From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.18 commit in: /
Date: Wed, 21 Nov 2018 12:28:55 +0000 (UTC) [thread overview]
Message-ID: <1542803307.f038ea3a40fec1a50410f3e39b1ca402f8d6543c.mpagano@gentoo> (raw)
commit: f038ea3a40fec1a50410f3e39b1ca402f8d6543c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 21 12:28:27 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Nov 21 12:28:27 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f038ea3a
proj/linux-patches: Linux patch 4.18.20
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1019_linux-4.18.20.patch | 4811 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4815 insertions(+)
diff --git a/0000_README b/0000_README
index 4d0ed54..805997e 100644
--- a/0000_README
+++ b/0000_README
@@ -119,6 +119,10 @@ Patch: 1018_linux-4.18.19.patch
From: http://www.kernel.org
Desc: Linux 4.18.19
+Patch: 1019_linux-4.18.20.patch
+From: http://www.kernel.org
+Desc: Linux 4.18.20
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1019_linux-4.18.20.patch b/1019_linux-4.18.20.patch
new file mode 100644
index 0000000..6ea25b7
--- /dev/null
+++ b/1019_linux-4.18.20.patch
@@ -0,0 +1,4811 @@
+diff --git a/Makefile b/Makefile
+index 71642133ba22..5f6697c4dbbc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 18
+-SUBLEVEL = 19
++SUBLEVEL = 20
+ EXTRAVERSION =
+ NAME = Merciless Moray
+
+diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h
+index 6a8c53dec57e..b7c77bb1bfd2 100644
+--- a/arch/alpha/include/asm/termios.h
++++ b/arch/alpha/include/asm/termios.h
+@@ -73,9 +73,15 @@
+ })
+
+ #define user_termios_to_kernel_termios(k, u) \
+- copy_from_user(k, u, sizeof(struct termios))
++ copy_from_user(k, u, sizeof(struct termios2))
+
+ #define kernel_termios_to_user_termios(u, k) \
++ copy_to_user(u, k, sizeof(struct termios2))
++
++#define user_termios_to_kernel_termios_1(k, u) \
++ copy_from_user(k, u, sizeof(struct termios))
++
++#define kernel_termios_to_user_termios_1(u, k) \
+ copy_to_user(u, k, sizeof(struct termios))
+
+ #endif /* _ALPHA_TERMIOS_H */
+diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h
+index 3729d92d3fa8..dc8c20ac7191 100644
+--- a/arch/alpha/include/uapi/asm/ioctls.h
++++ b/arch/alpha/include/uapi/asm/ioctls.h
+@@ -32,6 +32,11 @@
+ #define TCXONC _IO('t', 30)
+ #define TCFLSH _IO('t', 31)
+
++#define TCGETS2 _IOR('T', 42, struct termios2)
++#define TCSETS2 _IOW('T', 43, struct termios2)
++#define TCSETSW2 _IOW('T', 44, struct termios2)
++#define TCSETSF2 _IOW('T', 45, struct termios2)
++
+ #define TIOCSWINSZ _IOW('t', 103, struct winsize)
+ #define TIOCGWINSZ _IOR('t', 104, struct winsize)
+ #define TIOCSTART _IO('t', 110) /* start output, like ^Q */
+diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h
+index de6c8360fbe3..4575ba34a0ea 100644
+--- a/arch/alpha/include/uapi/asm/termbits.h
++++ b/arch/alpha/include/uapi/asm/termbits.h
+@@ -26,6 +26,19 @@ struct termios {
+ speed_t c_ospeed; /* output speed */
+ };
+
++/* Alpha has identical termios and termios2 */
++
++struct termios2 {
++ tcflag_t c_iflag; /* input mode flags */
++ tcflag_t c_oflag; /* output mode flags */
++ tcflag_t c_cflag; /* control mode flags */
++ tcflag_t c_lflag; /* local mode flags */
++ cc_t c_cc[NCCS]; /* control characters */
++ cc_t c_line; /* line discipline (== c_cc[19]) */
++ speed_t c_ispeed; /* input speed */
++ speed_t c_ospeed; /* output speed */
++};
++
+ /* Alpha has matching termios and ktermios */
+
+ struct ktermios {
+@@ -152,6 +165,7 @@ struct ktermios {
+ #define B3000000 00034
+ #define B3500000 00035
+ #define B4000000 00036
++#define BOTHER 00037
+
+ #define CSIZE 00001400
+ #define CS5 00000000
+@@ -169,6 +183,9 @@ struct ktermios {
+ #define CMSPAR 010000000000 /* mark or space (stick) parity */
+ #define CRTSCTS 020000000000 /* flow control */
+
++#define CIBAUD 07600000
++#define IBSHIFT 16
++
+ /* c_lflag bits */
+ #define ISIG 0x00000080
+ #define ICANON 0x00000100
+diff --git a/arch/arm/boot/dts/imx6ull-pinfunc.h b/arch/arm/boot/dts/imx6ull-pinfunc.h
+index fdc46bb09cc1..3c12a6fb0b61 100644
+--- a/arch/arm/boot/dts/imx6ull-pinfunc.h
++++ b/arch/arm/boot/dts/imx6ull-pinfunc.h
+@@ -14,14 +14,23 @@
+ * The pin function ID is a tuple of
+ * <mux_reg conf_reg input_reg mux_mode input_val>
+ */
++/* signals common for i.MX6UL and i.MX6ULL */
++#undef MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX
++#define MX6UL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6
++#undef MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX
++#define MX6UL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7
++#undef MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS
++#define MX6UL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5
++#undef MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS
++#define MX6UL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6
++#undef MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS
++#define MX6UL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7
++
++/* signals for i.MX6ULL only */
+ #define MX6ULL_PAD_UART1_TX_DATA__UART5_DTE_RX 0x0084 0x0310 0x0644 0x9 0x4
+ #define MX6ULL_PAD_UART1_RX_DATA__UART5_DCE_RX 0x0088 0x0314 0x0644 0x9 0x5
+ #define MX6ULL_PAD_UART1_CTS_B__UART5_DCE_RTS 0x008C 0x0318 0x0640 0x9 0x3
+ #define MX6ULL_PAD_UART1_RTS_B__UART5_DTE_RTS 0x0090 0x031C 0x0640 0x9 0x4
+-#define MX6ULL_PAD_UART5_TX_DATA__UART5_DTE_RX 0x00BC 0x0348 0x0644 0x0 0x6
+-#define MX6ULL_PAD_UART5_RX_DATA__UART5_DCE_RX 0x00C0 0x034C 0x0644 0x0 0x7
+-#define MX6ULL_PAD_ENET1_RX_EN__UART5_DCE_RTS 0x00CC 0x0358 0x0640 0x1 0x5
+-#define MX6ULL_PAD_ENET1_TX_DATA0__UART5_DTE_RTS 0x00D0 0x035C 0x0640 0x1 0x6
+ #define MX6ULL_PAD_ENET2_RX_DATA0__EPDC_SDDO08 0x00E4 0x0370 0x0000 0x9 0x0
+ #define MX6ULL_PAD_ENET2_RX_DATA1__EPDC_SDDO09 0x00E8 0x0374 0x0000 0x9 0x0
+ #define MX6ULL_PAD_ENET2_RX_EN__EPDC_SDDO10 0x00EC 0x0378 0x0000 0x9 0x0
+@@ -55,7 +64,6 @@
+ #define MX6ULL_PAD_CSI_DATA00__ESAI_TX_HF_CLK 0x01E4 0x0470 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA01__ESAI_RX_HF_CLK 0x01E8 0x0474 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA02__ESAI_RX_FS 0x01EC 0x0478 0x0000 0x9 0x0
+-#define MX6ULL_PAD_CSI_DATA02__UART5_DCE_RTS 0x01EC 0x0478 0x0640 0x8 0x7
+ #define MX6ULL_PAD_CSI_DATA03__ESAI_RX_CLK 0x01F0 0x047C 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA04__ESAI_TX_FS 0x01F4 0x0480 0x0000 0x9 0x0
+ #define MX6ULL_PAD_CSI_DATA05__ESAI_TX_CLK 0x01F8 0x0484 0x0000 0x9 0x0
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index 200ebda47e0c..254dcad97e67 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -406,6 +406,7 @@ CONFIG_ZISOFS=y
+ CONFIG_UDF_FS=m
+ CONFIG_MSDOS_FS=m
+ CONFIG_VFAT_FS=y
++CONFIG_TMPFS_POSIX_ACL=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_UBIFS_FS=y
+ CONFIG_NFS_FS=y
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index 6fe52819e014..339eb17c9808 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm)
+ hvc #0
+ ldmfd sp!, {r0 - r3}
+ b cpu_v7_switch_mm
+-ENDPROC(cpu_v7_smc_switch_mm)
++ENDPROC(cpu_v7_hvc_switch_mm)
+ #endif
+ ENTRY(cpu_v7_iciallu_switch_mm)
+ mov r3, #0
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+index 3989876ab699..6c8bd13d64b8 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+@@ -131,6 +131,9 @@
+ reset-names = "stmmaceth";
+ clocks = <&clkmgr STRATIX10_EMAC0_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+@@ -144,6 +147,9 @@
+ reset-names = "stmmaceth";
+ clocks = <&clkmgr STRATIX10_EMAC1_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+@@ -157,6 +163,9 @@
+ reset-names = "stmmaceth";
+ clocks = <&clkmgr STRATIX10_EMAC2_CLK>;
+ clock-names = "stmmaceth";
++ tx-fifo-depth = <16384>;
++ rx-fifo-depth = <16384>;
++ snps,multicast-filter-bins = <256>;
+ status = "disabled";
+ };
+
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index f9b1ef12db48..fb1b9ddd9f51 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -76,7 +76,7 @@
+ phy-mode = "rgmii";
+ phy-handle = <&phy0>;
+
+- max-frame-size = <3800>;
++ max-frame-size = <9000>;
+
+ mdio0 {
+ #address-cells = <1>;
+diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h
+index 3644b68c0ccc..be9f727a9328 100644
+--- a/arch/mips/include/asm/mach-loongson64/irq.h
++++ b/arch/mips/include/asm/mach-loongson64/irq.h
+@@ -10,7 +10,7 @@
+ #define MIPS_CPU_IRQ_BASE 56
+
+ #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */
+-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */
++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */
+ #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */
+
+ #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base
+diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c
+index d455363d51c3..4c07a43a3242 100644
+--- a/arch/mips/kernel/crash.c
++++ b/arch/mips/kernel/crash.c
+@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(void *passed_regs)
+ if (!cpu_online(cpu))
+ return;
+
++ /* We won't be sent IPIs any more. */
++ set_cpu_online(cpu, false);
++
+ local_irq_disable();
+ if (!cpumask_test_cpu(cpu, &cpus_in_crash))
+ crash_save_cpu(regs, cpu);
+diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c
+index 8b574bcd39ba..4b3726e4fe3a 100644
+--- a/arch/mips/kernel/machine_kexec.c
++++ b/arch/mips/kernel/machine_kexec.c
+@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image)
+ *ptr = (unsigned long) phys_to_virt(*ptr);
+ }
+
++ /* Mark offline BEFORE disabling local irq. */
++ set_cpu_online(smp_processor_id(), false);
++
+ /*
+ * we do not want to be bothered.
+ */
+diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c
+index cbeb20f9fc95..5605061f5f98 100644
+--- a/arch/mips/loongson64/loongson-3/irq.c
++++ b/arch/mips/loongson64/loongson-3/irq.c
+@@ -96,51 +96,8 @@ void mach_irq_dispatch(unsigned int pending)
+ }
+ }
+
+-static struct irqaction cascade_irqaction = {
+- .handler = no_action,
+- .flags = IRQF_NO_SUSPEND,
+- .name = "cascade",
+-};
+-
+-static inline void mask_loongson_irq(struct irq_data *d)
+-{
+- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_disable_hazard();
+-
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenclr_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENCLR);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenclr_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-}
+-
+-static inline void unmask_loongson_irq(struct irq_data *d)
+-{
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenset_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENSET);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenset_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-
+- set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_enable_hazard();
+-}
++static inline void mask_loongson_irq(struct irq_data *d) { }
++static inline void unmask_loongson_irq(struct irq_data *d) { }
+
+ /* For MIPS IRQs which shared by all cores */
+ static struct irq_chip loongson_irq_chip = {
+@@ -183,12 +140,11 @@ void __init mach_init_irq(void)
+ chip->irq_set_affinity = plat_set_irq_affinity;
+
+ irq_set_chip_and_handler(LOONGSON_UART_IRQ,
+- &loongson_irq_chip, handle_level_irq);
+-
+- /* setup HT1 irq */
+- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
++ &loongson_irq_chip, handle_percpu_irq);
++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ,
++ &loongson_irq_chip, handle_percpu_irq);
+
+- set_c0_status(STATUSF_IP2 | STATUSF_IP6);
++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6);
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c
+index f1e92bf743c2..3c3b1e6abb53 100644
+--- a/arch/mips/pci/pci-legacy.c
++++ b/arch/mips/pci/pci-legacy.c
+@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_controller *hose)
+ if (pci_has_flag(PCI_PROBE_ONLY)) {
+ pci_bus_claim_resources(bus);
+ } else {
++ struct pci_bus *child;
++
+ pci_bus_size_bridges(bus);
+ pci_bus_assign_resources(bus);
++ list_for_each_entry(child, &bus->children, node)
++ pcie_bus_configure_settings(child);
+ }
+ pci_bus_add_devices(bus);
+ }
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index fb96206de317..2510ff9381d0 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -244,7 +244,11 @@ cpu-as-$(CONFIG_4xx) += -Wa,-m405
+ cpu-as-$(CONFIG_ALTIVEC) += $(call as-option,-Wa$(comma)-maltivec)
+ cpu-as-$(CONFIG_E200) += -Wa,-me200
+ cpu-as-$(CONFIG_E500) += -Wa,-me500
+-cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4
++
++# When using '-many -mpower4' gas will first try and find a matching power4
++# mnemonic and failing that it will allow any valid mnemonic that GAS knows
++# about. GCC will pass -many to GAS when assembling, clang does not.
++cpu-as-$(CONFIG_PPC_BOOK3S_64) += -Wa,-mpower4 -Wa,-many
+ cpu-as-$(CONFIG_PPC_E500MC) += $(call as-option,-Wa$(comma)-me500mc)
+
+ KBUILD_AFLAGS += $(cpu-as-y)
+diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
+index dcf2f15e6797..32dfe6d083f3 100644
+--- a/arch/powerpc/boot/crt0.S
++++ b/arch/powerpc/boot/crt0.S
+@@ -47,8 +47,10 @@ p_end: .long _end
+ p_pstack: .long _platform_stack_top
+ #endif
+
+- .weak _zimage_start
+ .globl _zimage_start
++ /* Clang appears to require the .weak directive to be after the symbol
++ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */
++ .weak _zimage_start
+ _zimage_start:
+ .globl _zimage_start_lib
+ _zimage_start_lib:
+diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h
+index 4f547752ae79..193f53116c7a 100644
+--- a/arch/powerpc/include/asm/mmu-8xx.h
++++ b/arch/powerpc/include/asm/mmu-8xx.h
+@@ -34,20 +34,12 @@
+ * respectively NA for All or X for Supervisor and no access for User.
+ * Then we use the APG to say whether accesses are according to Page rules or
+ * "all Supervisor" rules (Access to all)
+- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP:
+- * When that bit is not set access is done iaw "all user"
+- * which means no access iaw page rules.
+- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED
+- * 0x => No access => 11 (all accesses performed as user iaw page definition)
+- * 10 => No user => 01 (all accesses performed according to page definition)
+- * 11 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+ * We define all 16 groups so that all other bits of APG can take any value
+ */
+-#ifdef CONFIG_SWAP
+-#define MI_APG_INIT 0xf4f4f4f4
+-#else
+ #define MI_APG_INIT 0x44444444
+-#endif
+
+ /* The effective page number register. When read, contains the information
+ * about the last instruction TLB miss. When MI_RPN is written, bits in
+@@ -115,20 +107,12 @@
+ * Supervisor and no access for user and NA for ALL.
+ * Then we use the APG to say whether accesses are according to Page rules or
+ * "all Supervisor" rules (Access to all)
+- * We also use the 2nd APG bit for _PAGE_ACCESSED when having SWAP:
+- * When that bit is not set access is done iaw "all user"
+- * which means no access iaw page rules.
+- * Therefore, we define 4 APG groups. lsb is _PMD_USER, 2nd is _PAGE_ACCESSED
+- * 0x => No access => 11 (all accesses performed as user iaw page definition)
+- * 10 => No user => 01 (all accesses performed according to page definition)
+- * 11 => User => 00 (all accesses performed as supervisor iaw page definition)
++ * Therefore, we define 2 APG groups. lsb is _PMD_USER
++ * 0 => No user => 01 (all accesses performed according to page definition)
++ * 1 => User => 00 (all accesses performed as supervisor iaw page definition)
+ * We define all 16 groups so that all other bits of APG can take any value
+ */
+-#ifdef CONFIG_SWAP
+-#define MD_APG_INIT 0xf4f4f4f4
+-#else
+ #define MD_APG_INIT 0x44444444
+-#endif
+
+ /* The effective page number register. When read, contains the information
+ * about the last instruction TLB miss. When MD_RPN is written, bits in
+@@ -180,12 +164,6 @@
+ */
+ #define SPRN_M_TW 799
+
+-/* APGs */
+-#define M_APG0 0x00000000
+-#define M_APG1 0x00000020
+-#define M_APG2 0x00000040
+-#define M_APG3 0x00000060
+-
+ #ifdef CONFIG_PPC_MM_SLICES
+ #include <asm/nohash/32/slice.h>
+ #define SLICE_ARRAY_SIZE (1 << (32 - SLICE_LOW_SHIFT - 1))
+diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
+index 5746809cfaad..bf0a02038cad 100644
+--- a/arch/powerpc/kernel/eeh.c
++++ b/arch/powerpc/kernel/eeh.c
+@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len)
+ int n = 0, l = 0;
+ char buffer[128];
+
++ if (!pdn) {
++ pr_warn("EEH: Note: No error log for absent device.\n");
++ return 0;
++ }
++
+ n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n",
+ pdn->phb->global_number, pdn->busno,
+ PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn));
+diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S
+index 6cab07e76732..19bdc65d05b8 100644
+--- a/arch/powerpc/kernel/head_8xx.S
++++ b/arch/powerpc/kernel/head_8xx.S
+@@ -354,13 +354,14 @@ _ENTRY(ITLBMiss_cmp)
+ #if defined(ITLB_MISS_KERNEL) || defined(CONFIG_HUGETLB_PAGE)
+ mtcr r12
+ #endif
+-
+-#ifdef CONFIG_SWAP
+- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1
+-#endif
+ /* Load the MI_TWC with the attributes for this "segment." */
+ mtspr SPRN_MI_TWC, r11 /* Set segment attributes */
+
++#ifdef CONFIG_SWAP
++ rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ and r11, r11, r10
++ rlwimi r10, r11, 0, _PAGE_PRESENT
++#endif
+ li r11, RPN_PATTERN | 0x200
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 20 and 23 must be clear.
+@@ -471,14 +472,22 @@ _ENTRY(DTLBMiss_jmp)
+ * above.
+ */
+ rlwimi r11, r10, 0, _PAGE_GUARDED
+-#ifdef CONFIG_SWAP
+- /* _PAGE_ACCESSED has to be set. We use second APG bit for that, 0
+- * on that bit will represent a Non Access group
+- */
+- rlwinm r11, r10, 31, _PAGE_ACCESSED >> 1
+-#endif
+ mtspr SPRN_MD_TWC, r11
+
++ /* Both _PAGE_ACCESSED and _PAGE_PRESENT has to be set.
++ * We also need to know if the insn is a load/store, so:
++ * Clear _PAGE_PRESENT and load that which will
++ * trap into DTLB Error with store bit set accordinly.
++ */
++ /* PRESENT=0x1, ACCESSED=0x20
++ * r11 = ((r10 & PRESENT) & ((r10 & ACCESSED) >> 5));
++ * r10 = (r10 & ~PRESENT) | r11;
++ */
++#ifdef CONFIG_SWAP
++ rlwinm r11, r10, 32-5, _PAGE_PRESENT
++ and r11, r11, r10
++ rlwimi r10, r11, 0, _PAGE_PRESENT
++#endif
+ /* The Linux PTE won't go exactly into the MMU TLB.
