irq_vectors(dev); + if (cleanup) + mlx5_cleanup_once(dev); +- mlx5_stop_health_poll(dev); ++ mlx5_stop_health_poll(dev, cleanup); + err = mlx5_cmd_teardown_hca(dev); + if (err) { + dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n"); +@@ -1587,7 +1589,7 @@ static int mlx5_try_fast_unload(struct mlx5_core_dev *dev) + * with the HCA, so the health polll is no longer needed. + */ + mlx5_drain_health_wq(dev); +- mlx5_stop_health_poll(dev); ++ mlx5_stop_health_poll(dev, false); + + ret = mlx5_cmd_force_teardown_hca(dev); + if (ret) { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.c b/drivers/net/ethernet/mellanox/mlx5/core/wq.c +index c8c315eb5128..d838af9539b1 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c +@@ -39,9 +39,9 @@ u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq) + return (u32)wq->fbc.sz_m1 + 1; + } + +-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq) ++u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq) + { +- return (u32)wq->fbc.frag_sz_m1 + 1; ++ return wq->fbc.frag_sz_m1 + 1; + } + + u32 mlx5_cqwq_get_size(struct mlx5_cqwq *wq) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wq.h b/drivers/net/ethernet/mellanox/mlx5/core/wq.h +index 0b47126815b6..16476cc1a602 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.h +@@ -80,7 +80,7 @@ int mlx5_wq_cyc_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, + void *wqc, struct mlx5_wq_cyc *wq, + struct mlx5_wq_ctrl *wq_ctrl); + u32 mlx5_wq_cyc_get_size(struct mlx5_wq_cyc *wq); +-u32 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq); ++u16 mlx5_wq_cyc_get_frag_size(struct mlx5_wq_cyc *wq); + + int mlx5_wq_qp_create(struct mlx5_core_dev *mdev, struct mlx5_wq_param *param, + void *qpc, struct mlx5_wq_qp *wq, +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c +index 152283d7e59c..4a540c5e27fe 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c +@@ -236,16 +236,20 @@ static int nfp_pcie_sriov_read_nfd_limit(struct nfp_pf *pf) + int err; + + pf->limit_vfs = nfp_rtsym_read_le(pf->rtbl, "nfd_vf_cfg_max_vfs", &err); +- if (!err) +- return pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs); ++ if (err) { ++ /* For backwards compatibility if symbol not found allow all */ ++ pf->limit_vfs = ~0; ++ if (err == -ENOENT) ++ return 0; + +- pf->limit_vfs = ~0; +- /* Allow any setting for backwards compatibility if symbol not found */ +- if (err == -ENOENT) +- return 0; ++ nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err); ++ return err; ++ } + +- nfp_warn(pf->cpp, "Warning: VF limit read failed: %d\n", err); +- return err; ++ err = pci_sriov_set_totalvfs(pf->pdev, pf->limit_vfs); ++ if (err) ++ nfp_warn(pf->cpp, "Failed to set VF count in sysfs: %d\n", err); ++ return 0; + } + + static int nfp_pcie_sriov_enable(struct pci_dev *pdev, int num_vfs) +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +index c2a9e64bc57b..bfccc1955907 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -1093,7 +1093,7 @@ static bool nfp_net_xdp_complete(struct nfp_net_tx_ring *tx_ring) + * @dp: NFP Net data path struct + * @tx_ring: TX ring structure + * +- * Assumes that the device is stopped ++ * Assumes that the device is stopped, must be idempotent. + */ + static void + nfp_net_tx_ring_reset(struct nfp_net_dp *dp, struct nfp_net_tx_ring *tx_ring) +@@ -1295,13 +1295,18 @@ static void nfp_net_rx_give_one(const struct nfp_net_dp *dp, + * nfp_net_rx_ring_reset() - Reflect in SW state of freelist after disable + * @rx_ring: RX ring structure + * +- * Warning: Do *not* call if ring buffers were never put on the FW freelist +- * (i.e. device was not enabled)! ++ * Assumes that the device is stopped, must be idempotent. + */ + static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring) + { + unsigned int wr_idx, last_idx; + ++ /* wr_p == rd_p means ring was never fed FL bufs. RX rings are always ++ * kept at cnt - 1 FL bufs. ++ */ ++ if (rx_ring->wr_p == 0 && rx_ring->rd_p == 0) ++ return; ++ + /* Move the empty entry to the end of the list */ + wr_idx = D_IDX(rx_ring, rx_ring->wr_p); + last_idx = rx_ring->cnt - 1; +@@ -2524,6 +2529,8 @@ static void nfp_net_vec_clear_ring_data(struct nfp_net *nn, unsigned int idx) + /** + * nfp_net_clear_config_and_disable() - Clear control BAR and disable NFP + * @nn: NFP Net device to reconfigure ++ * ++ * Warning: must be fully idempotent. + */ + static void nfp_net_clear_config_and_disable(struct nfp_net *nn) + { +diff --git a/drivers/net/ethernet/qualcomm/qca_7k.c b/drivers/net/ethernet/qualcomm/qca_7k.c +index ffe7a16bdfc8..6c8543fb90c0 100644 +--- a/drivers/net/ethernet/qualcomm/qca_7k.c ++++ b/drivers/net/ethernet/qualcomm/qca_7k.c +@@ -45,34 +45,33 @@ qcaspi_read_register(struct qcaspi *qca, u16 reg, u16 *result) + { + __be16 rx_data; + __be16 tx_data; +- struct spi_transfer *transfer; +- struct spi_message *msg; ++ struct spi_transfer transfer[2]; ++ struct spi_message msg; + int ret; + ++ memset(transfer, 0, sizeof(transfer)); ++ ++ spi_message_init(&msg); ++ + tx_data = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_INTERNAL | reg); ++ *result = 0; ++ ++ transfer[0].tx_buf = &tx_data; ++ transfer[0].len = QCASPI_CMD_LEN; ++ transfer[1].rx_buf = &rx_data; ++ transfer[1].len = QCASPI_CMD_LEN; ++ ++ spi_message_add_tail(&transfer[0], &msg); + + if (qca->legacy_mode) { +- msg = &qca->spi_msg1; +- transfer = &qca->spi_xfer1; +- transfer->tx_buf = &tx_data; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- spi_sync(qca->spi_dev, msg); +- } else { +- msg = &qca->spi_msg2; +- transfer = &qca->spi_xfer2[0]; +- transfer->tx_buf = &tx_data; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- transfer = &qca->spi_xfer2[1]; ++ spi_sync(qca->spi_dev, &msg); ++ spi_message_init(&msg); + } +- transfer->tx_buf = NULL; +- transfer->rx_buf = &rx_data; +- transfer->len = QCASPI_CMD_LEN; +- ret = spi_sync(qca->spi_dev, msg); ++ spi_message_add_tail(&transfer[1], &msg); ++ ret = spi_sync(qca->spi_dev, &msg); + + if (!ret) +- ret = msg->status; ++ ret = msg.status; + + if (ret) + qcaspi_spi_error(qca); +@@ -86,35 +85,32 @@ int + qcaspi_write_register(struct qcaspi *qca, u16 reg, u16 value) + { + __be16 tx_data[2]; +- struct spi_transfer *transfer; +- struct spi_message *msg; ++ struct spi_transfer transfer[2]; ++ struct spi_message msg; + int ret; + ++ memset(&transfer, 0, sizeof(transfer)); ++ ++ spi_message_init(&msg); ++ + tx_data[0] = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_INTERNAL | reg); + tx_data[1] = cpu_to_be16(value); + ++ transfer[0].tx_buf = &tx_data[0]; ++ transfer[0].len = QCASPI_CMD_LEN; ++ transfer[1].tx_buf = &tx_data[1]; ++ transfer[1].len = QCASPI_CMD_LEN; ++ ++ spi_message_add_tail(&transfer[0], &msg); + if (qca->legacy_mode) { +- msg = &qca->spi_msg1; +- transfer = &qca->spi_xfer1; +- transfer->tx_buf = &tx_data[0]; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- spi_sync(qca->spi_dev, msg); +- } else { +- msg = &qca->spi_msg2; +- transfer = &qca->spi_xfer2[0]; +- transfer->tx_buf = &tx_data[0]; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- transfer = &qca->spi_xfer2[1]; ++ spi_sync(qca->spi_dev, &msg); ++ spi_message_init(&msg); + } +- transfer->tx_buf = &tx_data[1]; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- ret = spi_sync(qca->spi_dev, msg); ++ spi_message_add_tail(&transfer[1], &msg); ++ ret = spi_sync(qca->spi_dev, &msg); + + if (!ret) +- ret = msg->status; ++ ret = msg.status; + + if (ret) + qcaspi_spi_error(qca); +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 206f0266463e..66b775d462fd 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -99,22 +99,24 @@ static u32 + qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len) + { + __be16 cmd; +- struct spi_message *msg = &qca->spi_msg2; +- struct spi_transfer *transfer = &qca->spi_xfer2[0]; ++ struct spi_message msg; ++ struct spi_transfer transfer[2]; + int ret; + ++ memset(&transfer, 0, sizeof(transfer)); ++ spi_message_init(&msg); ++ + cmd = cpu_to_be16(QCA7K_SPI_WRITE | QCA7K_SPI_EXTERNAL); +- transfer->tx_buf = &cmd; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- transfer = &qca->spi_xfer2[1]; +- transfer->tx_buf = src; +- transfer->rx_buf = NULL; +- transfer->len = len; ++ transfer[0].tx_buf = &cmd; ++ transfer[0].len = QCASPI_CMD_LEN; ++ transfer[1].tx_buf = src; ++ transfer[1].len = len; + +- ret = spi_sync(qca->spi_dev, msg); ++ spi_message_add_tail(&transfer[0], &msg); ++ spi_message_add_tail(&transfer[1], &msg); ++ ret = spi_sync(qca->spi_dev, &msg); + +- if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) { ++ if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) { + qcaspi_spi_error(qca); + return 0; + } +@@ -125,17 +127,20 @@ qcaspi_write_burst(struct qcaspi *qca, u8 *src, u32 len) + static u32 + qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len) + { +- struct spi_message *msg = &qca->spi_msg1; +- struct spi_transfer *transfer = &qca->spi_xfer1; ++ struct spi_message msg; ++ struct spi_transfer transfer; + int ret; + +- transfer->tx_buf = src; +- transfer->rx_buf = NULL; +- transfer->len = len; ++ memset(&transfer, 0, sizeof(transfer)); ++ spi_message_init(&msg); ++ ++ transfer.tx_buf = src; ++ transfer.len = len; + +- ret = spi_sync(qca->spi_dev, msg); ++ spi_message_add_tail(&transfer, &msg); ++ ret = spi_sync(qca->spi_dev, &msg); + +- if (ret || (msg->actual_length != len)) { ++ if (ret || (msg.actual_length != len)) { + qcaspi_spi_error(qca); + return 0; + } +@@ -146,23 +151,25 @@ qcaspi_write_legacy(struct qcaspi *qca, u8 *src, u32 len) + static u32 + qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len) + { +- struct spi_message *msg = &qca->spi_msg2; ++ struct spi_message msg; + __be16 cmd; +- struct spi_transfer *transfer = &qca->spi_xfer2[0]; ++ struct spi_transfer transfer[2]; + int ret; + ++ memset(&transfer, 0, sizeof(transfer)); ++ spi_message_init(&msg); ++ + cmd = cpu_to_be16(QCA7K_SPI_READ | QCA7K_SPI_EXTERNAL); +- transfer->tx_buf = &cmd; +- transfer->rx_buf = NULL; +- transfer->len = QCASPI_CMD_LEN; +- transfer = &qca->spi_xfer2[1]; +- transfer->tx_buf = NULL; +- transfer->rx_buf = dst; +- transfer->len = len; ++ transfer[0].tx_buf = &cmd; ++ transfer[0].len = QCASPI_CMD_LEN; ++ transfer[1].rx_buf = dst; ++ transfer[1].len = len; + +- ret = spi_sync(qca->spi_dev, msg); ++ spi_message_add_tail(&transfer[0], &msg); ++ spi_message_add_tail(&transfer[1], &msg); ++ ret = spi_sync(qca->spi_dev, &msg); + +- if (ret || (msg->actual_length != QCASPI_CMD_LEN + len)) { ++ if (ret || (msg.actual_length != QCASPI_CMD_LEN + len)) { + qcaspi_spi_error(qca); + return 0; + } +@@ -173,17 +180,20 @@ qcaspi_read_burst(struct qcaspi *qca, u8 *dst, u32 len) + static u32 + qcaspi_read_legacy(struct qcaspi *qca, u8 *dst, u32 len) + { +- struct spi_message *msg = &qca->spi_msg1; +- struct spi_transfer *transfer = &qca->spi_xfer1; ++ struct spi_message msg; ++ struct spi_transfer transfer; + int ret; + +- transfer->tx_buf = NULL; +- transfer->rx_buf = dst; +- transfer->len = len; ++ memset(&transfer, 0, sizeof(transfer)); ++ spi_message_init(&msg); + +- ret = spi_sync(qca->spi_dev, msg); ++ transfer.rx_buf = dst; ++ transfer.len = len; + +- if (ret || (msg->actual_length != len)) { ++ spi_message_add_tail(&transfer, &msg); ++ ret = spi_sync(qca->spi_dev, &msg); ++ ++ if (ret || (msg.actual_length != len)) { + qcaspi_spi_error(qca); + return 0; + } +@@ -195,19 +205,23 @@ static int + qcaspi_tx_cmd(struct qcaspi *qca, u16 cmd) + { + __be16 tx_data; +- struct spi_message *msg = &qca->spi_msg1; +- struct spi_transfer *transfer = &qca->spi_xfer1; ++ struct spi_message msg; ++ struct spi_transfer