+ * Software indicator bits 24, 25, 26, and 27 must be
+ * set. All other Linux PTE bits control the behavior
+@@ -638,8 +647,8 @@ InstructionBreakpoint:
+ */
+ DTLBMissIMMR:
+ mtcr r12
+- /* Set 512k byte guarded page and mark it valid and accessed */
+- li r10, MD_PS512K | MD_GUARDED | MD_SVALID | M_APG2
++ /* Set 512k byte guarded page and mark it valid */
++ li r10, MD_PS512K | MD_GUARDED | MD_SVALID
+ mtspr SPRN_MD_TWC, r10
+ mfspr r10, SPRN_IMMR /* Get current IMMR */
+ rlwinm r10, r10, 0, 0xfff80000 /* Get 512 kbytes boundary */
+@@ -657,8 +666,8 @@ _ENTRY(dtlb_miss_exit_2)
+
+ DTLBMissLinear:
+ mtcr r12
+- /* Set 8M byte page and mark it valid and accessed */
+- li r11, MD_PS8MEG | MD_SVALID | M_APG2
++ /* Set 8M byte page and mark it valid */
++ li r11, MD_PS8MEG | MD_SVALID
+ mtspr SPRN_MD_TWC, r11
+ rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */
+ ori r10, r10, 0xf0 | MD_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \
+@@ -676,8 +685,8 @@ _ENTRY(dtlb_miss_exit_3)
+ #ifndef CONFIG_PIN_TLB_TEXT
+ ITLBMissLinear:
+ mtcr r12
+- /* Set 8M byte page and mark it valid,accessed */
+- li r11, MI_PS8MEG | MI_SVALID | M_APG2
++ /* Set 8M byte page and mark it valid */
++ li r11, MI_PS8MEG | MI_SVALID
+ mtspr SPRN_MI_TWC, r11
+ rlwinm r10, r10, 0, 0x0f800000 /* 8xx supports max 256Mb RAM */
+ ori r10, r10, 0xf0 | MI_SPS16K | _PAGE_PRIVILEGED | _PAGE_DIRTY | \
+@@ -960,7 +969,7 @@ initial_mmu:
+ ori r8, r8, MI_EVALID /* Mark it valid */
+ mtspr SPRN_MI_EPN, r8
+ li r8, MI_PS8MEG /* Set 8M byte page */
+- ori r8, r8, MI_SVALID | M_APG2 /* Make it valid, APG 2 */
++ ori r8, r8, MI_SVALID /* Make it valid */
+ mtspr SPRN_MI_TWC, r8
+ li r8, MI_BOOTINIT /* Create RPN for address 0 */
+ mtspr SPRN_MI_RPN, r8 /* Store TLB entry */
+@@ -987,7 +996,7 @@ initial_mmu:
+ ori r8, r8, MD_EVALID /* Mark it valid */
+ mtspr SPRN_MD_EPN, r8
+ li r8, MD_PS512K | MD_GUARDED /* Set 512k byte page */
+- ori r8, r8, MD_SVALID | M_APG2 /* Make it valid and accessed */
++ ori r8, r8, MD_SVALID /* Make it valid */
+ mtspr SPRN_MD_TWC, r8
+ mr r8, r9 /* Create paddr for TLB */
+ ori r8, r8, MI_BOOTINIT|0x2 /* Inhibit cache -- Cort */
+diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
+index b8d61e019d06..f7b1203bdaee 100644
+--- a/arch/powerpc/kernel/module_64.c
++++ b/arch/powerpc/kernel/module_64.c
+@@ -685,7 +685,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
+
+ case R_PPC64_REL32:
+ /* 32 bits relative (used by relative exception tables) */
+- *(u32 *)location = value - (unsigned long)location;
++ /* Convert value to relative */
++ value -= (unsigned long)location;
++ if (value + 0x80000000 > 0xffffffff) {
++ pr_err("%s: REL32 %li out of range!\n",
++ me->name, (long int)value);
++ return -ENOEXEC;
++ }
++ *(u32 *)location = value;
+ break;
+
+ case R_PPC64_TOCSAVE:
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 0e17dcb48720..6bfcb5a506af 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -736,12 +736,17 @@ void machine_check_exception(struct pt_regs *regs)
+ if (check_io_access(regs))
+ goto bail;
+
+- die("Machine check", regs, SIGBUS);
+-
+ /* Must die if the interrupt is not recoverable */
+ if (!(regs->msr & MSR_RI))
+ nmi_panic(regs, "Unrecoverable Machine check");
+
++ if (!nested)
++ nmi_exit();
++
++ die("Machine check", regs, SIGBUS);
++
++ return;
++
+ bail:
+ if (!nested)
+ nmi_exit();
+diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c
+index cf77d755246d..5d53684c2ebd 100644
+--- a/arch/powerpc/mm/8xx_mmu.c
++++ b/arch/powerpc/mm/8xx_mmu.c
+@@ -79,7 +79,7 @@ void __init MMU_init_hw(void)
+ for (; i < 32 && mem >= LARGE_PAGE_SIZE_8M; i++) {
+ mtspr(SPRN_MD_CTR, ctr | (i << 8));
+ mtspr(SPRN_MD_EPN, (unsigned long)__va(addr) | MD_EVALID);
+- mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID | M_APG2);
++ mtspr(SPRN_MD_TWC, MD_PS8MEG | MD_SVALID);
+ mtspr(SPRN_MD_RPN, addr | flags | _PAGE_PRESENT);
+ addr += LARGE_PAGE_SIZE_8M;
+ mem -= LARGE_PAGE_SIZE_8M;
+diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
+index 876e2a3c79f2..bdf33b989f98 100644
+--- a/arch/powerpc/mm/dump_linuxpagetables.c
++++ b/arch/powerpc/mm/dump_linuxpagetables.c
+@@ -418,12 +418,13 @@ static void walk_pagetables(struct pg_state *st)
+ unsigned int i;
+ unsigned long addr;
+
++ addr = st->start_address;
++
+ /*
+ * Traverse the linux pagetable structure and dump pages that are in
+ * the hash pagetable.
+ */
+- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
+- addr = KERN_VIRT_START + i * PGDIR_SIZE;
++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) {
+ if (!pgd_none(*pgd) && !pgd_huge(*pgd))
+ /* pgd exists */
+ walk_pud(st, pgd, addr);
+@@ -472,9 +473,14 @@ static int ptdump_show(struct seq_file *m, void *v)
+ {
+ struct pg_state st = {
+ .seq = m,
+- .start_address = KERN_VIRT_START,
+ .marker = address_markers,
+ };
++
++ if (radix_enabled())
++ st.start_address = PAGE_OFFSET;
++ else
++ st.start_address = KERN_VIRT_START;
++
+ /* Traverse kernel page tables */
+ walk_pagetables(&st);
+ note_page(&st, 0, 0, 0);
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 8a9a49c13865..a84c410e5090 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -19,6 +19,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/swap.h>
+ #include <linux/swapops.h>
++#include <linux/kmemleak.h>
+ #include <asm/pgtable.h>
+ #include <asm/pgalloc.h>
+ #include <asm/tlb.h>
+@@ -112,6 +113,8 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
+ for (i = i - 1 ; i >= 0; i--, hpdp--)
+ *hpdp = __hugepd(0);
+ kmem_cache_free(cachep, new);
++ } else {
++ kmemleak_ignore(new);
+ }
+ spin_unlock(ptl);
+ return 0;
+diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c
+index 205fe557ca10..4f213ba33491 100644
+--- a/arch/powerpc/mm/slice.c
++++ b/arch/powerpc/mm/slice.c
+@@ -61,6 +61,13 @@ static void slice_print_mask(const char *label, const struct slice_mask *mask) {
+
+ #endif
+
++static inline bool slice_addr_is_low(unsigned long addr)
++{
++ u64 tmp = (u64)addr;
++
++ return tmp < SLICE_LOW_TOP;
++}
++
+ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ struct slice_mask *ret)
+ {
+@@ -70,7 +77,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ if (SLICE_NUM_HIGH)
+ bitmap_zero(ret->high_slices, SLICE_NUM_HIGH);
+
+- if (start < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(start)) {
+ unsigned long mend = min(end,
+ (unsigned long)(SLICE_LOW_TOP - 1));
+
+@@ -78,7 +85,7 @@ static void slice_range_to_mask(unsigned long start, unsigned long len,
+ - (1u << GET_LOW_SLICE_INDEX(start));
+ }
+
+- if ((start + len) > SLICE_LOW_TOP) {
++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) {
+ unsigned long start_index = GET_HIGH_SLICE_INDEX(start);
+ unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT));
+ unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index;
+@@ -133,7 +140,7 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret,
+ if (!slice_low_has_vma(mm, i))
+ ret->low_slices |= 1u << i;
+
+- if (high_limit <= SLICE_LOW_TOP)
++ if (slice_addr_is_low(high_limit - 1))
+ return;
+
+ for (i = 0; i < GET_HIGH_SLICE_INDEX(high_limit); i++)
+@@ -182,7 +189,7 @@ static bool slice_check_range_fits(struct mm_struct *mm,
+ unsigned long end = start + len - 1;
+ u64 low_slices = 0;
+
+- if (start < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(start)) {
+ unsigned long mend = min(end,
+ (unsigned long)(SLICE_LOW_TOP - 1));
+
+@@ -192,7 +199,7 @@ static bool slice_check_range_fits(struct mm_struct *mm,
+ if ((low_slices & available->low_slices) != low_slices)
+ return false;
+
+- if (SLICE_NUM_HIGH && ((start + len) > SLICE_LOW_TOP)) {
++ if (SLICE_NUM_HIGH && !slice_addr_is_low(end)) {
+ unsigned long start_index = GET_HIGH_SLICE_INDEX(start);
+ unsigned long align_end = ALIGN(end, (1UL << SLICE_HIGH_SHIFT));
+ unsigned long count = GET_HIGH_SLICE_INDEX(align_end) - start_index;
+@@ -303,7 +310,7 @@ static bool slice_scan_available(unsigned long addr,
+ int end, unsigned long *boundary_addr)
+ {
+ unsigned long slice;
+- if (addr < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(addr)) {
+ slice = GET_LOW_SLICE_INDEX(addr);
+ *boundary_addr = (slice + end) << SLICE_LOW_SHIFT;
+ return !!(available->low_slices & (1u << slice));
+@@ -706,7 +713,7 @@ unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr)
+
+ VM_BUG_ON(radix_enabled());
+
+- if (addr < SLICE_LOW_TOP) {
++ if (slice_addr_is_low(addr)) {
+ psizes = mm->context.low_slices_psize;
+ index = GET_LOW_SLICE_INDEX(addr);
+ } else {
+diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c
+index 15fe5f0c8665..ae5d568e267f 100644
+--- a/arch/powerpc/mm/tlb_nohash.c
++++ b/arch/powerpc/mm/tlb_nohash.c
+@@ -503,6 +503,9 @@ static void setup_page_sizes(void)
+ for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) {
+ struct mmu_psize_def *def = &mmu_psize_defs[psize];
+
++ if (!def->shift)
++ continue;
++
+ if (tlb1ps & (1U << (def->shift - 10))) {
+ def->flags |= MMU_PAGE_SIZE_DIRECT;
+
+diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c
+index b99283df8584..265669002da0 100644
+--- a/arch/powerpc/platforms/powernv/memtrace.c
++++ b/arch/powerpc/platforms/powernv/memtrace.c
+@@ -119,17 +119,15 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages)
+ walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE,
+ change_memblock_state);
+
+- lock_device_hotplug();
+- remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT);
+- unlock_device_hotplug();
+
+ return true;
+ }
+
+ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ {
+- u64 start_pfn, end_pfn, nr_pages;
++ u64 start_pfn, end_pfn, nr_pages, pfn;
+ u64 base_pfn;
++ u64 bytes = memory_block_size_bytes();
+
+ if (!node_spanned_pages(nid))
+ return 0;
+@@ -142,8 +140,21 @@ static u64 memtrace_alloc_node(u32 nid, u64 size)
+ end_pfn = round_down(end_pfn - nr_pages, nr_pages);
+
+ for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) {
+- if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true)
++ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) {
++ /*
++ * Remove memory in memory block size chunks so that
++ * iomem resources are always split to the same size and
++ * we never try to remove memory that spans two iomem
++ * resources.
++ */
++ lock_device_hotplug();
++ end_pfn = base_pfn + nr_pages;
++ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) {
++ remove_memory(nid, pfn << PAGE_SHIFT, bytes);
++ }
++ unlock_device_hotplug();
+ return base_pfn << PAGE_SHIFT;
++ }
+ }
+
+ return 0;
+diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
+index 3a17107594c8..eb786f90f2d3 100644
+--- a/arch/x86/include/asm/mce.h
++++ b/arch/x86/include/asm/mce.h
+@@ -216,6 +216,8 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s
+
+ int mce_available(struct cpuinfo_x86 *c);
+ bool mce_is_memory_error(struct mce *m);
++bool mce_is_correctable(struct mce *m);
++int mce_usable_address(struct mce *m);
+
+ DECLARE_PER_CPU(unsigned, mce_exception_count);
+ DECLARE_PER_CPU(unsigned, mce_poll_count);
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 8c50754c09c1..c51b9d116be1 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -489,7 +489,7 @@ static void mce_report_event(struct pt_regs *regs)
+ * be somewhat complicated (e.g. segment offset would require an instruction
+ * parser). So only support physical addresses up to page granuality for now.
+ */
+-static int mce_usable_address(struct mce *m)
++int mce_usable_address(struct mce *m)
+ {
+ if (!(m->status & MCI_STATUS_ADDRV))
+ return 0;
+@@ -509,6 +509,7 @@ static int mce_usable_address(struct mce *m)
+
+ return 1;
+ }
++EXPORT_SYMBOL_GPL(mce_usable_address);
+
+ bool mce_is_memory_error(struct mce *m)
+ {
+@@ -538,7 +539,7 @@ bool mce_is_memory_error(struct mce *m)
+ }
+ EXPORT_SYMBOL_GPL(mce_is_memory_error);
+
+-static bool mce_is_correctable(struct mce *m)
++bool mce_is_correctable(struct mce *m)
+ {
+ if (m->cpuvendor == X86_VENDOR_AMD && m->status & MCI_STATUS_DEFERRED)
+ return false;
+@@ -548,6 +549,7 @@ static bool mce_is_correctable(struct mce *m)
+
+ return true;
+ }
++EXPORT_SYMBOL_GPL(mce_is_correctable);
+
+ static bool cec_add_mce(struct mce *m)
+ {
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index 031082c96db8..12a67046fefb 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -20,6 +20,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+ #include <linux/kexec.h>
++#include <linux/i8253.h>
+ #include <asm/processor.h>
+ #include <asm/hypervisor.h>
+ #include <asm/hyperv-tlfs.h>
+@@ -285,6 +286,16 @@ static void __init ms_hyperv_init_platform(void)
+ if (efi_enabled(EFI_BOOT))
+ x86_platform.get_nmi_reason = hv_get_nmi_reason;
+
++ /*
++ * Hyper-V VMs have a PIT emulation quirk such that zeroing the
++ * counter register during PIT shutdown restarts the PIT. So it
++ * continues to interrupt @18.2 HZ. Setting i8253_clear_counter
++ * to false tells pit_shutdown() not to zero the counter so that
++ * the PIT really is shutdown. Generation 2 VMs don't have a PIT,
++ * and setting this value has no effect.
++ */
++ i8253_clear_counter_on_shutdown = false;
++
+ #if IS_ENABLED(CONFIG_HYPERV)
+ /*
+ * Setup the hook to get control post apic initialization.
+diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c
+index 8e005329648b..d805202c63cd 100644
+--- a/arch/x86/kernel/cpu/vmware.c
++++ b/arch/x86/kernel/cpu/vmware.c
+@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s)
+ }
+ early_param("no-vmw-sched-clock", setup_vmw_sched_clock);
+
+-static unsigned long long vmware_sched_clock(void)
++static unsigned long long notrace vmware_sched_clock(void)
+ {
+ unsigned long long ns;
+
+diff --git a/arch/x86/um/shared/sysdep/ptrace_32.h b/arch/x86/um/shared/sysdep/ptrace_32.h
+index b94a108de1dc..ae00d22bce02 100644
+--- a/arch/x86/um/shared/sysdep/ptrace_32.h
++++ b/arch/x86/um/shared/sysdep/ptrace_32.h
+@@ -10,20 +10,10 @@
+
+ static inline void update_debugregs(int seq) {}
+
+-/* syscall emulation path in ptrace */
+-
+-#ifndef PTRACE_SYSEMU
+-#define PTRACE_SYSEMU 31
+-#endif
+-
+ void set_using_sysemu(int value);
+ int get_using_sysemu(void);
+ extern int sysemu_supported;
+
+-#ifndef PTRACE_SYSEMU_SINGLESTEP
+-#define PTRACE_SYSEMU_SINGLESTEP 32
+-#endif
+-
+ #define UPT_SYSCALL_ARG1(r) UPT_BX(r)
+ #define UPT_SYSCALL_ARG2(r) UPT_CX(r)
+ #define UPT_SYSCALL_ARG3(r) UPT_DX(r)
+diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile
+index 53e4178711e6..8c20a7965bda 100644
+--- a/arch/xtensa/boot/Makefile
++++ b/arch/xtensa/boot/Makefile
+@@ -34,7 +34,7 @@ boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y)) \
+ $(addprefix $(obj)/,$(host-progs))
+ $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS)
+
+-OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary
++OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary
+
+ vmlinux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h
+index 5b0027d4ecc0..a39cd81b741a 100644
+--- a/arch/xtensa/include/asm/processor.h
++++ b/arch/xtensa/include/asm/processor.h
+@@ -24,7 +24,11 @@
+ # error Linux requires the Xtensa Windowed Registers Option.
+ #endif
+
+-#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH
++/* Xtensa ABI requires stack alignment to be at least 16 */
++
++#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16)
++
++#define ARCH_SLAB_MINALIGN STACK_ALIGN
+
+ /*
+ * User space process size: 1 GB.
+diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S
+index 9c4e9433e536..3ceb76c7a4ae 100644
+--- a/arch/xtensa/kernel/head.S
++++ b/arch/xtensa/kernel/head.S
+@@ -88,9 +88,12 @@ _SetupMMU:
+ initialize_mmu
+ #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY
+ rsr a2, excsave1
+- movi a3, 0x08000000
++ movi a3, XCHAL_KSEG_PADDR
++ bltu a2, a3, 1f
++ sub a2, a2, a3
++ movi a3, XCHAL_KSEG_SIZE
+ bgeu a2, a3, 1f
+- movi a3, 0xd0000000
++ movi a3, XCHAL_KSEG_CACHED_VADDR
+ add a2, a2, a3
+ wsr a2, excsave1
+ 1:
+diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
+index 70b731edc7b8..c430c96ea723 100644
+--- a/arch/xtensa/kernel/vmlinux.lds.S
++++ b/arch/xtensa/kernel/vmlinux.lds.S
+@@ -131,6 +131,7 @@ SECTIONS
+ .fixup : { *(.fixup) }
+
+ EXCEPTION_TABLE(16)
++ NOTES
+ /* Data section */
+
+ _sdata = .;
+diff --git a/block/blk-core.c b/block/blk-core.c
+index f9d2e1b66e05..41b7396c8658 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -793,9 +793,8 @@ void blk_cleanup_queue(struct request_queue *q)
+ * dispatch may still be in-progress since we dispatch requests
+ * from more than one contexts.
+ *
+- * No need to quiesce queue if it isn't initialized yet since
+- * blk_freeze_queue() should be enough for cases of passthrough
+- * request.
++ * We rely on driver to deal with the race in case that queue
++ * initialization isn't done.
+ */
+ if (q->mq_ops && blk_queue_init_done(q))
+ blk_mq_quiesce_queue(q);
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 0e89b5457cab..ceeb2eaf28cf 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -83,7 +83,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_cipher rcipher;
+
+- strlcpy(rcipher.type, "cipher", sizeof(rcipher.type));
++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type));
+
+ rcipher.blocksize = alg->cra_blocksize;
+ rcipher.min_keysize = alg->cra_cipher.cia_min_keysize;
+@@ -102,7 +102,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_comp rcomp;
+
+- strlcpy(rcomp.type, "compression", sizeof(rcomp.type));
++ strncpy(rcomp.type, "compression", sizeof(rcomp.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS,
+ sizeof(struct crypto_report_comp), &rcomp))
+ goto nla_put_failure;
+@@ -116,7 +116,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_acomp racomp;
+
+- strlcpy(racomp.type, "acomp", sizeof(racomp.type));
++ strncpy(racomp.type, "acomp", sizeof(racomp.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP,
+ sizeof(struct crypto_report_acomp), &racomp))
+@@ -131,7 +131,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_akcipher rakcipher;
+
+- strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
++ strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER,
+ sizeof(struct crypto_report_akcipher), &rakcipher))
+@@ -146,7 +146,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg)
+ {
+ struct crypto_report_kpp rkpp;
+
+- strlcpy(rkpp.type, "kpp", sizeof(rkpp.type));
++ strncpy(rkpp.type, "kpp", sizeof(rkpp.type));
+
+ if (nla_put(skb, CRYPTOCFGA_REPORT_KPP,
+ sizeof(struct crypto_report_kpp), &rkpp))
+@@ -160,10 +160,10 @@ nla_put_failure:
+ static int crypto_report_one(struct crypto_alg *alg,
+ struct crypto_user_alg *ualg, struct sk_buff *skb)
+ {
+- strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
+- strlcpy(ualg->cru_driver_name, alg->cra_driver_name,
++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name));
++ strncpy(ualg->cru_driver_name, alg->cra_driver_name,
+ sizeof(ualg->cru_driver_name));
+- strlcpy(ualg->cru_module_name, module_name(alg->cra_module),
++ strncpy(ualg->cru_module_name, module_name(alg->cra_module),
+ sizeof(ualg->cru_module_name));
+
+ ualg->cru_type = 0;
+@@ -176,7 +176,7 @@ static int crypto_report_one(struct crypto_alg *alg,
+ if (alg->cra_flags & CRYPTO_ALG_LARVAL) {
+ struct crypto_report_larval rl;
+
+- strlcpy(rl.type, "larval", sizeof(rl.type));
++ strncpy(rl.type, "larval", sizeof(rl.type));
+ if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL,
+ sizeof(struct crypto_report_larval), &rl))
+ goto nla_put_failure;
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index 78f9de260d5f..e9fb0bf3c8d2 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,10 +417,6 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+- status = acpi_ut_add_address_range(obj_desc->region.space_id,
+- obj_desc->region.address,
+- obj_desc->region.length, node);
+-
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index c0db96e8a81a..8eb123d47d54 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -2835,9 +2835,9 @@ static int acpi_nfit_query_poison(struct acpi_nfit_desc *acpi_desc)
+ return rc;
+
+ if (ars_status_process_records(acpi_desc))
+- return -ENOMEM;
++ dev_err(acpi_desc->dev, "Failed to process ARS records\n");
+
+- return 0;
++ return rc;
+ }
+
+ static int ars_register(struct acpi_nfit_desc *acpi_desc,
+diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
+index e9626bf6ca29..d6c1b10f6c25 100644
+--- a/drivers/acpi/nfit/mce.c
++++ b/drivers/acpi/nfit/mce.c
+@@ -25,8 +25,12 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
+ struct acpi_nfit_desc *acpi_desc;
+ struct nfit_spa *nfit_spa;
+
+- /* We only care about memory errors */
+- if (!mce_is_memory_error(mce))
++ /* We only care about uncorrectable memory errors */
++ if (!mce_is_memory_error(mce) || mce_is_correctable(mce))
++ return NOTIFY_DONE;
++
++ /* Verify the address reported in the MCE is valid. */
++ if (!mce_usable_address(mce))
+ return NOTIFY_DONE;
+
+ /*
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 321a9579556d..a9a8440a4945 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4552,7 +4552,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* These specific Samsung models/firmware-revs do not handle LPM well */
+ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, },
+ { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, },
+- { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, },
++ { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM, },
+
+ /* devices that don't properly handle queued TRIM commands */
+ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index af7cb8e618fe..363b9102ebb0 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1637,6 +1637,11 @@ static const struct attribute_group zram_disk_attr_group = {
+ .attrs = zram_disk_attrs,
+ };
+
++static const struct attribute_group *zram_disk_attr_groups[] = {
++ &zram_disk_attr_group,
++ NULL,
++};
++
+ /*
+ * Allocate and initialize new zram device. the function returns
+ * '>= 0' device_id upon success, and negative value otherwise.
+@@ -1717,24 +1722,15 @@ static int zram_add(void)
+
+ zram->disk->queue->backing_dev_info->capabilities |=
+ (BDI_CAP_STABLE_WRITES | BDI_CAP_SYNCHRONOUS_IO);
++ disk_to_dev(zram->disk)->groups = zram_disk_attr_groups;
+ add_disk(zram->disk);
+
+- ret = sysfs_create_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+- if (ret < 0) {
+- pr_err("Error creating sysfs group for device %d\n",
+- device_id);
+- goto out_free_disk;
+- }
+ strlcpy(zram->compressor, default_compressor, sizeof(zram->compressor));
+
+ zram_debugfs_register(zram);
+ pr_info("Added device: %s\n", zram->disk->disk_name);
+ return device_id;
+
+-out_free_disk:
+- del_gendisk(zram->disk);
+- put_disk(zram->disk);
+ out_free_queue:
+ blk_cleanup_queue(queue);
+ out_free_idr:
+@@ -1763,16 +1759,6 @@ static int zram_remove(struct zram *zram)
+ mutex_unlock(&bdev->bd_mutex);
+
+ zram_debugfs_unregister(zram);
+- /*
+- * Remove sysfs first, so no one will perform a disksize
+- * store while we destroy the devices. This also helps during
+- * hot_remove -- zram_reset_device() is the last holder of
+- * ->init_lock, no later/concurrent disksize_store() or any
+- * other sysfs handlers are possible.
+- */
+- sysfs_remove_group(&disk_to_dev(zram->disk)->kobj,
+- &zram_disk_attr_group);
+-
+ /* Make sure all the pending I/O are finished */
+ fsync_bdev(bdev);
+ zram_reset_device(zram);
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 66acbd063562..894103abe8a8 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2441,7 +2441,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi,
+ return -ENOSYS;
+
+ if (arg != CDSL_CURRENT && arg != CDSL_NONE) {
+- if ((int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+ }
+
+diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c
+index 72b6091eb7b9..dc7fbc796cb6 100644
+--- a/drivers/clk/at91/clk-pll.c
++++ b/drivers/clk/at91/clk-pll.c
+@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw,
+ {
+ struct clk_pll *pll = to_clk_pll(hw);
+
++ if (!pll->div || !pll->mul)
++ return 0;
++
+ return (parent_rate / pll->div) * (pll->mul + 1);
+ }
+
+diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c
+index d44e0eea31ec..0934d3724495 100644
+--- a/drivers/clk/clk-s2mps11.c
++++ b/drivers/clk/clk-s2mps11.c
+@@ -245,6 +245,36 @@ static const struct platform_device_id s2mps11_clk_id[] = {
+ };
+ MODULE_DEVICE_TABLE(platform, s2mps11_clk_id);
+
++#ifdef CONFIG_OF
++/*
++ * Device is instantiated through parent MFD device and device matching is done
++ * through platform_device_id.
++ *
++ * However if device's DT node contains proper clock compatible and driver is
++ * built as a module, then the *module* matching will be done trough DT aliases.
++ * This requires of_device_id table. In the same time this will not change the
++ * actual *device* matching so do not add .of_match_table.
++ */
++static const struct of_device_id s2mps11_dt_match[] = {
++ {
++ .compatible = "samsung,s2mps11-clk",
++ .data = (void *)S2MPS11X,
++ }, {
++ .compatible = "samsung,s2mps13-clk",
++ .data = (void *)S2MPS13X,
++ }, {
++ .compatible = "samsung,s2mps14-clk",
++ .data = (void *)S2MPS14X,
++ }, {
++ .compatible = "samsung,s5m8767-clk",
++ .data = (void *)S5M8767X,
++ }, {
++ /* Sentinel */
++ },
++};
++MODULE_DEVICE_TABLE(of, s2mps11_dt_match);
++#endif
++
+ static struct platform_driver s2mps11_clk_driver = {
+ .driver = {
+ .name = "s2mps11-clk",
+diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c
+index 2a5015c736ce..43e82fa64422 100644
+--- a/drivers/clk/hisilicon/reset.c
++++ b/drivers/clk/hisilicon/reset.c
+@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev)
+ return NULL;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- rstc->membase = devm_ioremap(&pdev->dev,
+- res->start, resource_size(res));
+- if (!rstc->membase)
++ rstc->membase = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(rstc->membase))
+ return NULL;
+
+ spin_lock_init(&rstc->lock);
+diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c
+index bd4dbc696b88..cfd26fd7e404 100644
+--- a/drivers/clk/meson/axg.c
++++ b/drivers/clk/meson/axg.c
+@@ -320,6 +320,7 @@ static struct clk_regmap axg_fclk_div2 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div2_div" },
+ .num_parents = 1,
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+@@ -344,6 +345,18 @@ static struct clk_regmap axg_fclk_div3 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div3_div" },
+ .num_parents = 1,
++ /*
++ * FIXME:
++ * This clock, as fdiv2, is used by the SCPI FW and is required
++ * by the platform to operate correctly.
++ * Until the following condition are met, we need this clock to
++ * be marked as critical:
++ * a) The SCPI generic driver claims and enable all the clocks
++ * it needs
++ * b) CCF has a clock hand-off mechanism to make the sure the
++ * clock stays on until the proper driver comes along
++ */
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 177fffb9ebef..902c63209785 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -523,6 +523,18 @@ static struct clk_regmap gxbb_fclk_div3 = {
+ .ops = &clk_regmap_gate_ops,
+ .parent_names = (const char *[]){ "fclk_div3_div" },
+ .num_parents = 1,
++ /*
++ * FIXME:
++ * This clock, as fdiv2, is used by the SCPI FW and is required
++ * by the platform to operate correctly.
++ * Until the following condition are met, we need this clock to
++ * be marked as critical:
++ * a) The SCPI generic driver claims and enable all the clocks
++ * it needs
++ * b) CCF has a clock hand-off mechanism to make the sure the
++ * clock stays on until the proper driver comes along
++ */
++ .flags = CLK_IS_CRITICAL,
+ },
+ };
+
+diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c
+index e8075359366b..ebce5260068b 100644
+--- a/drivers/clk/rockchip/clk-ddr.c
++++ b/drivers/clk/rockchip/clk-ddr.c
+@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rate(struct clk_hw *hw,
+ static u8 rockchip_ddrclk_get_parent(struct clk_hw *hw)
+ {
+ struct rockchip_ddrclk *ddrclk = to_rockchip_ddrclk_hw(hw);
+- int num_parents = clk_hw_get_num_parents(hw);
+ u32 val;
+
+ val = clk_readl(ddrclk->reg_base +
+ ddrclk->mux_offset) >> ddrclk->mux_shift;
+ val &= GENMASK(ddrclk->mux_width - 1, 0);
+
+- if (val >= num_parents)
+- return -EINVAL;
+-
+ return val;
+ }
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 252366a5231f..2c5426607790 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -813,22 +813,22 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ MMC(SCLK_SDMMC_DRV, "sdmmc_drv", "clk_sdmmc",
+ RK3328_SDMMC_CON0, 1),
+ MMC(SCLK_SDMMC_SAMPLE, "sdmmc_sample", "clk_sdmmc",
+- RK3328_SDMMC_CON1, 1),
++ RK3328_SDMMC_CON1, 0),
+
+ MMC(SCLK_SDIO_DRV, "sdio_drv", "clk_sdio",
+ RK3328_SDIO_CON0, 1),
+ MMC(SCLK_SDIO_SAMPLE, "sdio_sample", "clk_sdio",
+- RK3328_SDIO_CON1, 1),
++ RK3328_SDIO_CON1, 0),
+
+ MMC(SCLK_EMMC_DRV, "emmc_drv", "clk_emmc",
+ RK3328_EMMC_CON0, 1),
+ MMC(SCLK_EMMC_SAMPLE, "emmc_sample", "clk_emmc",
+- RK3328_EMMC_CON1, 1),
++ RK3328_EMMC_CON1, 0),
+
+ MMC(SCLK_SDMMC_EXT_DRV, "sdmmc_ext_drv", "clk_sdmmc_ext",
+ RK3328_SDMMC_EXT_CON0, 1),
+ MMC(SCLK_SDMMC_EXT_SAMPLE, "sdmmc_ext_sample", "clk_sdmmc_ext",
+- RK3328_SDMMC_EXT_CON1, 1),
++ RK3328_SDMMC_EXT_CON1, 0),
+ };
+
+ static const char *const rk3328_critical_clocks[] __initconst = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+index bdbfe78fe133..0f7a0ffd3f70 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c
+@@ -224,7 +224,7 @@ static SUNXI_CCU_MP_WITH_MUX(psi_ahb1_ahb2_clk, "psi-ahb1-ahb2",
+ psi_ahb1_ahb2_parents,
+ 0x510,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+@@ -233,19 +233,19 @@ static const char * const ahb3_apb1_apb2_parents[] = { "osc24M", "osc32k",
+ "pll-periph0" };
+ static SUNXI_CCU_MP_WITH_MUX(ahb3_clk, "ahb3", ahb3_apb1_apb2_parents, 0x51c,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb1_clk, "apb1", ahb3_apb1_apb2_parents, 0x520,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+ static SUNXI_CCU_MP_WITH_MUX(apb2_clk, "apb2", ahb3_apb1_apb2_parents, 0x524,
+ 0, 5, /* M */
+- 16, 2, /* P */
++ 8, 2, /* P */
+ 24, 2, /* mux */
+ 0);
+
+diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c
+index 9c38895542f4..d4350bb10b83 100644
+--- a/drivers/clocksource/i8253.c
++++ b/drivers/clocksource/i8253.c
+@@ -20,6 +20,13 @@
+ DEFINE_RAW_SPINLOCK(i8253_lock);
+ EXPORT_SYMBOL(i8253_lock);
+
++/*
++ * Handle PIT quirk in pit_shutdown() where zeroing the counter register
++ * restarts the PIT, negating the shutdown. On platforms with the quirk,
++ * platform specific code can set this to false.
++ */
++bool i8253_clear_counter_on_shutdown __ro_after_init = true;
++
+ #ifdef CONFIG_CLKSRC_I8253
+ /*
+ * Since the PIT overflows every tick, its not very useful
+@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt)
+ raw_spin_lock(&i8253_lock);
+
+ outb_p(0x30, PIT_MODE);
+- outb_p(0, PIT_CH0);
+- outb_p(0, PIT_CH0);
++
++ if (i8253_clear_counter_on_shutdown) {
++ outb_p(0, PIT_CH0);
++ outb_p(0, PIT_CH0);
++ }
+
+ raw_spin_unlock(&i8253_lock);
+ return 0;
+diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
+index 8830fa601e45..0c0d2312f4a8 100644
+--- a/drivers/firmware/efi/libstub/fdt.c
++++ b/drivers/firmware/efi/libstub/fdt.c
+@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt,
+ return efi_status;
+ }
+ }
++
++ /* shrink the FDT back to its minimum size */
++ fdt_pack(fdt);
++
+ return EFI_SUCCESS;
+
+ fdt_set_fail:
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+index a1c78f90eadf..b1a86f99011a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ids.c
+@@ -574,7 +574,7 @@ void amdgpu_vmid_mgr_init(struct amdgpu_device *adev)
+ /* skip over VMID 0, since it is the system VM */
+ for (j = 1; j < id_mgr->num_ids; ++j) {
+ amdgpu_vmid_reset(adev, i, j);
+- amdgpu_sync_create(&id_mgr->ids[i].active);
++ amdgpu_sync_create(&id_mgr->ids[j].active);
+ list_add_tail(&id_mgr->ids[j].list, &id_mgr->ids_lru);
+ }
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+index 2bd56760c744..b1cd8e9649b9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -62,6 +62,7 @@ int amdgpu_job_alloc(struct amdgpu_device *adev, unsigned num_ibs,
+ amdgpu_sync_create(&(*job)->sync);
+ amdgpu_sync_create(&(*job)->sched_sync);
+ (*job)->vram_lost_counter = atomic_read(&adev->vram_lost_counter);
++ (*job)->vm_pd_addr = AMDGPU_BO_INVALID_OFFSET;
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+index f55f72a37ca8..c29d519fa381 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c
+@@ -277,6 +277,7 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type)
+ case CHIP_PITCAIRN:
+ case CHIP_VERDE:
+ case CHIP_OLAND:
++ case CHIP_HAINAN:
+ return AMDGPU_FW_LOAD_DIRECT;
+ #endif
+ #ifdef CONFIG_DRM_AMDGPU_CIK
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+index c31fff32a321..eb0ae9726cf7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+@@ -631,7 +631,8 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job, bool need_
+ }
+
+ gds_switch_needed &= !!ring->funcs->emit_gds_switch;
+- vm_flush_needed &= !!ring->funcs->emit_vm_flush;
++ vm_flush_needed &= !!ring->funcs->emit_vm_flush &&
++ job->vm_pd_addr != AMDGPU_BO_INVALID_OFFSET;
+ pasid_mapping_needed &= adev->gmc.gmc_funcs->emit_pasid_mapping &&
+ ring->funcs->emit_wreg;
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 644b2187507b..a6348bbb6fc7 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -1045,9 +1045,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa
+ */
+ update_flags->bits.bpp_change = 1;
+
+- if (u->gamma && dce_use_lut(u->plane_info->format))
+- update_flags->bits.gamma_change = 1;
+-
+ if (memcmp(&u->plane_info->tiling_info, &u->surface->tiling_info,
+ sizeof(union dc_tiling_info)) != 0) {
+ update_flags->bits.swizzle_change = 1;
+@@ -1064,7 +1061,6 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa
+ if (update_flags->bits.rotation_change
+ || update_flags->bits.stereo_format_change
+ || update_flags->bits.pixel_format_change
+- || update_flags->bits.gamma_change
+ || update_flags->bits.bpp_change
+ || update_flags->bits.bandwidth_change
+ || update_flags->bits.output_tf_change)
+@@ -1154,13 +1150,26 @@ static enum surface_update_type det_surface_update(const struct dc *dc,
+ if (u->coeff_reduction_factor)
+ update_flags->bits.coeff_reduction_change = 1;
+
++ if (u->gamma) {
++ enum surface_pixel_format format = SURFACE_PIXEL_FORMAT_GRPH_BEGIN;
++
++ if (u->plane_info)
++ format = u->plane_info->format;
++ else if (u->surface)
++ format = u->surface->format;
++
++ if (dce_use_lut(format))
++ update_flags->bits.gamma_change = 1;
++ }
++
+ if (update_flags->bits.in_transfer_func_change) {
+ type = UPDATE_TYPE_MED;
+ elevate_update_type(&overall_type, type);
+ }
+
+ if (update_flags->bits.input_csc_change
+- || update_flags->bits.coeff_reduction_change) {
++ || update_flags->bits.coeff_reduction_change
++ || update_flags->bits.gamma_change) {
+ type = UPDATE_TYPE_FULL;
+ elevate_update_type(&overall_type, type);
+ }
+diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+index eee0dfad6962..7d9fea6877bc 100644
+--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c
+@@ -968,10 +968,14 @@ static void build_evenly_distributed_points(
+ struct dividers dividers)
+ {
+ struct gamma_pixel *p = points;
+- struct gamma_pixel *p_last = p + numberof_points - 1;
++ struct gamma_pixel *p_last;
+
+ uint32_t i = 0;
+
++ // This function should not gets called with 0 as a parameter
++ ASSERT(numberof_points > 0);
++ p_last = p + numberof_points - 1;
++
+ do {
+ struct fixed31_32 value = dc_fixpt_from_fraction(i,
+ numberof_points - 1);
+@@ -982,7 +986,7 @@ static void build_evenly_distributed_points(
+
+ ++p;
+ ++i;
+- } while (i != numberof_points);
++ } while (i < numberof_points);
+
+ p->r = dc_fixpt_div(p_last->r, dividers.divider1);
+ p->g = dc_fixpt_div(p_last->g, dividers.divider1);
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+index 617557bd8c24..b813e77d8e93 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+@@ -1222,14 +1222,17 @@ static int smu8_dpm_force_dpm_level(struct pp_hwmgr *hwmgr,
+
+ static int smu8_dpm_powerdown_uvd(struct pp_hwmgr *hwmgr)
+ {
+- if (PP_CAP(PHM_PlatformCaps_UVDPowerGating))
++ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, true, true);
+ return smum_send_msg_to_smc(hwmgr, PPSMC_MSG_UVDPowerOFF);
++ }
+ return 0;
+ }
+
+ static int smu8_dpm_powerup_uvd(struct pp_hwmgr *hwmgr)
+ {
+ if (PP_CAP(PHM_PlatformCaps_UVDPowerGating)) {
++ smu8_nbdpm_pstate_enable_disable(hwmgr, false, true);
+ return smum_send_msg_to_smc_with_parameter(
+ hwmgr,
+ PPSMC_MSG_UVDPowerON,
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+index 2d4ec8ac3a08..0b3ea7e9b805 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+@@ -2303,11 +2303,13 @@ static uint32_t ci_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU7_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU7_Discrete_DpmTable, LowSclkInterruptT);
+ }
++ break;
+ }
+ pr_debug("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
+index 53df9405f43a..bb616a530d3c 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smumgr.c
+@@ -2372,6 +2372,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU73_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2383,6 +2384,7 @@ static uint32_t fiji_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
+index 415f691c3fa9..c15e15e657b8 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smumgr.c
+@@ -2246,11 +2246,13 @@ static uint32_t iceland_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU71_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
+index 782b19fc2e70..a5b7a4484700 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smumgr.c
+@@ -2667,6 +2667,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU72_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2678,6 +2679,7 @@ static uint32_t tonga_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+index 2de48959ac93..52834334bd53 100644
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/vegam_smumgr.c
+@@ -2267,6 +2267,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member)
+ case DRAM_LOG_BUFF_SIZE:
+ return offsetof(SMU75_SoftRegisters, DRAM_LOG_BUFF_SIZE);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2278,6 +2279,7 @@ static uint32_t vegam_get_offsetof(uint32_t type, uint32_t member)
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU75_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 658830620ca3..9c166621e920 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -1274,6 +1274,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
+ mutex_lock(&mgr->lock);
+ mstb = mgr->mst_primary;
+
++ if (!mstb)
++ goto out;
++
+ for (i = 0; i < lct - 1; i++) {
+ int shift = (i % 2) ? 0 : 4;
+ int port_num = (rad[i / 2] >> shift) & 0xf;
+diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+index fe9c6c731e87..ee4a5e1221f1 100644
+--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
+@@ -30,6 +30,12 @@ struct drm_dmi_panel_orientation_data {
+ int orientation;
+ };
+
++static const struct drm_dmi_panel_orientation_data acer_s1003 = {
++ .width = 800,
++ .height = 1280,
++ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
++};
++
+ static const struct drm_dmi_panel_orientation_data asus_t100ha = {
+ .width = 800,
+ .height = 1280,
+@@ -67,7 +73,13 @@ static const struct drm_dmi_panel_orientation_data lcd800x1280_rightside_up = {
+ };
+
+ static const struct dmi_system_id orientation_data[] = {
+- { /* Asus T100HA */
++ { /* Acer One 10 (S1003) */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"),
++ },
++ .driver_data = (void *)&acer_s1003,
++ }, { /* Asus T100HA */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"),
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_sched.c b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+index 50d6b88cb7aa..5944f319c78b 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_sched.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_sched.c
+@@ -93,7 +93,7 @@ static void etnaviv_sched_timedout_job(struct drm_sched_job *sched_job)
+ * If the GPU managed to complete this jobs fence, the timout is
+ * spurious. Bail out.