transfer; + int ret; + ++ memset(&transfer, 0, sizeof(transfer)); ++ ++ spi_message_init(&msg); ++ + tx_data = cpu_to_be16(cmd); +- transfer->len = sizeof(tx_data); +- transfer->tx_buf = &tx_data; +- transfer->rx_buf = NULL; ++ transfer.len = sizeof(cmd); ++ transfer.tx_buf = &tx_data; ++ spi_message_add_tail(&transfer, &msg); + +- ret = spi_sync(qca->spi_dev, msg); ++ ret = spi_sync(qca->spi_dev, &msg); + + if (!ret) +- ret = msg->status; ++ ret = msg.status; + + if (ret) + qcaspi_spi_error(qca); +@@ -835,16 +849,6 @@ qcaspi_netdev_setup(struct net_device *dev) + qca = netdev_priv(dev); + memset(qca, 0, sizeof(struct qcaspi)); + +- memset(&qca->spi_xfer1, 0, sizeof(struct spi_transfer)); +- memset(&qca->spi_xfer2, 0, sizeof(struct spi_transfer) * 2); +- +- spi_message_init(&qca->spi_msg1); +- spi_message_add_tail(&qca->spi_xfer1, &qca->spi_msg1); +- +- spi_message_init(&qca->spi_msg2); +- spi_message_add_tail(&qca->spi_xfer2[0], &qca->spi_msg2); +- spi_message_add_tail(&qca->spi_xfer2[1], &qca->spi_msg2); +- + memset(&qca->txr, 0, sizeof(qca->txr)); + qca->txr.count = TX_RING_MAX_LEN; + } +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h +index fc4beb1b32d1..fc0e98726b36 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.h ++++ b/drivers/net/ethernet/qualcomm/qca_spi.h +@@ -83,11 +83,6 @@ struct qcaspi { + struct tx_ring txr; + struct qcaspi_stats stats; + +- struct spi_message spi_msg1; +- struct spi_message spi_msg2; +- struct spi_transfer spi_xfer1; +- struct spi_transfer spi_xfer2[2]; +- + u8 *rx_buffer; + u32 buffer_size; + u8 sync; +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index 9b09c9d0d0fb..5f0366a125e2 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -192,7 +192,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param), + ALIGNMENT_OF_UCC_HDLC_PRAM); + +- if (priv->ucc_pram_offset < 0) { ++ if (IS_ERR_VALUE(priv->ucc_pram_offset)) { + dev_err(priv->dev, "Can not allocate MURAM for hdlc parameter.\n"); + ret = -ENOMEM; + goto free_tx_bd; +@@ -230,14 +230,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + + /* Alloc riptr, tiptr */ + riptr = qe_muram_alloc(32, 32); +- if (riptr < 0) { ++ if (IS_ERR_VALUE(riptr)) { + dev_err(priv->dev, "Cannot allocate MURAM mem for Receive internal temp data pointer\n"); + ret = -ENOMEM; + goto free_tx_skbuff; + } + + tiptr = qe_muram_alloc(32, 32); +- if (tiptr < 0) { ++ if (IS_ERR_VALUE(tiptr)) { + dev_err(priv->dev, "Cannot allocate MURAM mem for Transmit internal temp data pointer\n"); + ret = -ENOMEM; + goto free_riptr; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +index 45ea32796cda..92b38a21cd10 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h +@@ -660,7 +660,7 @@ static inline void iwl_enable_fw_load_int(struct iwl_trans *trans) + } + } + +-static inline u8 iwl_pcie_get_cmd_index(struct iwl_txq *q, u32 index) ++static inline u8 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index) + { + return index & (q->n_window - 1); + } +@@ -730,9 +730,13 @@ static inline void iwl_stop_queue(struct iwl_trans *trans, + + static inline bool iwl_queue_used(const struct iwl_txq *q, int i) + { +- return q->write_ptr >= q->read_ptr ? +- (i >= q->read_ptr && i < q->write_ptr) : +- !(i < q->read_ptr && i >= q->write_ptr); ++ int index = iwl_pcie_get_cmd_index(q, i); ++ int r = iwl_pcie_get_cmd_index(q, q->read_ptr); ++ int w = iwl_pcie_get_cmd_index(q, q->write_ptr); ++ ++ return w >= r ? ++ (index >= r && index < w) : ++ !(index < r && index >= w); + } + + static inline bool iwl_is_rfkill_set(struct iwl_trans *trans) +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +index 473fe7ccb07c..11bd7ce2be8e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c +@@ -1225,9 +1225,13 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx) + struct iwl_txq *txq = trans_pcie->txq[txq_id]; + unsigned long flags; + int nfreed = 0; ++ u16 r; + + lockdep_assert_held(&txq->lock); + ++ idx = iwl_pcie_get_cmd_index(txq, idx); ++ r = iwl_pcie_get_cmd_index(txq, txq->read_ptr); ++ + if ((idx >= TFD_QUEUE_SIZE_MAX) || (!iwl_queue_used(txq, idx))) { + IWL_ERR(trans, + "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n", +@@ -1236,12 +1240,13 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx) + return; + } + +- for (idx = iwl_queue_inc_wrap(idx); txq->read_ptr != idx; +- txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr)) { ++ for (idx = iwl_queue_inc_wrap(idx); r != idx; ++ r = iwl_queue_inc_wrap(r)) { ++ txq->read_ptr = iwl_queue_inc_wrap(txq->read_ptr); + + if (nfreed++ > 0) { + IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n", +- idx, txq->write_ptr, txq->read_ptr); ++ idx, txq->write_ptr, r); + iwl_force_nmi(trans); + } + } +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 9dd2ca62d84a..c2b6aa1d485f 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -87,8 +87,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1331,11 +1330,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1603,14 +1602,16 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); + + timer_setup(&queue->rx_refill_timer, rx_refill_timeout, 0); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2007,15 +2008,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2031,12 +2031,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2144,14 +2142,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 66ec5985c9f3..69fb62feb833 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1741,6 +1741,8 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown) + nvme_rdma_stop_io_queues(ctrl); + blk_mq_tagset_busy_iter(&ctrl->tag_set, + nvme_cancel_request, &ctrl->ctrl); ++ if (shutdown) ++ nvme_start_queues(&ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, shutdown); + } + +diff --git a/drivers/nvme/target/io-cmd-file.c b/drivers/nvme/target/io-cmd-file.c +index 8c42b3a8c420..64c7596a46a1 100644 +--- a/drivers/nvme/target/io-cmd-file.c ++++ b/drivers/nvme/target/io-cmd-file.c +@@ -209,22 +209,24 @@ static void nvmet_file_execute_discard(struct nvmet_req *req) + { + int mode = FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE; + struct nvme_dsm_range range; +- loff_t offset; +- loff_t len; +- int i, ret; ++ loff_t offset, len; ++ u16 ret; ++ int i; + + for (i = 0; i <= le32_to_cpu(req->cmd->dsm.nr); i++) { +- if (nvmet_copy_from_sgl(req, i * sizeof(range), &range, +- sizeof(range))) ++ ret = nvmet_copy_from_sgl(req, i * sizeof(range), &range, ++ sizeof(range)); ++ if (ret) + break; + offset = le64_to_cpu(range.slba) << req->ns->blksize_shift; + len = le32_to_cpu(range.nlb) << req->ns->blksize_shift; +- ret = vfs_fallocate(req->ns->file, mode, offset, len); +- if (ret) ++ if (vfs_fallocate(req->ns->file, mode, offset, len)) { ++ ret = NVME_SC_INTERNAL | NVME_SC_DNR; + break; ++ } + } + +- nvmet_req_complete(req, ret < 0 ? NVME_SC_INTERNAL | NVME_SC_DNR : 0); ++ nvmet_req_complete(req, ret); + } + + static void nvmet_file_dsm_work(struct work_struct *w) +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 466e3c8582f0..53a51c6911eb 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -118,6 +118,9 @@ void of_populate_phandle_cache(void) + if (np->phandle && np->phandle != OF_PHANDLE_ILLEGAL) + phandles++; + ++ if (!phandles) ++ goto out; ++ + cache_entries = roundup_pow_of_two(phandles); + phandle_cache_mask = cache_entries - 1; + +@@ -719,6 +722,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node, + } + EXPORT_SYMBOL(of_get_next_available_child); + ++/** ++ * of_get_compatible_child - Find compatible child node ++ * @parent: parent node ++ * @compatible: compatible string ++ * ++ * Lookup child node whose compatible property contains the given compatible ++ * string. ++ * ++ * Returns a node pointer with refcount incremented, use of_node_put() on it ++ * when done; or NULL if not found. ++ */ ++struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible) ++{ ++ struct device_node *child; ++ ++ for_each_child_of_node(parent, child) { ++ if (of_device_is_compatible(child, compatible)) ++ break; ++ } ++ ++ return child; ++} ++EXPORT_SYMBOL(of_get_compatible_child); ++ + /** + * of_get_child_by_name - Find the child node by name for a given parent + * @node: parent node +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c +index a2e88386af28..0fbf612b8ef2 100644 +--- a/drivers/pci/pcie/aer.c ++++ b/drivers/pci/pcie/aer.c +@@ -303,6 +303,9 @@ int pcie_aer_get_firmware_first(struct pci_dev *dev) + if (!pci_is_pcie(dev)) + return 0; + ++ if (pcie_ports_native) ++ return 0; ++ + if (!dev->__aer_firmware_first_valid) + aer_set_firmware_first(dev); + return dev->__aer_firmware_first; +@@ -323,6 +326,9 @@ bool aer_acpi_firmware_first(void) + .firmware_first = 0, + }; + ++ if (pcie_ports_native) ++ return false; ++ + if (!parsed) { + apei_hest_parse(aer_hest_parse, &info); + aer_firmware_first = info.firmware_first; +diff --git a/drivers/pinctrl/mediatek/pinctrl-mt7622.c b/drivers/pinctrl/mediatek/pinctrl-mt7622.c +index 4c4740ffeb9c..3ea685634b6c 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mt7622.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mt7622.c +@@ -1537,7 +1537,7 @@ static int mtk_build_groups(struct mtk_pinctrl *hw) + err = pinctrl_generic_add_group(hw->pctrl, group->name, + group->pins, group->num_pins, + group->data); +- if (err) { ++ if (err < 0) { + dev_err(hw->dev, "Failed to register group %s\n", + group->name); + return err; +@@ -1558,7 +1558,7 @@ static int mtk_build_functions(struct mtk_pinctrl *hw) + func->group_names, + func->num_group_names, + func->data); +- if (err) { ++ if (err < 0) { + dev_err(hw->dev, "Failed to register function %s\n", + func->name); + return err; +diff --git a/drivers/pinctrl/pinctrl-rza1.c b/drivers/pinctrl/pinctrl-rza1.c +index 717c0f4449a0..f76edf664539 100644 +--- a/drivers/pinctrl/pinctrl-rza1.c ++++ b/drivers/pinctrl/pinctrl-rza1.c +@@ -1006,6 +1006,7 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev, + const char *grpname; + const char **fngrps; + int ret, npins; ++ int gsel, fsel; + + npins = rza1_dt_node_pin_count(np); + if (npins < 0) { +@@ -1055,18 +1056,19 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev, + fngrps[0] = grpname; + + mutex_lock(&rza1_pctl->mutex); +- ret = pinctrl_generic_add_group(pctldev, grpname, grpins, npins, +- NULL); +- if (ret) { ++ gsel = pinctrl_generic_add_group(pctldev, grpname, grpins, npins, ++ NULL); ++ if (gsel < 0) { + mutex_unlock(&rza1_pctl->mutex); +- return ret; ++ return gsel; + } + +- ret = pinmux_generic_add_function(pctldev, grpname, fngrps, 1, +- mux_confs); +- if (ret) ++ fsel = pinmux_generic_add_function(pctldev, grpname, fngrps, 1, ++ mux_confs); ++ if (fsel < 0) { ++ ret = fsel; + goto remove_group; +- mutex_unlock(&rza1_pctl->mutex); ++ } + + dev_info(rza1_pctl->dev, "Parsed function and group %s with %d pins\n", + grpname, npins); +@@ -1083,15 +1085,15 @@ static int rza1_dt_node_to_map(struct pinctrl_dev *pctldev, + (*map)->data.mux.group = np->name; + (*map)->data.mux.function = np->name; + *num_maps = 1; ++ mutex_unlock(&rza1_pctl->mutex); + + return 0; + + remove_function: +- mutex_lock(&rza1_pctl->mutex); +- pinmux_generic_remove_last_function(pctldev); ++ pinmux_generic_remove_function(pctldev, fsel); + + remove_group: +- pinctrl_generic_remove_last_group(pctldev); ++ pinctrl_generic_remove_group(pctldev, gsel); + mutex_unlock(&rza1_pctl->mutex); + + dev_info(rza1_pctl->dev, "Unable to parse function and group %s\n", +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 0e22f52b2a19..2155a30c282b 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -250,22 +250,30 @@ static int msm_config_group_get(struct pinctrl_dev *pctldev, + /* Convert register value to pinconf value */ + switch (param) { + case PIN_CONFIG_BIAS_DISABLE: +- arg = arg == MSM_NO_PULL; ++ if (arg != MSM_NO_PULL) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = arg == MSM_PULL_DOWN; ++ if (arg != MSM_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_BUS_HOLD: + if (pctrl->soc->pull_no_keeper) + return -ENOTSUPP; + +- arg = arg == MSM_KEEPER; ++ if (arg != MSM_KEEPER) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: + if (pctrl->soc->pull_no_keeper) + arg = arg == MSM_PULL_UP_NO_KEEPER; + else + arg = arg == MSM_PULL_UP; ++ if (!arg) ++ return -EINVAL; + break; + case PIN_CONFIG_DRIVE_STRENGTH: + arg = msm_regval_to_drive(arg); +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 3e66e0d10010..cf82db78e69e 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -390,31 +390,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index eef76bfa5d73..e50941c3ba54 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.24" + #define PROC_INTERFACE_VERSION 1 + ++#include + #include + #include + #include +@@ -1682,7 +1683,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/regulator/qcom_spmi-regulator.c b/drivers/regulator/qcom_spmi-regulator.c +index 9817f1a75342..ba3d5e63ada6 100644 +--- a/drivers/regulator/qcom_spmi-regulator.c ++++ b/drivers/regulator/qcom_spmi-regulator.c +@@ -1752,7 +1752,8 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev) + const char *name; + struct device *dev = &pdev->dev; + struct device_node *node = pdev->dev.of_node; +- struct device_node *syscon; ++ struct device_node *syscon, *reg_node; ++ struct property *reg_prop; + int ret, lenp; + struct list_head *vreg_list; + +@@ -1774,16 +1775,19 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev) + syscon = of_parse_phandle(node, "qcom,saw-reg", 0); + saw_regmap = syscon_node_to_regmap(syscon); + of_node_put(syscon); +- if (IS_ERR(regmap)) ++ if (IS_ERR(saw_regmap)) + dev_err(dev, "ERROR reading SAW regmap\n"); + } + + for (reg = match->data; reg->name; reg++) { + +- if (saw_regmap && \ +- of_find_property(of_find_node_by_name(node, reg->name), \ +- "qcom,saw-slave", &lenp)) { +- continue; ++ if (saw_regmap) { ++ reg_node = of_get_child_by_name(node, reg->name); ++ reg_prop = of_find_property(reg_node, "qcom,saw-slave", ++ &lenp); ++ of_node_put(reg_node); ++ if (reg_prop) ++ continue; + } + + vreg = devm_kzalloc(dev, sizeof(*vreg), GFP_KERNEL); +@@ -1816,13 +1820,17 @@ static int qcom_spmi_regulator_probe(struct platform_device *pdev) + if (ret) + continue; + +- if (saw_regmap && \ +- of_find_property(of_find_node_by_name(node, reg->name), \ +- "qcom,saw-leader", &lenp)) { +- spmi_saw_ops = *(vreg->desc.ops); +- spmi_saw_ops.set_voltage_sel = \ +- spmi_regulator_saw_set_voltage; +- vreg->desc.ops = &spmi_saw_ops; ++ if (saw_regmap) { ++ reg_node = of_get_child_by_name(node, reg->name); ++ reg_prop = of_find_property(reg_node, "qcom,saw-leader", ++ &lenp); ++ of_node_put(reg_node); ++ if (reg_prop) { ++ spmi_saw_ops = *(vreg->desc.ops); ++ spmi_saw_ops.set_voltage_sel = ++ spmi_regulator_saw_set_voltage; ++ vreg->desc.ops = &spmi_saw_ops; ++ } + } + + config.dev = dev; +diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c +index 2bf8e7c49f2a..e5ec59102b01 100644 +--- a/drivers/remoteproc/qcom_q6v5_pil.c ++++ b/drivers/remoteproc/qcom_q6v5_pil.c +@@ -1370,7 +1370,6 @@ static const struct rproc_hexagon_res sdm845_mss = { + .hexagon_mba_image = "mba.mbn", + .proxy_clk_names = (char*[]){ + "xo", +- "axis2", + "prng", + NULL + }, +diff --git a/drivers/reset/reset-imx7.c b/drivers/reset/reset-imx7.c +index 4db177bc89bc..fdeac1946429 100644 +--- a/drivers/reset/reset-imx7.c ++++ b/drivers/reset/reset-imx7.c +@@ -80,7 +80,7 @@ static int imx7_reset_set(struct reset_controller_dev *rcdev, + { + struct imx7_src *imx7src = to_imx7_src(rcdev); + const struct imx7_src_signal *signal = &imx7_src_signals[id]; +- unsigned int value = 0; ++ unsigned int value = assert ? signal->bit : 0; + + switch (id) { + case IMX7_RESET_PCIEPHY: +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index d768f6747961..113493b52149 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -162,6 +162,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index d01ac29fd986..ffdb78421a25 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3530,13 +3530,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index c3f18afb368b..cfb659747693 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -426,6 +426,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c +index 3f3569ec5ce3..ddc7921ae5da 100644 +--- a/drivers/scsi/libfc/fc_disc.c ++++ b/drivers/scsi/libfc/fc_disc.c +@@ -294,9 +294,11 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event) + * discovery, reverify or log them in. Otherwise, log them out. + * Skip ports which were never discovered. These are the dNS port + * and ports which were created by PLOGI. ++ * ++ * We don't need to use the _rcu variant here as the rport list ++ * is protected by the disc mutex which is already held on entry. + */ +- rcu_read_lock(); +- list_for_each_entry_rcu(rdata, &disc->rports, peers) { ++ list_for_each_entry(rdata, &disc->rports, peers) { + if (!kref_get_unless_zero(&rdata->kref)) + continue; + if (rdata->disc_id) { +@@ -307,7 +309,6 @@ static void fc_disc_done(struct fc_disc *disc, enum fc_disc_event event) + } + kref_put(&rdata->kref, fc_rport_destroy); + } +- rcu_read_unlock(); + mutex_unlock(&disc->disc_mutex); + disc->disc_callback(lport, event); + mutex_lock(&disc->disc_mutex); +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index d723fd1d7b26..cab1fb087e6a 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -2976,7 +2976,7 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba) + struct lpfc_sli_ring *pring; + u32 i, wait_cnt = 0; + +- if (phba->sli_rev < LPFC_SLI_REV4) ++ if (phba->sli_rev < LPFC_SLI_REV4 || !phba->sli4_hba.nvme_wq) + return; + + /* Cycle through all NVME rings and make sure all outstanding +@@ -2985,6 +2985,9 @@ lpfc_nvme_wait_for_io_drain(struct lpfc_hba *phba) + for (i = 0; i < phba->cfg_nvme_io_channel; i++) { + pring = phba->sli4_hba.nvme_wq[i]->pring; + ++ if (!pring) ++ continue; ++ + /* Retrieve everything on the txcmplq */ + while (!list_empty(&pring->txcmplq)) { + msleep(LPFC_XRI_EXCH_BUSY_WAIT_T1); +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index 7271c9d885dd..5e5ec3363b44 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -402,6 +402,7 @@ lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf) + + /* Process FCP command */ + if (rc == 0) { ++ ctxp->rqb_buffer = NULL; + atomic_inc(&tgtp->rcv_fcp_cmd_out); + nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf); + return; +@@ -1116,8 +1117,17 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport, + lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n", + ctxp->oxid, ctxp->size, smp_processor_id()); + ++ if (!nvmebuf) { ++ lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR, ++ "6425 Defer rcv: no buffer xri x%x: " ++ "flg %x ste %x\n", ++ ctxp->oxid, ctxp->flag, ctxp->state); ++ return; ++ } ++ + tgtp = phba->targetport->private; +- atomic_inc(&tgtp->rcv_fcp_cmd_defer); ++ if (tgtp) ++ atomic_inc(&tgtp->rcv_fcp_cmd_defer); + + /* Free the nvmebuf since a new buffer already replaced it */ + nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf); +diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c +index 70b2ee80d6bd..bf4bd71ab53f 100644 +--- a/drivers/soc/qcom/smem.c ++++ b/drivers/soc/qcom/smem.c +@@ -364,11 +364,6 @@ static int qcom_smem_alloc_private(struct qcom_smem *smem, + end = phdr_to_last_uncached_entry(phdr); + cached = phdr_to_last_cached_entry(phdr); + +- if (smem->global_partition) { +- dev_err(smem->dev, "Already found the global partition\n"); +- return -EINVAL; +- } +- + while (hdr < end) { + if (hdr->canary != SMEM_PRIVATE_CANARY) + goto bad_canary; +@@ -736,6 +731,11 @@ static int qcom_smem_set_global_partition(struct qcom_smem *smem) + bool found = false; + int i; + ++ if (smem->global_partition) { ++ dev_err(smem->dev, "Already found the global partition\n"); ++ return -EINVAL; ++ } ++ + ptable = qcom_smem_get_ptable(smem); + if (IS_ERR(ptable)) + return PTR_ERR(ptable); +diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c +index f693bfe95ab9..a087464efdd7 100644 +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -485,6 +485,8 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws) + dws->dma_inited = 0; + dws->dma_addr = (dma_addr_t)(dws->paddr + DW_SPI_DR); + ++ spi_controller_set_devdata(master, dws); ++ + ret = request_irq(dws->irq, dw_spi_irq, IRQF_SHARED, dev_name(dev), + master); + if (ret < 0) { +@@ -518,7 +520,6 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws) + } + } + +- spi_controller_set_devdata(master, dws); + ret = devm_spi_register_controller(dev, master); + if (ret) { + dev_err(&master->dev, "problem registering spi master\n"); +diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +index 396371728aa1..537d5bb5e294 100644 +--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c ++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +@@ -767,7 +767,7 @@ static void free_bufs(struct dpaa2_eth_priv *priv, u64 *buf_array, int count) + for (i = 0; i < count; i++) { + vaddr = dpaa2_iova_to_virt(priv->iommu_domain, buf_array[i]); + dma_unmap_single(dev, buf_array[i], DPAA2_ETH_RX_BUF_SIZE, +- DMA_BIDIRECTIONAL); ++ DMA_FROM_DEVICE); + skb_free_frag(vaddr); + } + } +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c +index f0cefa1b7b0f..b20d34449ed4 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-vchiq.c +@@ -439,16 +439,16 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream) + my_workqueue_init(alsa_stream); + + ret = bcm2835_audio_open_connection(alsa_stream); +- if (ret) { +- ret = -1; +- goto exit; +- } ++ if (ret) ++ goto free_wq; ++ + instance = alsa_stream->instance; + LOG_DBG(" instance (%p)\n", instance); + + if (mutex_lock_interruptible(&instance->vchi_mutex)) { + LOG_DBG("Interrupted whilst waiting for lock on (%d)\n", instance->num_connections); +- return -EINTR; ++ ret = -EINTR; ++ goto free_wq; + } + vchi_service_use(instance->vchi_handle[0]); + +@@ -471,7 +471,11 @@ int bcm2835_audio_open(struct bcm2835_alsa_stream *alsa_stream) + unlock: + vchi_service_release(instance->vchi_handle[0]); + mutex_unlock(&instance->vchi_mutex); +-exit: ++ ++free_wq: ++ if (ret) ++ destroy_workqueue(alsa_stream->my_wq); ++ + return ret; + } + +diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c +index ce26741ae9d9..3f61d04c47ab 100644 +--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c ++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c +@@ -580,6 +580,7 @@ static int start_streaming(struct vb2_queue *vq, unsigned int count) + static void stop_streaming(struct vb2_queue *vq) + { + int ret; ++ unsigned long timeout; + struct bm2835_mmal_dev *dev = vb2_get_drv_priv(vq); + + v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, "%s: dev:%p\n", +@@ -605,10 +606,10 @@ static void stop_streaming(struct vb2_queue *vq) + sizeof(dev->capture.frame_count)); + + /* wait for last frame to complete */ +- ret = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ); +- if (ret <= 0) ++ timeout = wait_for_completion_timeout(&dev->capture.frame_cmplt, HZ); ++ if (timeout == 0) + v4l2_err(&dev->v4l2_dev, +- "error %d waiting for frame completion\n", ret); ++ "timed out waiting for frame completion\n"); + + v4l2_dbg(1, bcm2835_v4l2_debug, &dev->v4l2_dev, + "disabling connection\n"); +diff --git a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c +index f5b5ead6347c..51e5b04ff0f5 100644 +--- a/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c ++++ b/drivers/staging/vc04_services/bcm2835-camera/mmal-vchiq.c +@@ -630,6 +630,7 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance, + { + struct mmal_msg_context *msg_context; + int ret; ++ unsigned long timeout; + + /* payload size must not cause message to exceed max size */ + if (payload_len > +@@ -668,11 +669,11 @@ static int send_synchronous_mmal_msg(struct vchiq_mmal_instance *instance, + return ret; + } + +- ret = wait_for_completion_timeout(&msg_context->u.sync.cmplt, 3 * HZ); +- if (ret <= 0) { +- pr_err("error %d waiting for sync completion\n", ret); +- if (ret == 0) +- ret = -ETIME; ++ timeout = wait_for_completion_timeout(&msg_context->u.sync.cmplt, ++ 3 * HZ); ++ if (timeout == 0) { ++ pr_err("timed out waiting for sync completion\n"); ++ ret = -ETIME; + /* todo: what happens if the message arrives after aborting */ + release_msg_context(msg_context); + return ret; +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index bfb37f0be22f..863e86b9a424 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -124,7 +124,7 @@ static int of_platform_serial_setup(struct platform_device *ofdev, + dev_warn(&ofdev->dev, "unsupported reg-io-width (%d)\n", + prop); + ret = -EINVAL; +- goto err_dispose; ++ goto err_unprepare; + } + } + port->flags |= UPF_IOREMAP; +diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c +index 6ff8cdfc9d2a..3e827a3d48d5 100644 +--- a/drivers/tty/tty_baudrate.c ++++ b/drivers/tty/tty_baudrate.c +@@ -157,18 +157,25 @@ void tty_termios_encode_baud_rate(struct ktermios *termios, + termios->c_ospeed = obaud; + + #ifdef BOTHER ++ if ((termios->c_cflag >> IBSHIFT) & CBAUD) ++ ibinput = 1; /* An input speed was specified */ ++ + /* If the user asked for a precise weird speed give a precise weird + answer. If they asked for a Bfoo speed they may have problems + digesting non-exact replies so fuzz a bit */ + +- if ((termios->c_cflag & CBAUD) == BOTHER) ++ if ((termios->c_cflag & CBAUD) == BOTHER) { + oclose = 0; ++ if (!ibinput) ++ iclose = 0; ++ } + if (((termios->c_cflag >> IBSHIFT) & CBAUD) == BOTHER) + iclose = 0; +- if ((termios->c_cflag >> IBSHIFT) & CBAUD) +- ibinput = 1; /* An input speed was specified */ + #endif + termios->c_cflag &= ~CBAUD; ++#ifdef IBSHIFT ++ termios->c_cflag &= ~(CBAUD << IBSHIFT); ++#endif + + /* + * Our goal is to find a close match to the standard baud rate +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 75c4623ad779..f8ee32d9843a 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -779,20 +779,9 @@ static int acm_tty_write(struct tty_struct *tty, + } + + if (acm->susp_count) { +- if (acm->putbuffer) { +- /* now to preserve order */ +- usb_anchor_urb(acm->putbuffer->urb, &acm->delayed); +- acm->putbuffer = NULL; +- } + usb_anchor_urb(wb->urb, &acm->delayed); + spin_unlock_irqrestore(&acm->write_lock, flags); + return count; +- } else { +- if (acm->putbuffer) { +- /* at this point there is no good way to handle errors */ +- acm_start_wb(acm, acm->putbuffer); +- acm->putbuffer = NULL; +- } + } + + stat = acm_start_wb(acm, wb); +@@ -803,66 +792,6 @@ static int acm_tty_write(struct tty_struct *tty, + return count; + } + +-static void acm_tty_flush_chars(struct tty_struct *tty) +-{ +- struct acm *acm = tty->driver_data; +- struct acm_wb *cur; +- int err; +- unsigned long flags; +- +- spin_lock_irqsave(&acm->write_lock, flags); +- +- cur = acm->putbuffer; +- if (!cur) /* nothing to do */ +- goto out; +- +- acm->putbuffer = NULL; +- err = usb_autopm_get_interface_async(acm->control); +- if (err < 0) { +- cur->use = 0; +- acm->putbuffer = cur; +- goto out; +- } +- +- if (acm->susp_count) +- usb_anchor_urb(cur->urb, &acm->delayed); +- else +- acm_start_wb(acm, cur); +-out: +- spin_unlock_irqrestore(&acm->write_lock, flags); +- return; +-} +- +-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch) +-{ +- struct acm *acm = tty->driver_data; +- struct acm_wb *cur; +- int wbn; +- unsigned long flags; +- +-overflow: +- cur = acm->putbuffer; +- if (!cur) { +- spin_lock_irqsave(&acm->write_lock, flags); +- wbn = acm_wb_alloc(acm); +- if (wbn >= 0) { +- cur = &acm->wb[wbn]; +- acm->putbuffer = cur; +- } +- spin_unlock_irqrestore(&acm->write_lock, flags); +- if (!cur) +- return 0; +- } +- +- if (cur->len == acm->writesize) { +- acm_tty_flush_chars(tty); +- goto overflow; +- } +- +- cur->buf[cur->len++] = ch; +- return 1; +-} +- + static int acm_tty_write_room(struct tty_struct *tty) + { + struct acm *acm = tty->driver_data; +@@ -1987,8 +1916,6 @@ static const struct tty_operations acm_ops = { + .cleanup = acm_tty_cleanup, + .hangup = acm_tty_hangup, + .write = acm_tty_write, +- .put_char = acm_tty_put_char, +- .flush_chars = acm_tty_flush_chars, + .write_room = acm_tty_write_room, + .ioctl = acm_tty_ioctl, + .throttle = acm_tty_throttle, +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index eacc116e83da..ca06b20d7af9 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -96,7 +96,6 @@ struct acm { + unsigned long read_urbs_free; + struct urb *read_urbs[ACM_NR]; + struct acm_rb read_buffers[ACM_NR]; +- struct acm_wb *putbuffer; /* for acm_tty_put_char() */ + int rx_buflimit; + spinlock_t read_lock; + u8 *notification_buffer; /* to reassemble fragmented notifications */ +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index a0d284ef3f40..632a2bfabc08 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -458,7 +458,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 66fe1b78d952..03432467b05f 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -515,8 +515,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 1a15392326fc..525ebd03cfe5 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1340,6 +1340,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1375,6 +1380,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 097057d2eacf..e77dfe5ed5ec 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -178,6 +178,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -406,6 +410,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h +index db610c56f1d6..2aacd1afd9ff 100644 +--- a/drivers/usb/dwc3/gadget.h ++++ b/drivers/usb/dwc3/gadget.h +@@ -25,7 +25,7 @@ struct dwc3; + #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN BIT(9) + #define DWC3_DEPCFG_XFER_NOT_READY_EN BIT(10) + #define DWC3_DEPCFG_FIFO_ERROR_EN BIT(11) +-#define DWC3_DEPCFG_STREAM_EVENT_EN BIT(12) ++#define DWC3_DEPCFG_STREAM_EVENT_EN BIT(13) + #define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) + #define DWC3_DEPCFG_STREAM_CAPABLE BIT(24) + #define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 318246d8b2e2..b02ab2a8d927 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1545,11 +1545,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2466,8 +2469,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3341,6 +3347,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3381,12 +3389,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3405,6 +3415,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3415,6 +3426,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 7cf98c793e04..5b5f1c8b47c9 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -787,12 +787,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3) + switch (speed) { + case USB_STA_SPEED_SS: + usb3->gadget.speed = USB_SPEED_SUPER; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE; + break; + case USB_STA_SPEED_HS: + usb3->gadget.speed = USB_SPEED_HIGH; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE; + break; + case USB_STA_SPEED_FS: + usb3->gadget.speed = USB_SPEED_FULL; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE; + break; + default: + usb3->gadget.speed = USB_SPEED_UNKNOWN; +@@ -2451,7 +2454,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev, + /* for control pipe */ + usb3->gadget.ep0 = &usb3_ep->ep; + usb_ep_set_maxpacket_limit(&usb3_ep->ep, +- USB3_EP0_HSFS_MAX_PACKET_SIZE); ++ USB3_EP0_SS_MAX_PACKET_SIZE); + usb3_ep->ep.caps.type_control = true; + usb3_ep->ep.caps.dir_in = true; + usb3_ep->ep.caps.dir_out = true; +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 032b8652910a..02f8e08b3ee8 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2555,7 +2555,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index ef350c33dc4a..b1f27aa38b10 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -1613,6 +1613,10 @@ void xhci_endpoint_copy(struct xhci_hcd *xhci, + in_ep_ctx->ep_info2 = out_ep_ctx->ep_info2; + in_ep_ctx->deq = out_ep_ctx->deq; + in_ep_ctx->tx_info = out_ep_ctx->tx_info; ++ if (xhci->quirks & XHCI_MTK_HOST) { ++ in_ep_ctx->reserved[0] = out_ep_ctx->reserved[0]; ++ in_ep_ctx->reserved[1] = out_ep_ctx->reserved[1]; ++ } + } + + /* Copy output xhci_slot_ctx to the input xhci_slot_ctx. +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 68e6132aa8b2..c2220a7fc758 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -37,6 +37,21 @@ static unsigned long long quirks; + module_param(quirks, ullong, S_IRUGO); + MODULE_PARM_DESC(quirks, "Bit flags for quirks to be enabled as default"); + ++static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring) ++{ ++ struct xhci_segment *seg = ring->first_seg; ++ ++ if (!td || !td->start_seg) ++ return false; ++ do { ++ if (seg == td->start_seg) ++ return true; ++ seg = seg->next; ++ } while (seg && seg != ring->first_seg); ++ ++ return false; ++} ++ + /* TODO: copied from ehci-hcd.c - can this be refactored? */ + /* + * xhci_handshake - spin reading hc until handshake completes or fails +@@ -1571,6 +1586,21 @@ static int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) + goto done; + } + ++ /* ++ * check ring is not re-allocated since URB was enqueued. If it is, then ++ * make sure none of the ring related pointers in this URB private data ++ * are touched, such as td_list, otherwise we overwrite freed data ++ */ ++ if (!td_on_ring(&urb_priv->td[0], ep_ring)) { ++ xhci_err(xhci, "Canceled URB td not found on endpoint ring"); ++ for (i = urb_priv->num_tds_done; i < urb_priv->num_tds; i++) { ++ td = &urb_priv->td[i]; ++ if (!list_empty(&td->cancelled_td_list)) ++ list_del_init(&td->cancelled_td_list); ++ } ++ goto err_giveback; ++ } ++ + if (xhci->xhc_state & XHCI_STATE_HALTED) { + xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, + "HC halted, freeing TD manually."); +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index de9a502491c2..69822852888a 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -369,7 +369,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -379,7 +379,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 3be40eaa1ac9..1232dd49556d 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -421,13 +421,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -446,6 +446,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c +index eecfd0671362..d045d8458f81 100644 +--- a/drivers/usb/mtu3/mtu3_core.c ++++ b/drivers/usb/mtu3/mtu3_core.c +@@ -107,8 +107,12 @@ static int mtu3_device_enable(struct mtu3 *mtu) + (SSUSB_U2_PORT_DIS | SSUSB_U2_PORT_PDN | + SSUSB_U2_PORT_HOST_SEL)); + +- if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) ++ if (mtu->ssusb->dr_mode == USB_DR_MODE_OTG) { + mtu3_setbits(ibase, SSUSB_U2_CTRL(0), SSUSB_U2_PORT_OTG_SEL); ++ if (mtu->is_u3_ip) ++ mtu3_setbits(ibase, SSUSB_U3_CTRL(0), ++ SSUSB_U3_PORT_DUAL_MODE); ++ } + + return ssusb_check_clocks(mtu->ssusb, check_clk); + } +diff --git a/drivers/usb/mtu3/mtu3_hw_regs.h b/drivers/usb/mtu3/mtu3_hw_regs.h +index 