+ */
+- if (fence_completed(gpu, submit->out_fence->seqno))
++ if (dma_fence_is_signaled(submit->out_fence))
+ return;
+
+ /*
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index b92595c477ef..8bd29075ae4e 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
+ if (IS_ERR(hi_fbdev->fb)) {
+ ret = PTR_ERR(hi_fbdev->fb);
++ hi_fbdev->fb = NULL;
+ DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
+ goto out_release_fbi;
+ }
+diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
+index 97e62647418a..5040bcd430d2 100644
+--- a/drivers/gpu/drm/i915/gvt/gtt.h
++++ b/drivers/gpu/drm/i915/gvt/gtt.h
+@@ -35,7 +35,6 @@
+ #define _GVT_GTT_H_
+
+ #define I915_GTT_PAGE_SHIFT 12
+-#define I915_GTT_PAGE_MASK (~(I915_GTT_PAGE_SIZE - 1))
+
+ struct intel_vgpu_mm;
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 17c5097721e8..4b77325d135a 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1112,11 +1112,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj,
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pread(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
+@@ -1562,11 +1558,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj,
+ offset = offset_in_page(args->offset);
+ for (idx = args->offset >> PAGE_SHIFT; remain; idx++) {
+ struct page *page = i915_gem_object_get_page(obj, idx);
+- int length;
+-
+- length = remain;
+- if (offset + length > PAGE_SIZE)
+- length = PAGE_SIZE - offset;
++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset);
+
+ ret = shmem_pwrite(page, offset, length, user_data,
+ page_to_phys(page) & obj_do_bit17_swizzling,
+diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+index 22df17c8ca9b..b43bc767ec3d 100644
+--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+@@ -449,7 +449,7 @@ eb_validate_vma(struct i915_execbuffer *eb,
+ * any non-page-aligned or non-canonical addresses.
+ */
+ if (unlikely(entry->flags & EXEC_OBJECT_PINNED &&
+- entry->offset != gen8_canonical_addr(entry->offset & PAGE_MASK)))
++ entry->offset != gen8_canonical_addr(entry->offset & I915_GTT_PAGE_MASK)))
+ return -EINVAL;
+
+ /* pad_to_size was once a reserved field, so sanitize it */
+diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h
+index aec4f73574f4..69f53faab644 100644
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.h
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h
+@@ -49,6 +49,8 @@
+ #define I915_GTT_PAGE_SIZE I915_GTT_PAGE_SIZE_4K
+ #define I915_GTT_MAX_PAGE_SIZE I915_GTT_PAGE_SIZE_2M
+
++#define I915_GTT_PAGE_MASK -I915_GTT_PAGE_SIZE
++
+ #define I915_GTT_MIN_ALIGNMENT I915_GTT_PAGE_SIZE
+
+ #define I915_FENCE_REG_NONE -1
+@@ -625,20 +627,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm,
+ u64 start, u64 end, unsigned int flags);
+
+ /* Flags used by pin/bind&friends. */
+-#define PIN_NONBLOCK BIT(0)
+-#define PIN_MAPPABLE BIT(1)
+-#define PIN_ZONE_4G BIT(2)
+-#define PIN_NONFAULT BIT(3)
+-#define PIN_NOEVICT BIT(4)
+-
+-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */
+-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */
+-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */
+-#define PIN_UPDATE BIT(8)
+-
+-#define PIN_HIGH BIT(9)
+-#define PIN_OFFSET_BIAS BIT(10)
+-#define PIN_OFFSET_FIXED BIT(11)
++#define PIN_NONBLOCK BIT_ULL(0)
++#define PIN_MAPPABLE BIT_ULL(1)
++#define PIN_ZONE_4G BIT_ULL(2)
++#define PIN_NONFAULT BIT_ULL(3)
++#define PIN_NOEVICT BIT_ULL(4)
++
++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */
++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */
++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */
++#define PIN_UPDATE BIT_ULL(8)
++
++#define PIN_HIGH BIT_ULL(9)
++#define PIN_OFFSET_BIAS BIT_ULL(10)
++#define PIN_OFFSET_FIXED BIT_ULL(11)
+ #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE)
+
+ #endif
+diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
+index 3ea566f99450..391ad4123953 100644
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -134,6 +134,9 @@ static const struct {
+ /* HDMI N/CTS table */
+ #define TMDS_297M 297000
+ #define TMDS_296M 296703
++#define TMDS_594M 594000
++#define TMDS_593M 593407
++
+ static const struct {
+ int sample_rate;
+ int clock;
+@@ -154,6 +157,20 @@ static const struct {
+ { 176400, TMDS_297M, 18816, 247500 },
+ { 192000, TMDS_296M, 23296, 281250 },
+ { 192000, TMDS_297M, 20480, 247500 },
++ { 44100, TMDS_593M, 8918, 937500 },
++ { 44100, TMDS_594M, 9408, 990000 },
++ { 48000, TMDS_593M, 5824, 562500 },
++ { 48000, TMDS_594M, 6144, 594000 },
++ { 32000, TMDS_593M, 5824, 843750 },
++ { 32000, TMDS_594M, 3072, 445500 },
++ { 88200, TMDS_593M, 17836, 937500 },
++ { 88200, TMDS_594M, 18816, 990000 },
++ { 96000, TMDS_593M, 11648, 562500 },
++ { 96000, TMDS_594M, 12288, 594000 },
++ { 176400, TMDS_593M, 35672, 937500 },
++ { 176400, TMDS_594M, 37632, 990000 },
++ { 192000, TMDS_593M, 23296, 562500 },
++ { 192000, TMDS_594M, 24576, 594000 },
+ };
+
+ /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 00486c744f24..b1e4f460f403 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -12509,17 +12509,12 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
+ intel_check_cpu_fifo_underruns(dev_priv);
+ intel_check_pch_fifo_underruns(dev_priv);
+
+- if (!new_crtc_state->active) {
+- /*
+- * Make sure we don't call initial_watermarks
+- * for ILK-style watermark updates.
+- *
+- * No clue what this is supposed to achieve.
+- */
+- if (INTEL_GEN(dev_priv) >= 9)
+- dev_priv->display.initial_watermarks(intel_state,
+- to_intel_crtc_state(new_crtc_state));
+- }
++ /* FIXME unify this for all platforms */
++ if (!new_crtc_state->active &&
++ !HAS_GMCH_DISPLAY(dev_priv) &&
++ dev_priv->display.initial_watermarks)
++ dev_priv->display.initial_watermarks(intel_state,
++ to_intel_crtc_state(new_crtc_state));
+ }
+ }
+
+@@ -14383,7 +14378,7 @@ static int intel_framebuffer_init(struct intel_framebuffer *intel_fb,
+ fb->height < SKL_MIN_YUV_420_SRC_H ||
+ (fb->width % 4) != 0 || (fb->height % 4) != 0)) {
+ DRM_DEBUG_KMS("src dimensions not correct for NV12\n");
+- return -EINVAL;
++ goto err;
+ }
+
+ for (i = 0; i < fb->format->num_planes; i++) {
+@@ -15216,13 +15211,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
+ I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ }
+
+- /* restore vblank interrupts to correct state */
+- drm_crtc_vblank_reset(&crtc->base);
+ if (crtc->active) {
+ struct intel_plane *plane;
+
+- drm_crtc_vblank_on(&crtc->base);
+-
+ /* Disable everything but the primary plane */
+ for_each_intel_plane_on_crtc(dev, crtc, plane) {
+ const struct intel_plane_state *plane_state =
+@@ -15549,7 +15540,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- enum pipe pipe;
+ struct intel_crtc *crtc;
+ struct intel_encoder *encoder;
+ int i;
+@@ -15560,15 +15550,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ /* HW state is read out, now we need to sanitize this mess. */
+ get_encoder_power_domains(dev_priv);
+
+- intel_sanitize_plane_mapping(dev_priv);
++ /*
++ * intel_sanitize_plane_mapping() may need to do vblank
++ * waits, so we need vblank interrupts restored beforehand.
++ */
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ drm_crtc_vblank_reset(&crtc->base);
+
+- for_each_intel_encoder(dev, encoder) {
+- intel_sanitize_encoder(encoder);
++ if (crtc->active)
++ drm_crtc_vblank_on(&crtc->base);
+ }
+
+- for_each_pipe(dev_priv, pipe) {
+- crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_sanitize_plane_mapping(dev_priv);
++
++ for_each_intel_encoder(dev, encoder)
++ intel_sanitize_encoder(encoder);
+
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ intel_sanitize_crtc(crtc, ctx);
+ intel_dump_pipe_config(crtc, crtc->config,
+ "[setup_hw_state]");
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 8e465095fe06..5d6517d37236 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -387,6 +387,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate,
+ return true;
+ }
+
++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp,
++ int link_rate,
++ uint8_t lane_count)
++{
++ const struct drm_display_mode *fixed_mode =
++ intel_dp->attached_connector->panel.fixed_mode;
++ int mode_rate, max_rate;
++
++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18);
++ max_rate = intel_dp_max_data_rate(link_rate, lane_count);
++ if (mode_rate > max_rate)
++ return false;
++
++ return true;
++}
++
+ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ int link_rate, uint8_t lane_count)
+ {
+@@ -396,9 +412,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ intel_dp->num_common_rates,
+ link_rate);
+ if (index > 0) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp->common_rates[index - 1],
++ lane_count)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp->common_rates[index - 1];
+ intel_dp->max_link_lane_count = lane_count;
+ } else if (lane_count > 1) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp_max_common_rate(intel_dp),
++ lane_count >> 1)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp);
+ intel_dp->max_link_lane_count = lane_count >> 1;
+ } else {
+@@ -4842,19 +4872,13 @@ intel_dp_long_pulse(struct intel_connector *connector,
+ */
+ status = connector_status_disconnected;
+ goto out;
+- } else {
+- /*
+- * If display is now connected check links status,
+- * there has been known issues of link loss triggering
+- * long pulse.
+- *
+- * Some sinks (eg. ASUS PB287Q) seem to perform some
+- * weird HPD ping pong during modesets. So we can apparently
+- * end up with HPD going low during a modeset, and then
+- * going back up soon after. And once that happens we must
+- * retrain the link to get a picture. That's in case no
+- * userspace component reacted to intermittent HPD dip.
+- */
++ }
++
++ /*
++ * Some external monitors do not signal loss of link synchronization
++ * with an IRQ_HPD, so force a link status check.
++ */
++ if (!intel_dp_is_edp(intel_dp)) {
+ struct intel_encoder *encoder = &dp_to_dig_port(intel_dp)->base;
+
+ intel_dp_retrain_link(encoder, ctx);
+diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c
+index 3fcaa98b9055..667397541f10 100644
+--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
+@@ -335,22 +335,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
+ return;
+
+ failure_handling:
+- /* Dont fallback and prune modes if its eDP */
+- if (!intel_dp_is_edp(intel_dp)) {
+- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- if (!intel_dp_get_link_train_fallback_values(intel_dp,
+- intel_dp->link_rate,
+- intel_dp->lane_count))
+- /* Schedule a Hotplug Uevent to userspace to start modeset */
+- schedule_work(&intel_connector->modeset_retry_work);
+- } else {
+- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- }
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
++ intel_connector->base.base.id,
++ intel_connector->base.name,
++ intel_dp->link_rate, intel_dp->lane_count);
++ if (!intel_dp_get_link_train_fallback_values(intel_dp,
++ intel_dp->link_rate,
++ intel_dp->lane_count))
++ /* Schedule a Hotplug Uevent to userspace to start modeset */
++ schedule_work(&intel_connector->modeset_retry_work);
+ return;
+ }
+diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c
+index 5890500a3a8b..80566cc347ee 100644
+--- a/drivers/gpu/drm/i915/intel_dp_mst.c
++++ b/drivers/gpu/drm/i915/intel_dp_mst.c
+@@ -38,11 +38,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
+ struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base);
+ struct intel_digital_port *intel_dig_port = intel_mst->primary;
+ struct intel_dp *intel_dp = &intel_dig_port->dp;
+- struct intel_connector *connector =
+- to_intel_connector(conn_state->connector);
++ struct drm_connector *connector = conn_state->connector;
++ void *port = to_intel_connector(connector)->port;
+ struct drm_atomic_state *state = pipe_config->base.state;
+ int bpp;
+- int lane_count, slots;
++ int lane_count, slots = 0;
+ const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode;
+ int mst_pbn;
+ bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc,
+@@ -70,17 +70,23 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder,
+
+ pipe_config->port_clock = intel_dp_max_link_rate(intel_dp);
+
+- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port))
++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port))
+ pipe_config->has_audio = true;
+
+ mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp);
+ pipe_config->pbn = mst_pbn;
+
+- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr,
+- connector->port, mst_pbn);
+- if (slots < 0) {
+- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots);
+- return false;
++ /* Zombie connectors can't have VCPI slots */
++ if (READ_ONCE(connector->registered)) {
++ slots = drm_dp_atomic_find_vcpi_slots(state,
++ &intel_dp->mst_mgr,
++ port,
++ mst_pbn);
++ if (slots < 0) {
++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n",
++ slots);
++ return false;
++ }
+ }
+
+ intel_link_compute_m_n(bpp, lane_count,
+@@ -307,9 +313,8 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector)
+ struct edid *edid;
+ int ret;
+
+- if (!intel_dp) {
++ if (!READ_ONCE(connector->registered))
+ return intel_connector_update_modes(connector, NULL);
+- }
+
+ edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port);
+ ret = intel_connector_update_modes(connector, edid);
+@@ -324,9 +329,10 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force)
+ struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return connector_status_disconnected;
+- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port);
++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr,
++ intel_connector->port);
+ }
+
+ static void
+@@ -366,7 +372,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector,
+ int bpp = 24; /* MST uses fixed bpp */
+ int max_rate, mode_rate, max_lanes, max_link_clock;
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return MODE_ERROR;
+
+ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
+@@ -398,7 +404,7 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c
+ struct intel_dp *intel_dp = intel_connector->mst_port;
+ struct intel_crtc *crtc = to_intel_crtc(state->crtc);
+
+- if (!intel_dp)
++ if (!READ_ONCE(connector->registered))
+ return NULL;
+ return &intel_dp->mst_encoders[crtc->pipe]->base.base;
+ }
+@@ -458,6 +464,10 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
+ if (!intel_connector)
+ return NULL;
+
++ intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
++ intel_connector->mst_port = intel_dp;
++ intel_connector->port = port;
++
+ connector = &intel_connector->base;
+ ret = drm_connector_init(dev, connector, &intel_dp_mst_connector_funcs,
+ DRM_MODE_CONNECTOR_DisplayPort);
+@@ -468,10 +478,6 @@ static struct drm_connector *intel_dp_add_mst_connector(struct drm_dp_mst_topolo
+
+ drm_connector_helper_add(connector, &intel_dp_mst_connector_helper_funcs);
+
+- intel_connector->get_hw_state = intel_dp_mst_get_hw_state;
+- intel_connector->mst_port = intel_dp;
+- intel_connector->port = port;
+-
+ for_each_pipe(dev_priv, pipe) {
+ struct drm_encoder *enc =
+ &intel_dp->mst_encoders[pipe]->base.base;
+@@ -510,7 +516,6 @@ static void intel_dp_register_mst_connector(struct drm_connector *connector)
+ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ struct drm_connector *connector)
+ {
+- struct intel_connector *intel_connector = to_intel_connector(connector);
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n", connector->base.id, connector->name);
+@@ -519,10 +524,6 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ if (dev_priv->fbdev)
+ drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper,
+ connector);
+- /* prevent race with the check in ->detect */
+- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL);
+- intel_connector->mst_port = NULL;
+- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex);
+
+ drm_connector_unreference(connector);
+ }
+diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
+index cdf19553ffac..5d5336fbe7b0 100644
+--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
+@@ -297,8 +297,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv)
+ lpe_audio_platdev_destroy(dev_priv);
+
+ irq_free_desc(dev_priv->lpe_audio.irq);
+-}
+
++ dev_priv->lpe_audio.irq = -1;
++ dev_priv->lpe_audio.platdev = NULL;
++}
+
+ /**
+ * intel_lpe_audio_notify() - notify lpe audio event
+diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
+index 7c4c8fb1dae4..0328ee704ee5 100644
+--- a/drivers/gpu/drm/i915/intel_lrc.c
++++ b/drivers/gpu/drm/i915/intel_lrc.c
+@@ -425,7 +425,8 @@ static u64 execlists_update_context(struct i915_request *rq)
+
+ reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail);
+
+- /* True 32b PPGTT with dynamic page allocation: update PDP
++ /*
++ * True 32b PPGTT with dynamic page allocation: update PDP
+ * registers and point the unallocated PDPs to scratch page.
+ * PML4 is allocated during ppgtt init, so this is not needed
+ * in 48-bit mode.
+@@ -433,6 +434,17 @@ static u64 execlists_update_context(struct i915_request *rq)
+ if (ppgtt && !i915_vm_is_48bit(&ppgtt->base))
+ execlists_update_context_pdps(ppgtt, reg_state);
+
++ /*
++ * Make sure the context image is complete before we submit it to HW.
++ *
++ * Ostensibly, writes (including the WCB) should be flushed prior to
++ * an uncached write such as our mmio register access, the empirical
++ * evidence (esp. on Braswell) suggests that the WC write into memory
++ * may not be visible to the HW prior to the completion of the UC
++ * register write and that we may begin execution from the context
++ * before its image is complete leading to invalid PD chasing.
++ */
++ wmb();
+ return ce->lrc_desc;
+ }
+
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 8f19349a6055..72007d634359 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -91,6 +91,7 @@ static int
+ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
+ {
+ u32 cmd, *cs;
++ int i;
+
+ /*
+ * read/write caches:
+@@ -127,12 +128,45 @@ gen4_render_ring_flush(struct i915_request *rq, u32 mode)
+ cmd |= MI_INVALIDATE_ISP;
+ }
+
+- cs = intel_ring_begin(rq, 2);
++ i = 2;
++ if (mode & EMIT_INVALIDATE)
++ i += 20;
++
++ cs = intel_ring_begin(rq, i);
+ if (IS_ERR(cs))
+ return PTR_ERR(cs);
+
+ *cs++ = cmd;
+- *cs++ = MI_NOOP;
++
++ /*
++ * A random delay to let the CS invalidate take effect? Without this
++ * delay, the GPU relocation path fails as the CS does not see
++ * the updated contents. Just as important, if we apply the flushes
++ * to the EMIT_FLUSH branch (i.e. immediately after the relocation
++ * write and before the invalidate on the next batch), the relocations
++ * still fail. This implies that is a delay following invalidation
++ * that is required to reset the caches as opposed to a delay to
++ * ensure the memory is written.
++ */
++ if (mode & EMIT_INVALIDATE) {
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++
++ for (i = 0; i < 12; i++)
++ *cs++ = MI_FLUSH;
++
++ *cs++ = GFX_OP_PIPE_CONTROL(4) | PIPE_CONTROL_QW_WRITE;
++ *cs++ = i915_ggtt_offset(rq->engine->scratch) |
++ PIPE_CONTROL_GLOBAL_GTT;
++ *cs++ = 0;
++ *cs++ = 0;
++ }
++
++ *cs++ = cmd;
++
+ intel_ring_advance(rq, cs);
+
+ return 0;
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 17d0506d058c..48960c1d92bc 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -477,8 +477,7 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
+ struct device_node *child, *node;
+ int ret;
+
+- node = of_find_compatible_node(dev->of_node, NULL,
+- "qcom,gpu-pwrlevels");
++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
+ if (!node) {
+ dev_err(dev, "Could not find the GPU powerlevels\n");
+ return -ENXIO;
+@@ -499,6 +498,8 @@ static int adreno_get_legacy_pwrlevels(struct device *dev)
+ dev_pm_opp_add(dev, val, 0);
+ }
+
++ of_node_put(node);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index c3c8c84da113..c1e4aab9932e 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -818,22 +818,16 @@ nv50_mstc_atomic_best_encoder(struct drm_connector *connector,
+ {
+ struct nv50_head *head = nv50_head(connector_state->crtc);
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[head->base.index]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[head->base.index]->encoder;
+ }
+
+ static struct drm_encoder *
+ nv50_mstc_best_encoder(struct drm_connector *connector)
+ {
+ struct nv50_mstc *mstc = nv50_mstc(connector);
+- if (mstc->port) {
+- struct nv50_mstm *mstm = mstc->mstm;
+- return &mstm->msto[0]->encoder;
+- }
+- return NULL;
++
++ return &mstc->mstm->msto[0]->encoder;
+ }
+
+ static enum drm_mode_status
+diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+index 408b955e5c39..6dd72bc32897 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c
++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c
+@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector *connector)
+ &nv40_bl_ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
+@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector *connector)
+ nv_encoder, ops, &props);
+
+ if (IS_ERR(bd)) {
+- if (bl_connector.id > 0)
++ if (bl_connector.id >= 0)
+ ida_simple_remove(&bl_ida, bl_connector.id);
+ return PTR_ERR(bd);
+ }
+diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+index f92fe205550b..e884183c018a 100644
+--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c
+@@ -285,6 +285,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait)
+ }
+
+ txn->last_pat->next_pa = 0;
++ /* ensure that the written descriptors are visible to DMM */
++ wmb();
++
++ /*
++ * NOTE: the wmb() above should be enough, but there seems to be a bug
++ * in OMAP's memory barrier implementation, which in some rare cases may
++ * cause the writes not to be observable after wmb().
++ */
++
++ /* read back to ensure the data is in RAM */
++ readl(&txn->last_pat->next_pa);
+
+ /* write to PAT_DESCR to clear out any pending transaction */
+ dmm_write(dmm, 0x0, reg[PAT_DESCR][engine->id]);
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index f0bc7cc0e913..fb46df56f0c4 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -516,12 +516,22 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu)
+
+ dev->mode_config.min_width = 0;
+ dev->mode_config.min_height = 0;
+- dev->mode_config.max_width = 4095;
+- dev->mode_config.max_height = 2047;
+ dev->mode_config.normalize_zpos = true;
+ dev->mode_config.funcs = &rcar_du_mode_config_funcs;
+ dev->mode_config.helper_private = &rcar_du_mode_config_helper;
+
++ if (rcdu->info->gen < 3) {
++ dev->mode_config.max_width = 4095;
++ dev->mode_config.max_height = 2047;
++ } else {
++ /*
++ * The Gen3 DU uses the VSP1 for memory access, and is limited
++ * to frame sizes of 8190x8190.
++ */
++ dev->mode_config.max_width = 8190;
++ dev->mode_config.max_height = 8190;
++ }
++
+ rcdu->num_crtcs = hweight8(rcdu->info->channels_mask);
+
+ ret = rcar_du_properties_init(rcdu);
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index f814d37b1db2..05368fa4f956 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -442,6 +442,11 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ rockchip_drm_platform_remove(pdev);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -451,6 +456,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
+index e88c01961948..52918185578a 100644
+--- a/drivers/hwmon/hwmon.c
++++ b/drivers/hwmon/hwmon.c
+@@ -631,8 +631,10 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+ if (info[i]->config[j] & HWMON_T_INPUT) {
+ err = hwmon_thermal_add_sensor(dev,
+ hwdev, j);
+- if (err)
+- goto free_device;
++ if (err) {
++ device_unregister(hdev);
++ goto ida_remove;
++ }
+ }
+ }
+ }
+@@ -640,8 +642,6 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
+
+ return hdev;
+
+-free_device:
+- device_unregister(hdev);
+ free_hwmon:
+ kfree(hwdev);
+ ida_remove:
+diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
+index 2566b4d8b342..73856c2a8ac0 100644
+--- a/drivers/input/touchscreen/wm97xx-core.c
++++ b/drivers/input/touchscreen/wm97xx-core.c
+@@ -929,7 +929,8 @@ static int __init wm97xx_init(void)
+
+ static void __exit wm97xx_exit(void)
+ {
+- driver_unregister(&wm97xx_driver);
++ if (IS_BUILTIN(CONFIG_AC97_BUS))
++ driver_unregister(&wm97xx_driver);
+ platform_driver_unregister(&wm97xx_mfd_driver);
+ }
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 805bd9c65940..8b450fc53202 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -901,9 +901,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+
+ /* tvp5150 has some special limits */
+ rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT);
+- rect.width = clamp_t(unsigned int, rect.width,
+- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
+- TVP5150_H_MAX - rect.left);
+ rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP);
+
+ /* Calculate height based on current standard */
+@@ -917,9 +914,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+ else
+ hmax = TVP5150_V_MAX_OTHERS;
+
+- rect.height = clamp_t(unsigned int, rect.height,
++ /*
++ * alignments:
++ * - width = 2 due to UYVY colorspace
++ * - height, image = no special alignment
++ */
++ v4l_bound_align_image(&rect.width,
++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
++ TVP5150_H_MAX - rect.left, 1, &rect.height,
+ hmax - TVP5150_MAX_CROP_TOP - rect.top,
+- hmax - rect.top);
++ hmax - rect.top, 0, 0);
+
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top);
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP,
+diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c
+index 70aec9bb7e95..07bf20c6c6fc 100644
+--- a/drivers/media/pci/cx23885/altera-ci.c
++++ b/drivers/media/pci/cx23885/altera-ci.c
+@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->filts_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -699,6 +703,7 @@ err:
+ __func__, ret);
+
+ kfree(pid_filt);
++ kfree(inter);
+
+ return ret;
+ }
+@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->cis_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -801,6 +810,7 @@ err:
+ ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret);
+
+ kfree(state);
++ kfree(inter);
+
+ return ret;
+ }
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index c7631e117dd3..1ae15d4ec5ed 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -1719,7 +1719,8 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl)
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_PROFILE:
+ /* TODO: switch between baseline and constrained baseline */
+- ctx->params.h264_profile_idc = 66;
++ if (ctx->inst_type == CODA_INST_ENCODER)
++ ctx->params.h264_profile_idc = 66;
+ break;
+ case V4L2_CID_MPEG_VIDEO_H264_LEVEL:
+ /* nothing to do, this is set by the encoder */
+diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
+index 57b02c4b3f63..6072ea9a84f2 100644
+--- a/drivers/mtd/devices/Kconfig
++++ b/drivers/mtd/devices/Kconfig
+@@ -207,7 +207,7 @@ comment "Disk-On-Chip Device Drivers"
+ config MTD_DOCG3
+ tristate "M-Systems Disk-On-Chip G3"
+ select BCH
+- select BCH_CONST_PARAMS
++ select BCH_CONST_PARAMS if !MTD_NAND_BCH
+ select BITREVERSE
+ ---help---
+ This provides an MTD device driver for the M-Systems DiskOnChip
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index d7e10b36a0b9..0f0126901ac5 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1000,7 +1000,7 @@ static int cqspi_direct_read_execute(struct spi_nor *nor, u_char *buf,
+ err_unmap:
+ dma_unmap_single(nor->dev, dma_dst, len, DMA_DEV_TO_MEM);
+
+- return 0;
++ return ret;
+ }
+
+ static ssize_t cqspi_read(struct spi_nor *nor, loff_t from,
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 2b01180be834..29661d45c6d0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3118,13 +3118,13 @@ static int bond_slave_netdev_event(unsigned long event,
+ case NETDEV_CHANGE:
+ /* For 802.3ad mode only:
+ * Getting invalid Speed/Duplex values here will put slave
+- * in weird state. So mark it as link-down for the time
++ * in weird state. So mark it as link-fail for the time
+ * being and let link-monitoring (miimon) set it right when
+ * correct speeds/duplex are available.
+ */
+ if (bond_update_speed_duplex(slave) &&
+ BOND_MODE(bond) == BOND_MODE_8023AD)
+- slave->link = BOND_LINK_DOWN;
++ slave->link = BOND_LINK_FAIL;
+
+ if (BOND_MODE(bond) == BOND_MODE_8023AD)
+ bond_3ad_adapter_speed_duplex_changed(slave);
+diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
+index 27d9b4bba535..2411ed3c7303 100644
+--- a/drivers/of/of_numa.c
++++ b/drivers/of/of_numa.c
+@@ -115,9 +115,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map)
+ distance = of_read_number(matrix, 1);
+ matrix++;
+
++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) ||
++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) {
++ pr_err("Invalid distance[node%d -> node%d] = %d\n",
++ nodea, nodeb, distance);
++ return -EINVAL;
++ }
++
+ numa_set_distance(nodea, nodeb, distance);
+- pr_debug("distance[node%d -> node%d] = %d\n",
+- nodea, nodeb, distance);
+
+ /* Set default distance of node B->A same as A->B */
+ if (nodeb > nodea)
+diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c
+index e79f2a181ad2..b9ec4a16db1f 100644
+--- a/drivers/rtc/hctosys.c
++++ b/drivers/rtc/hctosys.c
+@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void)
+ tv64.tv_sec = rtc_tm_to_time64(&tm);
+
+ #if BITS_PER_LONG == 32
+- if (tv64.tv_sec > INT_MAX)
++ if (tv64.tv_sec > INT_MAX) {
++ err = -ERANGE;
+ goto err_read;
++ }
+ #endif
+
+ err = do_settimeofday64(&tv64);
+diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c
+index 7a3744006419..c492af5bcd95 100644
+--- a/drivers/scsi/qla2xxx/qla_gs.c
++++ b/drivers/scsi/qla2xxx/qla_gs.c
+@@ -4410,9 +4410,9 @@ int qla24xx_async_gpnft(scsi_qla_host_t *vha, u8 fc4_type, srb_t *sp)
+ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout;
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+- rspsz = sizeof(struct ct_sns_gpnft_rsp) +
+- ((vha->hw->max_fibre_devices - 1) *
+- sizeof(struct ct_sns_gpn_ft_data));
++ rspsz = sp->u.iocb_cmd.u.ctarg.rsp_size;
++ memset(sp->u.iocb_cmd.u.ctarg.rsp, 0, sp->u.iocb_cmd.u.ctarg.rsp_size);
++ memset(sp->u.iocb_cmd.u.ctarg.req, 0, sp->u.iocb_cmd.u.ctarg.req_size);
+
+ ct_sns = (struct ct_sns_pkt *)sp->u.iocb_cmd.u.ctarg.req;
+ /* CT_IU preamble */
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 75d34def2361..f77e470152d0 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -1742,25 +1742,15 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ cid.b.rsvd_1 = 0;
+
+ ql_dbg(ql_dbg_disc, vha, 0x20ec,
+- "%s %d %8phC LoopID 0x%x in use post gnl\n",
++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n",
+ __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->loop_id);
++ ea->fcport->loop_id, cid.b24);
+
+- if (IS_SW_RESV_ADDR(cid)) {
+- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
+- ea->fcport->loop_id = FC_NO_LOOP_ID;
+- } else {
+- qla2x00_clear_loop_id(ea->fcport);
+- }
++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map);
++ ea->fcport->loop_id = FC_NO_LOOP_ID;
+ qla24xx_post_gnl_work(vha, ea->fcport);
+ break;
+ case MBS_PORT_ID_USED:
+- ql_dbg(ql_dbg_disc, vha, 0x20ed,
+- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n",
+- __func__, __LINE__, ea->fcport->port_name,
+- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area,
+- ea->fcport->d_id.b.al_pa);
+-
+ lid = ea->iop[1] & 0xffff;
+ qlt_find_sess_invalidate_other(vha,
+ wwn_to_u64(ea->fcport->port_name),
+@@ -4501,6 +4491,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags)
+ fcport->loop_id = FC_NO_LOOP_ID;
+ qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED);
+ fcport->supported_classes = FC_COS_UNSPECIFIED;
++ fcport->fp_speed = PORT_SPEED_UNKNOWN;
+
+ fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev,
+ sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma,
+@@ -6515,7 +6506,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
+ * The next call disables the board
+ * completely.
+ */
+- ha->isp_ops->reset_adapter(vha);
++ qla2x00_abort_isp_cleanup(vha);
+ vha->flags.online = 0;
+ clear_bit(ISP_ABORT_RETRY,
+ &vha->dpc_flags);
+@@ -6972,7 +6963,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha)
+ }
+ icb->firmware_options_2 &= cpu_to_le32(
+ ~(BIT_3 | BIT_2 | BIT_1 | BIT_0));
+- vha->flags.process_response_queue = 0;
+ if (ha->zio_mode != QLA_ZIO_DISABLED) {
+ ha->zio_mode = QLA_ZIO_MODE_6;
+
+@@ -6983,7 +6973,6 @@ qla24xx_nvram_config(scsi_qla_host_t *vha)
+ icb->firmware_options_2 |= cpu_to_le32(
+ (uint32_t)ha->zio_mode);
+ icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer);
+- vha->flags.process_response_queue = 1;
+ }
+
+ if (rval) {
+diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
+index 667055cbe155..3e94f15ce1cf 100644
+--- a/drivers/scsi/qla2xxx/qla_iocb.c
++++ b/drivers/scsi/qla2xxx/qla_iocb.c
+@@ -1526,12 +1526,6 @@ qla24xx_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return QLA_SUCCESS;
+@@ -1725,12 +1719,6 @@ qla24xx_dif_start_scsi(srb_t *sp)
+
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr);
+-
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
+@@ -1880,11 +1868,6 @@ qla2xxx_start_scsi_mq(srb_t *sp)
+ /* Set chip new ring index. */
+ WRT_REG_DWORD(req->req_q_in, req->ring_index);
+
+- /* Manage unprocessed RIO/ZIO commands in response queue. */
+- if (vha->flags.process_response_queue &&
+- rsp->ring_ptr->signature != RESPONSE_PROCESSED)
+- qla24xx_process_response_queue(vha, rsp);
+-
+ spin_unlock_irqrestore(&qpair->qp_lock, flags);
+ return QLA_SUCCESS;
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index f0ec13d48bf3..f301621e39d7 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3716,10 +3716,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id,
+ mcp->mb[0] = MBC_PORT_PARAMS;
+ mcp->mb[1] = loop_id;
+ mcp->mb[2] = BIT_0;
+- if (IS_CNA_CAPABLE(vha->hw))
+- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+- else
+- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0);
++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0);
+ mcp->mb[9] = vha->vp_idx;
+ mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0;
+ mcp->in_mb = MBX_3|MBX_1|MBX_0;
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index c5a963c2c86e..d0dc425f33f5 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -604,7 +604,7 @@ void qla_nvme_abort(struct qla_hw_data *ha, struct srb *sp, int res)
+ {
+ int rval;
+
+- if (!test_bit(ABORT_ISP_ACTIVE, &sp->vha->dpc_flags)) {
++ if (ha->flags.fw_started) {
+ rval = ha->isp_ops->abort_command(sp);
+ if (!rval && !qla_nvme_wait_on_command(sp))
+ ql_log(ql_log_warn, NULL, 0x2112,
+@@ -657,9 +657,6 @@ void qla_nvme_delete(struct scsi_qla_host *vha)
+ __func__, fcport);
+
+ nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, 0);
+- init_completion(&fcport->nvme_del_done);
+- nvme_fc_unregister_remoteport(fcport->nvme_remote_port);
+- wait_for_completion(&fcport->nvme_del_done);
+ }
+
+ if (vha->nvme_local_port) {
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 6dc1b1bd8069..27fbd437f412 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1257,7 +1257,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess)
+ qla24xx_chk_fcp_state(sess);
+
+ ql_dbg(ql_dbg_tgt, sess->vha, 0xe001,
+- "Scheduling sess %p for deletion\n", sess);
++ "Scheduling sess %p for deletion %8phC\n",
++ sess, sess->port_name);
+
+ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn);
+ WARN_ON(!queue_work(sess->vha->hw->wq, &sess->del_work));
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 7732e9336d43..edfcb98aa4ef 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -718,10 +718,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd)
+ cmd->sg_cnt = 0;
+ cmd->offset = 0;
+ cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
+- if (cmd->trc_flags & TRC_XMIT_STATUS) {
+- pr_crit("Multiple calls for status = %p.\n", cmd);
+- dump_stack();
+- }
+ cmd->trc_flags |= TRC_XMIT_STATUS;
+
+ if (se_cmd->data_direction == DMA_FROM_DEVICE) {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 41e9ac9fc138..4fd92b1802cd 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -696,6 +696,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
+ */
+ scsi_mq_uninit_cmd(cmd);
+
++ /*
++ * queue is still alive, so grab the ref for preventing it
++ * from being cleaned up during running queue.