6ee371478d89..a45bb253939f 100644 +--- a/drivers/usb/mtu3/mtu3_hw_regs.h ++++ b/drivers/usb/mtu3/mtu3_hw_regs.h +@@ -459,6 +459,7 @@ + + /* U3D_SSUSB_U3_CTRL_0P */ + #define SSUSB_U3_PORT_SSP_SPEED BIT(9) ++#define SSUSB_U3_PORT_DUAL_MODE BIT(7) + #define SSUSB_U3_PORT_HOST_SEL BIT(2) + #define SSUSB_U3_PORT_PDN BIT(1) + #define SSUSB_U3_PORT_DIS BIT(0) +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index e53c68261017..9bbcee37524e 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -173,7 +173,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c +index 6b22857f6e52..58fc7964ee6b 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1119,7 +1119,7 @@ static void ti_break(struct tty_struct *tty, int break_state) + + static int ti_get_port_from_code(unsigned char code) + { +- return (code >> 4) - 3; ++ return (code >> 6) & 0x01; + } + + static int ti_get_func_from_code(unsigned char code) +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index c267f2812a04..e227bb5b794f 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -376,6 +376,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 9e9de5452860..1f7b401c4d04 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev) + sdev->skip_ms_page_8 = 1; + sdev->wce_default_on = 1; + } ++ ++ /* ++ * Some disks return the total number of blocks in response ++ * to READ CAPACITY rather than the highest block number. ++ * If this device makes that mistake, tell the sd driver. ++ */ ++ if (devinfo->flags & US_FL_FIX_CAPACITY) ++ sdev->fix_capacity = 1; ++ ++ /* ++ * Some devices don't like MODE SENSE with page=0x3f, ++ * which is the command used for checking if a device ++ * is write-protected. Now that we tell the sd driver ++ * to do a 192-byte transfer with this command the ++ * majority of devices work fine, but a few still can't ++ * handle it. The sd driver will simply assume those ++ * devices are write-enabled. ++ */ ++ if (devinfo->flags & US_FL_NO_WP_DETECT) ++ sdev->skip_ms_page_3f = 1; ++ + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); + return 0; + } +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 22fcfccf453a..f7f83b21dc74 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2288,6 +2288,13 @@ UNUSUAL_DEV( 0x2735, 0x100b, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported-by: Tim Anderson */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Reported by Frederic Marchal + * Mio Moov 330 +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * x[M][R][-][@][i][m] or ++ * x[M][R][-][@][i][p][m] or + * [-][@] + * + * with , , and decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 3b70044773b6..9fe7edf725c6 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 585f39efcff6..1c75f4806ed3 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -958,7 +958,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/omap2/omapfb/Makefile b/drivers/video/fbdev/omap2/omapfb/Makefile +index 602edfed09df..f54c3f56b641 100644 +--- a/drivers/video/fbdev/omap2/omapfb/Makefile ++++ b/drivers/video/fbdev/omap2/omapfb/Makefile +@@ -2,5 +2,5 @@ + obj-$(CONFIG_OMAP2_VRFB) += vrfb.o + obj-y += dss/ + obj-y += displays/ +-obj-$(CONFIG_FB_OMAP2) += omapfb.o +-omapfb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o ++obj-$(CONFIG_FB_OMAP2) += omap2fb.o ++omap2fb-y := omapfb-main.o omapfb-sysfs.o omapfb-ioctl.o +diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c +index 76722a59f55e..dfe382e68287 100644 +--- a/drivers/video/fbdev/pxafb.c ++++ b/drivers/video/fbdev/pxafb.c +@@ -2128,8 +2128,8 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp, + return -EINVAL; + + ret = -ENOMEM; +- info->modes = kmalloc_array(timings->num_timings, +- sizeof(info->modes[0]), GFP_KERNEL); ++ info->modes = kcalloc(timings->num_timings, sizeof(info->modes[0]), ++ GFP_KERNEL); + if (!info->modes) + goto out; + info->num_modes = timings->num_timings; +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index d2f785068ef4..7bb7e90b8f00 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include + #include + #include + #include +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 816cc921cf36..efae2fb0930a 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1751,7 +1751,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset_size(t->task, regset); + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index eeab81c9452f..e169e1a5fd35 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 82be1dfeca33..29cce842ed04 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2418,14 +2418,14 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, + /* We check for obvious errors in the output buffer length and offset */ + if (*plen == 0) + goto ioctl_exit; /* server returned no data */ +- else if (*plen > 0xFF00) { ++ else if (*plen > rsp_iov.iov_len || *plen > 0xFF00) { + cifs_dbg(VFS, "srv returned invalid ioctl length: %d\n", *plen); + *plen = 0; + rc = -EIO; + goto ioctl_exit; + } + +- if (rsp_iov.iov_len < le32_to_cpu(rsp->OutputOffset) + *plen) { ++ if (rsp_iov.iov_len - *plen < le32_to_cpu(rsp->OutputOffset)) { + cifs_dbg(VFS, "Malformed ioctl resp: len %d offset %d\n", *plen, + le32_to_cpu(rsp->OutputOffset)); + *plen = 0; +@@ -3492,33 +3492,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index 577cff24707b..39843fa7e11b 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct config_group *group) + struct dentry *dentry = group->cg_item.ci_dentry; + struct dentry *parent = group->cg_item.ci_parent->ci_dentry; + ++ mutex_lock(&subsys->su_mutex); ++ if (!group->cg_item.ci_parent->ci_group) { ++ /* ++ * The parent has already been unlinked and detached ++ * due to a rmdir. ++ */ ++ goto unlink_group; ++ } ++ mutex_unlock(&subsys->su_mutex); ++ + inode_lock_nested(d_inode(parent), I_MUTEX_PARENT); + spin_lock(&configfs_dirent_lock); + configfs_detach_prep(dentry, NULL); +@@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct config_group *group) + dput(dentry); + + mutex_lock(&subsys->su_mutex); ++unlink_group: + unlink_group(group); + mutex_unlock(&subsys->su_mutex); + } +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 128d489acebb..742147cbe759 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3106,9 +3106,19 @@ static struct dentry *f2fs_mount(struct file_system_type *fs_type, int flags, + static void kill_f2fs_super(struct super_block *sb) + { + if (sb->s_root) { +- set_sbi_flag(F2FS_SB(sb), SBI_IS_CLOSE); +- f2fs_stop_gc_thread(F2FS_SB(sb)); +- f2fs_stop_discard_thread(F2FS_SB(sb)); ++ struct f2fs_sb_info *sbi = F2FS_SB(sb); ++ ++ set_sbi_flag(sbi, SBI_IS_CLOSE); ++ f2fs_stop_gc_thread(sbi); ++ f2fs_stop_discard_thread(sbi); ++ ++ if (is_sbi_flag_set(sbi, SBI_IS_DIRTY) || ++ !is_set_ckpt_flags(sbi, CP_UMOUNT_FLAG)) { ++ struct cp_control cpc = { ++ .reason = CP_UMOUNT, ++ }; ++ f2fs_write_checkpoint(sbi, &cpc); ++ } + } + kill_block_super(sb); + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index ed6699705c13..fd5bea55fd60 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -2060,7 +2060,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 33abcf29bc05..b86249ebde11 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1686,7 +1686,8 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, + + while(1) { + bi = rbm_bi(rbm); +- if (test_bit(GBF_FULL, &bi->bi_flags) && ++ if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) && ++ test_bit(GBF_FULL, &bi->bi_flags) && + (state == GFS2_BLKST_FREE)) + goto next_bitmap; + +diff --git a/fs/namespace.c b/fs/namespace.c +index bd2f4c68506a..1949e0939d40 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -446,10 +446,10 @@ int mnt_want_write_file_path(struct file *file) + { + int ret; + +- sb_start_write(file->f_path.mnt->mnt_sb); ++ sb_start_write(file_inode(file)->i_sb); + ret = __mnt_want_write_file(file); + if (ret) +- sb_end_write(file->f_path.mnt->mnt_sb); ++ sb_end_write(file_inode(file)->i_sb); + return ret; + } + +@@ -540,7 +540,8 @@ void __mnt_drop_write_file(struct file *file) + + void mnt_drop_write_file_path(struct file *file) + { +- mnt_drop_write(file->f_path.mnt); ++ __mnt_drop_write_file(file); ++ sb_end_write(file_inode(file)->i_sb); + } + + void mnt_drop_write_file(struct file *file) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ff98e2a3f3cc..f688338b0482 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2642,14 +2642,18 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state) + } + + nfs4_stateid_copy(&stateid, &delegation->stateid); +- if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) || +- !test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, +- &delegation->flags)) { ++ if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) { + rcu_read_unlock(); + nfs_finish_clear_delegation_stateid(state, &stateid); + return; + } + ++ if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, ++ &delegation->flags)) { ++ rcu_read_unlock(); ++ return; ++ } ++ + cred = get_rpccred(delegation->cred); + rcu_read_unlock(); + status = nfs41_test_and_free_expired_stateid(server, &stateid, cred); +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 2bf2eaa08ca7..3c18c12a5c4c 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1390,6 +1390,8 @@ int nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4_ + + if (!nfs4_state_mark_reclaim_nograce(clp, state)) + return -EBADF; ++ nfs_inode_find_delegation_state_and_recover(state->inode, ++ &state->stateid); + dprintk("%s: scheduling stateid recovery for server %s\n", __func__, + clp->cl_hostname); + nfs4_schedule_state_manager(clp); +diff --git a/fs/nfs/nfs4trace.h b/fs/nfs/nfs4trace.h +index a275fba93170..708342f4692f 100644 +--- a/fs/nfs/nfs4trace.h ++++ b/fs/nfs/nfs4trace.h +@@ -1194,7 +1194,7 @@ DECLARE_EVENT_CLASS(nfs4_inode_stateid_callback_event, + TP_fast_assign( + __entry->error = error; + __entry->fhandle = nfs_fhandle_hash(fhandle); +- if (inode != NULL) { ++ if (!IS_ERR_OR_NULL(inode)) { + __entry->fileid = NFS_FILEID(inode); + __entry->dev = inode->i_sb->s_dev; + } else { +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index 704b37311467..fa2121f877c1 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -970,16 +970,6 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath) + if (err) + goto out; + +- err = -EBUSY; +- if (ovl_inuse_trylock(upperpath->dentry)) { +- ofs->upperdir_locked = true; +- } else if (ofs->config.index) { +- pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n"); +- goto out; +- } else { +- pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n"); +- } +- + upper_mnt = clone_private_mount(upperpath); + err = PTR_ERR(upper_mnt); + if (IS_ERR(upper_mnt)) { +@@ -990,6 +980,17 @@ static int ovl_get_upper(struct ovl_fs *ofs, struct path *upperpath) + /* Don't inherit atime flags */ + upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME); + ofs->upper_mnt = upper_mnt; ++ ++ err = -EBUSY; ++ if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) { ++ ofs->upperdir_locked = true; ++ } else if (ofs->config.index) { ++ pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n"); ++ goto out; ++ } else { ++ pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n"); ++ } ++ + err = 0; + out: + return err; +@@ -1089,8 +1090,10 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath) + goto out; + } + ++ ofs->workbasedir = dget(workpath.dentry); ++ + err = -EBUSY; +- if (ovl_inuse_trylock(workpath.dentry)) { ++ if (ovl_inuse_trylock(ofs->workbasedir)) { + ofs->workdir_locked = true; + } else if (ofs->config.index) { + pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n"); +@@ -1099,7 +1102,6 @@ static int ovl_get_workdir(struct ovl_fs *ofs, struct path *upperpath) + pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n"); + } + +- ofs->workbasedir = dget(workpath.dentry); + err = ovl_make_workdir(ofs, &workpath); + if (err) + goto out; +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 951a14edcf51..0792595ebcfb 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -429,7 +429,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -448,6 +453,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -468,7 +478,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -515,7 +525,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/include/linux/crypto.h b/include/linux/crypto.h +index 6eb06101089f..e8839d3a7559 100644 +--- a/include/linux/crypto.h ++++ b/include/linux/crypto.h +@@ -112,6 +112,11 @@ + */ + #define CRYPTO_ALG_OPTIONAL_KEY 0x00004000 + ++/* ++ * Don't trigger module loading ++ */ ++#define CRYPTO_NOLOAD 0x00008000 ++ + /* + * Transform masks and values (for crt_flags). + */ +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 83957920653a..64f450593b54 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -357,7 +357,7 @@ struct mlx5_frag_buf { + struct mlx5_frag_buf_ctrl { + struct mlx5_frag_buf frag_buf; + u32 sz_m1; +- u32 frag_sz_m1; ++ u16 frag_sz_m1; + u32 strides_offset; + u8 log_sz; + u8 log_stride; +@@ -1042,7 +1042,7 @@ int mlx5_cmd_free_uar(struct mlx5_core_dev *dev, u32 uarn); + void mlx5_health_cleanup(struct mlx5_core_dev *dev); + int mlx5_health_init(struct mlx5_core_dev *dev); + void mlx5_start_health_poll(struct mlx5_core_dev *dev); +-void mlx5_stop_health_poll(struct mlx5_core_dev *dev); ++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health); + void mlx5_drain_health_wq(struct mlx5_core_dev *dev); + void mlx5_trigger_health_work(struct mlx5_core_dev *dev); + void mlx5_drain_health_recovery(struct mlx5_core_dev *dev); +diff --git a/include/linux/of.h b/include/linux/of.h +index 4d25e4f952d9..b99a1a8c2952 100644 +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -290,6 +290,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node, + extern struct device_node *of_get_next_available_child( + const struct device_node *node, struct device_node *prev); + ++extern struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible); + extern struct device_node *of_get_child_by_name(const struct device_node *node, + const char *name); + +@@ -632,6 +634,12 @@ static inline bool of_have_populated_dt(void) + return false; + } + ++static inline struct device_node *of_get_compatible_child(const struct device_node *parent, ++ const char *compatible) ++{ ++ return NULL; ++} ++ + static inline struct device_node *of_get_child_by_name( + const struct device_node *node, + const char *name) +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index c17c0c268436..dce35e16bff4 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 3d83ee7df381..badabb0b435c 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -95,7 +95,7 @@ static int compute_effective_progs(struct cgroup *cgrp, + enum bpf_attach_type type, + struct bpf_prog_array __rcu **array) + { +- struct bpf_prog_array __rcu *progs; ++ struct bpf_prog_array *progs; + struct bpf_prog_list *pl; + struct cgroup *p = cgrp; + int cnt = 0; +@@ -120,13 +120,12 @@ static int compute_effective_progs(struct cgroup *cgrp, + &p->bpf.progs[type], node) { + if (!pl->prog) + continue; +- rcu_dereference_protected(progs, 1)-> +- progs[cnt++] = pl->prog; ++ progs->progs[cnt++] = pl->prog; + } + p = cgroup_parent(p); + } while (p); + +- *array = progs; ++ rcu_assign_pointer(*array, progs); + return 0; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index eec2d5fb676b..c7b3e34811ec 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5948,6 +5948,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, + unsigned long sp; + unsigned int rem; + u64 dyn_size; ++ mm_segment_t fs; + + /* + * We dump: +@@ -5965,7 +5966,10 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, + + /* Data. */ + sp = perf_user_stack_pointer(regs); ++ fs = get_fs(); ++ set_fs(USER_DS); + rem = __output_copy_user(handle, (void *) sp, dump_size); ++ set_fs(fs); + dyn_size = dump_size - rem; + + perf_output_skip(handle, rem); +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 42fcb7f05fac..f42cf69ef539 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -1446,7 +1446,7 @@ static int rcu_torture_stall(void *args) + VERBOSE_TOROUT_STRING("rcu_torture_stall end holdoff"); + } + if (!kthread_should_stop()) { +- stop_at = get_seconds() + stall_cpu; ++ stop_at = ktime_get_seconds() + stall_cpu; + /* RCU CPU stall is expected behavior in following code. */ + rcu_read_lock(); + if (stall_cpu_irqsoff) +@@ -1455,7 +1455,8 @@ static int rcu_torture_stall(void *args) + preempt_disable(); + pr_alert("rcu_torture_stall start on CPU %d.\n", + smp_processor_id()); +- while (ULONG_CMP_LT(get_seconds(), stop_at)) ++ while (ULONG_CMP_LT((unsigned long)ktime_get_seconds(), ++ stop_at)) + continue; /* Induce RCU CPU stall warning. */ + if (stall_cpu_irqsoff) + local_irq_enable(); +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 9c219f7b0970..478d9d3e6be9 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -735,11 +735,12 @@ static void attach_entity_cfs_rq(struct sched_entity *se); + * To solve this problem, we also cap the util_avg of successive tasks to + * only 1/2 of the left utilization budget: + * +- * util_avg_cap = (1024 - cfs_rq->avg.util_avg) / 2^n ++ * util_avg_cap = (cpu_scale - cfs_rq->avg.util_avg) / 2^n + * +- * where n denotes the nth task. ++ * where n denotes the nth task and cpu_scale the CPU capacity. + * +- * For example, a simplest series from the beginning would be like: ++ * For example, for a CPU with 1024 of capacity, a simplest series from ++ * the beginning would be like: + * + * task util_avg: 512, 256, 128, 64, 32, 16, 8, ... + * cfs_rq util_avg: 512, 768, 896, 960, 992, 1008, 1016, ... +@@ -751,7 +752,8 @@ void post_init_entity_util_avg(struct sched_entity *se) + { + struct cfs_rq *cfs_rq = cfs_rq_of(se); + struct sched_avg *sa = &se->avg; +- long cap = (long)(SCHED_CAPACITY_SCALE - cfs_rq->avg.util_avg) / 2; ++ long cpu_scale = arch_scale_cpu_capacity(NULL, cpu_of(rq_of(cfs_rq))); ++ long cap = (long)(cpu_scale - cfs_rq->avg.util_avg) / 2; + + if (cap > 0) { + if (cfs_rq->avg.util_avg != 0) { +diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c +index 928be527477e..a7a2aaa3026a 100644 +--- a/kernel/sched/wait.c ++++ b/kernel/sched/wait.c +@@ -392,35 +392,36 @@ static inline bool is_kthread_should_stop(void) + * if (condition) + * break; + * +- * p->state = mode; condition = true; +- * smp_mb(); // A smp_wmb(); // C +- * if (!wq_entry->flags & WQ_FLAG_WOKEN) wq_entry->flags |= WQ_FLAG_WOKEN; +- * schedule() try_to_wake_up(); +- * p->state = TASK_RUNNING; ~~~~~~~~~~~~~~~~~~ +- * wq_entry->flags &= ~WQ_FLAG_WOKEN; condition = true; +- * smp_mb() // B smp_wmb(); // C +- * wq_entry->flags |= WQ_FLAG_WOKEN; +- * } +- * remove_wait_queue(&wq_head, &wait); ++ * // in wait_woken() // in woken_wake_function() + * ++ * p->state = mode; wq_entry->flags |= WQ_FLAG_WOKEN; ++ * smp_mb(); // A try_to_wake_up(): ++ * if (!(wq_entry->flags & WQ_FLAG_WOKEN)) ++ * schedule() if (p->state & mode) ++ * p->state = TASK_RUNNING; p->state = TASK_RUNNING; ++ * wq_entry->flags &= ~WQ_FLAG_WOKEN; ~~~~~~~~~~~~~~~~~~ ++ * smp_mb(); // B condition = true; ++ * } smp_mb(); // C ++ * remove_wait_queue(&wq_head, &wait); wq_entry->flags |= WQ_FLAG_WOKEN; + */ + long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout) + { +- set_current_state(mode); /* A */ + /* +- * The above implies an smp_mb(), which matches with the smp_wmb() from +- * woken_wake_function() such that if we observe WQ_FLAG_WOKEN we must +- * also observe all state before the wakeup. ++ * The below executes an smp_mb(), which matches with the full barrier ++ * executed by the try_to_wake_up() in woken_wake_function() such that ++ * either we see the store to wq_entry->flags in woken_wake_function() ++ * or woken_wake_function() sees our store to current->state. + */ ++ set_current_state(mode); /* A */ + if (!(wq_entry->flags & WQ_FLAG_WOKEN) && !is_kthread_should_stop()) + timeout = schedule_timeout(timeout); + __set_current_state(TASK_RUNNING); + + /* +- * The below implies an smp_mb(), it too pairs with the smp_wmb() from +- * woken_wake_function() such that we must either observe the wait +- * condition being true _OR_ WQ_FLAG_WOKEN such that we will not miss +- * an event. ++ * The below executes an smp_mb(), which matches with the smp_mb() (C) ++ * in woken_wake_function() such that either we see the wait condition ++ * being true or the store to wq_entry->flags in woken_wake_function() ++ * follows ours in the coherence order. + */ + smp_store_mb(wq_entry->flags, wq_entry->flags & ~WQ_FLAG_WOKEN); /* B */ + +@@ -430,14 +431,8 @@ EXPORT_SYMBOL(wait_woken); + + int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, int sync, void *key) + { +- /* +- * Although this function is called under waitqueue lock, LOCK +- * doesn't imply write barrier and the users expects write +- * barrier semantics on wakeup functions. The following +- * smp_wmb() is equivalent to smp_wmb() in try_to_wake_up() +- * and is paired with smp_store_mb() in wait_woken(). +- */ +- smp_wmb(); /* C */ ++ /* Pairs with the smp_store_mb() in wait_woken(). */ ++ smp_mb(); /* C */ + wq_entry->flags |= WQ_FLAG_WOKEN; + + return default_wake_function(wq_entry, mode, sync, key); +diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c +index 3264e1873219..deacc52d7ff1 100644 +--- a/net/bluetooth/af_bluetooth.c ++++ b/net/bluetooth/af_bluetooth.c +@@ -159,7 +159,7 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk) + BT_DBG("parent %p, sk %p", parent, sk); + + sock_hold(sk); +- lock_sock(sk); ++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING); + list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q); + bt_sk(sk)->parent = parent; + release_sock(sk); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index fb35b62af272..3680912f056a 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -939,9 +939,6 @@ struct ubuf_info *sock_zerocopy_alloc(struct sock *sk, size_t size) + + WARN_ON_ONCE(!in_task()); + +- if (!sock_flag(sk, SOCK_ZEROCOPY)) +- return NULL; +- + skb = sock_omalloc(sk, 0, GFP_KERNEL); + if (!skb) + return NULL; +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 055f4bbba86b..41883c34a385 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -178,6 +178,9 @@ static void ipgre_err(struct sk_buff *skb, u32 info, + + if (tpi->proto == htons(ETH_P_TEB)) + itn = net_generic(net, gre_tap_net_id); ++ else if (tpi->proto == htons(ETH_P_ERSPAN) || ++ tpi->proto == htons(ETH_P_ERSPAN2)) ++ itn = net_generic(net, erspan_net_id); + else + itn = net_generic(net, ipgre_net_id); + +@@ -328,6 +331,8 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); + return PACKET_RCVD; + } ++ return PACKET_REJECT; ++ + drop: + kfree_skb(skb); + return PACKET_RCVD; +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 4491faf83f4f..086201d96d54 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1186,7 +1186,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) + + flags = msg->msg_flags; + +- if (flags & MSG_ZEROCOPY && size) { ++ if (flags & MSG_ZEROCOPY && size && sock_flag(sk, SOCK_ZEROCOPY)) { + if (sk->sk_state != TCP_ESTABLISHED) { + err = -EINVAL; + goto out_err; +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index bdf6fa78d0d2..aa082b71d2e4 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -495,7 +495,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index ee0d0cc8dc3b..c054ac85793c 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -656,11 +656,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -688,14 +692,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -930,7 +934,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -940,7 +945,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/rds/bind.c b/net/rds/bind.c +index 5aa3a64aa4f0..48257d3a4201 100644 +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -60,11 +60,13 @@ struct rds_sock *rds_find_bound(__be32 addr, __be16 port) + u64 key = ((u64)addr << 32) | port; + struct rds_sock *rs; + +- rs = rhashtable_lookup_fast(&bind_hash_table, &key, ht_parms); ++ rcu_read_lock(); ++ rs = rhashtable_lookup(&bind_hash_table, &key, ht_parms); + if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) + rds_sock_addref(rs); + else + rs = NULL; ++ rcu_read_unlock(); + + rdsdebug("returning rs %p for %pI4:%u\n", rs, &addr, + ntohs(port)); +@@ -157,6 +159,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + ++ sock_set_flag(sk, SOCK_RCU_FREE); + ret = rds_add_bound(rs, sin->sin_addr.s_addr, &sin->sin_port); + if (ret) + goto out; +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 0a5fa347135e..ac8ca238c541 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -578,6 +578,7 @@ static int tipc_release(struct socket *sock) + sk_stop_timer(sk, &sk->sk_timer); + tipc_sk_remove(tsk); + ++ sock_orphan(sk); + /* Reject any messages that accumulated in backlog queue */ + release_sock(sk); + tipc_dest_list_purge(&tsk->cong_links); +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 1f3d9789af30..b3344bbe336b 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -149,6 +149,9 @@ static int alloc_encrypted_sg(struct sock *sk, int len) + &ctx->sg_encrypted_num_elem, + &ctx->sg_encrypted_size, 0); + ++ if (rc == -ENOSPC) ++ ctx->sg_encrypted_num_elem = ARRAY_SIZE(ctx->sg_encrypted_data); ++ + return rc; + } + +@@ -162,6 +165,9 @@ static int alloc_plaintext_sg(struct sock *sk, int len) + &ctx->sg_plaintext_num_elem, &ctx->sg_plaintext_size, + tls_ctx->pending_open_record_frags); + ++ if (rc == -ENOSPC) ++ ctx->sg_plaintext_num_elem = ARRAY_SIZE(ctx->sg_plaintext_data); ++ + return rc; + } + +@@ -280,7 +286,7 @@ static int zerocopy_from_iter(struct sock *sk, struct iov_iter *from, + int length, int *pages_used, + unsigned int *size_used, + struct scatterlist *to, int to_max_pages, +- bool charge) ++ bool charge, bool revert) + { + struct page *pages[MAX_SKB_FRAGS]; + +@@ -331,6 +337,8 @@ static int zerocopy_from_iter(struct sock *sk, struct iov_iter *from, + out: + *size_used = size; + *pages_used = num_elem; ++ if (revert) ++ iov_iter_revert(from, size); + + return rc; + } +@@ -432,7 +440,7 @@ alloc_encrypted: + &ctx->sg_plaintext_size, + ctx->sg_plaintext_data, + ARRAY_SIZE(ctx->sg_plaintext_data), +- true); ++ true, false); + if (ret) + goto fallback_to_reg_send; + +@@ -820,7 +828,7 @@ int tls_sw_recvmsg(struct sock *sk, + err = zerocopy_from_iter(sk, &msg->msg_iter, + to_copy, &pages, + &chunk, &sgin[1], +- MAX_SKB_FRAGS, false); ++ MAX_SKB_FRAGS, false, true); + if (err < 0) + goto fallback_to_reg_recv; + +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 7c5e8978aeaa..a94983e03a8b 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1831,7 +1831,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 86321f06461e..ed303f552f9d 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -400,3 +400,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index b60524310855..c20e3142b541 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -97,7 +97,8 @@ static struct shash_desc *init_desc(char type) + mutex_lock(&mutex); + if (*tfm) + goto out; +- *tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC); ++ *tfm = crypto_alloc_shash(algo, 0, ++ CRYPTO_ALG_ASYNC | CRYPTO_NOLOAD); + if (IS_ERR(*tfm)) { + rc = PTR_ERR(*tfm); + pr_err("Can not allocate %s (reason: %ld)\n", algo, rc); +diff --git a/security/security.c b/security/security.c +index 68f46d849abe..4e572b38937d 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -118,6 +118,8 @@ static int lsm_append(char *new, char **result) + + if (*result == NULL) { + *result = kstrdup(new, GFP_KERNEL); ++ if (*result == NULL) ++ return -ENOMEM; + } else { + /* Check if it is the last registered name */ + if (match_last_lsm(*result, new)) +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 19de675d4504..8b6cd5a79bfa 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -3924,15 +3924,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) + struct smack_known *skp = NULL; + int rc = 0; + struct smk_audit_info ad; ++ u16 family = sk->sk_family; + #ifdef CONFIG_AUDIT + struct lsm_network_audit net; + #endif + #if IS_ENABLED(CONFIG_IPV6) + struct sockaddr_in6 sadd; + int proto; ++ ++ if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) ++ family = PF_INET; + #endif /* CONFIG_IPV6 */ + +- switch (sk->sk_family) { ++ switch (family) { + case PF_INET: + #ifdef CONFIG_SECURITY_SMACK_NETFILTER + /* +@@ -3950,7 +3954,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) + */ + netlbl_secattr_init(&secattr); + +- rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr); ++ rc = netlbl_skbuff_getattr(skb, family, &secattr); + if (rc == 0) + skp = smack_from_secattr(&secattr, ssp); + else +@@ -3963,7 +3967,7 @@ access_check: + #endif + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); +- ad.a.u.net->family = sk->sk_family; ++ ad.a.u.net->family = family; + ad.a.u.net->netif = skb->skb_iif; + ipv4_skb_to_auditdata(skb, &ad.a, NULL); + #endif +@@ -3977,7 +3981,7 @@ access_check: + rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, + MAY_WRITE, rc); + if (rc != 0) +- netlbl_skbuff_err(skb, sk->sk_family, rc, 0); ++ netlbl_skbuff_err(skb, family, rc, 0); + break; + #if IS_ENABLED(CONFIG_IPV6) + case PF_INET6: +@@ -3993,7 +3997,7 @@ access_check: + skp = smack_net_ambient; + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); +- ad.a.u.net->family = sk->sk_family; ++ ad.a.u.net->family = family; + ad.a.u.net->netif = skb->skb_iif; + ipv6_skb_to_auditdata(skb, &ad.a, NULL); + #endif /* CONFIG_AUDIT */ +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 44b5ae833082..a4aac948ea49 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -626,27 +626,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index 6c584d9b6c42..a19f802b2071 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index 38e4a8515709..d00734d31e04 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -291,10 +291,6 @@ static const struct snd_soc_dapm_widget hdmi_widgets[] = { + SND_SOC_DAPM_OUTPUT("TX"), + }; + +-static const struct snd_soc_dapm_route hdmi_routes[] = { +- { "TX", NULL, "Playback" }, +-}; +- + enum { + DAI_ID_I2S = 0, + DAI_ID_SPDIF, +@@ -689,9 +685,23 @@ static int hdmi_codec_pcm_new(struct snd_soc_pcm_runtime *rtd, + return snd_ctl_add(rtd->card->snd_card, kctl); + } + ++static int hdmi_dai_probe(struct snd_soc_dai *dai) ++{ ++ struct snd_soc_dapm_context *dapm; ++ struct snd_soc_dapm_route route = { ++ .sink = "TX", ++ .source = dai->driver->playback.stream_name, ++ }; ++ ++ dapm = snd_soc_component_get_dapm(dai->component); ++ ++ return snd_soc_dapm_add_routes(dapm, &route, 1); ++} ++ + static const struct snd_soc_dai_driver hdmi_i2s_dai = { + .name = "i2s-hifi", + .id = DAI_ID_I2S, ++ .probe = hdmi_dai_probe, + .playback = { + .stream_name = "I2S Playback", + .channels_min = 2, +@@ -707,6 +717,7 @@ static const struct snd_soc_dai_driver hdmi_i2s_dai = { + static const struct snd_soc_dai_driver hdmi_spdif_dai = { + .name = "spdif-hifi", + .id = DAI_ID_SPDIF, ++ .probe = hdmi_dai_probe, + .playback = { + .stream_name = "SPDIF Playback", + .channels_min = 2, +@@ -733,8 +744,6 @@ static int hdmi_of_xlate_dai_id(struct snd_soc_component *component, + static const struct snd_soc_component_driver hdmi_driver = { + .dapm_widgets = hdmi_widgets, + .num_dapm_widgets = ARRAY_SIZE(hdmi_widgets), +- .dapm_routes = hdmi_routes, +- .num_dapm_routes = ARRAY_SIZE(hdmi_routes), + .of_xlate_dai_id = hdmi_of_xlate_dai_id, + .idle_bias_on = 1, + .use_pmdown_time = 1, +diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c +index 1570b91bf018..dca82dd6e3bf 100644 +--- a/sound/soc/codecs/rt5514.c ++++ b/sound/soc/codecs/rt5514.c +@@ -64,8 +64,8 @@ static const struct reg_sequence rt5514_patch[] = { + {RT5514_ANA_CTRL_LDO10, 0x00028604}, + {RT5514_ANA_CTRL_ADCFED, 0x00000800}, + {RT5514_ASRC_IN_CTRL1, 0x00000003}, +- {RT5514_DOWNFILTER0_CTRL3, 0x10000362}, +- {RT5514_DOWNFILTER1_CTRL3, 0x10000362}, ++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352}, ++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352}, + }; + + static const struct reg_default rt5514_reg[] = { +@@ -92,10 +92,10 @@ static const struct reg_default rt5514_reg[] = { + {RT5514_ASRC_IN_CTRL1, 0x00000003}, + {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f}, + {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f}, +- {RT5514_DOWNFILTER0_CTRL3, 0x10000362}, ++ {RT5514_DOWNFILTER0_CTRL3, 0x10000352}, + {RT5514_DOWNFILTER1_CTRL1, 0x00020c2f}, + {RT5514_DOWNFILTER1_CTRL2, 0x00020c2f}, +- {RT5514_DOWNFILTER1_CTRL3, 0x10000362}, ++ {RT5514_DOWNFILTER1_CTRL3, 0x10000352}, + {RT5514_ANA_CTRL_LDO10, 0x00028604}, + {RT5514_ANA_CTRL_LDO18_16, 0x02000345}, + {RT5514_ANA_CTRL_ADC12, 0x0000a2a8}, +diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c +index 6b5669f3e85d..39d2c67cd064 100644 +--- a/sound/soc/codecs/rt5651.c ++++ b/sound/soc/codecs/rt5651.c +@@ -1696,6 +1696,13 @@ static irqreturn_t rt5651_irq(int irq, void *data) + return IRQ_HANDLED; + } + ++static void rt5651_cancel_work(void *data) ++{ ++ struct rt5651_priv *rt5651 = data; ++ ++ cancel_work_sync(&rt5651->jack_detect_work); ++} ++ + static int rt5651_set_jack(struct snd_soc_component *component, + struct snd_soc_jack *hp_jack, void *data) + { +@@ -2036,6 +2043,11 @@ static int rt5651_i2c_probe(struct i2c_client *i2c, + + INIT_WORK(&rt5651->jack_detect_work, rt5651_jack_detect_work); + ++ /* Make sure work is stopped on probe-error / remove */ ++ ret = devm_add_action_or_reset(&i2c->dev, rt5651_cancel_work, rt5651); ++ if (ret) ++ return ret; ++ + ret = devm_snd_soc_register_component(&i2c->dev, + &soc_component_dev_rt5651, + rt5651_dai, ARRAY_SIZE(rt5651_dai)); +@@ -2043,15 +2055,6 @@ static int rt5651_i2c_probe(struct i2c_client *i2c, + return ret; + } + +-static int rt5651_i2c_remove(struct i2c_client *i2c) +-{ +- struct rt5651_priv *rt5651 = i2c_get_clientdata(i2c); +- +- cancel_work_sync(&rt5651->jack_detect_work); +- +- return 0; +-} +- + static struct i2c_driver rt5651_i2c_driver = { + .driver = { + .name = "rt5651", +@@ -2059,7 +2062,6 @@ static struct i2c_driver rt5651_i2c_driver = { + .of_match_table = of_match_ptr(rt5651_of_match), + }, + .probe = rt5651_i2c_probe, +- .remove = rt5651_i2c_remove, + .id_table = rt5651_i2c_id, + }; + module_i2c_driver(rt5651_i2c_driver); +diff --git a/sound/soc/qcom/qdsp6/q6afe-dai.c b/sound/soc/qcom/qdsp6/q6afe-dai.c +index 5002dd05bf27..f8298be7038f 100644 +--- a/sound/soc/qcom/qdsp6/q6afe-dai.c ++++ b/sound/soc/qcom/qdsp6/q6afe-dai.c +@@ -1180,7 +1180,7 @@ static void of_q6afe_parse_dai_data(struct device *dev, + int id, i, num_lines; + + ret = of_property_read_u32(node, "reg", &id); +- if (ret || id > AFE_PORT_MAX) { ++ if (ret || id < 0 || id >= AFE_PORT_MAX) { + dev_err(dev, "valid dai id not found:%d\n", ret); + continue; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 8aac48f9c322..08aa78007020 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 02b6cc02767f..dde87d64bc32 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1373,6 +1373,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + break; + ++ case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */ + case USB_ID(0x0d8c, 0x0316): /* Hegel HD12 DSD */ + case USB_ID(0x16b0, 0x06b2): /* NuPrime DAC-10 */ + case USB_ID(0x16d0, 0x0733): /* Furutech ADL Stratos */ +@@ -1443,6 +1444,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + */ + switch (USB_ID_VENDOR(chip->usb_id)) { + case 0x20b1: /* XMOS based devices */ ++ case 0x152a: /* Thesycon devices */ + case 0x25ce: /* Mytek devices */ + if (fp->dsd_raw) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index dbf6e8bd98ba..bbb2a8ef367c 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index ef5d59a5742e..7c6eeb4633fe 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al); + +diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c +index dd850a26d579..4f5de8245b32 100644 +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -599,7 +599,7 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist) + for (subi = 0; subi < subn; subi++) { + pr_info("%2d.%1d: %-*s:", i, subi + 1, subw, + t->subtest.get_desc(subi)); +- err = test_and_print(t, skip, subi); ++ err = test_and_print(t, skip, subi + 1); + if (err != TEST_OK && t->subtest.skip_if_fail) + skip = true; + } +diff --git a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh +index 94e513e62b34..3013ac8f83d0 100755 +--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh ++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh +@@ -13,11 +13,24 @@ + libc=$(grep -w libc /proc/self/maps | head -1 | sed -r 's/.*[[:space:]](\/.*)/\1/g') + nm -Dg $libc 2>/dev/null | fgrep -q inet_pton || exit 254 + ++event_pattern='probe_libc:inet_pton(\_[[:digit:]]+)?' ++ ++add_libc_inet_pton_event() { ++ ++ event_name=$(perf probe -f -x $libc -a inet_pton 2>&1 | tail -n +2 | head -n -5 | \ ++ grep -P -o "$event_pattern(?=[[:space:]]\(on inet_pton in $libc\))") ++ ++ if [ $? -ne 0 -o -z "$event_name" ] ; then ++ printf "FAIL: could not add event\n" ++ return 1 ++ fi ++} ++ + trace_libc_inet_pton_backtrace() { + + expected=`mktemp -u /tmp/expected.XXX` + +- echo "ping[][0-9 \.:]+probe_libc:inet_pton: \([[:xdigit:]]+\)" > $expected ++ echo "ping[][0-9 \.:]+$event_name: \([[:xdigit:]]+\)" > $expected + echo ".*inet_pton\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected + case "$(uname -m)" in + s390x) +@@ -26,6 +39,12 @@ trace_libc_inet_pton_backtrace() { + echo "(__GI_)?getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc|inlined\)$" >> $expected + echo "main\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected + ;; ++ ppc64|ppc64le) ++ eventattr='max-stack=4' ++ echo "gaih_inet.*\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected ++ echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected ++ echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected ++ ;; + *) + eventattr='max-stack=3' + echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected +@@ -35,7 +54,7 @@ trace_libc_inet_pton_backtrace() { + + perf_data=`mktemp -u /tmp/perf.data.XXX` + perf_script=`mktemp -u /tmp/perf.script.XXX` +- perf record -e probe_libc:inet_pton/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1 ++ perf record -e $event_name/$eventattr/ -o $perf_data ping -6 -c 1 ::1 > /dev/null 2>&1 + perf script -i $perf_data > $perf_script + + exec 3<$perf_script +@@ -46,7 +65,7 @@ trace_libc_inet_pton_backtrace() { + echo "$line" | egrep -q "$pattern" + if [ $? -ne 0 ] ; then + printf "FAIL: expected backtrace entry \"%s\" got \"%s\"\n" "$pattern" "$line" +- exit 1 ++ return 1 + fi + done + +@@ -56,13 +75,20 @@ trace_libc_inet_pton_backtrace() { + # even if the perf script output does not match. + } + ++delete_libc_inet_pton_event() { ++ ++ if [ -n "$event_name" ] ; then ++ perf probe -q -d $event_name ++ fi ++} ++ + # Check for IPv6 interface existence + ip a sh lo | fgrep -q inet6 || exit 2 + + skip_if_no_perf_probe && \ +-perf probe -q $libc inet_pton && \ ++add_libc_inet_pton_event && \ + trace_libc_inet_pton_backtrace + err=$? + rm -f ${perf_data} ${perf_script} ${expected} +-perf probe -q -d probe_libc:inet_pton ++delete_libc_inet_pton_event + exit $err +diff --git a/tools/perf/util/comm.c b/tools/perf/util/comm.c +index 7798a2cc8a86..31279a7bd919 100644 +--- a/tools/perf/util/comm.c ++++ b/tools/perf/util/comm.c +@@ -20,9 +20,10 @@ static struct rw_semaphore comm_str_lock = {.lock = PTHREAD_RWLOCK_INITIALIZER,} + + static struct comm_str *comm_str__get(struct comm_str *cs) + { +- if (cs) +- refcount_inc(&cs->refcnt); +- return cs; ++ if (cs && refcount_inc_not_zero(&cs->refcnt)) ++ return cs; ++ ++ return NULL; + } + + static void comm_str__put(struct comm_str *cs) +@@ -67,9 +68,14 @@ struct comm_str *__comm_str__findnew(const char *str, struct rb_root *root) + parent = *p; + iter = rb_entry(parent, struct comm_str, rb_node); + ++ /* ++ * If we race with comm_str__put, iter->refcnt is 0 ++ * and it will be removed within comm_str__put call ++ * shortly, ignore it in this search. ++ */ + cmp = strcmp(str, iter->str); +- if (!cmp) +- return comm_str__get(iter); ++ if (!cmp && comm_str__get(iter)) ++ return iter; + + if (cmp < 0) + p = &(*p)->rb_left; +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 653ff65aa2c3..5af58aac91ad 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2587,7 +2587,7 @@ static const struct feature_ops feat_ops[HEADER_LAST_FEATURE] = { + FEAT_OPR(NUMA_TOPOLOGY, numa_topology, true), + FEAT_OPN(BRANCH_STACK, branch_stack, false), + FEAT_OPR(PMU_MAPPINGS, pmu_mappings, false), +- FEAT_OPN(GROUP_DESC, group_desc, false), ++ FEAT_OPR(GROUP_DESC, group_desc, false), + FEAT_OPN(AUXTRACE, auxtrace, false), + FEAT_OPN(STAT, stat, false), + FEAT_OPN(CACHE, cache, true), +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index e7b4a8b513f2..22dbb6612b41 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -2272,6 +2272,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg) + { + struct callchain_cursor *cursor = arg; + const char *srcline = NULL; ++ u64 addr; + + if (symbol_conf.hide_unresolved && entry->sym == NULL) + return 0; +@@ -2279,7 +2280,13 @@ static int unwind_entry(struct unwind_entry *entry, void *arg) + if (append_inlines(cursor, entry->map, entry->sym, entry->ip) == 0) + return 0; + +- srcline = callchain_srcline(entry->map, entry->sym, entry->ip); ++ /* ++ * Convert entry->ip from a virtual address to an offset in ++ * its corresponding binary. ++ */ ++ addr = map__map_ip(entry->map, entry->ip); ++ ++ srcline = callchain_srcline(entry->map, entry->sym, addr); + return callchain_cursor_append(cursor, entry->ip, + entry->map, entry->sym, + false, NULL, 0, 0, 0, srcline); +diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c +index 89ac5b5dc218..f5431092c6d1 100644 +--- a/tools/perf/util/map.c ++++ b/tools/perf/util/map.c +@@ -590,6 +590,13 @@ struct symbol *map_groups__find_symbol(struct map_groups *mg, + return NULL; + } + ++static bool map__contains_symbol(struct map *map, struct symbol *sym) ++{ ++ u64 ip = map->unmap_ip(map, sym->start); ++ ++ return ip >= map->start && ip < map->end; ++} ++ + struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name, + struct map **mapp) + { +@@ -605,6 +612,10 @@ struct symbol *maps__find_symbol_by_name(struct maps *maps, const char *name, + + if (sym == NULL) + continue; ++ if (!map__contains_symbol(pos, sym)) { ++ sym = NULL; ++ continue; ++ } + if (mapp != NULL) + *mapp = pos; + goto out; +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index 538db4e5d1e6..6f318b15950e 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -77,7 +77,7 @@ static int entry(u64 ip, struct unwind_info *ui) + if (__report_module(&al, ip, ui)) + return -1; + +- e->ip = al.addr; ++ e->ip = ip; + e->map = al.map; + e->sym = al.sym; + +diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c +index 6a11bc7e6b27..79f521a552cf 100644 +--- a/tools/perf/util/unwind-libunwind-local.c ++++ b/tools/perf/util/unwind-libunwind-local.c +@@ -575,7 +575,7 @@ static int entry(u64 ip, struct thread *thread, + struct addr_location al; + + e.sym = thread__find_symbol(thread, PERF_RECORD_MISC_USER, ip, &al); +- e.ip = al.addr; ++ e.ip = ip; + e.map = al.map; + + pr_debug("unwind: %s:ip = 0x%" PRIx64 " (0x%" PRIx64 ")\n", +diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c +index e2926f72a821..94c3bdf82ff7 100644 +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -1308,7 +1308,8 @@ static void smart_init(struct nfit_test *t) + | ND_INTEL_SMART_ALARM_VALID + | ND_INTEL_SMART_USED_VALID + | ND_INTEL_SMART_SHUTDOWN_VALID +- | ND_INTEL_SMART_MTEMP_VALID, ++ | ND_INTEL_SMART_MTEMP_VALID ++ | ND_INTEL_SMART_CTEMP_VALID, + .health = ND_INTEL_SMART_NON_CRITICAL_HEALTH, + .media_temperature = 23 * 16, + .ctrl_temperature = 25 * 16, +diff --git a/tools/testing/selftests/android/ion/ionapp_export.c b/tools/testing/selftests/android/ion/ionapp_export.c +index a944e72621a9..b5fa0a2dc968 100644 +--- a/tools/testing/selftests/android/ion/ionapp_export.c ++++ b/tools/testing/selftests/android/ion/ionapp_export.c +@@ -51,6 +51,7 @@ int main(int argc, char *argv[]) + + heap_size = 0; + flags = 0; ++ heap_type = ION_HEAP_TYPE_SYSTEM; + + while ((opt = getopt(argc, argv, "hi:s:")) != -1) { + switch (opt) { +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index ca6cd146aafe..dcf73c5dab6e 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -134,6 +134,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } +diff --git a/tools/testing/selftests/vDSO/vdso_test.c b/tools/testing/selftests/vDSO/vdso_test.c +index 2df26bd0099c..eda53f833d8e 100644 +--- a/tools/testing/selftests/vDSO/vdso_test.c ++++ b/tools/testing/selftests/vDSO/vdso_test.c +@@ -15,6 +15,8 @@ + #include + #include + ++#include "../kselftest.h" ++ + extern void *vdso_sym(const char *version, const char *name); + extern void vdso_init_from_sysinfo_ehdr(uintptr_t base); + extern void vdso_init_from_auxv(void *auxv); +@@ -37,7 +39,7 @@ int main(int argc, char **argv) + unsigned long sysinfo_ehdr = getauxval(AT_SYSINFO_EHDR); + if (!sysinfo_ehdr) { + printf("AT_SYSINFO_EHDR is not present!\n"); +- return 0; ++ return KSFT_SKIP; + } + + vdso_init_from_sysinfo_ehdr(getauxval(AT_SYSINFO_EHDR)); +@@ -48,7 +50,7 @@ int main(int argc, char **argv) + + if (!gtod) { + printf("Could not find %s\n", name); +- return 1; ++ return KSFT_SKIP; + } + + struct timeval tv; +@@ -59,6 +61,7 @@ int main(int argc, char **argv) + (long long)tv.tv_sec, (long long)tv.tv_usec); + } else { + printf("%s failed\n", name); ++ return KSFT_FAIL; + } + + return 0; +diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c +index 2673efce65f3..b71417913741 100644 +--- a/virt/kvm/arm/vgic/vgic-init.c ++++ b/virt/kvm/arm/vgic/vgic-init.c +@@ -271,6 +271,10 @@ int vgic_init(struct kvm *kvm) + if (vgic_initialized(kvm)) + return 0; + ++ /* Are we also in the middle of creating a VCPU? */ ++ if (kvm->created_vcpus != atomic_read(&kvm->online_vcpus)) ++ return -EBUSY; ++ + /* freeze the number of spis */ + if (!dist->nr_spis) + dist->nr_spis = VGIC_NR_IRQS_LEGACY - VGIC_NR_PRIVATE_IRQS; +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c +index ffc587bf4742..64e571cc02df 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c +@@ -352,6 +352,9 @@ static void vgic_mmio_write_apr(struct kvm_vcpu *vcpu, + + if (n > vgic_v3_max_apr_idx(vcpu)) + return; ++ ++ n = array_index_nospec(n, 4); ++ + /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */ + vgicv3->vgic_ap1r[n] = val; + }