++ */
++ percpu_ref_get(&q->q_usage_counter);
++
+ __blk_mq_end_request(req, error);
+
+ if (scsi_target(sdev)->single_lun ||
+@@ -703,6 +709,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error,
+ kblockd_schedule_work(&sdev->requeue_work);
+ else
+ blk_mq_run_hw_queues(q, true);
++
++ percpu_ref_put(&q->q_usage_counter);
+ } else {
+ unsigned long flags;
+
+diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h
+index 3efc47e82973..bd040c29c4bf 100644
+--- a/drivers/soc/ti/knav_qmss.h
++++ b/drivers/soc/ti/knav_qmss.h
+@@ -329,8 +329,8 @@ struct knav_range_ops {
+ };
+
+ struct knav_irq_info {
+- int irq;
+- u32 cpu_map;
++ int irq;
++ struct cpumask *cpu_mask;
+ };
+
+ struct knav_range_info {
+diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c
+index 316e82e46f6c..2f7fb2dcc1d6 100644
+--- a/drivers/soc/ti/knav_qmss_acc.c
++++ b/drivers/soc/ti/knav_qmss_acc.c
+@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range,
+ {
+ struct knav_device *kdev = range->kdev;
+ struct knav_acc_channel *acc;
+- unsigned long cpu_map;
++ struct cpumask *cpu_mask;
+ int ret = 0, irq;
+ u32 old, new;
+
+ if (range->flags & RANGE_MULTI_QUEUE) {
+ acc = range->acc;
+ irq = range->irqs[0].irq;
+- cpu_map = range->irqs[0].cpu_map;
++ cpu_mask = range->irqs[0].cpu_mask;
+ } else {
+ acc = range->acc + queue;
+ irq = range->irqs[queue].irq;
+- cpu_map = range->irqs[queue].cpu_map;
++ cpu_mask = range->irqs[queue].cpu_mask;
+ }
+
+ old = acc->open_mask;
+@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range,
+ acc->name, acc->name);
+ ret = request_irq(irq, knav_acc_int_handler, 0, acc->name,
+ range);
+- if (!ret && cpu_map) {
+- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map));
++ if (!ret && cpu_mask) {
++ ret = irq_set_affinity_hint(irq, cpu_mask);
+ if (ret) {
+ dev_warn(range->kdev->dev,
+ "Failed to set IRQ affinity\n");
+diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c
+index 6755f2af5619..ef36acc0e708 100644
+--- a/drivers/soc/ti/knav_qmss_queue.c
++++ b/drivers/soc/ti/knav_qmss_queue.c
+@@ -118,19 +118,17 @@ static int knav_queue_setup_irq(struct knav_range_info *range,
+ struct knav_queue_inst *inst)
+ {
+ unsigned queue = inst->id - range->queue_base;
+- unsigned long cpu_map;
+ int ret = 0, irq;
+
+ if (range->flags & RANGE_HAS_IRQ) {
+ irq = range->irqs[queue].irq;
+- cpu_map = range->irqs[queue].cpu_map;
+ ret = request_irq(irq, knav_queue_int_handler, 0,
+ inst->irq_name, inst);
+ if (ret)
+ return ret;
+ disable_irq(irq);
+- if (cpu_map) {
+- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map));
++ if (range->irqs[queue].cpu_mask) {
++ ret = irq_set_affinity_hint(irq, range->irqs[queue].cpu_mask);
+ if (ret) {
+ dev_warn(range->kdev->dev,
+ "Failed to set IRQ affinity\n");
+@@ -1262,9 +1260,19 @@ static int knav_setup_queue_range(struct knav_device *kdev,
+
+ range->num_irqs++;
+
+- if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3)
+- range->irqs[i].cpu_map =
+- (oirq.args[2] & 0x0000ff00) >> 8;
++ if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) {
++ unsigned long mask;
++ int bit;
++
++ range->irqs[i].cpu_mask = devm_kzalloc(dev,
++ cpumask_size(), GFP_KERNEL);
++ if (!range->irqs[i].cpu_mask)
++ return -ENOMEM;
++
++ mask = (oirq.args[2] & 0x0000ff00) >> 8;
++ for_each_set_bit(bit, &mask, BITS_PER_LONG)
++ cpumask_set_cpu(bit, range->irqs[i].cpu_mask);
++ }
+ }
+
+ range->num_irqs = min(range->num_irqs, range->num_queues);
+diff --git a/drivers/staging/iio/adc/ad7606.c b/drivers/staging/iio/adc/ad7606.c
+index 25b9fcd5e3a4..ce3351832fb1 100644
+--- a/drivers/staging/iio/adc/ad7606.c
++++ b/drivers/staging/iio/adc/ad7606.c
+@@ -26,9 +26,12 @@
+
+ #include "ad7606.h"
+
+-/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */
++/*
++ * Scales are computed as 5000/32768 and 10000/32768 respectively,
++ * so that when applied to the raw values they provide mV values
++ */
+ static const unsigned int scale_avail[2][2] = {
+- {0, 38147}, {0, 76294}
++ {0, 152588}, {0, 305176}
+ };
+
+ static int ad7606_reset(struct ad7606_state *st)
+diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
+index cf342eb58e10..ad7e28ab9a4f 100644
+--- a/drivers/staging/most/video/video.c
++++ b/drivers/staging/most/video/video.c
+@@ -530,7 +530,7 @@ static int comp_disconnect_channel(struct most_interface *iface,
+ return 0;
+ }
+
+-static struct core_component comp_info = {
++static struct core_component comp = {
+ .name = "video",
+ .probe_channel = comp_probe_channel,
+ .disconnect_channel = comp_disconnect_channel,
+@@ -565,7 +565,7 @@ static void __exit comp_exit(void)
+ }
+ spin_unlock_irq(&list_lock);
+
+- most_deregister_component(&comp_info);
++ most_deregister_component(&comp);
+ BUG_ON(!list_empty(&video_devices));
+ }
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index 6ab982309e6a..441778100887 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -1102,8 +1102,9 @@ void thermal_cooling_device_unregister(struct thermal_cooling_device *cdev)
+ mutex_unlock(&thermal_list_lock);
+
+ ida_simple_remove(&thermal_cdev_ida, cdev->id);
+- device_unregister(&cdev->device);
++ device_del(&cdev->device);
+ thermal_cooling_device_destroy_sysfs(cdev);
++ put_device(&cdev->device);
+ }
+ EXPORT_SYMBOL_GPL(thermal_cooling_device_unregister);
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 243c96025053..47b41159a8bc 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -657,7 +657,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port)
+ uart_write_wakeup(port);
+ }
+
+-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
++static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+ {
+ struct uart_port *port = &s->p[portno].port;
+
+@@ -666,7 +666,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+
+ iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG);
+ if (iir & SC16IS7XX_IIR_NO_INT_BIT)
+- break;
++ return false;
+
+ iir &= SC16IS7XX_IIR_ID_MASK;
+
+@@ -688,16 +688,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno)
+ port->line, iir);
+ break;
+ }
+- } while (1);
++ } while (0);
++ return true;
+ }
+
+ static void sc16is7xx_ist(struct kthread_work *ws)
+ {
+ struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work);
+- int i;
+
+- for (i = 0; i < s->devtype->nr_uart; ++i)
+- sc16is7xx_port_irq(s, i);
++ while (1) {
++ bool keep_polling = false;
++ int i;
++
++ for (i = 0; i < s->devtype->nr_uart; ++i)
++ keep_polling |= sc16is7xx_port_irq(s, i);
++ if (!keep_polling)
++ break;
++ }
+ }
+
+ static irqreturn_t sc16is7xx_irq(int irq, void *dev_id)
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 3c55600a8236..671dc6a25e6c 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -3045,6 +3045,7 @@ static struct uart_driver sci_uart_driver = {
+ static int sci_remove(struct platform_device *dev)
+ {
+ struct sci_port *port = platform_get_drvdata(dev);
++ unsigned int type = port->port.type; /* uart_remove_... clears it */
+
+ sci_ports_in_use &= ~BIT(port->port.line);
+ uart_remove_one_port(&sci_uart_driver, &port->port);
+@@ -3055,8 +3056,7 @@ static int sci_remove(struct platform_device *dev)
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_trigger.attr);
+ }
+- if (port->port.type == PORT_SCIFA || port->port.type == PORT_SCIFB ||
+- port->port.type == PORT_HSCIF) {
++ if (type == PORT_SCIFA || type == PORT_SCIFB || type == PORT_HSCIF) {
+ sysfs_remove_file(&dev->dev.kobj,
+ &dev_attr_rx_fifo_timeout.attr);
+ }
+diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c
+index 3e827a3d48d5..b7dc2196f9d7 100644
+--- a/drivers/tty/tty_baudrate.c
++++ b/drivers/tty/tty_baudrate.c
+@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios)
+ else
+ cbaud += 15;
+ }
+- return baud_table[cbaud];
++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
+ }
+ EXPORT_SYMBOL(tty_termios_baud_rate);
+
+@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios)
+ else
+ cbaud += 15;
+ }
+- return baud_table[cbaud];
++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
+ #else
+ return tty_termios_baud_rate(termios);
+ #endif
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 31d06f59c4e4..da45120d9453 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -408,7 +408,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
+ mutex_lock(&tty_mutex);
+ /* Search through the tty devices to look for a match */
+ list_for_each_entry(p, &tty_drivers, tty_drivers) {
+- if (strncmp(name, p->name, len) != 0)
++ if (!len || strncmp(name, p->name, len) != 0)
+ continue;
+ stp = str;
+ if (*stp == ',')
+diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
+index 17fcd3b2e686..fe7914dffd8f 100644
+--- a/drivers/vhost/scsi.c
++++ b/drivers/vhost/scsi.c
+@@ -964,7 +964,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin);
+ }
+ /*
+- * Set prot_iter to data_iter, and advance past any
++ * Set prot_iter to data_iter and truncate it to
++ * prot_bytes, and advance data_iter past any
+ * preceeding prot_bytes that may be present.
+ *
+ * Also fix up the exp_data_len to reflect only the
+@@ -973,6 +974,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
+ if (prot_bytes) {
+ exp_data_len -= prot_bytes;
+ prot_iter = data_iter;
++ iov_iter_truncate(&prot_iter, prot_bytes);
+ iov_iter_advance(&data_iter, prot_bytes);
+ }
+ tag = vhost64_to_cpu(vq, v_req_pi.tag);
+diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c
+index 2541a0e0de76..3ad46255f990 100644
+--- a/drivers/video/fbdev/aty/mach64_accel.c
++++ b/drivers/video/fbdev/aty/mach64_accel.c
+@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info)
+
+ /* set host attributes */
+ wait_for_fifo(13, par);
+- aty_st_le32(HOST_CNTL, 0, par);
++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par);
+
+ /* set pattern attributes */
+ aty_st_le32(PAT_REG0, 0, par);
+@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area)
+ rotation = rotation24bpp(dx, direction);
+ }
+
+- wait_for_fifo(4, par);
++ wait_for_fifo(5, par);
++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par);
+ aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par);
+ aty_st_le32(SRC_Y_X, (sx << 16) | sy, par);
+ aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par);
+@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
+ rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT);
+ }
+
+- wait_for_fifo(3, par);
++ wait_for_fifo(4, par);
++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par);
+ aty_st_le32(DP_FRGD_CLR, color, par);
+ aty_st_le32(DP_SRC,
+ BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE,
+@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ {
+ struct atyfb_par *par = (struct atyfb_par *) info->par;
+ u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width;
+- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix;
++ u32 pix_width, rotation = 0, src, mix;
+
+ if (par->asleep)
+ return;
+@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ return;
+ }
+
+- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par);
+- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN;
++ pix_width = par->crtc.dp_pix_width;
+
+ switch (image->depth) {
+ case 1:
+@@ -345,7 +346,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit
+ * this hwaccelerated triple has an issue with not aligned data
+ */
+- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0)
++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0)
+ pix_width |= DP_HOST_TRIPLE_EN;
+ }
+
+@@ -370,19 +371,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D;
+ }
+
+- wait_for_fifo(6, par);
+- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par);
++ wait_for_fifo(5, par);
+ aty_st_le32(DP_PIX_WIDTH, pix_width, par);
+ aty_st_le32(DP_MIX, mix, par);
+ aty_st_le32(DP_SRC, src, par);
+- aty_st_le32(HOST_CNTL, host_cntl, par);
++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par);
+ aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par);
+
+ draw_rect(dx, dy, width, image->height, par);
+ src_bytes = (((image->width * image->depth) + 7) / 8) * image->height;
+
+ /* manual triple each pixel */
+- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) {
++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) {
+ int inbit, outbit, mult24, byte_id_in_dword, width;
+ u8 *pbitmapin = (u8*)image->data, *pbitmapout;
+ u32 hostdword;
+@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ }
+ }
+ wait_for_fifo(1, par);
+- aty_st_le32(HOST_DATA0, hostdword, par);
++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par);
+ }
+ } else {
+ u32 *pbitmap, dwords = (src_bytes + 3) / 4;
+@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image)
+ aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par);
+ }
+ }
+-
+- /* restore pix_width */
+- wait_for_fifo(1, par);
+- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par);
+ }
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index 03c9e325bfbc..3a2f37ad1f89 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
+ break;
+ if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
+ break;
++ /*
++ * p9_client_lock_dotl overwrites flock.client_id with the
++ * server message, free and reuse the client name
++ */
++ if (flock.client_id != fid->clnt->name) {
++ kfree(flock.client_id);
++ flock.client_id = fid->clnt->name;
++ }
+ }
+
+ /* map 9p status to VFS status */
+@@ -235,6 +243,8 @@ out_unlock:
+ locks_lock_file_wait(filp, fl);
+ fl->fl_type = fl_type;
+ }
++ if (flock.client_id != fid->clnt->name)
++ kfree(flock.client_id);
+ out:
+ return res;
+ }
+@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+
+ res = p9_client_getlock_dotl(fid, &glock);
+ if (res < 0)
+- return res;
++ goto out;
+ /* map 9p lock type to os lock type */
+ switch (glock.type) {
+ case P9_LOCK_TYPE_RDLCK:
+@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
+ fl->fl_end = glock.start + glock.length - 1;
+ fl->fl_pid = -glock.proc_id;
+ }
+- kfree(glock.client_id);
++out:
++ if (glock.client_id != fid->clnt->name)
++ kfree(glock.client_id);
+ return res;
+ }
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 891b1aab3480..2012eaf80da5 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4404,13 +4404,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ /*
++ * The btrfs_finish_extent_commit() may get the same range as
++ * ours between find_first_extent_bit and clear_extent_dirty.
++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin
++ * the same extent range.
++ */
++ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+ EXTENT_DIRTY, NULL);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
++ }
+
+ clear_extent_dirty(unpin, start, end);
+ btrfs_error_unpin_extent_range(fs_info, start, end);
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+ }
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index dc0f9d089b19..3e6c1baddda3 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1537,12 +1537,11 @@ out_check:
+ }
+ btrfs_release_path(path);
+
+- if (cur_offset <= end && cow_start == (u64)-1) {
++ if (cur_offset <= end && cow_start == (u64)-1)
+ cow_start = cur_offset;
+- cur_offset = end;
+- }
+
+ if (cow_start != (u64)-1) {
++ cur_offset = end;
+ ret = cow_file_range(inode, locked_page, cow_start, end, end,
+ page_started, nr_written, 1, NULL);
+ if (ret)
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index c972920701a3..ec021bd947ba 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3499,6 +3499,8 @@ static int btrfs_extent_same_range(struct inode *src, u64 loff, u64 olen,
+ const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize;
+
+ len = round_down(i_size_read(src), sz) - loff;
++ if (len == 0)
++ return 0;
+ olen = len;
+ }
+ }
+@@ -4291,9 +4293,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src,
+ goto out_unlock;
+ if (len == 0)
+ olen = len = src->i_size - off;
+- /* if we extend to eof, continue to block boundary */
+- if (off + len == src->i_size)
++ /*
++ * If we extend to eof, continue to block boundary if and only if the
++ * destination end offset matches the destination file's size, otherwise
++ * we would be corrupting data by placing the eof block into the middle
++ * of a file.
++ */
++ if (off + len == src->i_size) {
++ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size)
++ goto out_unlock;
+ len = ALIGN(src->i_size, bs) - off;
++ }
+
+ if (len == 0) {
+ ret = 0;
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index a866be999216..4b1eda26480b 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1135,8 +1135,12 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in)
+ if (IS_ERR(realdn)) {
+ pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
+ PTR_ERR(realdn), dn, in, ceph_vinop(in));
+- dput(dn);
+- dn = realdn; /* note realdn contains the error */
++ dn = realdn;
++ /*
++ * Caller should release 'dn' in the case of error.
++ * If 'req->r_dentry' is passed to this function,
++ * caller should leave 'req->r_dentry' untouched.
++ */
+ goto out;
+ } else if (realdn) {
+ dout("dn %p (%d) spliced with %p (%d) "
+diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c
+index 78ffc2699993..a5c54af861f7 100644
+--- a/fs/configfs/symlink.c
++++ b/fs/configfs/symlink.c
+@@ -64,7 +64,7 @@ static void fill_item_path(struct config_item * item, char * buffer, int length)
+
+ /* back up enough to print this bus id with '/' */
+ length -= cur;
+- strncpy(buffer + length,config_item_name(p),cur);
++ memcpy(buffer + length, config_item_name(p), cur);
+ *(buffer + --length) = '/';
+ }
+ }
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 2276137d0083..fc05c7f7bbcf 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5763,9 +5763,10 @@ int ext4_mark_iloc_dirty(handle_t *handle,
+ {
+ int err = 0;
+
+- if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb))))
++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) {
++ put_bh(iloc->bh);
+ return -EIO;
+-
++ }
+ if (IS_I_VERSION(inode))
+ inode_inc_iversion(inode);
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 377d516c475f..ffa25753e929 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -126,6 +126,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode,
+ if (!is_dx_block && type == INDEX) {
+ ext4_error_inode(inode, func, line, block,
+ "directory leaf block found instead of index block");
++ brelse(bh);
+ return ERR_PTR(-EFSCORRUPTED);
+ }
+ if (!ext4_has_metadata_csum(inode->i_sb) ||
+@@ -2811,7 +2812,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ list_del_init(&EXT4_I(inode)->i_orphan);
+ mutex_unlock(&sbi->s_orphan_lock);
+ }
+- }
++ } else
++ brelse(iloc.bh);
++
+ jbd_debug(4, "superblock will point to %lu\n", inode->i_ino);
+ jbd_debug(4, "orphan inode %lu will point to %d\n",
+ inode->i_ino, NEXT_ORPHAN(inode));
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index ebbc663d0798..a5efee34415f 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -459,16 +459,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle,
+
+ BUFFER_TRACE(bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, bh);
+- if (err)
++ if (err) {
++ brelse(bh);
+ return err;
++ }
+ ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n",
+ first_cluster, first_cluster - start, count2);
+ ext4_set_bits(bh->b_data, first_cluster - start, count2);
+
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (unlikely(err))
+ return err;
+- brelse(bh);
+ }
+
+ return 0;
+@@ -605,7 +607,6 @@ handle_bb:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
+- bh = NULL;
+ goto out;
+ }
+ overhead = ext4_group_overhead_blocks(sb, group);
+@@ -618,9 +619,9 @@ handle_bb:
+ ext4_mark_bitmap_end(EXT4_B2C(sbi, group_data[i].blocks_count),
+ sb->s_blocksize * 8, bh->b_data);
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (err)
+ goto out;
+- brelse(bh);
+
+ handle_ib:
+ if (bg_flags[i] & EXT4_BG_INODE_UNINIT)
+@@ -635,18 +636,16 @@ handle_ib:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
+- bh = NULL;
+ goto out;
+ }
+
+ ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb),
+ sb->s_blocksize * 8, bh->b_data);
+ err = ext4_handle_dirty_metadata(handle, NULL, bh);
++ brelse(bh);
+ if (err)
+ goto out;
+- brelse(bh);
+ }
+- bh = NULL;
+
+ /* Mark group tables in block bitmap */
+ for (j = 0; j < GROUP_TABLE_COUNT; j++) {
+@@ -685,7 +684,6 @@ handle_ib:
+ }
+
+ out:
+- brelse(bh);
+ err2 = ext4_journal_stop(handle);
+ if (err2 && !err)
+ err = err2;
+@@ -873,6 +871,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode,
+ err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh);
+ if (unlikely(err)) {
+ ext4_std_error(sb, err);
++ iloc.bh = NULL;
+ goto exit_inode;
+ }
+ brelse(dind);
+@@ -924,6 +923,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ sizeof(struct buffer_head *),
+ GFP_NOFS);
+ if (!n_group_desc) {
++ brelse(gdb_bh);
+ err = -ENOMEM;
+ ext4_warning(sb, "not enough memory for %lu groups",
+ gdb_num + 1);
+@@ -939,8 +939,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb,
+ kvfree(o_group_desc);
+ BUFFER_TRACE(gdb_bh, "get_write_access");
+ err = ext4_journal_get_write_access(handle, gdb_bh);
+- if (unlikely(err))
+- brelse(gdb_bh);
+ return err;
+ }
+
+@@ -1124,8 +1122,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data,
+ backup_block, backup_block -
+ ext4_group_first_block_no(sb, group));
+ BUFFER_TRACE(bh, "get_write_access");
+- if ((err = ext4_journal_get_write_access(handle, bh)))
++ if ((err = ext4_journal_get_write_access(handle, bh))) {
++ brelse(bh);
+ break;
++ }
+ lock_buffer(bh);
+ memcpy(bh->b_data, data, size);
+ if (rest)
+@@ -2023,7 +2023,7 @@ retry:
+
+ err = ext4_alloc_flex_bg_array(sb, n_group + 1);
+ if (err)
+- return err;
++ goto out;
+
+ err = ext4_mb_alloc_groupinfo(sb, n_group + 1);
+ if (err)
+@@ -2059,6 +2059,10 @@ retry:
+ n_blocks_count_retry = 0;
+ free_flex_gd(flex_gd);
+ flex_gd = NULL;
++ if (resize_inode) {
++ iput(resize_inode);
++ resize_inode = NULL;
++ }
+ goto retry;
+ }
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 8d91d50ccf42..8b8c351fa9c5 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4053,6 +4053,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ sbi->s_groups_count = blocks_count;
+ sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
+ (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
++ le32_to_cpu(es->s_inodes_count)) {
++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
++ le32_to_cpu(es->s_inodes_count),
++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
++ ret = -EINVAL;
++ goto failed_mount;
++ }
+ db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
+ EXT4_DESC_PER_BLOCK(sb);
+ if (ext4_has_feature_meta_bg(sb)) {
+@@ -4072,14 +4080,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ ret = -ENOMEM;
+ goto failed_mount;
+ }
+- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) !=
+- le32_to_cpu(es->s_inodes_count)) {
+- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu",
+- le32_to_cpu(es->s_inodes_count),
+- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group));
+- ret = -EINVAL;
+- goto failed_mount;
+- }
+
+ bgl_lock_init(sbi->s_blockgroup_lock);
+
+@@ -4488,6 +4488,7 @@ failed_mount6:
+ percpu_counter_destroy(&sbi->s_freeinodes_counter);
+ percpu_counter_destroy(&sbi->s_dirs_counter);
+ percpu_counter_destroy(&sbi->s_dirtyclusters_counter);
++ percpu_free_rwsem(&sbi->s_journal_flag_rwsem);
+ failed_mount5:
+ ext4_ext_release(sb);
+ ext4_release_system_zone(sb);
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index f36fc5d5b257..4380c8630539 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1388,6 +1388,12 @@ retry:
+ bh = ext4_getblk(handle, ea_inode, block, 0);
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
++ if (!bh) {
++ WARN_ON_ONCE(1);
++ EXT4_ERROR_INODE(ea_inode,
++ "ext4_getblk() return bh = NULL");
++ return -EFSCORRUPTED;
++ }
+ ret = ext4_journal_get_write_access(handle, bh);
+ if (ret)
+ goto out;
+@@ -2276,8 +2282,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode)
+ if (!bh)
+ return ERR_PTR(-EIO);
+ error = ext4_xattr_check_block(inode, bh);
+- if (error)
++ if (error) {
++ brelse(bh);
+ return ERR_PTR(error);
++ }
+ return bh;
+ }
+
+@@ -2397,6 +2405,8 @@ retry_inode:
+ error = ext4_xattr_block_set(handle, inode, &i, &bs);
+ } else if (error == -ENOSPC) {
+ if (EXT4_I(inode)->i_file_acl && !bs.s.base) {
++ brelse(bs.bh);
++ bs.bh = NULL;
+ error = ext4_xattr_block_find(inode, &i, &bs);
+ if (error)
+ goto cleanup;
+@@ -2617,6 +2627,8 @@ out:
+ kfree(buffer);
+ if (is)
+ brelse(is->iloc.bh);
++ if (bs)
++ brelse(bs->bh);
+ kfree(is);
+ kfree(bs);
+
+@@ -2696,7 +2708,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
+ struct ext4_inode *raw_inode, handle_t *handle)
+ {
+ struct ext4_xattr_ibody_header *header;
+- struct buffer_head *bh;
+ struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ static unsigned int mnt_count;
+ size_t min_offs;
+@@ -2737,13 +2748,17 @@ retry:
+ * EA block can hold new_extra_isize bytes.
+ */
+ if (EXT4_I(inode)->i_file_acl) {
++ struct buffer_head *bh;
++
+ bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+ error = -EIO;
+ if (!bh)
+ goto cleanup;
+ error = ext4_xattr_check_block(inode, bh);
+- if (error)
++ if (error) {
++ brelse(bh);
+ goto cleanup;
++ }
+ base = BHDR(bh);
+ end = bh->b_data + bh->b_size;
+ min_offs = end - base;
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 4a9ace7280b9..97f15787cfeb 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -391,12 +391,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req)
+ if (test_bit(FR_BACKGROUND, &req->flags)) {
+ spin_lock(&fc->lock);
+ clear_bit(FR_BACKGROUND, &req->flags);
+- if (fc->num_background == fc->max_background)
++ if (fc->num_background == fc->max_background) {
+ fc->blocked = 0;
+-
+- /* Wake up next waiter, if any */
+- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq))
+ wake_up(&fc->blocked_waitq);
++ } else if (!fc->blocked) {
++ /*
++ * Wake up next waiter, if any. It's okay to use
++ * waitqueue_active(), as we've already synced up
++ * fc->blocked with waiters with the wake_up() call
++ * above.
++ */
++ if (waitqueue_active(&fc->blocked_waitq))
++ wake_up(&fc->blocked_waitq);
++ }
+
+ if (fc->num_background == fc->congestion_threshold && fc->sb) {
+ clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC);
+@@ -1311,12 +1318,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file,
+ goto out_end;
+ }
+ list_move_tail(&req->list, &fpq->processing);
+- spin_unlock(&fpq->lock);
++ __fuse_get_request(req);
+ set_bit(FR_SENT, &req->flags);
++ spin_unlock(&fpq->lock);
+ /* matches barrier in request_wait_answer() */
+ smp_mb__after_atomic();
+ if (test_bit(FR_INTERRUPTED, &req->flags))
+ queue_interrupt(fiq, req);
++ fuse_put_request(fc, req);
+
+ return reqsize;
+
+@@ -1715,8 +1724,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
+ req->in.args[1].size = total_len;
+
+ err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique);
+- if (err)
++ if (err) {
+ fuse_retrieve_end(fc, req);
++ fuse_put_request(fc, req);
++ }
+
+ return err;
+ }
+@@ -1875,16 +1886,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud,
+
+ /* Is it an interrupt reply? */
+ if (req->intr_unique == oh.unique) {
++ __fuse_get_request(req);
+ spin_unlock(&fpq->lock);
+
+ err = -EINVAL;
+- if (nbytes != sizeof(struct fuse_out_header))
++ if (nbytes != sizeof(struct fuse_out_header)) {
++ fuse_put_request(fc, req);
+ goto err_finish;
++ }
+
+ if (oh.error == -ENOSYS)
+ fc->no_interrupt = 1;
+ else if (oh.error == -EAGAIN)
+ queue_interrupt(&fc->iq, req);
++ fuse_put_request(fc, req);
+
+ fuse_copy_finish(cs);
+ return nbytes;
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index aa23749a943b..2162771ce7d5 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -2912,10 +2912,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter)
+ }
+
+ if (io->async) {
++ bool blocking = io->blocking;
++
+ fuse_aio_complete(io, ret < 0 ? ret : 0, -1);
+
+ /* we have a non-extending, async request, so return */
+- if (!io->blocking)
++ if (!blocking)
+ return -EIOCBQUEUED;
+
+ wait_for_completion(&wait);
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index fd5bea55fd60..9c418249734d 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1652,10 +1652,16 @@ static int punch_hole(struct gfs2_inode *ip, u64 offset, u64 length)
+ if (ret < 0)
+ goto out;
+
+- /* issue read-ahead on metadata */
+- if (mp.mp_aheight > 1) {
+- for (; ret > 1; ret--) {
+- metapointer_range(&mp, mp.mp_aheight - ret,
++ /* On the first pass, issue read-ahead on metadata. */
++ if (mp.mp_aheight > 1 && strip_h == ip->i_height - 1) {
++ unsigned int height = mp.mp_aheight - 1;
++
++ /* No read-ahead for data blocks. */
++ if (mp.mp_aheight - 1 == strip_h)
++ height--;
++
++ for (; height >= mp.mp_aheight - ret; height--) {
++ metapointer_range(&mp, height,
+ start_list, start_aligned,
+ end_list, end_aligned,
+ &start, &end);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index b86249ebde11..1d62526738c4 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -714,6 +714,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp)
+
+ if (gl) {
+ glock_clear_object(gl, rgd);
++ gfs2_rgrp_brelse(rgd);
+ gfs2_glock_put(gl);
+ }
+
+@@ -1136,7 +1137,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd)
+ * @rgd: the struct gfs2_rgrpd describing the RG to read in
+ *
+ * Read in all of a Resource Group's header and bitmap blocks.
+- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps.
++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps.
+ *
+ * Returns: errno
+ */
+diff --git a/fs/namespace.c b/fs/namespace.c
+index bd2f4c68506a..e65254003cad 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -780,9 +780,6 @@ static struct mountpoint *lookup_mountpoint(struct dentry *dentry)
+
+ hlist_for_each_entry(mp, chain, m_hash) {
+ if (mp->m_dentry == dentry) {
+- /* might be worth a WARN_ON() */
+- if (d_unlinked(dentry))
+- return ERR_PTR(-ENOENT);
+ mp->m_count++;
+ return mp;
+ }
+@@ -796,6 +793,9 @@ static struct mountpoint *get_mountpoint(struct dentry *dentry)
+ int ret;
+
+ if (d_mountpoint(dentry)) {
++ /* might be worth a WARN_ON() */
++ if (d_unlinked(dentry))
++ return ERR_PTR(-ENOENT);
+ mountpoint:
+ read_seqlock_excl(&mount_lock);
+ mp = lookup_mountpoint(dentry);
+@@ -1625,8 +1625,13 @@ static int do_umount(struct mount *mnt, int flags)
+
+ namespace_lock();
+ lock_mount_hash();
+- event++;
+
++ /* Recheck MNT_LOCKED with the locks held */
++ retval = -EINVAL;
++ if (mnt->mnt.mnt_flags & MNT_LOCKED)
++ goto out;
++
++ event++;
+ if (flags & MNT_DETACH) {
+ if (!list_empty(&mnt->mnt_list))
+ umount_tree(mnt, UMOUNT_PROPAGATE);
+@@ -1640,6 +1645,7 @@ static int do_umount(struct mount *mnt, int flags)
+ retval = 0;
+ }
+ }
++out:
+ unlock_mount_hash();
+ namespace_unlock();
+ return retval;
+@@ -1730,7 +1736,7 @@ int ksys_umount(char __user *name, int flags)
+ goto dput_and_out;
+ if (!check_mnt(mnt))
+ goto dput_and_out;
+- if (mnt->mnt.mnt_flags & MNT_LOCKED)
++ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */
+ goto dput_and_out;
+ retval = -EPERM;
+ if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN))
+@@ -1813,8 +1819,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry,
+ for (s = r; s; s = next_mnt(s, r)) {
+ if (!(flag & CL_COPY_UNBINDABLE) &&
+ IS_MNT_UNBINDABLE(s)) {
+- s = skip_mnt_tree(s);
+- continue;
++ if (s->mnt.mnt_flags & MNT_LOCKED) {
++ /* Both unbindable and locked. */
++ q = ERR_PTR(-EPERM);
++ goto out;
++ } else {
++ s = skip_mnt_tree(s);
++ continue;
++ }
+ }
+ if (!(flag & CL_COPY_MNT_NS_FILE) &&
+ is_mnt_ns_file(s->mnt.mnt_root)) {
+@@ -1867,7 +1879,7 @@ void drop_collected_mounts(struct vfsmount *mnt)
+ {
+ namespace_lock();
+ lock_mount_hash();
+- umount_tree(real_mount(mnt), UMOUNT_SYNC);
++ umount_tree(real_mount(mnt), 0);
+ unlock_mount_hash();
+ namespace_unlock();
+ }
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 3c18c12a5c4c..b8615a4f5316 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -2553,11 +2553,12 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ nfs4_clear_state_manager_bit(clp);
+ /* Did we race with an attempt to give us more work? */
+ if (clp->cl_state == 0)
+- break;
++ return;
+ if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
+- break;
++ return;
+ } while (refcount_read(&clp->cl_count) > 1);
+- return;
++ goto out_drain;
++
+ out_error:
+ if (strlen(section))
+ section_sep = ": ";
+@@ -2565,6 +2566,7 @@ out_error:
+ " with error %d\n", section_sep, section,
+ clp->cl_hostname, -status);
+ ssleep(1);
++out_drain:
+ nfs4_end_drain_session(clp);
+ nfs4_clear_state_manager_bit(clp);
+ }
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 0dded931f119..7c78d10a58a0 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1048,6 +1048,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ {
+ __be32 status;
+
++ if (!cstate->save_fh.fh_dentry)
++ return nfserr_nofilehandle;
++
+ status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh,
+ src_stateid, RD_STATE, src, NULL);
+ if (status) {
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 302cd7caa4a7..7578bd507c70 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -2412,8 +2412,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb,
+ /* this io's submitter should not have unlocked this before we could */
+ BUG_ON(!ocfs2_iocb_is_rw_locked(iocb));
+
+- if (bytes > 0 && private)
+- ret = ocfs2_dio_end_io_write(inode, private, offset, bytes);
++ if (bytes <= 0)
++ mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld",
++ (long long)bytes);
++ if (private) {
++ if (bytes > 0)
++ ret = ocfs2_dio_end_io_write(inode, private, offset,
++ bytes);
++ else
++ ocfs2_dio_free_write_ctx(inode, private);
++ }
+
+ ocfs2_iocb_clear_rw_locked(iocb);
+
+diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h
+index 308ea0eb35fd..a396096a5099 100644
+--- a/fs/ocfs2/cluster/masklog.h
++++ b/fs/ocfs2/cluster/masklog.h
+@@ -178,6 +178,15 @@ do { \
+ ##__VA_ARGS__); \
+ } while (0)
+
++#define mlog_ratelimited(mask, fmt, ...) \
++do { \
++ static DEFINE_RATELIMIT_STATE(_rs, \
++ DEFAULT_RATELIMIT_INTERVAL, \
++ DEFAULT_RATELIMIT_BURST); \
++ if (__ratelimit(&_rs)) \
++ mlog(mask, fmt, ##__VA_ARGS__); \
++} while (0)
++
+ #define mlog_errno(st) ({ \
+ int _st = (st); \
+ if (_st != -ERESTARTSYS && _st != -EINTR && \
+diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
+index b048d4fa3959..c121abbdfc7d 100644
+--- a/fs/ocfs2/dir.c
++++ b/fs/ocfs2/dir.c
+@@ -1897,8 +1897,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode,
+ /* On error, skip the f_pos to the
+ next block. */
+ ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1;
+- brelse(bh);
+- continue;
++ break;
+ }
+ if (le64_to_cpu(de->inode)) {
+ unsigned char d_type = DT_UNKNOWN;
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index da9b3ccfde23..f1dffd70a1c0 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -461,6 +461,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
+ if (IS_ERR(upper))
+ goto out_unlock;
+
++ err = -ESTALE;
++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper)))
++ goto out_dput;
++
+ newdentry = ovl_create_temp(workdir, cattr);
+ err = PTR_ERR(newdentry);
+ if (IS_ERR(newdentry))
+@@ -661,6 +665,11 @@ static int ovl_link(struct dentry *old, struct inode *newdir,
+ if (err)
+ goto out_drop_write;
+
++ err = ovl_copy_up(new->d_parent);
++ if (err)
++ goto out_drop_write;
++
++
+ err = ovl_nlink_start(old, &locked);
+ if (err)
+ goto out_drop_write;
+diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c
+index c2229f02389b..1531f81037b9 100644
+--- a/fs/overlayfs/namei.c
++++ b/fs/overlayfs/namei.c
+@@ -441,8 +441,10 @@ int ovl_verify_set_fh(struct dentry *dentry, const char *name,
+
+ fh = ovl_encode_real_fh(real, is_upper);
+ err = PTR_ERR(fh);
+- if (IS_ERR(fh))
++ if (IS_ERR(fh)) {
++ fh = NULL;
+ goto fail;
++ }
+
+ err = ovl_verify_fh(dentry, name, fh);
+ if (set && err == -ENODATA)
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 74b13347cd94..e557d1317d0e 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -613,14 +613,11 @@ static int udf_remount_fs(struct super_block *sb, int *flags, char *options)
+ struct udf_options uopt;
+ struct udf_sb_info *sbi = UDF_SB(sb);
+ int error = 0;
+- struct logicalVolIntegrityDescImpUse *lvidiu = udf_sb_lvidiu(sb);
++
++ if (!(*flags & SB_RDONLY) && UDF_QUERY_FLAG(sb, UDF_FLAG_RW_INCOMPAT))
++ return -EACCES;
+
+ sync_filesystem(sb);
+- if (lvidiu) {
+- int write_rev = le16_to_cpu(lvidiu->minUDFWriteRev);
+- if (write_rev > UDF_MAX_WRITE_VERSION && !(*flags & SB_RDONLY))
+- return -EACCES;
+- }
+
+ uopt.flags = sbi->s_flags;
+ uopt.uid = sbi->s_uid;
+@@ -1317,6 +1314,7 @@ static int udf_load_partdesc(struct super_block *sb, sector_t block)
+ ret = -EACCES;
+ goto out_bh;
+ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ ret = udf_load_vat(sb, i, type1_idx);
+ if (ret < 0)
+ goto out_bh;
+@@ -2215,10 +2213,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ UDF_MAX_READ_VERSION);
+ ret = -EINVAL;
+ goto error_out;
+- } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION &&
+- !sb_rdonly(sb)) {
+- ret = -EACCES;
+- goto error_out;
++ } else if (minUDFWriteRev > UDF_MAX_WRITE_VERSION) {
++ if (!sb_rdonly(sb)) {
++ ret = -EACCES;
++ goto error_out;
++ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ }
+
+ sbi->s_udfrev = minUDFWriteRev;
+@@ -2236,10 +2236,12 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
+ }
+
+ if (sbi->s_partmaps[sbi->s_partition].s_partition_flags &
+- UDF_PART_FLAG_READ_ONLY &&
+- !sb_rdonly(sb)) {
+- ret = -EACCES;
+- goto error_out;
++ UDF_PART_FLAG_READ_ONLY) {
++ if (!sb_rdonly(sb)) {
++ ret = -EACCES;
++ goto error_out;
++ }
++ UDF_SET_FLAG(sb, UDF_FLAG_RW_INCOMPAT);
+ }
+
+ if (udf_find_fileset(sb, &fileset, &rootdir)) {
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 9dd3e1b9619e..f8e0d200271d 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -30,6 +30,8 @@
+ #define UDF_FLAG_LASTBLOCK_SET 16
+ #define UDF_FLAG_BLOCKSIZE_SET 17
+ #define UDF_FLAG_INCONSISTENT 18
++#define UDF_FLAG_RW_INCOMPAT 19 /* Set when we find RW incompatible
++ * feature */
+
+ #define UDF_PART_FLAG_UNALLOC_BITMAP 0x0001
+ #define UDF_PART_FLAG_UNALLOC_TABLE 0x0002
+diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h
+index 49c93b9308d7..68bb09c29ce8 100644
+--- a/include/linux/ceph/libceph.h
++++ b/include/linux/ceph/libceph.h
+@@ -81,7 +81,13 @@ struct ceph_options {
+
+ #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024)
+ #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024)
+-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024)
++
++/*
++ * Handle the largest possible rbd object in one message.
++ * There is no limit on the size of cephfs objects, but it has to obey
++ * rsize and wsize mount options anyway.
++ */
++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024)
+
+ #define CEPH_AUTH_NAME_DEFAULT "guest"
+
+diff --git a/include/linux/i8253.h b/include/linux/i8253.h
+index e6bb36a97519..8336b2f6f834 100644
+--- a/include/linux/i8253.h
++++ b/include/linux/i8253.h
+@@ -21,6 +21,7 @@
+ #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ)
+
+ extern raw_spinlock_t i8253_lock;
++extern bool i8253_clear_counter_on_shutdown;
+ extern struct clock_event_device i8253_clockevent;
+ extern void clockevent_i8253_init(bool oneshot);
+
+diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
+index abe975c87b90..78b86dea2f29 100644
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -324,9 +324,8 @@ static inline unsigned int nanddev_ntargets(const struct nand_device *nand)
+ */
+ static inline unsigned int nanddev_neraseblocks(const struct nand_device *nand)
+ {
+- return (u64)nand->memorg.luns_per_target *
+- nand->memorg.eraseblocks_per_lun *
+- nand->memorg.pages_per_eraseblock;
++ return nand->memorg.ntargets * nand->memorg.luns_per_target *
++ nand->memorg.eraseblocks_per_lun;
+ }
+
+ /**
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index b8d868d23e79..50d143995338 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -113,6 +113,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; }
+ void watchdog_nmi_stop(void);
+ void watchdog_nmi_start(void);
+ int watchdog_nmi_probe(void);
++int watchdog_nmi_enable(unsigned int cpu);
++void watchdog_nmi_disable(unsigned int cpu);
+
+ /**
+ * touch_nmi_watchdog - restart NMI watchdog timeout.
+diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
+index fd18c974a619..f6e798d42069 100644
+--- a/include/xen/xen-ops.h
++++ b/include/xen/xen-ops.h
+@@ -41,7 +41,7 @@ int xen_setup_shutdown_event(void);
+
+ extern unsigned long *xen_contiguous_bitmap;
+
+-#ifdef CONFIG_XEN_PV
++#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
+ unsigned int address_bits,
+ dma_addr_t *dma_handle);
+diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c
+index 6ad4a9fcbd6f..7921ae4fca8d 100644
+--- a/kernel/debug/kdb/kdb_bt.c
++++ b/kernel/debug/kdb/kdb_bt.c
+@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv)
+ kdb_printf("no process for cpu %ld\n", cpu);
+ return 0;
+ }
+- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
+ kdb_parse(buf);
+ return 0;
+ }
+ kdb_printf("btc: cpu status: ");
+ kdb_parse("cpu\n");
+ for_each_online_cpu(cpu) {
+- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu));
++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu));
+ kdb_parse(buf);
+ touch_nmi_watchdog();
+ }
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 2ddfce8f1e8f..f338d23b112b 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -1192,7 +1192,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
+ if (reason == KDB_REASON_DEBUG) {
+ /* special case below */
+ } else {
+- kdb_printf("\nEntering kdb (current=0x%p, pid %d) ",
++ kdb_printf("\nEntering kdb (current=0x%px, pid %d) ",
+ kdb_current, kdb_current ? kdb_current->pid : 0);
+ #if defined(CONFIG_SMP)
+ kdb_printf("on processor %d ", raw_smp_processor_id());
+@@ -1208,7 +1208,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
+ */
+ switch (db_result) {
+ case KDB_DB_BPT:
+- kdb_printf("\nEntering kdb (0x%p, pid %d) ",
++ kdb_printf("\nEntering kdb (0x%px, pid %d) ",
+ kdb_current, kdb_current->pid);
+ #if defined(CONFIG_SMP)
+ kdb_printf("on processor %d ", raw_smp_processor_id());
+@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const char **argv)
+ if (mod->state == MODULE_STATE_UNFORMED)
+ continue;
+
+- kdb_printf("%-20s%8u 0x%p ", mod->name,
++ kdb_printf("%-20s%8u 0x%px ", mod->name,
+ mod->core_layout.size, (void *)mod);
+ #ifdef CONFIG_MODULE_UNLOAD
+ kdb_printf("%4d ", module_refcount(mod));
+@@ -2059,7 +2059,7 @@ static int kdb_lsmod(int argc, const char **argv)
+ kdb_printf(" (Loading)");
+ else
+ kdb_printf(" (Live)");
+- kdb_printf(" 0x%p", mod->core_layout.base);
++ kdb_printf(" 0x%px", mod->core_layout.base);
+
+ #ifdef CONFIG_MODULE_UNLOAD
+ {
+@@ -2341,7 +2341,7 @@ void kdb_ps1(const struct task_struct *p)
+ return;
+
+ cpu = kdb_process_cpu(p);
+- kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n",
++ kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n",
+ (void *)p, p->pid, p->parent->pid,
+ kdb_task_has_cpu(p), kdb_process_cpu(p),
+ kdb_task_state_char(p),
+@@ -2354,7 +2354,7 @@ void kdb_ps1(const struct task_struct *p)
+ } else {
+ if (KDB_TSK(cpu) != p)
+ kdb_printf(" Error: does not match running "
+- "process table (0x%p)\n", KDB_TSK(cpu));
++ "process table (0x%px)\n", KDB_TSK(cpu));
+ }
+ }
+ }
+@@ -2692,7 +2692,7 @@ int kdb_register_flags(char *cmd,
+ for_each_kdbcmd(kp, i) {
+ if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) {
+ kdb_printf("Duplicate kdb command registered: "
+- "%s, func %p help %s\n", cmd, func, help);
++ "%s, func %px help %s\n", cmd, func, help);
+ return 1;
+ }
+ }
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 990b3cc526c8..987eb73284d2 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -40,7 +40,7 @@
+ int kdbgetsymval(const char *symname, kdb_symtab_t *symtab)
+ {
+ if (KDB_DEBUG(AR))
+- kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname,
++ kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname,
+ symtab);
+ memset(symtab, 0, sizeof(*symtab));
+ symtab->sym_start = kallsyms_lookup_name(symname);
+@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ char *knt1 = NULL;
+
+ if (KDB_DEBUG(AR))
+- kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab);
++ kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab);
+ memset(symtab, 0, sizeof(*symtab));
+
+ if (addr < 4096)
+@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ symtab->mod_name = "kernel";
+ if (KDB_DEBUG(AR))
+ kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, "
+- "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret,
++ "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret,
+ symtab->sym_start, symtab->mod_name, symtab->sym_name,
+ symtab->sym_name);
+
+@@ -887,13 +887,13 @@ void debug_kusage(void)
+ __func__, dah_first);
+ if (dah_first) {
+ h_used = (struct debug_alloc_header *)debug_alloc_pool;
+- kdb_printf("%s: h_used %p size %d\n", __func__, h_used,
++ kdb_printf("%s: h_used %px size %d\n", __func__, h_used,
+ h_used->size);
+ }
+ do {
+ h_used = (struct debug_alloc_header *)
+ ((char *)h_free + dah_overhead + h_free->size);
+- kdb_printf("%s: h_used %p size %d caller %p\n",
++ kdb_printf("%s: h_used %px size %d caller %px\n",
+ __func__, h_used, h_used->size, h_used->caller);
+ h_free = (struct debug_alloc_header *)
+ (debug_alloc_pool + h_free->next);
+@@ -902,7 +902,7 @@ void debug_kusage(void)
+ ((char *)h_free + dah_overhead + h_free->size);
+ if ((char *)h_used - debug_alloc_pool !=
+ sizeof(debug_alloc_pool_aligned))
+- kdb_printf("%s: h_used %p size %d caller %p\n",
++ kdb_printf("%s: h_used %px size %d caller %px\n",
+ __func__, h_used, h_used->size, h_used->caller);
+ out:
+ spin_unlock(&dap_lock);
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 6b71860f3998..4a8f3780aae5 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -71,9 +71,23 @@ static nokprobe_inline bool trace_kprobe_within_module(struct trace_kprobe *tk,
+ return strncmp(mod->name, name, len) == 0 && name[len] == ':';
+ }
+
+-static nokprobe_inline bool trace_kprobe_is_on_module(struct trace_kprobe *tk)
++static nokprobe_inline bool trace_kprobe_module_exist(struct trace_kprobe *tk)
+ {
+- return !!strchr(trace_kprobe_symbol(tk), ':');
++ char *p;
++ bool ret;
++
++ if (!tk->symbol)
++ return false;
++ p = strchr(tk->symbol, ':');
++ if (!p)
++ return true;
++ *p = '\0';
++ mutex_lock(&module_mutex);
++ ret = !!find_module(tk->symbol);
++ mutex_unlock(&module_mutex);
++ *p = ':';
++
++ return ret;
+ }
+
+ static nokprobe_inline unsigned long trace_kprobe_nhit(struct trace_kprobe *tk)
+@@ -520,19 +534,13 @@ static int __register_trace_kprobe(struct trace_kprobe *tk)
+ else
+ ret = register_kprobe(&tk->rp.kp);
+
+- if (ret == 0)
++ if (ret == 0) {
+ tk->tp.flags |= TP_FLAG_REGISTERED;
+- else {
+- if (ret == -ENOENT && trace_kprobe_is_on_module(tk)) {
+- pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
+- ret = 0;
+- } else if (ret == -EILSEQ) {
+- pr_warn("Probing address(0x%p) is not an instruction boundary.\n",
+- tk->rp.kp.addr);
+- ret = -EINVAL;
+- }
++ } else if (ret == -EILSEQ) {
++ pr_warn("Probing address(0x%p) is not an instruction boundary.\n",
++ tk->rp.kp.addr);
++ ret = -EINVAL;
+ }
+-
+ return ret;
+ }
+
+@@ -595,6 +603,11 @@ static int register_trace_kprobe(struct trace_kprobe *tk)
+
+ /* Register k*probe */
+ ret = __register_trace_kprobe(tk);
++ if (ret == -ENOENT && !trace_kprobe_module_exist(tk)) {
++ pr_warn("This probe might be able to register after target module is loaded. Continue.\n");
++ ret = 0;
++ }
++
+ if (ret < 0)
+ unregister_kprobe_event(tk);
+ else
+diff --git a/lib/ubsan.c b/lib/ubsan.c
+index 59fee96c29a0..e4162f59a81c 100644
+--- a/lib/ubsan.c
++++ b/lib/ubsan.c
+@@ -427,8 +427,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data,
+ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds);
+
+
+-void __noreturn
+-__ubsan_handle_builtin_unreachable(struct unreachable_data *data)
++void __ubsan_handle_builtin_unreachable(struct unreachable_data *data)
+ {
+ unsigned long flags;
+
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5b38fbef9441..bf15bd78846b 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3240,7 +3240,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ struct vm_area_struct *vma)
+ {
+- pte_t *src_pte, *dst_pte, entry;
++ pte_t *src_pte, *dst_pte, entry, dst_entry;
+ struct page *ptepage;
+ unsigned long addr;
+ int cow;
+@@ -3268,15 +3268,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ break;
+ }
+
+- /* If the pagetables are shared don't copy or take references */
+- if (dst_pte == src_pte)
++ /*
++ * If the pagetables are shared don't copy or take references.
++ * dst_pte == src_pte is the common case of src/dest sharing.
++ *
++ * However, src could have 'unshared' and dst shares with
++ * another vma. If dst_pte !none, this implies sharing.
++ * Check here before taking page table lock, and once again
++ * after taking the lock below.
++ */
++ dst_entry = huge_ptep_get(dst_pte);
++ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry))
+ continue;
+
+ dst_ptl = huge_pte_lock(h, dst, dst_pte);
+ src_ptl = huge_pte_lockptr(h, src, src_pte);
+ spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING);
+ entry = huge_ptep_get(src_pte);
+- if (huge_pte_none(entry)) { /* skip none entry */
++ dst_entry = huge_ptep_get(dst_pte);
++ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) {
++ /*
++ * Skip if src entry none. Also, skip in the
++ * unlikely case dst entry !none as this implies
++ * sharing with another vma.
++ */
+ ;
+ } else if (unlikely(is_hugetlb_entry_migration(entry) ||
+ is_hugetlb_entry_hwpoisoned(entry))) {
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 785252397e35..03fd2d08c361 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -587,6 +587,7 @@ int __remove_pages(struct zone *zone, unsigned long phys_start_pfn,
+ for (i = 0; i < sections_to_remove; i++) {
+ unsigned long pfn = phys_start_pfn + i*PAGES_PER_SECTION;
+
++ cond_resched();
+ ret = __remove_section(zone, __pfn_to_section(pfn), map_offset,
+ altmap);
+ map_offset = 0;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 01f1a14facc4..73fd00d2df8c 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -2046,8 +2046,36 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
+ nmask = policy_nodemask(gfp, pol);
+ if (!nmask || node_isset(hpage_node, *nmask)) {
+ mpol_cond_put(pol);
+- page = __alloc_pages_node(hpage_node,
+- gfp | __GFP_THISNODE, order);
++ /*
++ * We cannot invoke reclaim if __GFP_THISNODE
++ * is set. Invoking reclaim with
++ * __GFP_THISNODE set, would cause THP
++ * allocations to trigger heavy swapping
++ * despite there may be tons of free memory
++ * (including potentially plenty of THP
++ * already available in the buddy) on all the
++ * other NUMA nodes.
++ *
++ * At most we could invoke compaction when
++ * __GFP_THISNODE is set (but we would need to
++ * refrain from invoking reclaim even if
++ * compaction returned COMPACT_SKIPPED because
++ * there wasn't not enough memory to succeed
++ * compaction). For now just avoid
++ * __GFP_THISNODE instead of limiting the
++ * allocation path to a strict and single
++ * compaction invocation.
++ *
++ * Supposedly if direct reclaim was enabled by
++ * the caller, the app prefers THP regardless
++ * of the node it comes from so this would be
++ * more desiderable behavior than only
++ * providing THP originated from the local
++ * node in such case.
++ */
++ if (!(gfp & __GFP_DIRECT_RECLAIM))
++ gfp |= __GFP_THISNODE;
++ page = __alloc_pages_node(hpage_node, gfp, order);
+ goto out;
+ }
+ }
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 18185ae4f223..f8b846b5108c 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2837,7 +2837,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ unsigned int type;
+ int i;
+
+- p = kzalloc(sizeof(*p), GFP_KERNEL);
++ p = kvzalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
+ return ERR_PTR(-ENOMEM);
+
+@@ -2848,7 +2848,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ }
+ if (type >= MAX_SWAPFILES) {
+ spin_unlock(&swap_lock);
+- kfree(p);
++ kvfree(p);
+ return ERR_PTR(-EPERM);
+ }
+ if (type >= nr_swapfiles) {
+@@ -2862,7 +2862,7 @@ static struct swap_info_struct *alloc_swap_info(void)
+ smp_wmb();
+ nr_swapfiles++;
+ } else {
+- kfree(p);
++ kvfree(p);
+ p = swap_info[type];
+ /*
+ * Do not memset this entry: a racing procfs swap_next()
+diff --git a/net/9p/protocol.c b/net/9p/protocol.c
+index 931ea00c4fed..ce7c221ca18b 100644
+--- a/net/9p/protocol.c
++++ b/net/9p/protocol.c
+@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...);
+ void p9stat_free(struct p9_wstat *stbuf)
+ {
+ kfree(stbuf->name);
++ stbuf->name = NULL;
+ kfree(stbuf->uid);
++ stbuf->uid = NULL;
+ kfree(stbuf->gid);
++ stbuf->gid = NULL;
+ kfree(stbuf->muid);
++ stbuf->muid = NULL;
+ kfree(stbuf->extension);
++ stbuf->extension = NULL;
+ }
+ EXPORT_SYMBOL(p9stat_free);
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 3d5280425027..2d3723606fb0 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -929,19 +929,22 @@ static unsigned int early_drop_list(struct net *net,
+ return drops;
+ }
+
+-static noinline int early_drop(struct net *net, unsigned int _hash)
++static noinline int early_drop(struct net *net, unsigned int hash)
+ {
+- unsigned int i;
++ unsigned int i, bucket;
+
+ for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
+ struct hlist_nulls_head *ct_hash;
+- unsigned int hash, hsize, drops;
++ unsigned int hsize, drops;
+
+ rcu_read_lock();
+ nf_conntrack_get_ht(&ct_hash, &hsize);
+- hash = reciprocal_scale(_hash++, hsize);
++ if (!i)
++ bucket = reciprocal_scale(hash, hsize);
++ else
++ bucket = (bucket + 1) % hsize;
+
+- drops = early_drop_list(net, &ct_hash[hash]);
++ drops = early_drop_list(net, &ct_hash[bucket]);
+ rcu_read_unlock();
+
+ if (drops) {
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 30afbd236656..b53cc0960b5d 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len)
+ WARN_ON_ONCE(xdr->iov);
+ return;
+ }
+- if (fraglen) {
++ if (fraglen)
+ xdr->end = head->iov_base + head->iov_len;
+- xdr->page_ptr--;
+- }
+ /* (otherwise assume xdr->end is already set) */
++ xdr->page_ptr--;
+ head->iov_len = len;
+ buf->len = len;
+ xdr->p = head->iov_base + head->iov_len;
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 4680a217d0fa..46ec7be75d4b 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5306,6 +5306,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
+ addr_buf = address;
+
+ while (walk_size < addrlen) {
++ if (walk_size + sizeof(sa_family_t) > addrlen)
++ return -EINVAL;
++
+ addr = addr_buf;
+ switch (addr->sa_family) {
+ case AF_UNSPEC:
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index 02580f3ded1a..0b88ec9381e7 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -779,7 +779,7 @@ static void pmu_add_cpu_aliases(struct list_head *head, struct perf_pmu *pmu)
+
+ if (!is_arm_pmu_core(name)) {
+ pname = pe->pmu ? pe->pmu : "cpu";
+- if (strncmp(pname, name, strlen(pname)))
++ if (strcmp(pname, name))
+ continue;
+ }
+
+diff --git a/tools/testing/selftests/powerpc/tm/tm-tmspr.c b/tools/testing/selftests/powerpc/tm/tm-tmspr.c
+index 2bda81c7bf23..df1d7d4b1c89 100644
+--- a/tools/testing/selftests/powerpc/tm/tm-tmspr.c
++++ b/tools/testing/selftests/powerpc/tm/tm-tmspr.c
+@@ -98,7 +98,7 @@ void texasr(void *in)
+
+ int test_tmspr()
+ {
+- pthread_t thread;
++ pthread_t *thread;
+ int thread_num;
+ unsigned long i;
+
+@@ -107,21 +107,28 @@ int test_tmspr()
+ /* To cause some context switching */
+ thread_num = 10 * sysconf(_SC_NPROCESSORS_ONLN);
+
++ thread = malloc(thread_num * sizeof(pthread_t));
++ if (thread == NULL)
++ return EXIT_FAILURE;
++
+ /* Test TFIAR and TFHAR */
+- for (i = 0 ; i < thread_num ; i += 2){
+- if (pthread_create(&thread, NULL, (void*)tfiar_tfhar, (void *)i))
++ for (i = 0; i < thread_num; i += 2) {
++ if (pthread_create(&thread[i], NULL, (void *)tfiar_tfhar,
++ (void *)i))
+ return EXIT_FAILURE;
+ }
+- if (pthread_join(thread, NULL) != 0)
+- return EXIT_FAILURE;
+-
+ /* Test TEXASR */
+- for (i = 0 ; i < thread_num ; i++){
+- if (pthread_create(&thread, NULL, (void*)texasr, (void *)i))
++ for (i = 1; i < thread_num; i += 2) {
++ if (pthread_create(&thread[i], NULL, (void *)texasr, (void *)i))
+ return EXIT_FAILURE;
+ }
+- if (pthread_join(thread, NULL) != 0)
+- return EXIT_FAILURE;
++
++ for (i = 0; i < thread_num; i++) {
++ if (pthread_join(thread[i], NULL) != 0)
++ return EXIT_FAILURE;
++ }
++
++ free(thread);
+
+ if (passed)
+ return 0;
next reply other threads:[~2018-11-21 12:29 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-21 12:28 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2018-11-14 13:15 [gentoo-commits] proj/linux-patches:4.18 commit in: / Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 13:15 Mike Pagano
2018-11-14 11:40 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-14 11:37 Mike Pagano
2018-11-13 21:17 Mike Pagano
2018-11-11 1:51 Mike Pagano
2018-11-10 21:33 Mike Pagano
2018-11-04 17:33 Alice Ferrazzi
2018-10-20 12:36 Mike Pagano
2018-10-18 10:27 Mike Pagano
2018-10-13 16:32 Mike Pagano
2018-10-10 11:16 Mike Pagano
2018-10-04 10:44 Mike Pagano
2018-09-29 13:36 Mike Pagano
2018-09-26 10:40 Mike Pagano
2018-09-19 22:41 Mike Pagano
2018-09-15 10:12 Mike Pagano
2018-09-09 11:25 Mike Pagano
2018-09-05 15:30 Mike Pagano
2018-08-24 11:46 Mike Pagano
2018-08-22 9:59 Alice Ferrazzi
2018-08-18 18:13 Mike Pagano
2018-08-17 19:44 Mike Pagano
2018-08-17 19:28 Mike Pagano
2018-08-16 11:45 Mike Pagano
2018-08-15 16:36 Mike Pagano
2018-08-12 23:21 Mike Pagano
2018-08-12 23:15 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1542803307.f038ea3a40fec1a50410f3e39b1ca402f8d6543c.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox