From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.19 commit in: /
Date: Sat, 1 Dec 2018 15:08:21 +0000 (UTC) [thread overview]
Message-ID: <1543676871.3c846c91f5b30fcc7c4adbb519f42d972fd9cfd4.mpagano@gentoo> (raw)
commit: 3c846c91f5b30fcc7c4adbb519f42d972fd9cfd4
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 1 15:07:51 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec 1 15:07:51 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3c846c91
proj/linux-patches: Linux patch 4.19.6
Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
0000_README | 4 +
1005_linux-4.19.6.patch | 4624 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4628 insertions(+)
diff --git a/0000_README b/0000_README
index c0b6ddf..c4c0a77 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch: 1004_linux-4.19.5.patch
From: http://www.kernel.org
Desc: Linux 4.19.5
+Patch: 1005_linux-4.19.6.patch
+From: http://www.kernel.org
+Desc: Linux 4.19.6
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1005_linux-4.19.6.patch b/1005_linux-4.19.6.patch
new file mode 100644
index 0000000..91b0881
--- /dev/null
+++ b/1005_linux-4.19.6.patch
@@ -0,0 +1,4624 @@
+diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
+index 30491d91e93d..30187d49dc2c 100644
+--- a/Documentation/admin-guide/security-bugs.rst
++++ b/Documentation/admin-guide/security-bugs.rst
+@@ -26,23 +26,35 @@ information is helpful. Any exploit code is very helpful and will not
+ be released without consent from the reporter unless it has already been
+ made public.
+
+-Disclosure
+-----------
+-
+-The goal of the Linux kernel security team is to work with the bug
+-submitter to understand and fix the bug. We prefer to publish the fix as
+-soon as possible, but try to avoid public discussion of the bug itself
+-and leave that to others.
+-
+-Publishing the fix may be delayed when the bug or the fix is not yet
+-fully understood, the solution is not well-tested or for vendor
+-coordination. However, we expect these delays to be short, measurable in
+-days, not weeks or months. A release date is negotiated by the security
+-team working with the bug submitter as well as vendors. However, the
+-kernel security team holds the final say when setting a timeframe. The
+-timeframe varies from immediate (esp. if it's already publicly known bug)
+-to a few weeks. As a basic default policy, we expect report date to
+-release date to be on the order of 7 days.
++Disclosure and embargoed information
++------------------------------------
++
++The security list is not a disclosure channel. For that, see Coordination
++below.
++
++Once a robust fix has been developed, the release process starts. Fixes
++for publicly known bugs are released immediately.
++
++Although our preference is to release fixes for publicly undisclosed bugs
++as soon as they become available, this may be postponed at the request of
++the reporter or an affected party for up to 7 calendar days from the start
++of the release process, with an exceptional extension to 14 calendar days
++if it is agreed that the criticality of the bug requires more time. The
++only valid reason for deferring the publication of a fix is to accommodate
++the logistics of QA and large scale rollouts which require release
++coordination.
++
++Whilst embargoed information may be shared with trusted individuals in
++order to develop a fix, such information will not be published alongside
++the fix or on any other disclosure channel without the permission of the
++reporter. This includes but is not limited to the original bug report
++and followup discussions (if any), exploits, CVE information or the
++identity of the reporter.
++
++In other words our only interest is in getting bugs fixed. All other
++information submitted to the security list and any followup discussions
++of the report are treated confidentially even after the embargo has been
++lifted, in perpetuity.
+
+ Coordination
+ ------------
+@@ -68,7 +80,7 @@ may delay the bug handling. If a reporter wishes to have a CVE identifier
+ assigned ahead of public disclosure, they will need to contact the private
+ linux-distros list, described above. When such a CVE identifier is known
+ before a patch is provided, it is desirable to mention it in the commit
+-message, though.
++message if the reporter agrees.
+
+ Non-disclosure agreements
+ -------------------------
+diff --git a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+index 903a78da65be..3a9926f99937 100644
+--- a/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
++++ b/Documentation/devicetree/bindings/net/can/holt_hi311x.txt
+@@ -17,7 +17,7 @@ Example:
+ reg = <1>;
+ clocks = <&clk32m>;
+ interrupt-parent = <&gpio4>;
+- interrupts = <13 IRQ_TYPE_EDGE_RISING>;
++ interrupts = <13 IRQ_TYPE_LEVEL_HIGH>;
+ vdd-supply = <®5v0>;
+ xceiver-supply = <®5v0>;
+ };
+diff --git a/MAINTAINERS b/MAINTAINERS
+index b2f710eee67a..9e9b19ecf6f7 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -13769,6 +13769,7 @@ F: drivers/i2c/busses/i2c-stm32*
+
+ STABLE BRANCH
+ M: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
++M: Sasha Levin <sashal@kernel.org>
+ L: stable@vger.kernel.org
+ S: Supported
+ F: Documentation/process/stable-kernel-rules.rst
+diff --git a/Makefile b/Makefile
+index a07830185bdf..20cbb8e84650 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = "People's Front"
+
+diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h
+index e0331e754568..b855f56489ac 100644
+--- a/arch/powerpc/include/asm/io.h
++++ b/arch/powerpc/include/asm/io.h
+@@ -285,19 +285,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ * their hooks, a bitfield is reserved for use by the platform near the
+ * top of MMIO addresses (not PIO, those have to cope the hard way).
+ *
+- * This bit field is 12 bits and is at the top of the IO virtual
+- * addresses PCI_IO_INDIRECT_TOKEN_MASK.
++ * The highest address in the kernel virtual space are:
+ *
+- * The kernel virtual space is thus:
++ * d0003fffffffffff # with Hash MMU
++ * c00fffffffffffff # with Radix MMU
+ *
+- * 0xD000000000000000 : vmalloc
+- * 0xD000080000000000 : PCI PHB IO space
+- * 0xD000080080000000 : ioremap
+- * 0xD0000fffffffffff : end of ioremap region
+- *
+- * Since the top 4 bits are reserved as the region ID, we use thus
+- * the next 12 bits and keep 4 bits available for the future if the
+- * virtual address space is ever to be extended.
++ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits
++ * that can be used for the field.
+ *
+ * The direct IO mapping operations will then mask off those bits
+ * before doing the actual access, though that only happen when
+@@ -309,8 +303,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,
+ */
+
+ #ifdef CONFIG_PPC_INDIRECT_MMIO
+-#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul
+-#define PCI_IO_IND_TOKEN_SHIFT 48
++#define PCI_IO_IND_TOKEN_SHIFT 52
++#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT)
+ #define PCI_FIX_ADDR(addr) \
+ ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))
+ #define PCI_GET_ADDR_TOKEN(addr) \
+diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h
+index 491b0f715d6b..ea1d7c808319 100644
+--- a/arch/powerpc/kvm/trace.h
++++ b/arch/powerpc/kvm/trace.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace
+
+ /*
+ * Tracepoint for guest mode entry.
+@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h
+index ac640e81fdc5..3837842986aa 100644
+--- a/arch/powerpc/kvm/trace_booke.h
++++ b/arch/powerpc/kvm/trace_booke.h
+@@ -6,8 +6,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_booke
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_booke
+
+ #define kvm_trace_symbol_exit \
+ {0, "CRITICAL"}, \
+@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,
+ #endif
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_booke
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h
+index bcfe8a987f6a..8a1e3b0047f1 100644
+--- a/arch/powerpc/kvm/trace_hv.h
++++ b/arch/powerpc/kvm/trace_hv.h
+@@ -9,8 +9,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_hv
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_hv
+
+ #define kvm_trace_symbol_hcall \
+ {H_REMOVE, "H_REMOVE"}, \
+@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,
+ #endif /* _TRACE_KVM_HV_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_hv
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h
+index 2f9a8829552b..46a46d328fbf 100644
+--- a/arch/powerpc/kvm/trace_pr.h
++++ b/arch/powerpc/kvm/trace_pr.h
+@@ -8,8 +8,6 @@
+
+ #undef TRACE_SYSTEM
+ #define TRACE_SYSTEM kvm_pr
+-#define TRACE_INCLUDE_PATH .
+-#define TRACE_INCLUDE_FILE trace_pr
+
+ TRACE_EVENT(kvm_book3s_reenter,
+ TP_PROTO(int r, struct kvm_vcpu *vcpu),
+@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit,
+ #endif /* _TRACE_KVM_H */
+
+ /* This part must be outside protection */
++
++#undef TRACE_INCLUDE_PATH
++#undef TRACE_INCLUDE_FILE
++
++#define TRACE_INCLUDE_PATH .
++#define TRACE_INCLUDE_FILE trace_pr
++
+ #include <trace/define_trace.h>
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 055b211b7126..5500e4edabc6 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1179,7 +1179,7 @@ static long vphn_get_associativity(unsigned long cpu,
+
+ switch (rc) {
+ case H_FUNCTION:
+- printk(KERN_INFO
++ printk_once(KERN_INFO
+ "VPHN is not supported. Disabling polling...\n");
+ stop_topology_update();
+ break;
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 61ec42405ec9..110be14e6122 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -82,4 +82,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/
+
+ libs-y += arch/riscv/lib/
+
++PHONY += vdso_install
++vdso_install:
++ $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@
++
+ all: vmlinux
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 3303ed2cd419..7dd308129b40 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+ if (v != (u32)v) {
+ pr_err("%s: value %016llx out of range for 32-bit field\n",
+- me->name, v);
++ me->name, (long long)v);
+ return -EINVAL;
+ }
+ *location = v;
+@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location,
+ if (offset != (s32)offset) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location,
+ if (IS_ENABLED(CMODEL_MEDLOW)) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location,
+ } else {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+ }
+@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location,
+ if (offset != fill_v) {
+ pr_err(
+ "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n",
+- me->name, v, location);
++ me->name, (long long)v, location);
+ return -EINVAL;
+ }
+
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index 8527c3e1038b..bfa25814fe5f 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -15,6 +15,25 @@
+ #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910
+ #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f
+ #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f
++#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c
++#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904
++#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914
++#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f
++#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f
++#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc
++#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0
++#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10
++#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4
++#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f
++#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f
++#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2
++#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30
++#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18
++#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6
++#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31
++#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33
++#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca
++#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32
+
+ /* SNB event control */
+ #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff
+@@ -569,7 +588,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+ },
+-
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
+ { /* end: all zeroes */ },
+ };
+
+@@ -618,6 +712,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
+ IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */
+ IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */
+ IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */
++ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */
++ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */
++ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */
++ IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Dual Core */
++ IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Quad Core */
++ IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 2 Cores */
++ IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 4 Cores */
++ IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 4 Cores */
++ IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 6 Cores */
++ IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 2 Cores Desktop */
++ IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Desktop */
++ IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Desktop */
++ IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Desktop */
++ IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Work Station */
++ IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Work Station */
++ IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Work Station */
++ IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Server */
++ IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Server */
++ IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */
+ { /* end marker */ }
+ };
+
+diff --git a/block/bio.c b/block/bio.c
+index 41173710430c..c4ef8aa46452 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src)
+ if (bio_flagged(bio_src, BIO_THROTTLED))
+ bio_set_flag(bio, BIO_THROTTLED);
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter = bio_src->bi_iter;
+ bio->bi_io_vec = bio_src->bi_io_vec;
+diff --git a/block/bounce.c b/block/bounce.c
+index 418677dcec60..abb50e7e5fab 100644
+--- a/block/bounce.c
++++ b/block/bounce.c
+@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask,
+ return NULL;
+ bio->bi_disk = bio_src->bi_disk;
+ bio->bi_opf = bio_src->bi_opf;
++ bio->bi_ioprio = bio_src->bi_ioprio;
+ bio->bi_write_hint = bio_src->bi_write_hint;
+ bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector;
+ bio->bi_iter.bi_size = bio_src->bi_iter.bi_size;
+diff --git a/crypto/simd.c b/crypto/simd.c
+index ea7240be3001..78e8d037ae2b 100644
+--- a/crypto/simd.c
++++ b/crypto/simd.c
+@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm)
+
+ ctx->cryptd_tfm = cryptd_tfm;
+
+- reqsize = sizeof(struct skcipher_request);
+- reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base);
++ reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm));
++ reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base));
++ reqsize += sizeof(struct skcipher_request);
+
+ crypto_skcipher_set_reqsize(tfm, reqsize);
+
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index e9fb0bf3c8d2..78f9de260d5f 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -417,6 +417,10 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
++ status = acpi_ut_add_address_range(obj_desc->region.space_id,
++ obj_desc->region.address,
++ obj_desc->region.length, node);
++
+ /* Now the address and length are valid for this opregion */
+
+ obj_desc->region.flags |= AOPOBJ_DATA_VALID;
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index f2b6f4da1034..fdabd0b74492 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4151,10 +4151,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive)
+ bio.bi_end_io = floppy_rb0_cb;
+ bio_set_op_attrs(&bio, REQ_OP_READ, 0);
+
++ init_completion(&cbdata.complete);
++
+ submit_bio(&bio);
+ process_fd_request();
+
+- init_completion(&cbdata.complete);
+ wait_for_completion(&cbdata.complete);
+
+ __free_page(page);
+diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
+index b2ff423ad7f8..f4880a4f865b 100644
+--- a/drivers/cpufreq/imx6q-cpufreq.c
++++ b/drivers/cpufreq/imx6q-cpufreq.c
+@@ -159,8 +159,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)
+ /* Ensure the arm clock divider is what we expect */
+ ret = clk_set_rate(clks[ARM].clk, new_freq * 1000);
+ if (ret) {
++ int ret1;
++
+ dev_err(cpu_dev, "failed to set clock rate: %d\n", ret);
+- regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0);
++ if (ret1)
++ dev_warn(cpu_dev,
++ "failed to restore vddarm voltage: %d\n", ret1);
+ return ret;
+ }
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index 388a929baf95..1a6a77df8a5e 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -265,6 +265,10 @@ void __init efi_init(void)
+ (params.mmap & ~PAGE_MASK)));
+
+ init_screen_info();
++
++ /* ARM does not permit early mappings to persist across paging_init() */
++ if (IS_ENABLED(CONFIG_ARM))
++ efi_memmap_unmap();
+ }
+
+ static int __init register_gop_device(void)
+diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c
+index 922cfb813109..a00934d263c5 100644
+--- a/drivers/firmware/efi/arm-runtime.c
++++ b/drivers/firmware/efi/arm-runtime.c
+@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void)
+ {
+ u64 mapsize;
+
+- if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) {
++ if (!efi_enabled(EFI_BOOT)) {
+ pr_info("EFI services will not be available.\n");
+ return 0;
+ }
+diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
+index 14c40a7750d1..c51627660dbb 100644
+--- a/drivers/firmware/efi/libstub/Makefile
++++ b/drivers/firmware/efi/libstub/Makefile
+@@ -16,7 +16,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -O2 \
+ cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS)) -fpie \
+ $(DISABLE_STACKLEAK_PLUGIN)
+ cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \
+- -fno-builtin -fpic -mno-single-pic-base
++ -fno-builtin -fpic \
++ $(call cc-option,-mno-single-pic-base)
+
+ cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
+
+diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c
+index 5fc70520e04c..1907db2b38d8 100644
+--- a/drivers/firmware/efi/memmap.c
++++ b/drivers/firmware/efi/memmap.c
+@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)
+
+ void __init efi_memmap_unmap(void)
+ {
++ if (!efi_enabled(EFI_MEMMAP))
++ return;
++
+ if (!efi.memmap.late) {
+ unsigned long size;
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 25187403e3ac..a8e01d99919c 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1285,7 +1285,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
+ gdev->descs = kcalloc(chip->ngpio, sizeof(gdev->descs[0]), GFP_KERNEL);
+ if (!gdev->descs) {
+ status = -ENOMEM;
+- goto err_free_gdev;
++ goto err_free_ida;
+ }
+
+ if (chip->ngpio == 0) {
+@@ -1413,8 +1413,9 @@ err_free_label:
+ kfree_const(gdev->label);
+ err_free_descs:
+ kfree(gdev->descs);
+-err_free_gdev:
++err_free_ida:
+ ida_simple_remove(&gpio_ida, gdev->id);
++err_free_gdev:
+ /* failures here can mean systems won't boot... */
+ pr_err("%s: GPIOs %d..%d (%s) failed to register, %d\n", __func__,
+ gdev->base, gdev->base + gdev->ngpio - 1,
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+index 0c791e35acf0..79bd8bd97fae 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -496,8 +496,11 @@ void amdgpu_amdkfd_set_compute_idle(struct kgd_dev *kgd, bool idle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)kgd;
+
+- amdgpu_dpm_switch_power_profile(adev,
+- PP_SMC_POWER_PROFILE_COMPUTE, !idle);
++ if (adev->powerplay.pp_funcs &&
++ adev->powerplay.pp_funcs->switch_power_profile)
++ amdgpu_dpm_switch_power_profile(adev,
++ PP_SMC_POWER_PROFILE_COMPUTE,
++ !idle);
+ }
+
+ bool amdgpu_amdkfd_is_kfd_vmid(struct amdgpu_device *adev, u32 vmid)
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+index ad151fefa41f..db406a35808f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+@@ -45,6 +45,7 @@ MODULE_FIRMWARE("amdgpu/tahiti_mc.bin");
+ MODULE_FIRMWARE("amdgpu/pitcairn_mc.bin");
+ MODULE_FIRMWARE("amdgpu/verde_mc.bin");
+ MODULE_FIRMWARE("amdgpu/oland_mc.bin");
++MODULE_FIRMWARE("amdgpu/hainan_mc.bin");
+ MODULE_FIRMWARE("amdgpu/si58_mc.bin");
+
+ #define MC_SEQ_MISC0__MT__MASK 0xf0000000
+diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+index 5ae5ed2e62d6..21bc12e02311 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c
+@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev)
+ else
+ wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4);
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off));
+- WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF);
++ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF);
+
+ /* set rptr, wptr to 0 */
+ WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0);
+diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
+index 69dab82a3771..bf589c53b908 100644
+--- a/drivers/gpu/drm/ast/ast_drv.c
++++ b/drivers/gpu/drm/ast/ast_drv.c
+@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlist[] = {
+
+ MODULE_DEVICE_TABLE(pci, pciidlist);
+
++static void ast_kick_out_firmware_fb(struct pci_dev *pdev)
++{
++ struct apertures_struct *ap;
++ bool primary = false;
++
++ ap = alloc_apertures(1);
++ if (!ap)
++ return;
++
++ ap->ranges[0].base = pci_resource_start(pdev, 0);
++ ap->ranges[0].size = pci_resource_len(pdev, 0);
++
++#ifdef CONFIG_X86
++ primary = pdev->resource[PCI_ROM_RESOURCE].flags & IORESOURCE_ROM_SHADOW;
++#endif
++ drm_fb_helper_remove_conflicting_framebuffers(ap, "astdrmfb", primary);
++ kfree(ap);
++}
++
+ static int ast_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++ ast_kick_out_firmware_fb(pdev);
++
+ return drm_get_pci_dev(pdev, ent, &driver);
+ }
+
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 5e77d456d9bb..7c6ac3cadb6b 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct drm_crtc *crtc,
+ }
+ ast_bo_unreserve(bo);
+
++ ast_set_offset_reg(crtc);
+ ast_set_start_address_crt1(crtc, (u32)gpu_addr);
+
+ return 0;
+@@ -1254,7 +1255,7 @@ static int ast_cursor_move(struct drm_crtc *crtc,
+ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xc7, ((y >> 8) & 0x07));
+
+ /* dummy write to fire HWC */
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xCB, 0xFF, 0x00);
++ ast_show_cursor(crtc);
+
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index 9628dd617826..9214c8b02484 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -200,6 +200,9 @@ int drm_fb_helper_single_add_all_connectors(struct drm_fb_helper *fb_helper)
+ mutex_lock(&fb_helper->lock);
+ drm_connector_list_iter_begin(dev, &conn_iter);
+ drm_for_each_connector_iter(connector, &conn_iter) {
++ if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK)
++ continue;
++
+ ret = __drm_fb_helper_add_one_connector(fb_helper, connector);
+ if (ret)
+ goto fail;
+diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
+index 43ae9de12ba3..c3a64d6a18df 100644
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2492,6 +2492,9 @@ static uint32_t ilk_compute_pri_wm(const struct intel_crtc_state *cstate,
+ uint32_t method1, method2;
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2521,6 +2524,9 @@ static uint32_t ilk_compute_spr_wm(const struct intel_crtc_state *cstate,
+ uint32_t method1, method2;
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2544,6 +2550,9 @@ static uint32_t ilk_compute_cur_wm(const struct intel_crtc_state *cstate,
+ {
+ int cpp;
+
++ if (mem_value == 0)
++ return U32_MAX;
++
+ if (!intel_wm_plane_visible(cstate, pstate))
+ return 0;
+
+@@ -2998,6 +3007,34 @@ static void snb_wm_latency_quirk(struct drm_i915_private *dev_priv)
+ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+ }
+
++static void snb_wm_lp3_irq_quirk(struct drm_i915_private *dev_priv)
++{
++ /*
++ * On some SNB machines (Thinkpad X220 Tablet at least)
++ * LP3 usage can cause vblank interrupts to be lost.
++ * The DEIIR bit will go high but it looks like the CPU
++ * never gets interrupted.
++ *
++ * It's not clear whether other interrupt source could
++ * be affected or if this is somehow limited to vblank
++ * interrupts only. To play it safe we disable LP3
++ * watermarks entirely.
++ */
++ if (dev_priv->wm.pri_latency[3] == 0 &&
++ dev_priv->wm.spr_latency[3] == 0 &&
++ dev_priv->wm.cur_latency[3] == 0)
++ return;
++
++ dev_priv->wm.pri_latency[3] = 0;
++ dev_priv->wm.spr_latency[3] = 0;
++ dev_priv->wm.cur_latency[3] = 0;
++
++ DRM_DEBUG_KMS("LP3 watermarks disabled due to potential for lost interrupts\n");
++ intel_print_wm_latency(dev_priv, "Primary", dev_priv->wm.pri_latency);
++ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
++ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
++}
++
+ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
+ {
+ intel_read_wm_latency(dev_priv, dev_priv->wm.pri_latency);
+@@ -3014,8 +3051,10 @@ static void ilk_setup_wm_latency(struct drm_i915_private *dev_priv)
+ intel_print_wm_latency(dev_priv, "Sprite", dev_priv->wm.spr_latency);
+ intel_print_wm_latency(dev_priv, "Cursor", dev_priv->wm.cur_latency);
+
+- if (IS_GEN6(dev_priv))
++ if (IS_GEN6(dev_priv)) {
+ snb_wm_latency_quirk(dev_priv);
++ snb_wm_lp3_irq_quirk(dev_priv);
++ }
+ }
+
+ static void skl_setup_wm_latency(struct drm_i915_private *dev_priv)
+diff --git a/drivers/gpu/drm/vc4/vc4_kms.c b/drivers/gpu/drm/vc4/vc4_kms.c
+index ca5aa7fba769..f4d8a730e821 100644
+--- a/drivers/gpu/drm/vc4/vc4_kms.c
++++ b/drivers/gpu/drm/vc4/vc4_kms.c
+@@ -216,6 +216,12 @@ static int vc4_atomic_commit(struct drm_device *dev,
+ return 0;
+ }
+
++ /* We know for sure we don't want an async update here. Set
++ * state->legacy_cursor_update to false to prevent
++ * drm_atomic_helper_setup_commit() from auto-completing
++ * commit->flip_done.
++ */
++ state->legacy_cursor_update = false;
+ ret = drm_atomic_helper_setup_commit(state, nonblock);
+ if (ret)
+ return ret;
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 0422ec2b13d2..dc4128bfe2ca 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -23,8 +23,9 @@
+ * In order to avoid breaking them this driver creates a layered hidraw device,
+ * so it can detect when the client is running and then:
+ * - it will not send any command to the controller.
+- * - this input device will be disabled, to avoid double input of the same
++ * - this input device will be removed, to avoid double input of the same
+ * user action.
++ * When the client is closed, this input device will be created again.
+ *
+ * For additional functions, such as changing the right-pad margin or switching
+ * the led, you can use the user-space tool at:
+@@ -113,7 +114,7 @@ struct steam_device {
+ spinlock_t lock;
+ struct hid_device *hdev, *client_hdev;
+ struct mutex mutex;
+- bool client_opened, input_opened;
++ bool client_opened;
+ struct input_dev __rcu *input;
+ unsigned long quirks;
+ struct work_struct work_connect;
+@@ -279,18 +280,6 @@ static void steam_set_lizard_mode(struct steam_device *steam, bool enable)
+ }
+ }
+
+-static void steam_update_lizard_mode(struct steam_device *steam)
+-{
+- mutex_lock(&steam->mutex);
+- if (!steam->client_opened) {
+- if (steam->input_opened)
+- steam_set_lizard_mode(steam, false);
+- else
+- steam_set_lizard_mode(steam, lizard_mode);
+- }
+- mutex_unlock(&steam->mutex);
+-}
+-
+ static int steam_input_open(struct input_dev *dev)
+ {
+ struct steam_device *steam = input_get_drvdata(dev);
+@@ -301,7 +290,6 @@ static int steam_input_open(struct input_dev *dev)
+ return ret;
+
+ mutex_lock(&steam->mutex);
+- steam->input_opened = true;
+ if (!steam->client_opened && lizard_mode)
+ steam_set_lizard_mode(steam, false);
+ mutex_unlock(&steam->mutex);
+@@ -313,7 +301,6 @@ static void steam_input_close(struct input_dev *dev)
+ struct steam_device *steam = input_get_drvdata(dev);
+
+ mutex_lock(&steam->mutex);
+- steam->input_opened = false;
+ if (!steam->client_opened && lizard_mode)
+ steam_set_lizard_mode(steam, true);
+ mutex_unlock(&steam->mutex);
+@@ -400,7 +387,7 @@ static int steam_battery_register(struct steam_device *steam)
+ return 0;
+ }
+
+-static int steam_register(struct steam_device *steam)
++static int steam_input_register(struct steam_device *steam)
+ {
+ struct hid_device *hdev = steam->hdev;
+ struct input_dev *input;
+@@ -414,17 +401,6 @@ static int steam_register(struct steam_device *steam)
+ return 0;
+ }
+
+- /*
+- * Unlikely, but getting the serial could fail, and it is not so
+- * important, so make up a serial number and go on.
+- */
+- if (steam_get_serial(steam) < 0)
+- strlcpy(steam->serial_no, "XXXXXXXXXX",
+- sizeof(steam->serial_no));
+-
+- hid_info(hdev, "Steam Controller '%s' connected",
+- steam->serial_no);
+-
+ input = input_allocate_device();
+ if (!input)
+ return -ENOMEM;
+@@ -492,11 +468,6 @@ static int steam_register(struct steam_device *steam)
+ goto input_register_fail;
+
+ rcu_assign_pointer(steam->input, input);
+-
+- /* ignore battery errors, we can live without it */
+- if (steam->quirks & STEAM_QUIRK_WIRELESS)
+- steam_battery_register(steam);
+-
+ return 0;
+
+ input_register_fail:
+@@ -504,27 +475,88 @@ input_register_fail:
+ return ret;
+ }
+
+-static void steam_unregister(struct steam_device *steam)
++static void steam_input_unregister(struct steam_device *steam)
+ {
+ struct input_dev *input;
++ rcu_read_lock();
++ input = rcu_dereference(steam->input);
++ rcu_read_unlock();
++ if (!input)
++ return;
++ RCU_INIT_POINTER(steam->input, NULL);
++ synchronize_rcu();
++ input_unregister_device(input);
++}
++
++static void steam_battery_unregister(struct steam_device *steam)
++{
+ struct power_supply *battery;
+
+ rcu_read_lock();
+- input = rcu_dereference(steam->input);
+ battery = rcu_dereference(steam->battery);
+ rcu_read_unlock();
+
+- if (battery) {
+- RCU_INIT_POINTER(steam->battery, NULL);
+- synchronize_rcu();
+- power_supply_unregister(battery);
++ if (!battery)
++ return;
++ RCU_INIT_POINTER(steam->battery, NULL);
++ synchronize_rcu();
++ power_supply_unregister(battery);
++}
++
++static int steam_register(struct steam_device *steam)
++{
++ int ret;
++
++ /*
++ * This function can be called several times in a row with the
++ * wireless adaptor, without steam_unregister() between them, because
++ * another client send a get_connection_status command, for example.
++ * The battery and serial number are set just once per device.
++ */
++ if (!steam->serial_no[0]) {
++ /*
++ * Unlikely, but getting the serial could fail, and it is not so
++ * important, so make up a serial number and go on.
++ */
++ if (steam_get_serial(steam) < 0)
++ strlcpy(steam->serial_no, "XXXXXXXXXX",
++ sizeof(steam->serial_no));
++
++ hid_info(steam->hdev, "Steam Controller '%s' connected",
++ steam->serial_no);
++
++ /* ignore battery errors, we can live without it */
++ if (steam->quirks & STEAM_QUIRK_WIRELESS)
++ steam_battery_register(steam);
++
++ mutex_lock(&steam_devices_lock);
++ list_add(&steam->list, &steam_devices);
++ mutex_unlock(&steam_devices_lock);
+ }
+- if (input) {
+- RCU_INIT_POINTER(steam->input, NULL);
+- synchronize_rcu();
++
++ mutex_lock(&steam->mutex);
++ if (!steam->client_opened) {
++ steam_set_lizard_mode(steam, lizard_mode);
++ ret = steam_input_register(steam);
++ } else {
++ ret = 0;
++ }
++ mutex_unlock(&steam->mutex);
++
++ return ret;
++}
++
++static void steam_unregister(struct steam_device *steam)
++{
++ steam_battery_unregister(steam);
++ steam_input_unregister(steam);
++ if (steam->serial_no[0]) {
+ hid_info(steam->hdev, "Steam Controller '%s' disconnected",
+ steam->serial_no);
+- input_unregister_device(input);
++ mutex_lock(&steam_devices_lock);
++ list_del(&steam->list);
++ mutex_unlock(&steam_devices_lock);
++ steam->serial_no[0] = 0;
+ }
+ }
+
+@@ -600,6 +632,9 @@ static int steam_client_ll_open(struct hid_device *hdev)
+ mutex_lock(&steam->mutex);
+ steam->client_opened = true;
+ mutex_unlock(&steam->mutex);
++
++ steam_input_unregister(steam);
++
+ return ret;
+ }
+
+@@ -609,13 +644,13 @@ static void steam_client_ll_close(struct hid_device *hdev)
+
+ mutex_lock(&steam->mutex);
+ steam->client_opened = false;
+- if (steam->input_opened)
+- steam_set_lizard_mode(steam, false);
+- else
+- steam_set_lizard_mode(steam, lizard_mode);
+ mutex_unlock(&steam->mutex);
+
+ hid_hw_close(steam->hdev);
++ if (steam->connected) {
++ steam_set_lizard_mode(steam, lizard_mode);
++ steam_input_register(steam);
++ }
+ }
+
+ static int steam_client_ll_raw_request(struct hid_device *hdev,
+@@ -744,11 +779,6 @@ static int steam_probe(struct hid_device *hdev,
+ }
+ }
+
+- mutex_lock(&steam_devices_lock);
+- steam_update_lizard_mode(steam);
+- list_add(&steam->list, &steam_devices);
+- mutex_unlock(&steam_devices_lock);
+-
+ return 0;
+
+ hid_hw_open_fail:
+@@ -774,10 +804,6 @@ static void steam_remove(struct hid_device *hdev)
+ return;
+ }
+
+- mutex_lock(&steam_devices_lock);
+- list_del(&steam->list);
+- mutex_unlock(&steam_devices_lock);
+-
+ hid_destroy_device(steam->client_hdev);
+ steam->client_opened = false;
+ cancel_work_sync(&steam->work_connect);
+@@ -792,12 +818,14 @@ static void steam_remove(struct hid_device *hdev)
+ static void steam_do_connect_event(struct steam_device *steam, bool connected)
+ {
+ unsigned long flags;
++ bool changed;
+
+ spin_lock_irqsave(&steam->lock, flags);
++ changed = steam->connected != connected;
+ steam->connected = connected;
+ spin_unlock_irqrestore(&steam->lock, flags);
+
+- if (schedule_work(&steam->work_connect) == 0)
++ if (changed && schedule_work(&steam->work_connect) == 0)
+ dbg_hid("%s: connected=%d event already queued\n",
+ __func__, connected);
+ }
+@@ -1019,13 +1047,8 @@ static int steam_raw_event(struct hid_device *hdev,
+ return 0;
+ rcu_read_lock();
+ input = rcu_dereference(steam->input);
+- if (likely(input)) {
++ if (likely(input))
+ steam_do_input_event(steam, input, data);
+- } else {
+- dbg_hid("%s: input data without connect event\n",
+- __func__);
+- steam_do_connect_event(steam, true);
+- }
+ rcu_read_unlock();
+ break;
+ case STEAM_EV_CONNECT:
+@@ -1074,7 +1097,10 @@ static int steam_param_set_lizard_mode(const char *val,
+
+ mutex_lock(&steam_devices_lock);
+ list_for_each_entry(steam, &steam_devices, list) {
+- steam_update_lizard_mode(steam);
++ mutex_lock(&steam->mutex);
++ if (!steam->client_opened)
++ steam_set_lizard_mode(steam, lizard_mode);
++ mutex_unlock(&steam->mutex);
+ }
+ mutex_unlock(&steam_devices_lock);
+ return 0;
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 5c88706121c1..39134dd305f5 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -328,7 +328,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ u8 opcode, sc, vl;
+ u16 pkey;
+ u32 slid;
+- int req_queued = 0;
+ u16 dlid;
+ u32 selector;
+
+@@ -392,7 +391,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->data_len = 0;
+ req->pq = pq;
+ req->cq = cq;
+- req->status = -1;
+ req->ahg_idx = -1;
+ req->iov_idx = 0;
+ req->sent = 0;
+@@ -400,12 +398,14 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->seqcomp = 0;
+ req->seqsubmitted = 0;
+ req->tids = NULL;
+- req->done = 0;
+ req->has_error = 0;
+ INIT_LIST_HEAD(&req->txps);
+
+ memcpy(&req->info, &info, sizeof(info));
+
++ /* The request is initialized, count it */
++ atomic_inc(&pq->n_reqs);
++
+ if (req_opcode(info.ctrl) == EXPECTED) {
+ /* expected must have a TID info and at least one data vector */
+ if (req->data_iovs < 2) {
+@@ -500,7 +500,6 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ ret = pin_vector_pages(req, &req->iovs[i]);
+ if (ret) {
+ req->data_iovs = i;
+- req->status = ret;
+ goto free_req;
+ }
+ req->data_len += req->iovs[i].iov.iov_len;
+@@ -561,14 +560,10 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ req->ahg_idx = sdma_ahg_alloc(req->sde);
+
+ set_comp_state(pq, cq, info.comp_idx, QUEUED, 0);
+- atomic_inc(&pq->n_reqs);
+- req_queued = 1;
+ /* Send the first N packets in the request to buy us some time */
+ ret = user_sdma_send_pkts(req, pcount);
+- if (unlikely(ret < 0 && ret != -EBUSY)) {
+- req->status = ret;
++ if (unlikely(ret < 0 && ret != -EBUSY))
+ goto free_req;
+- }
+
+ /*
+ * It is possible that the SDMA engine would have processed all the
+@@ -588,14 +583,8 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ while (req->seqsubmitted != req->info.npkts) {
+ ret = user_sdma_send_pkts(req, pcount);
+ if (ret < 0) {
+- if (ret != -EBUSY) {
+- req->status = ret;
+- WRITE_ONCE(req->has_error, 1);
+- if (READ_ONCE(req->seqcomp) ==
+- req->seqsubmitted - 1)
+- goto free_req;
+- return ret;
+- }
++ if (ret != -EBUSY)
++ goto free_req;
+ wait_event_interruptible_timeout(
+ pq->busy.wait_dma,
+ (pq->state == SDMA_PKT_Q_ACTIVE),
+@@ -606,10 +595,19 @@ int hfi1_user_sdma_process_request(struct hfi1_filedata *fd,
+ *count += idx;
+ return 0;
+ free_req:
+- user_sdma_free_request(req, true);
+- if (req_queued)
++ /*
++ * If the submitted seqsubmitted == npkts, the completion routine
++ * controls the final state. If sequbmitted < npkts, wait for any
++ * outstanding packets to finish before cleaning up.
++ */
++ if (req->seqsubmitted < req->info.npkts) {
++ if (req->seqsubmitted)
++ wait_event(pq->busy.wait_dma,
++ (req->seqcomp == req->seqsubmitted - 1));
++ user_sdma_free_request(req, true);
+ pq_update(pq);
+- set_comp_state(pq, cq, info.comp_idx, ERROR, req->status);
++ set_comp_state(pq, cq, info.comp_idx, ERROR, ret);
++ }
+ return ret;
+ }
+
+@@ -917,7 +915,6 @@ dosend:
+ ret = sdma_send_txlist(req->sde, &pq->busy, &req->txps, &count);
+ req->seqsubmitted += count;
+ if (req->seqsubmitted == req->info.npkts) {
+- WRITE_ONCE(req->done, 1);
+ /*
+ * The txreq has already been submitted to the HW queue
+ * so we can free the AHG entry now. Corruption will not
+@@ -1365,11 +1362,15 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
+ return idx;
+ }
+
+-/*
+- * SDMA tx request completion callback. Called when the SDMA progress
+- * state machine gets notification that the SDMA descriptors for this
+- * tx request have been processed by the DMA engine. Called in
+- * interrupt context.
++/**
++ * user_sdma_txreq_cb() - SDMA tx request completion callback.
++ * @txreq: valid sdma tx request
++ * @status: success/failure of request
++ *
++ * Called when the SDMA progress state machine gets notification that
++ * the SDMA descriptors for this tx request have been processed by the
++ * DMA engine. Called in interrupt context.
++ * Only do work on completed sequences.
+ */
+ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ {
+@@ -1378,7 +1379,7 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ struct user_sdma_request *req;
+ struct hfi1_user_sdma_pkt_q *pq;
+ struct hfi1_user_sdma_comp_q *cq;
+- u16 idx;
++ enum hfi1_sdma_comp_state state = COMPLETE;
+
+ if (!tx->req)
+ return;
+@@ -1391,31 +1392,19 @@ static void user_sdma_txreq_cb(struct sdma_txreq *txreq, int status)
+ SDMA_DBG(req, "SDMA completion with error %d",
+ status);
+ WRITE_ONCE(req->has_error, 1);
++ state = ERROR;
+ }
+
+ req->seqcomp = tx->seqnum;
+ kmem_cache_free(pq->txreq_cache, tx);
+- tx = NULL;
+-
+- idx = req->info.comp_idx;
+- if (req->status == -1 && status == SDMA_TXREQ_S_OK) {
+- if (req->seqcomp == req->info.npkts - 1) {
+- req->status = 0;
+- user_sdma_free_request(req, false);
+- pq_update(pq);
+- set_comp_state(pq, cq, idx, COMPLETE, 0);
+- }
+- } else {
+- if (status != SDMA_TXREQ_S_OK)
+- req->status = status;
+- if (req->seqcomp == (READ_ONCE(req->seqsubmitted) - 1) &&
+- (READ_ONCE(req->done) ||
+- READ_ONCE(req->has_error))) {
+- user_sdma_free_request(req, false);
+- pq_update(pq);
+- set_comp_state(pq, cq, idx, ERROR, req->status);
+- }
+- }
++
++ /* sequence isn't complete? We are done */
++ if (req->seqcomp != req->info.npkts - 1)
++ return;
++
++ user_sdma_free_request(req, false);
++ set_comp_state(pq, cq, req->info.comp_idx, state, status);
++ pq_update(pq);
+ }
+
+ static inline void pq_update(struct hfi1_user_sdma_pkt_q *pq)
+@@ -1448,6 +1437,8 @@ static void user_sdma_free_request(struct user_sdma_request *req, bool unpin)
+ if (!node)
+ continue;
+
++ req->iovs[i].node = NULL;
++
+ if (unpin)
+ hfi1_mmu_rb_remove(req->pq->handler,
+ &node->rb);
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.h b/drivers/infiniband/hw/hfi1/user_sdma.h
+index d2bc77f75253..0ae06456c868 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.h
++++ b/drivers/infiniband/hw/hfi1/user_sdma.h
+@@ -205,8 +205,6 @@ struct user_sdma_request {
+ /* Writeable fields shared with interrupt */
+ u64 seqcomp ____cacheline_aligned_in_smp;
+ u64 seqsubmitted;
+- /* status of the last txreq completed */
+- int status;
+
+ /* Send side fields */
+ struct list_head txps ____cacheline_aligned_in_smp;
+@@ -228,7 +226,6 @@ struct user_sdma_request {
+ u16 tididx;
+ /* progress index moving along the iovs array */
+ u8 iov_idx;
+- u8 done;
+ u8 has_error;
+
+ struct user_sdma_iovec iovs[MAX_VECTORS_PER_REQ];
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 55d33500d55e..5e85f3cca867 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -99,9 +99,7 @@ static int synaptics_mode_cmd(struct psmouse *psmouse, u8 mode)
+ int synaptics_detect(struct psmouse *psmouse, bool set_properties)
+ {
+ struct ps2dev *ps2dev = &psmouse->ps2dev;
+- u8 param[4];
+-
+- param[0] = 0;
++ u8 param[4] = { 0 };
+
+ ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES);
+ ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES);
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 7b662bd1c7a0..30b15e91d8be 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -288,10 +288,10 @@ static const struct reg_value ov5640_init_setting_30fps_VGA[] = {
+ {0x3a0d, 0x04, 0, 0}, {0x3a14, 0x03, 0, 0}, {0x3a15, 0xd8, 0, 0},
+ {0x4001, 0x02, 0, 0}, {0x4004, 0x02, 0, 0}, {0x3000, 0x00, 0, 0},
+ {0x3002, 0x1c, 0, 0}, {0x3004, 0xff, 0, 0}, {0x3006, 0xc3, 0, 0},
+- {0x300e, 0x45, 0, 0}, {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0},
++ {0x302e, 0x08, 0, 0}, {0x4300, 0x3f, 0, 0},
+ {0x501f, 0x00, 0, 0}, {0x4713, 0x03, 0, 0}, {0x4407, 0x04, 0, 0},
+ {0x440e, 0x00, 0, 0}, {0x460b, 0x35, 0, 0}, {0x460c, 0x22, 0, 0},
+- {0x4837, 0x0a, 0, 0}, {0x4800, 0x04, 0, 0}, {0x3824, 0x02, 0, 0},
++ {0x4837, 0x0a, 0, 0}, {0x3824, 0x02, 0, 0},
+ {0x5000, 0xa7, 0, 0}, {0x5001, 0xa3, 0, 0}, {0x5180, 0xff, 0, 0},
+ {0x5181, 0xf2, 0, 0}, {0x5182, 0x00, 0, 0}, {0x5183, 0x14, 0, 0},
+ {0x5184, 0x25, 0, 0}, {0x5185, 0x24, 0, 0}, {0x5186, 0x09, 0, 0},
+@@ -910,6 +910,26 @@ static int ov5640_mod_reg(struct ov5640_dev *sensor, u16 reg,
+ }
+
+ /* download ov5640 settings to sensor through i2c */
++static int ov5640_set_timings(struct ov5640_dev *sensor,
++ const struct ov5640_mode_info *mode)
++{
++ int ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact);
++ if (ret < 0)
++ return ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact);
++ if (ret < 0)
++ return ret;
++
++ ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot);
++ if (ret < 0)
++ return ret;
++
++ return ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot);
++}
++
+ static int ov5640_load_regs(struct ov5640_dev *sensor,
+ const struct ov5640_mode_info *mode)
+ {
+@@ -937,7 +957,13 @@ static int ov5640_load_regs(struct ov5640_dev *sensor,
+ usleep_range(1000 * delay_ms, 1000 * delay_ms + 100);
+ }
+
+- return ret;
++ return ov5640_set_timings(sensor, mode);
++}
++
++static int ov5640_set_autoexposure(struct ov5640_dev *sensor, bool on)
++{
++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
++ BIT(0), on ? 0 : BIT(0));
+ }
+
+ /* read exposure, in number of line periods */
+@@ -996,6 +1022,18 @@ static int ov5640_get_gain(struct ov5640_dev *sensor)
+ return gain & 0x3ff;
+ }
+
++static int ov5640_set_gain(struct ov5640_dev *sensor, int gain)
++{
++ return ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN,
++ (u16)gain & 0x3ff);
++}
++
++static int ov5640_set_autogain(struct ov5640_dev *sensor, bool on)
++{
++ return ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
++ BIT(1), on ? 0 : BIT(1));
++}
++
+ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on)
+ {
+ int ret;
+@@ -1104,12 +1142,25 @@ static int ov5640_set_stream_mipi(struct ov5640_dev *sensor, bool on)
+ {
+ int ret;
+
+- ret = ov5640_mod_reg(sensor, OV5640_REG_MIPI_CTRL00, BIT(5),
+- on ? 0 : BIT(5));
+- if (ret)
+- return ret;
+- ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00,
+- on ? 0x00 : 0x70);
++ /*
++ * Enable/disable the MIPI interface
++ *
++ * 0x300e = on ? 0x45 : 0x40
++ *
++ * FIXME: the sensor manual (version 2.03) reports
++ * [7:5] = 000 : 1 data lane mode
++ * [7:5] = 001 : 2 data lanes mode
++ * But this settings do not work, while the following ones
++ * have been validated for 2 data lanes mode.
++ *
++ * [7:5] = 010 : 2 data lanes mode
++ * [4] = 0 : Power up MIPI HS Tx
++ * [3] = 0 : Power up MIPI LS Rx
++ * [2] = 1/0 : MIPI interface enable/disable
++ * [1:0] = 01/00: FIXME: 'debug'
++ */
++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00,
++ on ? 0x45 : 0x40);
+ if (ret)
+ return ret;
+
+@@ -1333,7 +1384,7 @@ static int ov5640_set_ae_target(struct ov5640_dev *sensor, int target)
+ return ov5640_write_reg(sensor, OV5640_REG_AEC_CTRL1F, fast_low);
+ }
+
+-static int ov5640_binning_on(struct ov5640_dev *sensor)
++static int ov5640_get_binning(struct ov5640_dev *sensor)
+ {
+ u8 temp;
+ int ret;
+@@ -1341,8 +1392,8 @@ static int ov5640_binning_on(struct ov5640_dev *sensor)
+ ret = ov5640_read_reg(sensor, OV5640_REG_TIMING_TC_REG21, &temp);
+ if (ret)
+ return ret;
+- temp &= 0xfe;
+- return temp ? 1 : 0;
++
++ return temp & BIT(0);
+ }
+
+ static int ov5640_set_binning(struct ov5640_dev *sensor, bool enable)
+@@ -1387,30 +1438,6 @@ static int ov5640_set_virtual_channel(struct ov5640_dev *sensor)
+ return ov5640_write_reg(sensor, OV5640_REG_DEBUG_MODE, temp);
+ }
+
+-static int ov5640_set_timings(struct ov5640_dev *sensor,
+- const struct ov5640_mode_info *mode)
+-{
+- int ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPHO, mode->hact);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_DVPVO, mode->vact);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_HTS, mode->htot);
+- if (ret < 0)
+- return ret;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_TIMING_VTS, mode->vtot);
+- if (ret < 0)
+- return ret;
+-
+- return 0;
+-}
+-
+ static const struct ov5640_mode_info *
+ ov5640_find_mode(struct ov5640_dev *sensor, enum ov5640_frame_rate fr,
+ int width, int height, bool nearest)
+@@ -1452,7 +1479,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ if (ret < 0)
+ return ret;
+ prev_shutter = ret;
+- ret = ov5640_binning_on(sensor);
++ ret = ov5640_get_binning(sensor);
+ if (ret < 0)
+ return ret;
+ if (ret && mode->id != OV5640_MODE_720P_1280_720 &&
+@@ -1573,7 +1600,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ }
+
+ /* set capture gain */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.gain, cap_gain16);
++ ret = ov5640_set_gain(sensor, cap_gain16);
+ if (ret)
+ return ret;
+
+@@ -1586,7 +1613,7 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ }
+
+ /* set exposure */
+- return __v4l2_ctrl_s_ctrl(sensor->ctrls.exposure, cap_shutter);
++ return ov5640_set_exposure(sensor, cap_shutter);
+ }
+
+ /*
+@@ -1594,25 +1621,13 @@ static int ov5640_set_mode_exposure_calc(struct ov5640_dev *sensor,
+ * change mode directly
+ */
+ static int ov5640_set_mode_direct(struct ov5640_dev *sensor,
+- const struct ov5640_mode_info *mode,
+- s32 exposure)
++ const struct ov5640_mode_info *mode)
+ {
+- int ret;
+-
+ if (!mode->reg_data)
+ return -EINVAL;
+
+ /* Write capture setting */
+- ret = ov5640_load_regs(sensor, mode);
+- if (ret < 0)
+- return ret;
+-
+- /* turn auto gain/exposure back on for direct mode */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 1);
+- if (ret)
+- return ret;
+-
+- return __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_exp, exposure);
++ return ov5640_load_regs(sensor, mode);
+ }
+
+ static int ov5640_set_mode(struct ov5640_dev *sensor)
+@@ -1620,27 +1635,31 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ const struct ov5640_mode_info *mode = sensor->current_mode;
+ const struct ov5640_mode_info *orig_mode = sensor->last_mode;
+ enum ov5640_downsize_mode dn_mode, orig_dn_mode;
+- s32 exposure;
++ bool auto_gain = sensor->ctrls.auto_gain->val == 1;
++ bool auto_exp = sensor->ctrls.auto_exp->val == V4L2_EXPOSURE_AUTO;
+ int ret;
+
+ dn_mode = mode->dn_mode;
+ orig_dn_mode = orig_mode->dn_mode;
+
+ /* auto gain and exposure must be turned off when changing modes */
+- ret = __v4l2_ctrl_s_ctrl(sensor->ctrls.auto_gain, 0);
+- if (ret)
+- return ret;
++ if (auto_gain) {
++ ret = ov5640_set_autogain(sensor, false);
++ if (ret)
++ return ret;
++ }
+
+- exposure = sensor->ctrls.auto_exp->val;
+- ret = ov5640_set_exposure(sensor, V4L2_EXPOSURE_MANUAL);
+- if (ret)
+- return ret;
++ if (auto_exp) {
++ ret = ov5640_set_autoexposure(sensor, false);
++ if (ret)
++ goto restore_auto_gain;
++ }
+
+ if ((dn_mode == SUBSAMPLING && orig_dn_mode == SCALING) ||
+ (dn_mode == SCALING && orig_dn_mode == SUBSAMPLING)) {
+ /*
+ * change between subsampling and scaling
+- * go through exposure calucation
++ * go through exposure calculation
+ */
+ ret = ov5640_set_mode_exposure_calc(sensor, mode);
+ } else {
+@@ -1648,15 +1667,16 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ * change inside subsampling or scaling
+ * download firmware directly
+ */
+- ret = ov5640_set_mode_direct(sensor, mode, exposure);
++ ret = ov5640_set_mode_direct(sensor, mode);
+ }
+-
+ if (ret < 0)
+- return ret;
++ goto restore_auto_exp_gain;
+
+- ret = ov5640_set_timings(sensor, mode);
+- if (ret < 0)
+- return ret;
++ /* restore auto gain and exposure */
++ if (auto_gain)
++ ov5640_set_autogain(sensor, true);
++ if (auto_exp)
++ ov5640_set_autoexposure(sensor, true);
+
+ ret = ov5640_set_binning(sensor, dn_mode != SCALING);
+ if (ret < 0)
+@@ -1678,6 +1698,15 @@ static int ov5640_set_mode(struct ov5640_dev *sensor)
+ sensor->last_mode = mode;
+
+ return 0;
++
++restore_auto_exp_gain:
++ if (auto_exp)
++ ov5640_set_autoexposure(sensor, true);
++restore_auto_gain:
++ if (auto_gain)
++ ov5640_set_autogain(sensor, true);
++
++ return ret;
+ }
+
+ static int ov5640_set_framefmt(struct ov5640_dev *sensor,
+@@ -1790,23 +1819,69 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on)
+ if (ret)
+ goto power_off;
+
++ /* We're done here for DVP bus, while CSI-2 needs setup. */
++ if (sensor->ep.bus_type != V4L2_MBUS_CSI2)
++ return 0;
++
++ /*
++ * Power up MIPI HS Tx and LS Rx; 2 data lanes mode
++ *
++ * 0x300e = 0x40
++ * [7:5] = 010 : 2 data lanes mode (see FIXME note in
++ * "ov5640_set_stream_mipi()")
++ * [4] = 0 : Power up MIPI HS Tx
++ * [3] = 0 : Power up MIPI LS Rx
++ * [2] = 0 : MIPI interface disabled
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_IO_MIPI_CTRL00, 0x40);
++ if (ret)
++ goto power_off;
++
++ /*
++ * Gate clock and set LP11 in 'no packets mode' (idle)
++ *
++ * 0x4800 = 0x24
++ * [5] = 1 : Gate clock when 'no packets'
++ * [2] = 1 : MIPI bus in LP11 when 'no packets'
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_MIPI_CTRL00, 0x24);
++ if (ret)
++ goto power_off;
++
++ /*
++ * Set data lanes and clock in LP11 when 'sleeping'
++ *
++ * 0x3019 = 0x70
++ * [6] = 1 : MIPI data lane 2 in LP11 when 'sleeping'
++ * [5] = 1 : MIPI data lane 1 in LP11 when 'sleeping'
++ * [4] = 1 : MIPI clock lane in LP11 when 'sleeping'
++ */
++ ret = ov5640_write_reg(sensor,
++ OV5640_REG_PAD_OUTPUT00, 0x70);
++ if (ret)
++ goto power_off;
++
++ /* Give lanes some time to coax into LP11 state. */
++ usleep_range(500, 1000);
++
++ } else {
+ if (sensor->ep.bus_type == V4L2_MBUS_CSI2) {
+- /*
+- * start streaming briefly followed by stream off in
+- * order to coax the clock lane into LP-11 state.
+- */
+- ret = ov5640_set_stream_mipi(sensor, true);
+- if (ret)
+- goto power_off;
+- usleep_range(1000, 2000);
+- ret = ov5640_set_stream_mipi(sensor, false);
+- if (ret)
+- goto power_off;
++ /* Reset MIPI bus settings to their default values. */
++ ov5640_write_reg(sensor,
++ OV5640_REG_IO_MIPI_CTRL00, 0x58);
++ ov5640_write_reg(sensor,
++ OV5640_REG_MIPI_CTRL00, 0x04);
++ ov5640_write_reg(sensor,
++ OV5640_REG_PAD_OUTPUT00, 0x00);
+ }
+
+- return 0;
++ ov5640_set_power_off(sensor);
+ }
+
++ return 0;
++
+ power_off:
+ ov5640_set_power_off(sensor);
+ return ret;
+@@ -2144,20 +2219,20 @@ static int ov5640_set_ctrl_white_balance(struct ov5640_dev *sensor, int awb)
+ return ret;
+ }
+
+-static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp)
++static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor,
++ enum v4l2_exposure_auto_type auto_exposure)
+ {
+ struct ov5640_ctrls *ctrls = &sensor->ctrls;
+- bool auto_exposure = (exp == V4L2_EXPOSURE_AUTO);
++ bool auto_exp = (auto_exposure == V4L2_EXPOSURE_AUTO);
+ int ret = 0;
+
+ if (ctrls->auto_exp->is_new) {
+- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
+- BIT(0), auto_exposure ? 0 : BIT(0));
++ ret = ov5640_set_autoexposure(sensor, auto_exp);
+ if (ret)
+ return ret;
+ }
+
+- if (!auto_exposure && ctrls->exposure->is_new) {
++ if (!auto_exp && ctrls->exposure->is_new) {
+ u16 max_exp;
+
+ ret = ov5640_read_reg16(sensor, OV5640_REG_AEC_PK_VTS,
+@@ -2177,25 +2252,19 @@ static int ov5640_set_ctrl_exposure(struct ov5640_dev *sensor, int exp)
+ return ret;
+ }
+
+-static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, int auto_gain)
++static int ov5640_set_ctrl_gain(struct ov5640_dev *sensor, bool auto_gain)
+ {
+ struct ov5640_ctrls *ctrls = &sensor->ctrls;
+ int ret = 0;
+
+ if (ctrls->auto_gain->is_new) {
+- ret = ov5640_mod_reg(sensor, OV5640_REG_AEC_PK_MANUAL,
+- BIT(1),
+- ctrls->auto_gain->val ? 0 : BIT(1));
++ ret = ov5640_set_autogain(sensor, auto_gain);
+ if (ret)
+ return ret;
+ }
+
+- if (!auto_gain && ctrls->gain->is_new) {
+- u16 gain = (u16)ctrls->gain->val;
+-
+- ret = ov5640_write_reg16(sensor, OV5640_REG_AEC_PK_REAL_GAIN,
+- gain & 0x3ff);
+- }
++ if (!auto_gain && ctrls->gain->is_new)
++ ret = ov5640_set_gain(sensor, ctrls->gain->val);
+
+ return ret;
+ }
+@@ -2268,16 +2337,12 @@ static int ov5640_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
+
+ switch (ctrl->id) {
+ case V4L2_CID_AUTOGAIN:
+- if (!ctrl->val)
+- return 0;
+ val = ov5640_get_gain(sensor);
+ if (val < 0)
+ return val;
+ sensor->ctrls.gain->val = val;
+ break;
+ case V4L2_CID_EXPOSURE_AUTO:
+- if (ctrl->val == V4L2_EXPOSURE_MANUAL)
+- return 0;
+ val = ov5640_get_exposure(sensor);
+ if (val < 0)
+ return val;
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 7bfd366d970d..c4115bae5db1 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -12,6 +12,7 @@
+ * - JMicron (hardware and technical support)
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/string.h>
+ #include <linux/delay.h>
+ #include <linux/highmem.h>
+@@ -462,6 +463,9 @@ struct intel_host {
+ u32 dsm_fns;
+ int drv_strength;
+ bool d3_retune;
++ bool rpm_retune_ok;
++ u32 glk_rx_ctrl1;
++ u32 glk_tun_val;
+ };
+
+ static const guid_t intel_dsm_guid =
+@@ -791,6 +795,77 @@ cleanup:
+ return ret;
+ }
+
++#ifdef CONFIG_PM
++#define GLK_RX_CTRL1 0x834
++#define GLK_TUN_VAL 0x840
++#define GLK_PATH_PLL GENMASK(13, 8)
++#define GLK_DLY GENMASK(6, 0)
++/* Workaround firmware failing to restore the tuning value */
++static void glk_rpm_retune_wa(struct sdhci_pci_chip *chip, bool susp)
++{
++ struct sdhci_pci_slot *slot = chip->slots[0];
++ struct intel_host *intel_host = sdhci_pci_priv(slot);
++ struct sdhci_host *host = slot->host;
++ u32 glk_rx_ctrl1;
++ u32 glk_tun_val;
++ u32 dly;
++
++ if (intel_host->rpm_retune_ok || !mmc_can_retune(host->mmc))
++ return;
++
++ glk_rx_ctrl1 = sdhci_readl(host, GLK_RX_CTRL1);
++ glk_tun_val = sdhci_readl(host, GLK_TUN_VAL);
++
++ if (susp) {
++ intel_host->glk_rx_ctrl1 = glk_rx_ctrl1;
++ intel_host->glk_tun_val = glk_tun_val;
++ return;
++ }
++
++ if (!intel_host->glk_tun_val)
++ return;
++
++ if (glk_rx_ctrl1 != intel_host->glk_rx_ctrl1) {
++ intel_host->rpm_retune_ok = true;
++ return;
++ }
++
++ dly = FIELD_PREP(GLK_DLY, FIELD_GET(GLK_PATH_PLL, glk_rx_ctrl1) +
++ (intel_host->glk_tun_val << 1));
++ if (dly == FIELD_GET(GLK_DLY, glk_rx_ctrl1))
++ return;
++
++ glk_rx_ctrl1 = (glk_rx_ctrl1 & ~GLK_DLY) | dly;
++ sdhci_writel(host, glk_rx_ctrl1, GLK_RX_CTRL1);
++
++ intel_host->rpm_retune_ok = true;
++ chip->rpm_retune = true;
++ mmc_retune_needed(host->mmc);
++ pr_info("%s: Requiring re-tune after rpm resume", mmc_hostname(host->mmc));
++}
++
++static void glk_rpm_retune_chk(struct sdhci_pci_chip *chip, bool susp)
++{
++ if (chip->pdev->device == PCI_DEVICE_ID_INTEL_GLK_EMMC &&
++ !chip->rpm_retune)
++ glk_rpm_retune_wa(chip, susp);
++}
++
++static int glk_runtime_suspend(struct sdhci_pci_chip *chip)
++{
++ glk_rpm_retune_chk(chip, true);
++
++ return sdhci_cqhci_runtime_suspend(chip);
++}
++
++static int glk_runtime_resume(struct sdhci_pci_chip *chip)
++{
++ glk_rpm_retune_chk(chip, false);
++
++ return sdhci_cqhci_runtime_resume(chip);
++}
++#endif
++
+ #ifdef CONFIG_ACPI
+ static int ni_set_max_freq(struct sdhci_pci_slot *slot)
+ {
+@@ -879,8 +954,8 @@ static const struct sdhci_pci_fixes sdhci_intel_glk_emmc = {
+ .resume = sdhci_cqhci_resume,
+ #endif
+ #ifdef CONFIG_PM
+- .runtime_suspend = sdhci_cqhci_runtime_suspend,
+- .runtime_resume = sdhci_cqhci_runtime_resume,
++ .runtime_suspend = glk_runtime_suspend,
++ .runtime_resume = glk_runtime_resume,
+ #endif
+ .quirks = SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN |
+@@ -1762,8 +1837,13 @@ static struct sdhci_pci_slot *sdhci_pci_probe_slot(
+ device_init_wakeup(&pdev->dev, true);
+
+ if (slot->cd_idx >= 0) {
+- ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
++ ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
+ slot->cd_override_level, 0, NULL);
++ if (ret && ret != -EPROBE_DEFER)
++ ret = mmc_gpiod_request_cd(host->mmc, NULL,
++ slot->cd_idx,
++ slot->cd_override_level,
++ 0, NULL);
+ if (ret == -EPROBE_DEFER)
+ goto remove;
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 49163570a63a..3b3f88ffab53 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -477,6 +477,34 @@ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
+ }
+ EXPORT_SYMBOL_GPL(can_put_echo_skb);
+
++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr)
++{
++ struct can_priv *priv = netdev_priv(dev);
++ struct sk_buff *skb = priv->echo_skb[idx];
++ struct canfd_frame *cf;
++
++ if (idx >= priv->echo_skb_max) {
++ netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
++ __func__, idx, priv->echo_skb_max);
++ return NULL;
++ }
++
++ if (!skb) {
++ netdev_err(dev, "%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n",
++ __func__, idx);
++ return NULL;
++ }
++
++ /* Using "struct canfd_frame::len" for the frame
++ * length is supported on both CAN and CANFD frames.
++ */
++ cf = (struct canfd_frame *)skb->data;
++ *len_ptr = cf->len;
++ priv->echo_skb[idx] = NULL;
++
++ return skb;
++}
++
+ /*
+ * Get the skb from the stack and loop it back locally
+ *
+@@ -486,22 +514,16 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);
+ */
+ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ {
+- struct can_priv *priv = netdev_priv(dev);
+-
+- BUG_ON(idx >= priv->echo_skb_max);
+-
+- if (priv->echo_skb[idx]) {
+- struct sk_buff *skb = priv->echo_skb[idx];
+- struct can_frame *cf = (struct can_frame *)skb->data;
+- u8 dlc = cf->can_dlc;
++ struct sk_buff *skb;
++ u8 len;
+
+- netif_rx(priv->echo_skb[idx]);
+- priv->echo_skb[idx] = NULL;
++ skb = __can_get_echo_skb(dev, idx, &len);
++ if (!skb)
++ return 0;
+
+- return dlc;
+- }
++ netif_rx(skb);
+
+- return 0;
++ return len;
+ }
+ EXPORT_SYMBOL_GPL(can_get_echo_skb);
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 8e972ef08637..75ce11395ee8 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -135,13 +135,12 @@
+
+ /* FLEXCAN interrupt flag register (IFLAG) bits */
+ /* Errata ERR005829 step7: Reserve first valid MB */
+-#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
+-#define FLEXCAN_TX_MB_OFF_FIFO 9
++#define FLEXCAN_TX_MB_RESERVED_OFF_FIFO 8
+ #define FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP 0
+-#define FLEXCAN_TX_MB_OFF_TIMESTAMP 1
+-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_OFF_TIMESTAMP + 1)
+-#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST 63
+-#define FLEXCAN_IFLAG_MB(x) BIT(x)
++#define FLEXCAN_TX_MB 63
++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_FIRST (FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP + 1)
++#define FLEXCAN_RX_MB_OFF_TIMESTAMP_LAST (FLEXCAN_TX_MB - 1)
++#define FLEXCAN_IFLAG_MB(x) BIT(x & 0x1f)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6)
+ #define FLEXCAN_IFLAG_RX_FIFO_AVAILABLE BIT(5)
+@@ -259,9 +258,7 @@ struct flexcan_priv {
+ struct can_rx_offload offload;
+
+ struct flexcan_regs __iomem *regs;
+- struct flexcan_mb __iomem *tx_mb;
+ struct flexcan_mb __iomem *tx_mb_reserved;
+- u8 tx_mb_idx;
+ u32 reg_ctrl_default;
+ u32 reg_imask1_default;
+ u32 reg_imask2_default;
+@@ -515,6 +512,7 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
+ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ const struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct can_frame *cf = (struct can_frame *)skb->data;
+ u32 can_id;
+ u32 data;
+@@ -537,17 +535,17 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
+
+ if (cf->can_dlc > 0) {
+ data = be32_to_cpup((__be32 *)&cf->data[0]);
+- priv->write(data, &priv->tx_mb->data[0]);
++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[0]);
+ }
+ if (cf->can_dlc > 4) {
+ data = be32_to_cpup((__be32 *)&cf->data[4]);
+- priv->write(data, &priv->tx_mb->data[1]);
++ priv->write(data, ®s->mb[FLEXCAN_TX_MB].data[1]);
+ }
+
+ can_put_echo_skb(skb, dev, 0);
+
+- priv->write(can_id, &priv->tx_mb->can_id);
+- priv->write(ctrl, &priv->tx_mb->can_ctrl);
++ priv->write(can_id, ®s->mb[FLEXCAN_TX_MB].can_id);
++ priv->write(ctrl, ®s->mb[FLEXCAN_TX_MB].can_ctrl);
+
+ /* Errata ERR005829 step8:
+ * Write twice INACTIVE(0x8) code to first MB.
+@@ -563,9 +561,13 @@ static netdev_tx_t flexcan_start_xmit(struct sk_buff *skb, struct net_device *de
+ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ {
+ struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct sk_buff *skb;
+ struct can_frame *cf;
+ bool rx_errors = false, tx_errors = false;
++ u32 timestamp;
++
++ timestamp = priv->read(®s->timer) << 16;
+
+ skb = alloc_can_err_skb(dev, &cf);
+ if (unlikely(!skb))
+@@ -612,17 +614,21 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ if (tx_errors)
+ dev->stats.tx_errors++;
+
+- can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+ }
+
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ {
+ struct flexcan_priv *priv = netdev_priv(dev);
++ struct flexcan_regs __iomem *regs = priv->regs;
+ struct sk_buff *skb;
+ struct can_frame *cf;
+ enum can_state new_state, rx_state, tx_state;
+ int flt;
+ struct can_berr_counter bec;
++ u32 timestamp;
++
++ timestamp = priv->read(®s->timer) << 16;
+
+ flt = reg_esr & FLEXCAN_ESR_FLT_CONF_MASK;
+ if (likely(flt == FLEXCAN_ESR_FLT_CONF_ACTIVE)) {
+@@ -652,7 +658,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ can_bus_off(dev);
+
+- can_rx_offload_irq_queue_err_skb(&priv->offload, skb);
++ can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
+ }
+
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+@@ -720,9 +726,14 @@ static unsigned int flexcan_mailbox_read(struct can_rx_offload *offload,
+ priv->write(BIT(n - 32), ®s->iflag2);
+ } else {
+ priv->write(FLEXCAN_IFLAG_RX_FIFO_AVAILABLE, ®s->iflag1);
+- priv->read(®s->timer);
+ }
+
++ /* Read the Free Running Timer. It is optional but recommended
++ * to unlock Mailbox as soon as possible and make it available
++ * for reception.
++ */
++ priv->read(®s->timer);
++
+ return 1;
+ }
+
+@@ -732,9 +743,9 @@ static inline u64 flexcan_read_reg_iflag_rx(struct flexcan_priv *priv)
+ struct flexcan_regs __iomem *regs = priv->regs;
+ u32 iflag1, iflag2;
+
+- iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default;
+- iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default &
+- ~FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
++ iflag2 = priv->read(®s->iflag2) & priv->reg_imask2_default &
++ ~FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
++ iflag1 = priv->read(®s->iflag1) & priv->reg_imask1_default;
+
+ return (u64)iflag2 << 32 | iflag1;
+ }
+@@ -746,11 +757,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ struct flexcan_priv *priv = netdev_priv(dev);
+ struct flexcan_regs __iomem *regs = priv->regs;
+ irqreturn_t handled = IRQ_NONE;
+- u32 reg_iflag1, reg_esr;
++ u32 reg_iflag2, reg_esr;
+ enum can_state last_state = priv->can.state;
+
+- reg_iflag1 = priv->read(®s->iflag1);
+-
+ /* reception interrupt */
+ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+ u64 reg_iflag;
+@@ -764,6 +773,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ break;
+ }
+ } else {
++ u32 reg_iflag1;
++
++ reg_iflag1 = priv->read(®s->iflag1);
+ if (reg_iflag1 & FLEXCAN_IFLAG_RX_FIFO_AVAILABLE) {
+ handled = IRQ_HANDLED;
+ can_rx_offload_irq_offload_fifo(&priv->offload);
+@@ -779,17 +791,22 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ }
+ }
+
++ reg_iflag2 = priv->read(®s->iflag2);
++
+ /* transmission complete interrupt */
+- if (reg_iflag1 & FLEXCAN_IFLAG_MB(priv->tx_mb_idx)) {
++ if (reg_iflag2 & FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB)) {
++ u32 reg_ctrl = priv->read(®s->mb[FLEXCAN_TX_MB].can_ctrl);
++
+ handled = IRQ_HANDLED;
+- stats->tx_bytes += can_get_echo_skb(dev, 0);
++ stats->tx_bytes += can_rx_offload_get_echo_skb(&priv->offload,
++ 0, reg_ctrl << 16);
+ stats->tx_packets++;
+ can_led_event(dev, CAN_LED_EVENT_TX);
+
+ /* after sending a RTR frame MB is in RX mode */
+ priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
+- &priv->tx_mb->can_ctrl);
+- priv->write(FLEXCAN_IFLAG_MB(priv->tx_mb_idx), ®s->iflag1);
++ ®s->mb[FLEXCAN_TX_MB].can_ctrl);
++ priv->write(FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB), ®s->iflag2);
+ netif_wake_queue(dev);
+ }
+
+@@ -931,15 +948,13 @@ static int flexcan_chip_start(struct net_device *dev)
+ reg_mcr &= ~FLEXCAN_MCR_MAXMB(0xff);
+ reg_mcr |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT | FLEXCAN_MCR_SUPV |
+ FLEXCAN_MCR_WRN_EN | FLEXCAN_MCR_SRX_DIS | FLEXCAN_MCR_IRMQ |
+- FLEXCAN_MCR_IDAM_C;
++ FLEXCAN_MCR_IDAM_C | FLEXCAN_MCR_MAXMB(FLEXCAN_TX_MB);
+
+- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
+ reg_mcr &= ~FLEXCAN_MCR_FEN;
+- reg_mcr |= FLEXCAN_MCR_MAXMB(priv->offload.mb_last);
+- } else {
+- reg_mcr |= FLEXCAN_MCR_FEN |
+- FLEXCAN_MCR_MAXMB(priv->tx_mb_idx);
+- }
++ else
++ reg_mcr |= FLEXCAN_MCR_FEN;
++
+ netdev_dbg(dev, "%s: writing mcr=0x%08x", __func__, reg_mcr);
+ priv->write(reg_mcr, ®s->mcr);
+
+@@ -982,16 +997,17 @@ static int flexcan_chip_start(struct net_device *dev)
+ priv->write(reg_ctrl2, ®s->ctrl2);
+ }
+
+- /* clear and invalidate all mailboxes first */
+- for (i = priv->tx_mb_idx; i < ARRAY_SIZE(regs->mb); i++) {
+- priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
+- ®s->mb[i].can_ctrl);
+- }
+-
+ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+- for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++)
++ for (i = priv->offload.mb_first; i <= priv->offload.mb_last; i++) {
+ priv->write(FLEXCAN_MB_CODE_RX_EMPTY,
+ ®s->mb[i].can_ctrl);
++ }
++ } else {
++ /* clear and invalidate unused mailboxes first */
++ for (i = FLEXCAN_TX_MB_RESERVED_OFF_FIFO; i <= ARRAY_SIZE(regs->mb); i++) {
++ priv->write(FLEXCAN_MB_CODE_RX_INACTIVE,
++ ®s->mb[i].can_ctrl);
++ }
+ }
+
+ /* Errata ERR005829: mark first TX mailbox as INACTIVE */
+@@ -1000,7 +1016,7 @@ static int flexcan_chip_start(struct net_device *dev)
+
+ /* mark TX mailbox as INACTIVE */
+ priv->write(FLEXCAN_MB_CODE_TX_INACTIVE,
+- &priv->tx_mb->can_ctrl);
++ ®s->mb[FLEXCAN_TX_MB].can_ctrl);
+
+ /* acceptance mask/acceptance code (accept everything) */
+ priv->write(0x0, ®s->rxgmask);
+@@ -1355,17 +1371,13 @@ static int flexcan_probe(struct platform_device *pdev)
+ priv->devtype_data = devtype_data;
+ priv->reg_xceiver = reg_xceiver;
+
+- if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP) {
+- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_TIMESTAMP;
++ if (priv->devtype_data->quirks & FLEXCAN_QUIRK_USE_OFF_TIMESTAMP)
+ priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_TIMESTAMP];
+- } else {
+- priv->tx_mb_idx = FLEXCAN_TX_MB_OFF_FIFO;
++ else
+ priv->tx_mb_reserved = ®s->mb[FLEXCAN_TX_MB_RESERVED_OFF_FIFO];
+- }
+- priv->tx_mb = ®s->mb[priv->tx_mb_idx];
+
+- priv->reg_imask1_default = FLEXCAN_IFLAG_MB(priv->tx_mb_idx);
+- priv->reg_imask2_default = 0;
++ priv->reg_imask1_default = 0;
++ priv->reg_imask2_default = FLEXCAN_IFLAG_MB(FLEXCAN_TX_MB);
+
+ priv->offload.mailbox_read = flexcan_mailbox_read;
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index d94dae216820..727691dd08fb 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -209,7 +209,54 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ }
+ EXPORT_SYMBOL_GPL(can_rx_offload_irq_offload_fifo);
+
+-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb)
++int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
++ struct sk_buff *skb, u32 timestamp)
++{
++ struct can_rx_offload_cb *cb;
++ unsigned long flags;
++
++ if (skb_queue_len(&offload->skb_queue) >
++ offload->skb_queue_len_max)
++ return -ENOMEM;
++
++ cb = can_rx_offload_get_cb(skb);
++ cb->timestamp = timestamp;
++
++ spin_lock_irqsave(&offload->skb_queue.lock, flags);
++ __skb_queue_add_sort(&offload->skb_queue, skb, can_rx_offload_compare);
++ spin_unlock_irqrestore(&offload->skb_queue.lock, flags);
++
++ can_rx_offload_schedule(offload);
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(can_rx_offload_queue_sorted);
++
++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
++ unsigned int idx, u32 timestamp)
++{
++ struct net_device *dev = offload->dev;
++ struct net_device_stats *stats = &dev->stats;
++ struct sk_buff *skb;
++ u8 len;
++ int err;
++
++ skb = __can_get_echo_skb(dev, idx, &len);
++ if (!skb)
++ return 0;
++
++ err = can_rx_offload_queue_sorted(offload, skb, timestamp);
++ if (err) {
++ stats->rx_errors++;
++ stats->tx_fifo_errors++;
++ }
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(can_rx_offload_get_echo_skb);
++
++int can_rx_offload_queue_tail(struct can_rx_offload *offload,
++ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+ offload->skb_queue_len_max)
+@@ -220,7 +267,7 @@ int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_b
+
+ return 0;
+ }
+-EXPORT_SYMBOL_GPL(can_rx_offload_irq_queue_err_skb);
++EXPORT_SYMBOL_GPL(can_rx_offload_queue_tail);
+
+ static int can_rx_offload_init_queue(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight)
+ {
+diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
+index 53e320c92a8b..ddaf46239e39 100644
+--- a/drivers/net/can/spi/hi311x.c
++++ b/drivers/net/can/spi/hi311x.c
+@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device *net)
+ {
+ struct hi3110_priv *priv = netdev_priv(net);
+ struct spi_device *spi = priv->spi;
+- unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_RISING;
++ unsigned long flags = IRQF_ONESHOT | IRQF_TRIGGER_HIGH;
+ int ret;
+
+ ret = open_candev(net);
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index 5444e6213d45..64a794be7fcb 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5997,7 +5997,8 @@ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
+ * for subsequent chanspecs.
+ */
+ channel->flags = IEEE80211_CHAN_NO_HT40 |
+- IEEE80211_CHAN_NO_80MHZ;
++ IEEE80211_CHAN_NO_80MHZ |
++ IEEE80211_CHAN_NO_160MHZ;
+ ch.bw = BRCMU_CHAN_BW_20;
+ cfg->d11inf.encchspec(&ch);
+ chaninfo = ch.chspec;
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+index cb5f32c1d705..0b3b1223cff7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
++++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+@@ -6,6 +6,7 @@
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -29,6 +30,7 @@
+ * BSD LICENSE
+ *
+ * Copyright(c) 2017 Intel Deutschland GmbH
++ * Copyright(c) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -84,7 +86,7 @@
+ #define ACPI_WRDS_WIFI_DATA_SIZE (ACPI_SAR_TABLE_SIZE + 2)
+ #define ACPI_EWRD_WIFI_DATA_SIZE ((ACPI_SAR_PROFILE_NUM - 1) * \
+ ACPI_SAR_TABLE_SIZE + 3)
+-#define ACPI_WGDS_WIFI_DATA_SIZE 18
++#define ACPI_WGDS_WIFI_DATA_SIZE 19
+ #define ACPI_WRDD_WIFI_DATA_SIZE 2
+ #define ACPI_SPLC_WIFI_DATA_SIZE 2
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 48a3611d6a31..4d49a1a3f504 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -880,7 +880,7 @@ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ IWL_DEBUG_RADIO(mvm, "Sending GEO_TX_POWER_LIMIT\n");
+
+ BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES * ACPI_WGDS_NUM_BANDS *
+- ACPI_WGDS_TABLE_SIZE != ACPI_WGDS_WIFI_DATA_SIZE);
++ ACPI_WGDS_TABLE_SIZE + 1 != ACPI_WGDS_WIFI_DATA_SIZE);
+
+ BUILD_BUG_ON(ACPI_NUM_GEO_PROFILES > IWL_NUM_GEO_PROFILES);
+
+@@ -915,6 +915,11 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+ return -ENOENT;
+ }
+
++static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm)
++{
++ return -ENOENT;
++}
++
+ static int iwl_mvm_sar_geo_init(struct iwl_mvm *mvm)
+ {
+ return 0;
+@@ -941,8 +946,11 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
+ IWL_DEBUG_RADIO(mvm,
+ "WRDS SAR BIOS table invalid or unavailable. (%d)\n",
+ ret);
+- /* if not available, don't fail and don't bother with EWRD */
+- return 0;
++ /*
++ * If not available, don't fail and don't bother with EWRD.
++ * Return 1 to tell that we can't use WGDS either.
++ */
++ return 1;
+ }
+
+ ret = iwl_mvm_sar_get_ewrd_table(mvm);
+@@ -955,9 +963,13 @@ static int iwl_mvm_sar_init(struct iwl_mvm *mvm)
+ /* choose profile 1 (WRDS) as default for both chains */
+ ret = iwl_mvm_sar_select_profile(mvm, 1, 1);
+
+- /* if we don't have profile 0 from BIOS, just skip it */
++ /*
++ * If we don't have profile 0 from BIOS, just skip it. This
++ * means that SAR Geo will not be enabled either, even if we
++ * have other valid profiles.
++ */
+ if (ret == -ENOENT)
+- return 0;
++ return 1;
+
+ return ret;
+ }
+@@ -1155,11 +1167,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ iwl_mvm_unref(mvm, IWL_MVM_REF_UCODE_DOWN);
+
+ ret = iwl_mvm_sar_init(mvm);
+- if (ret)
+- goto error;
++ if (ret == 0) {
++ ret = iwl_mvm_sar_geo_init(mvm);
++ } else if (ret > 0 && !iwl_mvm_sar_get_wgds_table(mvm)) {
++ /*
++ * If basic SAR is not available, we check for WGDS,
++ * which should *not* be available either. If it is
++ * available, issue an error, because we can't use SAR
++ * Geo without basic SAR.
++ */
++ IWL_ERR(mvm, "BIOS contains WGDS but no WRDS\n");
++ }
+
+- ret = iwl_mvm_sar_geo_init(mvm);
+- if (ret)
++ if (ret < 0)
+ goto error;
+
+ iwl_mvm_leds_sync(mvm);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 155cc2ac0120..afed549f5645 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -306,8 +306,12 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
+ goto out;
+ }
+
+- if (changed)
+- *changed = (resp->status == MCC_RESP_NEW_CHAN_PROFILE);
++ if (changed) {
++ u32 status = le32_to_cpu(resp->status);
++
++ *changed = (status == MCC_RESP_NEW_CHAN_PROFILE ||
++ status == MCC_RESP_ILLEGAL);
++ }
+
+ regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg,
+ __le32_to_cpu(resp->n_channels),
+@@ -4416,10 +4420,6 @@ static void iwl_mvm_mac_sta_statistics(struct ieee80211_hw *hw,
+ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
+ }
+
+- if (!fw_has_capa(&mvm->fw->ucode_capa,
+- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+- return;
+-
+ /* if beacon filtering isn't on mac80211 does it anyway */
+ if (!(vif->driver_flags & IEEE80211_VIF_BEACON_FILTER))
+ return;
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index cf48517944ec..f2579c94ffdb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -545,9 +545,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, const char *alpha2,
+ }
+
+ IWL_DEBUG_LAR(mvm,
+- "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n",
+- status, mcc, mcc >> 8, mcc & 0xff,
+- !!(status == MCC_RESP_NEW_CHAN_PROFILE), n_channels);
++ "MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n",
++ status, mcc, mcc >> 8, mcc & 0xff, n_channels);
+
+ exit:
+ iwl_free_resp(&cmd);
+diff --git a/drivers/opp/ti-opp-supply.c b/drivers/opp/ti-opp-supply.c
+index 9e5a9a3112c9..3f4fb4dbbe33 100644
+--- a/drivers/opp/ti-opp-supply.c
++++ b/drivers/opp/ti-opp-supply.c
+@@ -288,7 +288,10 @@ static int ti_opp_supply_set_opp(struct dev_pm_set_opp_data *data)
+ int ret;
+
+ vdd_uv = _get_optimal_vdd_voltage(dev, &opp_data,
+- new_supply_vbb->u_volt);
++ new_supply_vdd->u_volt);
++
++ if (new_supply_vdd->u_volt_min < vdd_uv)
++ new_supply_vdd->u_volt_min = vdd_uv;
+
+ /* Scaling up? Scale voltage before frequency */
+ if (freq > old_freq) {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+index 4ceb06f8a33c..4edeb4cae72a 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c
+@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = {
+
+ static struct meson_bank meson_gxbb_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+index 7dae1d7bf6b0..158f618f1695 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c
++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c
+@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = {
+
+ static struct meson_bank meson_gxl_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
+index 29a458da78db..4f3ab18636a3 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,
+ dev_dbg(pc->dev, "pin %u: disable bias\n", pin);
+
+ meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit);
+- ret = regmap_update_bits(pc->reg_pull, reg,
++ ret = regmap_update_bits(pc->reg_pullen, reg,
+ BIT(bit), 0);
+ if (ret)
+ return ret;
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c
+index c6d79315218f..86466173114d 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8.c
+@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = {
+
+ static struct meson_bank meson8_aobus_banks[] = {
+ /* name first last irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8_cbus_pinctrl_data = {
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index bb2a30964fc6..647ad15d5c3c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = {
+
+ static struct meson_bank meson8b_aobus_banks[] = {
+ /* name first lastc irq pullen pull dir out in */
+- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0),
++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0),
+ };
+
+ static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = {
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index df0c5776d49b..a5a19ff10535 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned char rtc_control;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ unsigned char mon, mday, hrs, min, sec, rtc_control;
+ int ret;
+
++ /* This not only a rtc_op, but also called directly */
+ if (!is_valid_irq(cmos->irq))
+ return -EIO;
+
+@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
+ struct cmos_rtc *cmos = dev_get_drvdata(dev);
+ unsigned long flags;
+
+- if (!is_valid_irq(cmos->irq))
+- return -EINVAL;
+-
+ spin_lock_irqsave(&rtc_lock, flags);
+
+ if (enabled)
+@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = {
+ .alarm_irq_enable = cmos_alarm_irq_enable,
+ };
+
++static const struct rtc_class_ops cmos_rtc_ops_no_alarm = {
++ .read_time = cmos_read_time,
++ .set_time = cmos_set_time,
++ .proc = cmos_procfs,
++};
++
+ /*----------------------------------------------------------------*/
+
+ /*
+@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
+ dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq);
+ goto cleanup1;
+ }
++
++ cmos_rtc.rtc->ops = &cmos_rtc_ops;
++ } else {
++ cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm;
+ }
+
+- cmos_rtc.rtc->ops = &cmos_rtc_ops;
+ cmos_rtc.rtc->nvram_old_abi = true;
+ retval = rtc_register_device(cmos_rtc.rtc);
+ if (retval)
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 9f99a0966550..7cb786d76e3c 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context,
+ memcpy(buf + 1, val, val_size);
+
+ ret = i2c_master_send(client, buf, val_size + 1);
++
++ kfree(buf);
++
+ if (ret != val_size + 1)
+ return ret < 0 ? ret : -EIO;
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+index 8f60f0e04599..410eccf0bc5e 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+index 9c5c5a601332..1c4ea58da1ae 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+@@ -1666,11 +1666,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index 08b503e274b8..687ff61bba9f 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -883,11 +883,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq)
+ {
+ struct hisi_hba *hisi_hba = dq->hisi_hba;
+ struct hisi_sas_slot *s, *s1, *s2 = NULL;
+- struct list_head *dq_list;
+ int dlvry_queue = dq->id;
+ int wp;
+
+- dq_list = &dq->list;
+ list_for_each_entry_safe(s, s1, &dq->list, delivery) {
+ if (!s->ready)
+ break;
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index aec5b10a8c85..ca6c3982548d 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -700,6 +700,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size)
+ rport = lpfc_ndlp_get_nrport(ndlp);
+ if (rport)
+ nrport = rport->remoteport;
++ else
++ nrport = NULL;
+ spin_unlock(&phba->hbalock);
+ if (!nrport)
+ continue;
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 431742201709..3ad460219fd6 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -152,17 +152,28 @@ static inline unsigned char *echo_buf_addr(struct n_tty_data *ldata, size_t i)
+ return &ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)];
+ }
+
++/* If we are not echoing the data, perhaps this is a secret so erase it */
++static void zero_buffer(struct tty_struct *tty, u8 *buffer, int size)
++{
++ bool icanon = !!L_ICANON(tty);
++ bool no_echo = !L_ECHO(tty);
++
++ if (icanon && no_echo)
++ memset(buffer, 0x00, size);
++}
++
+ static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
+ size_t tail, size_t n)
+ {
+ struct n_tty_data *ldata = tty->disc_data;
+ size_t size = N_TTY_BUF_SIZE - tail;
+- const void *from = read_buf_addr(ldata, tail);
++ void *from = read_buf_addr(ldata, tail);
+ int uncopied;
+
+ if (n > size) {
+ tty_audit_add_data(tty, from, size);
+ uncopied = copy_to_user(to, from, size);
++ zero_buffer(tty, from, size - uncopied);
+ if (uncopied)
+ return uncopied;
+ to += size;
+@@ -171,7 +182,9 @@ static int tty_copy_to_user(struct tty_struct *tty, void __user *to,
+ }
+
+ tty_audit_add_data(tty, from, n);
+- return copy_to_user(to, from, n);
++ uncopied = copy_to_user(to, from, n);
++ zero_buffer(tty, from, n - uncopied);
++ return uncopied;
+ }
+
+ /**
+@@ -1960,11 +1973,12 @@ static int copy_from_read_buf(struct tty_struct *tty,
+ n = min(head - ldata->read_tail, N_TTY_BUF_SIZE - tail);
+ n = min(*nr, n);
+ if (n) {
+- const unsigned char *from = read_buf_addr(ldata, tail);
++ unsigned char *from = read_buf_addr(ldata, tail);
+ retval = copy_to_user(*b, from, n);
+ n -= retval;
+ is_eof = n == 1 && *from == EOF_CHAR(tty);
+ tty_audit_add_data(tty, from, n);
++ zero_buffer(tty, from, n);
+ smp_store_release(&ldata->read_tail, ldata->read_tail + n);
+ /* Turn single EOF into zero-length read */
+ if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index c996b6859c5e..ae3ce330200e 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -468,11 +468,15 @@ receive_buf(struct tty_port *port, struct tty_buffer *head, int count)
+ {
+ unsigned char *p = char_buf_ptr(head, head->read);
+ char *f = NULL;
++ int n;
+
+ if (~head->flags & TTYB_NORMAL)
+ f = flag_buf_ptr(head, head->read);
+
+- return port->client_ops->receive_buf(port, p, f, count);
++ n = port->client_ops->receive_buf(port, p, f, count);
++ if (n > 0)
++ memset(p, 0, n);
++ return n;
+ }
+
+ /**
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 6e0823790bee..f79979ae482a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2847,7 +2847,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ USB_PORT_FEAT_C_BH_PORT_RESET);
+ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_PORT_LINK_STATE);
+- usb_clear_port_feature(hub->hdev, port1,
++
++ if (udev)
++ usb_clear_port_feature(hub->hdev, port1,
+ USB_PORT_FEAT_C_CONNECTION);
+
+ /*
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 88c80fcc39f5..fec97465ccac 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1499,6 +1499,7 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ err5:
+ dwc3_event_buffers_cleanup(dwc);
++ dwc3_ulpi_exit(dwc);
+
+ err4:
+ dwc3_free_scratch_buffers(dwc);
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 1286076a8890..842795856bf4 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -283,8 +283,10 @@ err:
+ static void dwc3_pci_remove(struct pci_dev *pci)
+ {
+ struct dwc3_pci *dwc = pci_get_drvdata(pci);
++ struct pci_dev *pdev = dwc->pci;
+
+- gpiod_remove_lookup_table(&platform_bytcr_gpios);
++ if (pdev->device == PCI_DEVICE_ID_INTEL_BYT)
++ gpiod_remove_lookup_table(&platform_bytcr_gpios);
+ #ifdef CONFIG_PM
+ cancel_work_sync(&dwc->wakeup_work);
+ #endif
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 2b53194081ba..2de1a3971a26 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1072,7 +1072,7 @@ static void dwc3_prepare_one_trb_sg(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr,
+- maxp - rem, false, 0,
++ maxp - rem, false, 1,
+ req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+@@ -1116,7 +1116,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to align transfer size */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, maxp - rem,
+- false, 0, req->request.stream_id,
++ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ } else if (req->request.zero && req->request.length &&
+@@ -1132,7 +1132,7 @@ static void dwc3_prepare_one_trb_linear(struct dwc3_ep *dep,
+ /* Now prepare one extra TRB to handle ZLP */
+ trb = &dep->trb_pool[dep->trb_enqueue];
+ __dwc3_prepare_one_trb(dep, trb, dwc->bounce_addr, 0,
+- false, 0, req->request.stream_id,
++ false, 1, req->request.stream_id,
+ req->request.short_not_ok,
+ req->request.no_interrupt);
+ } else {
+@@ -2250,7 +2250,7 @@ static int dwc3_gadget_ep_reclaim_completed_trb(struct dwc3_ep *dep,
+ * with one TRB pending in the ring. We need to manually clear HWO bit
+ * from that TRB.
+ */
+- if ((req->zero || req->unaligned) && (trb->ctrl & DWC3_TRB_CTRL_HWO)) {
++ if ((req->zero || req->unaligned) && !(trb->ctrl & DWC3_TRB_CTRL_CHN)) {
+ trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+ return 1;
+ }
+diff --git a/drivers/usb/host/xhci-histb.c b/drivers/usb/host/xhci-histb.c
+index 27f00160332e..3c4abb5a1c3f 100644
+--- a/drivers/usb/host/xhci-histb.c
++++ b/drivers/usb/host/xhci-histb.c
+@@ -325,14 +325,16 @@ static int xhci_histb_remove(struct platform_device *dev)
+ struct xhci_hcd_histb *histb = platform_get_drvdata(dev);
+ struct usb_hcd *hcd = histb->hcd;
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ device_wakeup_disable(&dev->dev);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+
+ xhci_histb_host_disable(histb);
+ usb_put_hcd(hcd);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 12eea73d9f20..94aca1b5ac8a 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -876,7 +876,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_SUSPEND;
+ }
+ if ((raw_port_status & PORT_PLS_MASK) == XDEV_RESUME &&
+- !DEV_SUPERSPEED_ANY(raw_port_status)) {
++ !DEV_SUPERSPEED_ANY(raw_port_status) && hcd->speed < HCD_USB3) {
+ if ((raw_port_status & PORT_RESET) ||
+ !(raw_port_status & PORT_PE))
+ return 0xffffffff;
+@@ -921,7 +921,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ time_left = wait_for_completion_timeout(
+ &bus_state->rexit_done[wIndex],
+ msecs_to_jiffies(
+- XHCI_MAX_REXIT_TIMEOUT));
++ XHCI_MAX_REXIT_TIMEOUT_MS));
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (time_left) {
+@@ -935,7 +935,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ } else {
+ int port_status = readl(port->addr);
+ xhci_warn(xhci, "Port resume took longer than %i msec, port status = 0x%x\n",
+- XHCI_MAX_REXIT_TIMEOUT,
++ XHCI_MAX_REXIT_TIMEOUT_MS,
+ port_status);
+ status |= USB_PORT_STAT_SUSPEND;
+ clear_bit(wIndex, &bus_state->rexit_ports);
+@@ -1474,15 +1474,18 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ unsigned long flags;
+ struct xhci_hub *rhub;
+ struct xhci_port **ports;
++ u32 portsc_buf[USB_MAXCHILDREN];
++ bool wake_enabled;
+
+ rhub = xhci_get_rhub(hcd);
+ ports = rhub->ports;
+ max_ports = rhub->num_ports;
+ bus_state = &xhci->bus_state[hcd_index(hcd)];
++ wake_enabled = hcd->self.root_hub->do_remote_wakeup;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+
+- if (hcd->self.root_hub->do_remote_wakeup) {
++ if (wake_enabled) {
+ if (bus_state->resuming_ports || /* USB2 */
+ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+@@ -1490,26 +1493,36 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ return -EBUSY;
+ }
+ }
+-
+- port_index = max_ports;
++ /*
++ * Prepare ports for suspend, but don't write anything before all ports
++ * are checked and we know bus suspend can proceed
++ */
+ bus_state->bus_suspended = 0;
++ port_index = max_ports;
+ while (port_index--) {
+- /* suspend the port if the port is not suspended */
+ u32 t1, t2;
+- int slot_id;
+
+ t1 = readl(ports[port_index]->addr);
+ t2 = xhci_port_state_to_neutral(t1);
++ portsc_buf[port_index] = 0;
+
+- if ((t1 & PORT_PE) && !(t1 & PORT_PLS_MASK)) {
+- xhci_dbg(xhci, "port %d not suspended\n", port_index);
+- slot_id = xhci_find_slot_id_by_port(hcd, xhci,
+- port_index + 1);
+- if (slot_id) {
++ /* Bail out if a USB3 port has a new device in link training */
++ if ((t1 & PORT_PLS_MASK) == XDEV_POLLING) {
++ bus_state->bus_suspended = 0;
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port in polling\n");
++ return -EBUSY;
++ }
++
++ /* suspend ports in U0, or bail out for new connect changes */
++ if ((t1 & PORT_PE) && (t1 & PORT_PLS_MASK) == XDEV_U0) {
++ if ((t1 & PORT_CSC) && wake_enabled) {
++ bus_state->bus_suspended = 0;
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_stop_device(xhci, slot_id, 1);
+- spin_lock_irqsave(&xhci->lock, flags);
++ xhci_dbg(xhci, "Bus suspend bailout, port connect change\n");
++ return -EBUSY;
+ }
++ xhci_dbg(xhci, "port %d not suspended\n", port_index);
+ t2 &= ~PORT_PLS_MASK;
+ t2 |= PORT_LINK_STROBE | XDEV_U3;
+ set_bit(port_index, &bus_state->bus_suspended);
+@@ -1518,7 +1531,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ * including the USB 3.0 roothub, but only if CONFIG_PM
+ * is enabled, so also enable remote wake here.
+ */
+- if (hcd->self.root_hub->do_remote_wakeup) {
++ if (wake_enabled) {
+ if (t1 & PORT_CONNECT) {
+ t2 |= PORT_WKOC_E | PORT_WKDISC_E;
+ t2 &= ~PORT_WKCONN_E;
+@@ -1538,7 +1551,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+
+ t1 = xhci_port_state_to_neutral(t1);
+ if (t1 != t2)
+- writel(t2, ports[port_index]->addr);
++ portsc_buf[port_index] = t2;
++ }
++
++ /* write port settings, stopping and suspending ports if needed */
++ port_index = max_ports;
++ while (port_index--) {
++ if (!portsc_buf[port_index])
++ continue;
++ if (test_bit(port_index, &bus_state->bus_suspended)) {
++ int slot_id;
++
++ slot_id = xhci_find_slot_id_by_port(hcd, xhci,
++ port_index + 1);
++ if (slot_id) {
++ spin_unlock_irqrestore(&xhci->lock, flags);
++ xhci_stop_device(xhci, slot_id, 1);
++ spin_lock_irqsave(&xhci->lock, flags);
++ }
++ }
++ writel(portsc_buf[port_index], ports[port_index]->addr);
+ }
+ hcd->state = HC_STATE_SUSPENDED;
+ bus_state->next_statechange = jiffies + msecs_to_jiffies(10);
+diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
+index 71d0d33c3286..60987c787e44 100644
+--- a/drivers/usb/host/xhci-mtk.c
++++ b/drivers/usb/host/xhci-mtk.c
+@@ -590,12 +590,14 @@ static int xhci_mtk_remove(struct platform_device *dev)
+ struct xhci_hcd_mtk *mtk = platform_get_drvdata(dev);
+ struct usb_hcd *hcd = mtk->hcd;
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ device_init_wakeup(&dev->dev, false);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+ usb_put_hcd(hcd);
+ xhci_mtk_sch_exit(mtk);
+ xhci_mtk_clks_disable(mtk);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 51dd8e00c4f8..beeda27b3789 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -231,6 +231,11 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
+ xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
+
++ if ((pdev->vendor == PCI_VENDOR_ID_BROADCOM ||
++ pdev->vendor == PCI_VENDOR_ID_CAVIUM) &&
++ pdev->device == 0x9026)
++ xhci->quirks |= XHCI_RESET_PLL_ON_DISCONNECT;
++
+ if (xhci->quirks & XHCI_RESET_ON_RESUME)
+ xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
+ "QUIRK: Resetting on resume");
+@@ -356,6 +361,7 @@ static void xhci_pci_remove(struct pci_dev *dev)
+ if (xhci->shared_hcd) {
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
++ xhci->shared_hcd = NULL;
+ }
+
+ /* Workaround for spurious wakeups at shutdown with HSW */
+diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
+index 94e939249b2b..e5da8ce62914 100644
+--- a/drivers/usb/host/xhci-plat.c
++++ b/drivers/usb/host/xhci-plat.c
+@@ -359,14 +359,16 @@ static int xhci_plat_remove(struct platform_device *dev)
+ struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ struct clk *clk = xhci->clk;
+ struct clk *reg_clk = xhci->reg_clk;
++ struct usb_hcd *shared_hcd = xhci->shared_hcd;
+
+ xhci->xhc_state |= XHCI_STATE_REMOVING;
+
+- usb_remove_hcd(xhci->shared_hcd);
++ usb_remove_hcd(shared_hcd);
++ xhci->shared_hcd = NULL;
+ usb_phy_shutdown(hcd->usb_phy);
+
+ usb_remove_hcd(hcd);
+- usb_put_hcd(xhci->shared_hcd);
++ usb_put_hcd(shared_hcd);
+
+ clk_disable_unprepare(clk);
+ clk_disable_unprepare(reg_clk);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index cd4659703647..9ae17a666bdb 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1517,6 +1517,35 @@ static void handle_device_notification(struct xhci_hcd *xhci,
+ usb_wakeup_notification(udev->parent, udev->portnum);
+ }
+
++/*
++ * Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI
++ * Controller.
++ * As per ThunderX2errata-129 USB 2 device may come up as USB 1
++ * If a connection to a USB 1 device is followed by another connection
++ * to a USB 2 device.
++ *
++ * Reset the PHY after the USB device is disconnected if device speed
++ * is less than HCD_USB3.
++ * Retry the reset sequence max of 4 times checking the PLL lock status.
++ *
++ */
++static void xhci_cavium_reset_phy_quirk(struct xhci_hcd *xhci)
++{
++ struct usb_hcd *hcd = xhci_to_hcd(xhci);
++ u32 pll_lock_check;
++ u32 retry_count = 4;
++
++ do {
++ /* Assert PHY reset */
++ writel(0x6F, hcd->regs + 0x1048);
++ udelay(10);
++ /* De-assert the PHY reset */
++ writel(0x7F, hcd->regs + 0x1048);
++ udelay(200);
++ pll_lock_check = readl(hcd->regs + 0x1070);
++ } while (!(pll_lock_check & 0x1) && --retry_count);
++}
++
+ static void handle_port_status(struct xhci_hcd *xhci,
+ union xhci_trb *event)
+ {
+@@ -1552,6 +1581,13 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ }
+
++ /* We might get interrupts after shared_hcd is removed */
++ if (port->rhub == &xhci->usb3_rhub && xhci->shared_hcd == NULL) {
++ xhci_dbg(xhci, "ignore port event for removed USB3 hcd\n");
++ bogus_port_status = true;
++ goto cleanup;
++ }
++
+ hcd = port->rhub->hcd;
+ bus_state = &xhci->bus_state[hcd_index(hcd)];
+ hcd_portnum = port->hcd_portnum;
+@@ -1635,7 +1671,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ * RExit to a disconnect state). If so, let the the driver know it's
+ * out of the RExit state.
+ */
+- if (!DEV_SUPERSPEED_ANY(portsc) &&
++ if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
+ test_and_clear_bit(hcd_portnum,
+ &bus_state->rexit_ports)) {
+ complete(&bus_state->rexit_done[hcd_portnum]);
+@@ -1643,8 +1679,12 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ goto cleanup;
+ }
+
+- if (hcd->speed < HCD_USB3)
++ if (hcd->speed < HCD_USB3) {
+ xhci_test_and_clear_bit(xhci, port, PORT_PLC);
++ if ((xhci->quirks & XHCI_RESET_PLL_ON_DISCONNECT) &&
++ (portsc & PORT_CSC) && !(portsc & PORT_CONNECT))
++ xhci_cavium_reset_phy_quirk(xhci);
++ }
+
+ cleanup:
+ /* Update event ring dequeue pointer before dropping the lock */
+@@ -2247,6 +2287,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ goto cleanup;
+ case COMP_RING_UNDERRUN:
+ case COMP_RING_OVERRUN:
++ case COMP_STOPPED_LENGTH_INVALID:
+ goto cleanup;
+ default:
+ xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
+diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
+index 4b463e5202a4..b1cce989bd12 100644
+--- a/drivers/usb/host/xhci-tegra.c
++++ b/drivers/usb/host/xhci-tegra.c
+@@ -1240,6 +1240,7 @@ static int tegra_xusb_remove(struct platform_device *pdev)
+
+ usb_remove_hcd(xhci->shared_hcd);
+ usb_put_hcd(xhci->shared_hcd);
++ xhci->shared_hcd = NULL;
+ usb_remove_hcd(tegra->hcd);
+ usb_put_hcd(tegra->hcd);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 0420eefa647a..c928dbbff881 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -719,8 +719,6 @@ static void xhci_stop(struct usb_hcd *hcd)
+
+ /* Only halt host and free memory after both hcds are removed */
+ if (!usb_hcd_is_primary_hcd(hcd)) {
+- /* usb core will free this hcd shortly, unset pointer */
+- xhci->shared_hcd = NULL;
+ mutex_unlock(&xhci->mutex);
+ return;
+ }
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6230a578324c..e936e4c8af98 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1678,7 +1678,7 @@ struct xhci_bus_state {
+ * It can take up to 20 ms to transition from RExit to U0 on the
+ * Intel Lynx Point LP xHCI host.
+ */
+-#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000)
++#define XHCI_MAX_REXIT_TIMEOUT_MS 20
+
+ static inline unsigned int hcd_index(struct usb_hcd *hcd)
+ {
+@@ -1846,6 +1846,7 @@ struct xhci_hcd {
+ #define XHCI_SUSPEND_DELAY BIT_ULL(30)
+ #define XHCI_INTEL_USB_ROLE_SW BIT_ULL(31)
+ #define XHCI_ZERO_64B_REGS BIT_ULL(32)
++#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)
+
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
+index b0405d6aac85..48db9a9f13f9 100644
+--- a/fs/9p/vfs_dir.c
++++ b/fs/9p/vfs_dir.c
+@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstat *mistat)
+ return rettype;
+ }
+
+-static void p9stat_init(struct p9_wstat *stbuf)
+-{
+- stbuf->name = NULL;
+- stbuf->uid = NULL;
+- stbuf->gid = NULL;
+- stbuf->muid = NULL;
+- stbuf->extension = NULL;
+-}
+-
+ /**
+ * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir
+ * @filp: opened file structure
+@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file *file, struct dir_context *ctx)
+ rdir->tail = n;
+ }
+ while (rdir->head < rdir->tail) {
+- p9stat_init(&st);
+ err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
+ rdir->tail - rdir->head, &st);
+ if (err) {
+ p9_debug(P9_DEBUG_VFS, "returned %d\n", err);
+- p9stat_free(&st);
+ return -EIO;
+ }
+ reclen = st.size+2;
+diff --git a/fs/bfs/inode.c b/fs/bfs/inode.c
+index 9a69392f1fb3..d81c148682e7 100644
+--- a/fs/bfs/inode.c
++++ b/fs/bfs/inode.c
+@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
+
+ s->s_magic = BFS_MAGIC;
+
+- if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) {
++ if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end) ||
++ le32_to_cpu(bfs_sb->s_start) < BFS_BSIZE) {
+ printf("Superblock is corrupted\n");
+ goto out1;
+ }
+@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_block *s, void *data, int silent)
+ sizeof(struct bfs_inode)
+ + BFS_ROOT_INO - 1;
+ imap_len = (info->si_lasti / 8) + 1;
+- info->si_imap = kzalloc(imap_len, GFP_KERNEL);
+- if (!info->si_imap)
++ info->si_imap = kzalloc(imap_len, GFP_KERNEL | __GFP_NOWARN);
++ if (!info->si_imap) {
++ printf("Cannot allocate %u bytes\n", imap_len);
+ goto out1;
++ }
+ for (i = 0; i < BFS_ROOT_INO; i++)
+ set_bit(i, info->si_imap);
+
+diff --git a/fs/dax.c b/fs/dax.c
+index 0fb270f0a0ef..b0cd1364c68f 100644
+--- a/fs/dax.c
++++ b/fs/dax.c
+@@ -217,6 +217,9 @@ static inline void *unlock_slot(struct address_space *mapping, void **slot)
+ return (void *)entry;
+ }
+
++static void put_unlocked_mapping_entry(struct address_space *mapping,
++ pgoff_t index, void *entry);
++
+ /*
+ * Lookup entry in radix tree, wait for it to become unlocked if it is
+ * exceptional entry and return it. The caller must call
+@@ -256,8 +259,10 @@ static void *__get_unlocked_mapping_entry(struct address_space *mapping,
+ revalidate = wait_fn();
+ finish_wait(wq, &ewait.wait);
+ xa_lock_irq(&mapping->i_pages);
+- if (revalidate)
++ if (revalidate) {
++ put_unlocked_mapping_entry(mapping, index, entry);
+ return ERR_PTR(-EAGAIN);
++ }
+ }
+ }
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 8748539c04ed..7f8bb0868c0f 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -826,7 +826,7 @@ static int gfs2_iomap_get(struct inode *inode, loff_t pos, loff_t length,
+ ret = gfs2_meta_inode_buffer(ip, &dibh);
+ if (ret)
+ goto unlock;
+- iomap->private = dibh;
++ mp->mp_bh[0] = dibh;
+
+ if (gfs2_is_stuffed(ip)) {
+ if (flags & IOMAP_WRITE) {
+@@ -863,9 +863,6 @@ unstuff:
+ len = lblock_stop - lblock + 1;
+ iomap->length = len << inode->i_blkbits;
+
+- get_bh(dibh);
+- mp->mp_bh[0] = dibh;
+-
+ height = ip->i_height;
+ while ((lblock + 1) * sdp->sd_sb.sb_bsize > sdp->sd_heightsize[height])
+ height++;
+@@ -898,8 +895,6 @@ out:
+ iomap->bdev = inode->i_sb->s_bdev;
+ unlock:
+ up_read(&ip->i_rw_mutex);
+- if (ret && dibh)
+- brelse(dibh);
+ return ret;
+
+ do_alloc:
+@@ -980,9 +975,9 @@ static void gfs2_iomap_journaled_page_done(struct inode *inode, loff_t pos,
+
+ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ loff_t length, unsigned flags,
+- struct iomap *iomap)
++ struct iomap *iomap,
++ struct metapath *mp)
+ {
+- struct metapath mp = { .mp_aheight = 1, };
+ struct gfs2_inode *ip = GFS2_I(inode);
+ struct gfs2_sbd *sdp = GFS2_SB(inode);
+ unsigned int data_blocks = 0, ind_blocks = 0, rblocks;
+@@ -996,9 +991,9 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ unstuff = gfs2_is_stuffed(ip) &&
+ pos + length > gfs2_max_stuffed_size(ip);
+
+- ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
++ ret = gfs2_iomap_get(inode, pos, length, flags, iomap, mp);
+ if (ret)
+- goto out_release;
++ goto out_unlock;
+
+ alloc_required = unstuff || iomap->type == IOMAP_HOLE;
+
+@@ -1013,7 +1008,7 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+
+ ret = gfs2_quota_lock_check(ip, &ap);
+ if (ret)
+- goto out_release;
++ goto out_unlock;
+
+ ret = gfs2_inplace_reserve(ip, &ap);
+ if (ret)
+@@ -1038,17 +1033,15 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ ret = gfs2_unstuff_dinode(ip, NULL);
+ if (ret)
+ goto out_trans_end;
+- release_metapath(&mp);
+- brelse(iomap->private);
+- iomap->private = NULL;
++ release_metapath(mp);
+ ret = gfs2_iomap_get(inode, iomap->offset, iomap->length,
+- flags, iomap, &mp);
++ flags, iomap, mp);
+ if (ret)
+ goto out_trans_end;
+ }
+
+ if (iomap->type == IOMAP_HOLE) {
+- ret = gfs2_iomap_alloc(inode, iomap, flags, &mp);
++ ret = gfs2_iomap_alloc(inode, iomap, flags, mp);
+ if (ret) {
+ gfs2_trans_end(sdp);
+ gfs2_inplace_release(ip);
+@@ -1056,7 +1049,6 @@ static int gfs2_iomap_begin_write(struct inode *inode, loff_t pos,
+ goto out_qunlock;
+ }
+ }
+- release_metapath(&mp);
+ if (!gfs2_is_stuffed(ip) && gfs2_is_jdata(ip))
+ iomap->page_done = gfs2_iomap_journaled_page_done;
+ return 0;
+@@ -1069,10 +1061,7 @@ out_trans_fail:
+ out_qunlock:
+ if (alloc_required)
+ gfs2_quota_unlock(ip);
+-out_release:
+- if (iomap->private)
+- brelse(iomap->private);
+- release_metapath(&mp);
++out_unlock:
+ gfs2_write_unlock(inode);
+ return ret;
+ }
+@@ -1088,10 +1077,10 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+
+ trace_gfs2_iomap_start(ip, pos, length, flags);
+ if ((flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)) {
+- ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap);
++ ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
+ } else {
+ ret = gfs2_iomap_get(inode, pos, length, flags, iomap, &mp);
+- release_metapath(&mp);
++
+ /*
+ * Silently fall back to buffered I/O for stuffed files or if
+ * we've hot a hole (see gfs2_file_direct_write).
+@@ -1100,6 +1089,11 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
+ iomap->type != IOMAP_MAPPED)
+ ret = -ENOTBLK;
+ }
++ if (!ret) {
++ get_bh(mp.mp_bh[0]);
++ iomap->private = mp.mp_bh[0];
++ }
++ release_metapath(&mp);
+ trace_gfs2_iomap_end(ip, iomap, ret);
+ return ret;
+ }
+diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
+index 6b84ef6ccff3..b041cb8ae383 100644
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -72,13 +72,13 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
+ if (!sdp)
+ return NULL;
+
+- sb->s_fs_info = sdp;
+ sdp->sd_vfs = sb;
+ sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats);
+ if (!sdp->sd_lkstats) {
+ kfree(sdp);
+ return NULL;
+ }
++ sb->s_fs_info = sdp;
+
+ set_bit(SDF_NOJOURNALID, &sdp->sd_flags);
+ gfs2_tune_init(&sdp->sd_tune);
+diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
+index fa515d5ea5ba..7b861bbc0b43 100644
+--- a/fs/nfs/callback_proc.c
++++ b/fs/nfs/callback_proc.c
+@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp,
+ out_iput:
+ rcu_read_unlock();
+ trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status));
+ return res->status;
+@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp,
+ }
+ trace_nfs4_cb_recall(cps->clp, &args->fh, inode,
+ &args->stateid, -ntohl(res));
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ out:
+ dprintk("%s: exit with status = %d\n", __func__, ntohl(res));
+ return res;
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index f033f3a69a3b..75fe92eaa681 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -849,16 +849,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server,
+ const struct nfs_fh *fhandle)
+ {
+ struct nfs_delegation *delegation;
+- struct inode *res = NULL;
++ struct inode *freeme, *res = NULL;
+
+ list_for_each_entry_rcu(delegation, &server->delegations, super_list) {
+ spin_lock(&delegation->lock);
+ if (delegation->inode != NULL &&
+ nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) {
+- res = igrab(delegation->inode);
++ freeme = igrab(delegation->inode);
++ if (freeme && nfs_sb_active(freeme->i_sb))
++ res = freeme;
+ spin_unlock(&delegation->lock);
+ if (res != NULL)
+ return res;
++ if (freeme) {
++ rcu_read_unlock();
++ iput(freeme);
++ rcu_read_lock();
++ }
+ return ERR_PTR(-EAGAIN);
+ }
+ spin_unlock(&delegation->lock);
+diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
+index 94b52157bf8d..29dee9630eec 100644
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -115,12 +115,12 @@ static bool fanotify_should_send_event(struct fsnotify_iter_info *iter_info,
+ continue;
+ mark = iter_info->marks[type];
+ /*
+- * if the event is for a child and this inode doesn't care about
+- * events on the child, don't send it!
++ * If the event is for a child and this mark doesn't care about
++ * events on a child, don't send it!
+ */
+- if (type == FSNOTIFY_OBJ_TYPE_INODE &&
+- (event_mask & FS_EVENT_ON_CHILD) &&
+- !(mark->mask & FS_EVENT_ON_CHILD))
++ if (event_mask & FS_EVENT_ON_CHILD &&
++ (type != FSNOTIFY_OBJ_TYPE_INODE ||
++ !(mark->mask & FS_EVENT_ON_CHILD)))
+ continue;
+
+ marks_mask |= mark->mask;
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index f43ea1aad542..170a733454f7 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -161,9 +161,9 @@ int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u32 mask
+ parent = dget_parent(dentry);
+ p_inode = parent->d_inode;
+
+- if (unlikely(!fsnotify_inode_watches_children(p_inode)))
++ if (unlikely(!fsnotify_inode_watches_children(p_inode))) {
+ __fsnotify_update_child_dentry_flags(p_inode);
+- else if (p_inode->i_fsnotify_mask & mask) {
++ } else if (p_inode->i_fsnotify_mask & mask & ALL_FSNOTIFY_EVENTS) {
+ struct name_snapshot name;
+
+ /* we are notifying a parent so come up with the new mask which
+@@ -193,7 +193,7 @@ static int send_to_group(struct inode *to_tell,
+ struct fsnotify_iter_info *iter_info)
+ {
+ struct fsnotify_group *group = NULL;
+- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS);
+ __u32 marks_mask = 0;
+ __u32 marks_ignored_mask = 0;
+ struct fsnotify_mark *mark;
+@@ -324,14 +324,17 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
+ struct fsnotify_iter_info iter_info = {};
+ struct mount *mnt;
+ int ret = 0;
+- /* global tests shouldn't care about events on child only the specific event */
+- __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD);
++ __u32 test_mask = (mask & ALL_FSNOTIFY_EVENTS);
+
+ if (data_is == FSNOTIFY_EVENT_PATH)
+ mnt = real_mount(((const struct path *)data)->mnt);
+ else
+ mnt = NULL;
+
++ /* An event "on child" is not intended for a mount mark */
++ if (mask & FS_EVENT_ON_CHILD)
++ mnt = NULL;
++
+ /*
+ * Optimization: srcu_read_lock() has a memory barrier which can
+ * be expensive. It protects walking the *_fsnotify_marks lists.
+@@ -389,7 +392,7 @@ static __init int fsnotify_init(void)
+ {
+ int ret;
+
+- BUG_ON(hweight32(ALL_FSNOTIFY_EVENTS) != 23);
++ BUG_ON(hweight32(ALL_FSNOTIFY_BITS) != 23);
+
+ ret = init_srcu_struct(&fsnotify_mark_srcu);
+ if (ret)
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index a83e1f632eb7..f01623aef2f7 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -169,6 +169,7 @@ void can_change_state(struct net_device *dev, struct can_frame *cf,
+
+ void can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
+ unsigned int idx);
++struct sk_buff *__can_get_echo_skb(struct net_device *dev, unsigned int idx, u8 *len_ptr);
+ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx);
+ void can_free_echo_skb(struct net_device *dev, unsigned int idx);
+
+diff --git a/include/linux/can/rx-offload.h b/include/linux/can/rx-offload.h
+index cb31683bbe15..8268811a697e 100644
+--- a/include/linux/can/rx-offload.h
++++ b/include/linux/can/rx-offload.h
+@@ -41,7 +41,12 @@ int can_rx_offload_add_timestamp(struct net_device *dev, struct can_rx_offload *
+ int can_rx_offload_add_fifo(struct net_device *dev, struct can_rx_offload *offload, unsigned int weight);
+ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 reg);
+ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload);
+-int can_rx_offload_irq_queue_err_skb(struct can_rx_offload *offload, struct sk_buff *skb);
++int can_rx_offload_queue_sorted(struct can_rx_offload *offload,
++ struct sk_buff *skb, u32 timestamp);
++unsigned int can_rx_offload_get_echo_skb(struct can_rx_offload *offload,
++ unsigned int idx, u32 timestamp);
++int can_rx_offload_queue_tail(struct can_rx_offload *offload,
++ struct sk_buff *skb);
+ void can_rx_offload_reset(struct can_rx_offload *offload);
+ void can_rx_offload_del(struct can_rx_offload *offload);
+ void can_rx_offload_enable(struct can_rx_offload *offload);
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index b8f4182f42f1..4599d1c95f8c 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -68,15 +68,20 @@
+
+ #define ALL_FSNOTIFY_PERM_EVENTS (FS_OPEN_PERM | FS_ACCESS_PERM)
+
++/* Events that can be reported to backends */
+ #define ALL_FSNOTIFY_EVENTS (FS_ACCESS | FS_MODIFY | FS_ATTRIB | \
+ FS_CLOSE_WRITE | FS_CLOSE_NOWRITE | FS_OPEN | \
+ FS_MOVED_FROM | FS_MOVED_TO | FS_CREATE | \
+ FS_DELETE | FS_DELETE_SELF | FS_MOVE_SELF | \
+ FS_UNMOUNT | FS_Q_OVERFLOW | FS_IN_IGNORED | \
+- FS_OPEN_PERM | FS_ACCESS_PERM | FS_EXCL_UNLINK | \
+- FS_ISDIR | FS_IN_ONESHOT | FS_DN_RENAME | \
++ FS_OPEN_PERM | FS_ACCESS_PERM | FS_DN_RENAME)
++
++/* Extra flags that may be reported with event or control handling of events */
++#define ALL_FSNOTIFY_FLAGS (FS_EXCL_UNLINK | FS_ISDIR | FS_IN_ONESHOT | \
+ FS_DN_MULTISHOT | FS_EVENT_ON_CHILD)
+
++#define ALL_FSNOTIFY_BITS (ALL_FSNOTIFY_EVENTS | ALL_FSNOTIFY_FLAGS)
++
+ struct fsnotify_group;
+ struct fsnotify_event;
+ struct fsnotify_mark;
+diff --git a/include/linux/pfn_t.h b/include/linux/pfn_t.h
+index 21713dc14ce2..673546ba7342 100644
+--- a/include/linux/pfn_t.h
++++ b/include/linux/pfn_t.h
+@@ -10,7 +10,7 @@
+ * PFN_DEV - pfn is not covered by system memmap by default
+ * PFN_MAP - pfn has a dynamic page mapping established by a device driver
+ */
+-#define PFN_FLAGS_MASK (((u64) ~PAGE_MASK) << (BITS_PER_LONG_LONG - PAGE_SHIFT))
++#define PFN_FLAGS_MASK (((u64) (~PAGE_MASK)) << (BITS_PER_LONG_LONG - PAGE_SHIFT))
+ #define PFN_SG_CHAIN (1ULL << (BITS_PER_LONG_LONG - 1))
+ #define PFN_SG_LAST (1ULL << (BITS_PER_LONG_LONG - 2))
+ #define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3))
+diff --git a/include/net/sock.h b/include/net/sock.h
+index c64a1cff9eb3..f18dbd6da906 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1491,6 +1491,7 @@ static inline void lock_sock(struct sock *sk)
+ lock_sock_nested(sk, 0);
+ }
+
++void __release_sock(struct sock *sk);
+ void release_sock(struct sock *sk);
+
+ /* BH context may only use the following locking interface. */
+diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
+index ed5d34925ad0..6a4b41484afe 100644
+--- a/kernel/debug/kdb/kdb_io.c
++++ b/kernel/debug/kdb/kdb_io.c
+@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)
+ int count;
+ int i;
+ int diag, dtab_count;
+- int key;
++ int key, buf_size, ret;
+
+
+ diag = kdbgetintenv("DTABCOUNT", &dtab_count);
+@@ -336,9 +336,8 @@ poll_again:
+ else
+ p_tmp = tmpbuffer;
+ len = strlen(p_tmp);
+- count = kallsyms_symbol_complete(p_tmp,
+- sizeof(tmpbuffer) -
+- (p_tmp - tmpbuffer));
++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer);
++ count = kallsyms_symbol_complete(p_tmp, buf_size);
+ if (tab == 2 && count > 0) {
+ kdb_printf("\n%d symbols are found.", count);
+ if (count > dtab_count) {
+@@ -350,9 +349,13 @@ poll_again:
+ }
+ kdb_printf("\n");
+ for (i = 0; i < count; i++) {
+- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
++ ret = kallsyms_symbol_next(p_tmp, i, buf_size);
++ if (WARN_ON(!ret))
+ break;
+- kdb_printf("%s ", p_tmp);
++ if (ret != -E2BIG)
++ kdb_printf("%s ", p_tmp);
++ else
++ kdb_printf("%s... ", p_tmp);
+ *(p_tmp + len) = '\0';
+ }
+ if (i >= dtab_count)
+diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h
+index 1e5a502ba4a7..2118d8258b7c 100644
+--- a/kernel/debug/kdb/kdb_private.h
++++ b/kernel/debug/kdb/kdb_private.h
+@@ -83,7 +83,7 @@ typedef struct __ksymtab {
+ unsigned long sym_start;
+ unsigned long sym_end;
+ } kdb_symtab_t;
+-extern int kallsyms_symbol_next(char *prefix_name, int flag);
++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size);
+ extern int kallsyms_symbol_complete(char *prefix_name, int max_len);
+
+ /* Exported Symbols for kernel loadable modules to use. */
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 987eb73284d2..b14b0925c184 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)
+ * Parameters:
+ * prefix_name prefix of a symbol name to lookup
+ * flag 0 means search from the head, 1 means continue search.
++ * buf_size maximum length that can be written to prefix_name
++ * buffer
+ * Returns:
+ * 1 if a symbol matches the given prefix.
+ * 0 if no string found
+ */
+-int kallsyms_symbol_next(char *prefix_name, int flag)
++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size)
+ {
+ int prefix_len = strlen(prefix_name);
+ static loff_t pos;
+@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag)
+ pos = 0;
+
+ while ((name = kdb_walk_kallsyms(&pos))) {
+- if (strncmp(name, prefix_name, prefix_len) == 0) {
+- strncpy(prefix_name, name, strlen(name)+1);
+- return 1;
+- }
++ if (!strncmp(name, prefix_name, prefix_len))
++ return strscpy(prefix_name, name, buf_size);
+ }
+ return 0;
+ }
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 0b760c1369f7..15301ed19da6 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -2662,6 +2662,15 @@ void rcu_check_callbacks(int user)
+ rcu_bh_qs();
+ }
+ rcu_preempt_check_callbacks();
++ /* The load-acquire pairs with the store-release setting to true. */
++ if (smp_load_acquire(this_cpu_ptr(&rcu_dynticks.rcu_urgent_qs))) {
++ /* Idle and userspace execution already are quiescent states. */
++ if (!rcu_is_cpu_rrupt_from_idle() && !user) {
++ set_tsk_need_resched(current);
++ set_preempt_need_resched();
++ }
++ __this_cpu_write(rcu_dynticks.rcu_urgent_qs, false);
++ }
+ if (rcu_pending())
+ invoke_rcu_core();
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 908c9cdae2f0..1162552dc3cc 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -5672,11 +5672,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p,
+ return target;
+ }
+
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p);
++static unsigned long cpu_util_without(int cpu, struct task_struct *p);
+
+-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p)
++static unsigned long capacity_spare_without(int cpu, struct task_struct *p)
+ {
+- return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0);
++ return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0);
+ }
+
+ /*
+@@ -5736,7 +5736,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p,
+
+ avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs);
+
+- spare_cap = capacity_spare_wake(i, p);
++ spare_cap = capacity_spare_without(i, p);
+
+ if (spare_cap > max_spare_cap)
+ max_spare_cap = spare_cap;
+@@ -5887,8 +5887,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p
+ return prev_cpu;
+
+ /*
+- * We need task's util for capacity_spare_wake, sync it up to prev_cpu's
+- * last_update_time.
++ * We need task's util for capacity_spare_without, sync it up to
++ * prev_cpu's last_update_time.
+ */
+ if (!(sd_flag & SD_BALANCE_FORK))
+ sync_entity_load_avg(&p->se);
+@@ -6214,10 +6214,19 @@ static inline unsigned long cpu_util(int cpu)
+ }
+
+ /*
+- * cpu_util_wake: Compute CPU utilization with any contributions from
+- * the waking task p removed.
++ * cpu_util_without: compute cpu utilization without any contributions from *p
++ * @cpu: the CPU which utilization is requested
++ * @p: the task which utilization should be discounted
++ *
++ * The utilization of a CPU is defined by the utilization of tasks currently
++ * enqueued on that CPU as well as tasks which are currently sleeping after an
++ * execution on that CPU.
++ *
++ * This method returns the utilization of the specified CPU by discounting the
++ * utilization of the specified task, whenever the task is currently
++ * contributing to the CPU utilization.
+ */
+-static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
++static unsigned long cpu_util_without(int cpu, struct task_struct *p)
+ {
+ struct cfs_rq *cfs_rq;
+ unsigned int util;
+@@ -6229,7 +6238,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ cfs_rq = &cpu_rq(cpu)->cfs;
+ util = READ_ONCE(cfs_rq->avg.util_avg);
+
+- /* Discount task's blocked util from CPU's util */
++ /* Discount task's util from CPU's util */
+ util -= min_t(unsigned int, util, task_util(p));
+
+ /*
+@@ -6238,14 +6247,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * a) if *p is the only task sleeping on this CPU, then:
+ * cpu_util (== task_util) > util_est (== 0)
+ * and thus we return:
+- * cpu_util_wake = (cpu_util - task_util) = 0
++ * cpu_util_without = (cpu_util - task_util) = 0
+ *
+ * b) if other tasks are SLEEPING on this CPU, which is now exiting
+ * IDLE, then:
+ * cpu_util >= task_util
+ * cpu_util > util_est (== 0)
+ * and thus we discount *p's blocked utilization to return:
+- * cpu_util_wake = (cpu_util - task_util) >= 0
++ * cpu_util_without = (cpu_util - task_util) >= 0
+ *
+ * c) if other tasks are RUNNABLE on that CPU and
+ * util_est > cpu_util
+@@ -6258,8 +6267,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p)
+ * covered by the following code when estimated utilization is
+ * enabled.
+ */
+- if (sched_feat(UTIL_EST))
+- util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued));
++ if (sched_feat(UTIL_EST)) {
++ unsigned int estimated =
++ READ_ONCE(cfs_rq->avg.util_est.enqueued);
++
++ /*
++ * Despite the following checks we still have a small window
++ * for a possible race, when an execl's select_task_rq_fair()
++ * races with LB's detach_task():
++ *
++ * detach_task()
++ * p->on_rq = TASK_ON_RQ_MIGRATING;
++ * ---------------------------------- A
++ * deactivate_task() \
++ * dequeue_task() + RaceTime
++ * util_est_dequeue() /
++ * ---------------------------------- B
++ *
++ * The additional check on "current == p" it's required to
++ * properly fix the execl regression and it helps in further
++ * reducing the chances for the above race.
++ */
++ if (unlikely(task_on_rq_queued(p) || current == p)) {
++ estimated -= min_t(unsigned int, estimated,
++ (_task_util_est(p) | UTIL_AVG_UNCHANGED));
++ }
++ util = max(util, estimated);
++ }
+
+ /*
+ * Utilization (estimated) can exceed the CPU capacity, thus let's
+diff --git a/mm/memory.c b/mm/memory.c
+index c467102a5cbc..5c5df53dbdf9 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3745,10 +3745,36 @@ static vm_fault_t do_fault(struct vm_fault *vmf)
+ struct vm_area_struct *vma = vmf->vma;
+ vm_fault_t ret;
+
+- /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+- if (!vma->vm_ops->fault)
+- ret = VM_FAULT_SIGBUS;
+- else if (!(vmf->flags & FAULT_FLAG_WRITE))
++ /*
++ * The VMA was not fully populated on mmap() or missing VM_DONTEXPAND
++ */
++ if (!vma->vm_ops->fault) {
++ /*
++ * If we find a migration pmd entry or a none pmd entry, which
++ * should never happen, return SIGBUS
++ */
++ if (unlikely(!pmd_present(*vmf->pmd)))
++ ret = VM_FAULT_SIGBUS;
++ else {
++ vmf->pte = pte_offset_map_lock(vmf->vma->vm_mm,
++ vmf->pmd,
++ vmf->address,
++ &vmf->ptl);
++ /*
++ * Make sure this is not a temporary clearing of pte
++ * by holding ptl and checking again. A R/M/W update
++ * of pte involves: take ptl, clearing the pte so that
++ * we don't have concurrent modification by hardware
++ * followed by an update.
++ */
++ if (unlikely(pte_none(*vmf->pte)))
++ ret = VM_FAULT_SIGBUS;
++ else
++ ret = VM_FAULT_NOPAGE;
++
++ pte_unmap_unlock(vmf->pte, vmf->ptl);
++ }
++ } else if (!(vmf->flags & FAULT_FLAG_WRITE))
+ ret = do_read_fault(vmf);
+ else if (!(vma->vm_flags & VM_SHARED))
+ ret = do_cow_fault(vmf);
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index e2ef1c17942f..b721631d78ab 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4055,17 +4055,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
+ unsigned int cpuset_mems_cookie;
+ int reserve_flags;
+
+- /*
+- * In the slowpath, we sanity check order to avoid ever trying to
+- * reclaim >= MAX_ORDER areas which will never succeed. Callers may
+- * be using allocators in order of preference for an area that is
+- * too large.
+- */
+- if (order >= MAX_ORDER) {
+- WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
+- return NULL;
+- }
+-
+ /*
+ * We also sanity check to catch abuse of atomic reserves being used by
+ * callers that are not in atomic context.
+@@ -4359,6 +4348,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid,
+ gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */
+ struct alloc_context ac = { };
+
++ /*
++ * There are several places where we assume that the order value is sane
++ * so bail out early if the request is out of bound.
++ */
++ if (unlikely(order >= MAX_ORDER)) {
++ WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN));
++ return NULL;
++ }
++
+ gfp_mask &= gfp_allowed_mask;
+ alloc_mask = gfp_mask;
+ if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags))
+@@ -7690,6 +7688,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count,
+ if (PageReserved(page))
+ goto unmovable;
+
++ /*
++ * If the zone is movable and we have ruled out all reserved
++ * pages then it should be reasonably safe to assume the rest
++ * is movable.
++ */
++ if (zone_idx(zone) == ZONE_MOVABLE)
++ continue;
++
+ /*
+ * Hugepages are not in LRU lists, but they're movable.
+ * We need not scan over tail pages bacause we don't
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 446942677cd4..38d228a30fdc 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2610,9 +2610,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)
+ inode_lock(inode);
+ /* We're holding i_mutex so we can access i_size directly */
+
+- if (offset < 0)
+- offset = -EINVAL;
+- else if (offset >= inode->i_size)
++ if (offset < 0 || offset >= inode->i_size)
+ offset = -ENXIO;
+ else {
+ start = offset >> PAGE_SHIFT;
+diff --git a/mm/slab.c b/mm/slab.c
+index aa76a70e087e..d73c7a4820a4 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3675,6 +3675,8 @@ __do_kmalloc_node(size_t size, gfp_t flags, int node, unsigned long caller)
+ struct kmem_cache *cachep;
+ void *ret;
+
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
++ return NULL;
+ cachep = kmalloc_slab(size, flags);
+ if (unlikely(ZERO_OR_NULL_PTR(cachep)))
+ return cachep;
+@@ -3710,6 +3712,8 @@ static __always_inline void *__do_kmalloc(size_t size, gfp_t flags,
+ struct kmem_cache *cachep;
+ void *ret;
+
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE))
++ return NULL;
+ cachep = kmalloc_slab(size, flags);
+ if (unlikely(ZERO_OR_NULL_PTR(cachep)))
+ return cachep;
+diff --git a/mm/slab_common.c b/mm/slab_common.c
+index fea3376f9816..3a7ac4f15194 100644
+--- a/mm/slab_common.c
++++ b/mm/slab_common.c
+@@ -1027,18 +1027,18 @@ struct kmem_cache *kmalloc_slab(size_t size, gfp_t flags)
+ {
+ unsigned int index;
+
+- if (unlikely(size > KMALLOC_MAX_SIZE)) {
+- WARN_ON_ONCE(!(flags & __GFP_NOWARN));
+- return NULL;
+- }
+-
+ if (size <= 192) {
+ if (!size)
+ return ZERO_SIZE_PTR;
+
+ index = size_index[size_index_elem(size)];
+- } else
++ } else {
++ if (unlikely(size > KMALLOC_MAX_CACHE_SIZE)) {
++ WARN_ON(1);
++ return NULL;
++ }
+ index = fls(size - 1);
++ }
+
+ #ifdef CONFIG_ZONE_DMA
+ if (unlikely((flags & GFP_DMA)))
+diff --git a/mm/z3fold.c b/mm/z3fold.c
+index 4b366d181f35..aee9b0b8d907 100644
+--- a/mm/z3fold.c
++++ b/mm/z3fold.c
+@@ -99,6 +99,7 @@ struct z3fold_header {
+ #define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)
+
+ #define BUDDY_MASK (0x3)
++#define BUDDY_SHIFT 2
+
+ /**
+ * struct z3fold_pool - stores metadata for each z3fold pool
+@@ -145,7 +146,7 @@ enum z3fold_page_flags {
+ MIDDLE_CHUNK_MAPPED,
+ NEEDS_COMPACTING,
+ PAGE_STALE,
+- UNDER_RECLAIM
++ PAGE_CLAIMED, /* by either reclaim or free */
+ };
+
+ /*****************
+@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page,
+ clear_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ clear_bit(NEEDS_COMPACTING, &page->private);
+ clear_bit(PAGE_STALE, &page->private);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+
+ spin_lock_init(&zhdr->page_lock);
+ kref_init(&zhdr->refcount);
+@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)
+ unsigned long handle;
+
+ handle = (unsigned long)zhdr;
+- if (bud != HEADLESS)
+- handle += (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud != HEADLESS) {
++ handle |= (bud + zhdr->first_num) & BUDDY_MASK;
++ if (bud == LAST)
++ handle |= (zhdr->last_chunks << BUDDY_SHIFT);
++ }
+ return handle;
+ }
+
+@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle)
+ return (struct z3fold_header *)(handle & PAGE_MASK);
+ }
+
++/* only for LAST bud, returns zero otherwise */
++static unsigned short handle_to_chunks(unsigned long handle)
++{
++ return (handle & ~PAGE_MASK) >> BUDDY_SHIFT;
++}
++
+ /*
+ * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle
+ * but that doesn't matter. because the masking will result in the
+@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ page = virt_to_page(zhdr);
+
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+- /* HEADLESS page stored */
+- bud = HEADLESS;
+- } else {
+- z3fold_page_lock(zhdr);
+- bud = handle_to_buddy(handle);
+-
+- switch (bud) {
+- case FIRST:
+- zhdr->first_chunks = 0;
+- break;
+- case MIDDLE:
+- zhdr->middle_chunks = 0;
+- zhdr->start_middle = 0;
+- break;
+- case LAST:
+- zhdr->last_chunks = 0;
+- break;
+- default:
+- pr_err("%s: unknown bud %d\n", __func__, bud);
+- WARN_ON(1);
+- z3fold_page_unlock(zhdr);
+- return;
++ /* if a headless page is under reclaim, just leave.
++ * NB: we use test_and_set_bit for a reason: if the bit
++ * has not been set before, we release this page
++ * immediately so we don't care about its value any more.
++ */
++ if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) {
++ spin_lock(&pool->lock);
++ list_del(&page->lru);
++ spin_unlock(&pool->lock);
++ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ }
++ return;
+ }
+
+- if (bud == HEADLESS) {
+- spin_lock(&pool->lock);
+- list_del(&page->lru);
+- spin_unlock(&pool->lock);
+- free_z3fold_page(page);
+- atomic64_dec(&pool->pages_nr);
++ /* Non-headless case */
++ z3fold_page_lock(zhdr);
++ bud = handle_to_buddy(handle);
++
++ switch (bud) {
++ case FIRST:
++ zhdr->first_chunks = 0;
++ break;
++ case MIDDLE:
++ zhdr->middle_chunks = 0;
++ break;
++ case LAST:
++ zhdr->last_chunks = 0;
++ break;
++ default:
++ pr_err("%s: unknown bud %d\n", __func__, bud);
++ WARN_ON(1);
++ z3fold_page_unlock(zhdr);
+ return;
+ }
+
+@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)
+ atomic64_dec(&pool->pages_nr);
+ return;
+ }
+- if (test_bit(UNDER_RECLAIM, &page->private)) {
++ if (test_bit(PAGE_CLAIMED, &page->private)) {
+ z3fold_page_unlock(zhdr);
+ return;
+ }
+@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries)
+ }
+ list_for_each_prev(pos, &pool->lru) {
+ page = list_entry(pos, struct page, lru);
++
++ /* this bit could have been set by free, in which case
++ * we pass over to the next page in the pool.
++ */
++ if (test_and_set_bit(PAGE_CLAIMED, &page->private))
++ continue;
++
++ zhdr = page_address(page);
+ if (test_bit(PAGE_HEADLESS, &page->private))
+- /* candidate found */
+ break;
+
+- zhdr = page_address(page);
+- if (!z3fold_page_trylock(zhdr))
++ if (!z3fold_page_trylock(zhdr)) {
++ zhdr = NULL;
+ continue; /* can't evict at this point */
++ }
+ kref_get(&zhdr->refcount);
+ list_del_init(&zhdr->buddy);
+ zhdr->cpu = -1;
+- set_bit(UNDER_RECLAIM, &page->private);
+ break;
+ }
+
++ if (!zhdr)
++ break;
++
+ list_del_init(&page->lru);
+ spin_unlock(&pool->lock);
+
+@@ -898,6 +920,7 @@ next:
+ if (test_bit(PAGE_HEADLESS, &page->private)) {
+ if (ret == 0) {
+ free_z3fold_page(page);
++ atomic64_dec(&pool->pages_nr);
+ return 0;
+ }
+ spin_lock(&pool->lock);
+@@ -905,7 +928,7 @@ next:
+ spin_unlock(&pool->lock);
+ } else {
+ z3fold_page_lock(zhdr);
+- clear_bit(UNDER_RECLAIM, &page->private);
++ clear_bit(PAGE_CLAIMED, &page->private);
+ if (kref_put(&zhdr->refcount,
+ release_z3fold_page_locked)) {
+ atomic64_dec(&pool->pages_nr);
+@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle)
+ set_bit(MIDDLE_CHUNK_MAPPED, &page->private);
+ break;
+ case LAST:
+- addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT);
++ addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT);
+ break;
+ default:
+ pr_err("unknown buddy id %d\n", buddy);
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 1051eee82581..3aab7664933f 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ } else
+ ifindex = ro->ifindex;
+
+- if (ro->fd_frames) {
++ dev = dev_get_by_index(sock_net(sk), ifindex);
++ if (!dev)
++ return -ENXIO;
++
++ err = -EINVAL;
++ if (ro->fd_frames && dev->mtu == CANFD_MTU) {
+ if (unlikely(size != CANFD_MTU && size != CAN_MTU))
+- return -EINVAL;
++ goto put_dev;
+ } else {
+ if (unlikely(size != CAN_MTU))
+- return -EINVAL;
++ goto put_dev;
+ }
+
+- dev = dev_get_by_index(sock_net(sk), ifindex);
+- if (!dev)
+- return -ENXIO;
+-
+ skb = sock_alloc_send_skb(sk, size + sizeof(struct can_skb_priv),
+ msg->msg_flags & MSG_DONTWAIT, &err);
+ if (!skb)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 3730eb855095..748765e35423 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2317,7 +2317,7 @@ static void __lock_sock(struct sock *sk)
+ finish_wait(&sk->sk_lock.wq, &wait);
+ }
+
+-static void __release_sock(struct sock *sk)
++void __release_sock(struct sock *sk)
+ __releases(&sk->sk_lock.slock)
+ __acquires(&sk->sk_lock.slock)
+ {
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index bbd07736fb0f..a32a0f4cc138 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2403,16 +2403,10 @@ adjudge_to_death:
+ sock_hold(sk);
+ sock_orphan(sk);
+
+- /* It is the last release_sock in its life. It will remove backlog. */
+- release_sock(sk);
+-
+-
+- /* Now socket is owned by kernel and we acquire BH lock
+- * to finish close. No need to check for user refs.
+- */
+ local_bh_disable();
+ bh_lock_sock(sk);
+- WARN_ON(sock_owned_by_user(sk));
++ /* remove backlog if any, without releasing ownership. */
++ __release_sock(sk);
+
+ percpu_counter_inc(sk->sk_prot->orphan_count);
+
+@@ -2481,6 +2475,7 @@ adjudge_to_death:
+ out:
+ bh_unlock_sock(sk);
+ local_bh_enable();
++ release_sock(sk);
+ sock_put(sk);
+ }
+ EXPORT_SYMBOL(tcp_close);
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 1beeea9549fa..b99e73a7e7e0 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -730,7 +730,6 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ struct sk_buff *skb = NULL;
+ struct sock *sk = sock->sk;
+ struct llc_sock *llc = llc_sk(sk);
+- unsigned long cpu_flags;
+ size_t copied = 0;
+ u32 peek_seq = 0;
+ u32 *seq, skb_len;
+@@ -855,9 +854,8 @@ static int llc_ui_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ goto copy_uaddr;
+
+ if (!(flags & MSG_PEEK)) {
+- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
+- sk_eat_skb(sk, skb);
+- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
++ skb_unlink(skb, &sk->sk_receive_queue);
++ kfree_skb(skb);
+ *seq = 0;
+ }
+
+@@ -878,9 +876,8 @@ copy_uaddr:
+ llc_cmsg_rcv(msg, skb);
+
+ if (!(flags & MSG_PEEK)) {
+- spin_lock_irqsave(&sk->sk_receive_queue.lock, cpu_flags);
+- sk_eat_skb(sk, skb);
+- spin_unlock_irqrestore(&sk->sk_receive_queue.lock, cpu_flags);
++ skb_unlink(skb, &sk->sk_receive_queue);
++ kfree_skb(skb);
+ *seq = 0;
+ }
+
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index a827a1f562bf..6a28b96e779e 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -499,8 +499,9 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
+ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ struct sctp_transport *peer)
+ {
+- struct list_head *pos;
+- struct sctp_transport *transport;
++ struct sctp_transport *transport;
++ struct list_head *pos;
++ struct sctp_chunk *ch;
+
+ pr_debug("%s: association:%p addr:%pISpc\n",
+ __func__, asoc, &peer->ipaddr.sa);
+@@ -564,7 +565,6 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ */
+ if (!list_empty(&peer->transmitted)) {
+ struct sctp_transport *active = asoc->peer.active_path;
+- struct sctp_chunk *ch;
+
+ /* Reset the transport of each chunk on this list */
+ list_for_each_entry(ch, &peer->transmitted,
+@@ -586,6 +586,10 @@ void sctp_assoc_rm_peer(struct sctp_association *asoc,
+ sctp_transport_hold(active);
+ }
+
++ list_for_each_entry(ch, &asoc->outqueue.out_chunk_list, list)
++ if (ch->transport == peer)
++ ch->transport = NULL;
++
+ asoc->peer.transport_count--;
+
+ sctp_transport_free(peer);
+diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
+index f1df9837f1ac..1ac08dcbf85d 100644
+--- a/net/sunrpc/auth_generic.c
++++ b/net/sunrpc/auth_generic.c
+@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred)
+ {
+ struct auth_cred *acred = &container_of(cred, struct generic_cred,
+ gc_base)->acred;
+- bool ret;
+-
+- get_rpccred(cred);
+- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+- put_rpccred(cred);
+-
+- return ret;
++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags);
+ }
+
+ static const struct rpc_credops generic_credops = {
+diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
+index e9394e7adc84..f4eadd3f7350 100644
+--- a/security/selinux/ss/policydb.c
++++ b/security/selinux/ss/policydb.c
+@@ -1101,7 +1101,7 @@ static int str_read(char **strp, gfp_t flags, void *fp, u32 len)
+ if ((len == 0) || (len == (u32)-1))
+ return -EINVAL;
+
+- str = kmalloc(len + 1, flags);
++ str = kmalloc(len + 1, flags | __GFP_NOWARN);
+ if (!str)
+ return -ENOMEM;
+
+diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
+index f8d4a419f3af..467039b342b5 100644
+--- a/sound/core/oss/pcm_oss.c
++++ b/sound/core/oss/pcm_oss.c
+@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream)
+ runtime->oss.channels = params_channels(params);
+ runtime->oss.rate = params_rate(params);
+
+- vfree(runtime->oss.buffer);
+- runtime->oss.buffer = vmalloc(runtime->oss.period_bytes);
++ kvfree(runtime->oss.buffer);
++ runtime->oss.buffer = kvzalloc(runtime->oss.period_bytes, GFP_KERNEL);
+ if (!runtime->oss.buffer) {
+ err = -ENOMEM;
+ goto failure;
+@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime;
+ runtime = substream->runtime;
+- vfree(runtime->oss.buffer);
++ kvfree(runtime->oss.buffer);
+ runtime->oss.buffer = NULL;
+ #ifdef CONFIG_SND_PCM_OSS_PLUGINS
+ snd_pcm_oss_plugin_clear(substream);
+diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c
+index 0391cb1a4f19..71571d992159 100644
+--- a/sound/core/oss/pcm_plugin.c
++++ b/sound/core/oss/pcm_plugin.c
+@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct snd_pcm_plugin *plugin, snd_pcm_uframes_t
+ return -ENXIO;
+ size /= 8;
+ if (plugin->buf_frames < frames) {
+- vfree(plugin->buf);
+- plugin->buf = vmalloc(size);
++ kvfree(plugin->buf);
++ plugin->buf = kvzalloc(size, GFP_KERNEL);
+ plugin->buf_frames = frames;
+ }
+ if (!plugin->buf) {
+@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_plugin *plugin)
+ if (plugin->private_free)
+ plugin->private_free(plugin);
+ kfree(plugin->buf_channels);
+- vfree(plugin->buf);
++ kvfree(plugin->buf);
+ kfree(plugin);
+ return 0;
+ }
+diff --git a/tools/power/cpupower/bench/Makefile b/tools/power/cpupower/bench/Makefile
+index d79ab161cc75..f68b4bc55273 100644
+--- a/tools/power/cpupower/bench/Makefile
++++ b/tools/power/cpupower/bench/Makefile
+@@ -9,7 +9,7 @@ endif
+ ifeq ($(strip $(STATIC)),true)
+ LIBS = -L../ -L$(OUTPUT) -lm
+ OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \
+- $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o
++ $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o
+ else
+ LIBS = -L../ -L$(OUTPUT) -lm -lcpupower
+ OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
+diff --git a/tools/power/cpupower/lib/cpufreq.c b/tools/power/cpupower/lib/cpufreq.c
+index 1b993fe1ce23..0c0f3e3f0d80 100644
+--- a/tools/power/cpupower/lib/cpufreq.c
++++ b/tools/power/cpupower/lib/cpufreq.c
+@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_file(unsigned int cpu, const char *fname,
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/cpufreq/%s",
+ cpu, fname);
+- return sysfs_read_file(path, buf, buflen);
++ return cpupower_read_sysfs(path, buf, buflen);
+ }
+
+ /* helper function to write a new value to a /sys file */
+diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
+index 9bd4c7655fdb..852d25462388 100644
+--- a/tools/power/cpupower/lib/cpuidle.c
++++ b/tools/power/cpupower/lib/cpuidle.c
+@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_file(const char *fname, char *buf,
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpuidle/%s", fname);
+
+- return sysfs_read_file(path, buf, buflen);
++ return cpupower_read_sysfs(path, buf, buflen);
+ }
+
+
+diff --git a/tools/power/cpupower/lib/cpupower.c b/tools/power/cpupower/lib/cpupower.c
+index 9c395ec924de..9711d628b0f4 100644
+--- a/tools/power/cpupower/lib/cpupower.c
++++ b/tools/power/cpupower/lib/cpupower.c
+@@ -15,7 +15,7 @@
+ #include "cpupower.h"
+ #include "cpupower_intern.h"
+
+-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen)
++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen)
+ {
+ int fd;
+ ssize_t numread;
+@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsigned int cpu, const char *fname, int *re
+
+ snprintf(path, sizeof(path), PATH_TO_CPU "cpu%u/topology/%s",
+ cpu, fname);
+- if (sysfs_read_file(path, linebuf, MAX_LINE_LEN) == 0)
++ if (cpupower_read_sysfs(path, linebuf, MAX_LINE_LEN) == 0)
+ return -1;
+ *result = strtol(linebuf, &endp, 0);
+ if (endp == linebuf || errno == ERANGE)
+diff --git a/tools/power/cpupower/lib/cpupower_intern.h b/tools/power/cpupower/lib/cpupower_intern.h
+index 92affdfbe417..4887c76d23f8 100644
+--- a/tools/power/cpupower/lib/cpupower_intern.h
++++ b/tools/power/cpupower/lib/cpupower_intern.h
+@@ -3,4 +3,4 @@
+ #define MAX_LINE_LEN 4096
+ #define SYSFS_PATH_MAX 255
+
+-unsigned int sysfs_read_file(const char *path, char *buf, size_t buflen);
++unsigned int cpupower_read_sysfs(const char *path, char *buf, size_t buflen);
+diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
+index cffc2c5a778d..ec50d2a95076 100644
+--- a/tools/testing/nvdimm/test/nfit.c
++++ b/tools/testing/nvdimm/test/nfit.c
+@@ -139,8 +139,8 @@ static u32 handle[] = {
+ [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1),
+ };
+
+-static unsigned long dimm_fail_cmd_flags[NUM_DCR];
+-static int dimm_fail_cmd_code[NUM_DCR];
++static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)];
++static int dimm_fail_cmd_code[ARRAY_SIZE(handle)];
+
+ static const struct nd_intel_smart smart_def = {
+ .flags = ND_INTEL_SMART_HEALTH_VALID
+@@ -203,7 +203,7 @@ struct nfit_test {
+ unsigned long deadline;
+ spinlock_t lock;
+ } ars_state;
+- struct device *dimm_dev[NUM_DCR];
++ struct device *dimm_dev[ARRAY_SIZE(handle)];
+ struct nd_intel_smart *smart;
+ struct nd_intel_smart_threshold *smart_threshold;
+ struct badrange badrange;
+@@ -2678,7 +2678,7 @@ static int nfit_test_probe(struct platform_device *pdev)
+ u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle;
+ int i;
+
+- for (i = 0; i < NUM_DCR; i++)
++ for (i = 0; i < ARRAY_SIZE(handle); i++)
+ if (nfit_handle == handle[i])
+ dev_set_drvdata(nfit_test->dimm_dev[i],
+ nfit_mem);
next reply other threads:[~2018-12-01 15:08 UTC|newest]
Thread overview: 332+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-12-01 15:08 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-04-18 3:06 [gentoo-commits] proj/linux-patches:4.19 commit in: / Alice Ferrazzi
2023-09-02 9:59 Mike Pagano
2023-08-30 15:00 Mike Pagano
2023-08-16 16:59 Mike Pagano
2023-08-11 11:58 Mike Pagano
2023-08-08 18:43 Mike Pagano
2023-07-24 20:30 Mike Pagano
2023-06-28 10:29 Mike Pagano
2023-06-21 14:55 Alice Ferrazzi
2023-06-14 10:21 Mike Pagano
2023-06-09 11:32 Mike Pagano
2023-05-30 12:57 Mike Pagano
2023-05-17 11:14 Mike Pagano
2023-05-17 11:01 Mike Pagano
2023-05-10 17:59 Mike Pagano
2023-04-26 9:35 Alice Ferrazzi
2023-04-20 11:17 Alice Ferrazzi
2023-04-05 11:41 Mike Pagano
2023-03-22 14:16 Alice Ferrazzi
2023-03-17 10:46 Mike Pagano
2023-03-13 11:35 Alice Ferrazzi
2023-03-11 16:01 Mike Pagano
2023-03-03 12:31 Mike Pagano
2023-02-25 11:41 Mike Pagano
2023-02-24 3:19 Alice Ferrazzi
2023-02-24 3:15 Alice Ferrazzi
2023-02-22 14:51 Alice Ferrazzi
2023-02-06 12:49 Mike Pagano
2023-01-24 7:16 Alice Ferrazzi
2023-01-18 11:11 Mike Pagano
2022-12-14 12:15 Mike Pagano
2022-12-08 12:14 Alice Ferrazzi
2022-11-25 17:04 Mike Pagano
2022-11-23 9:39 Alice Ferrazzi
2022-11-10 17:58 Mike Pagano
2022-11-03 15:11 Mike Pagano
2022-11-01 19:48 Mike Pagano
2022-10-26 11:41 Mike Pagano
2022-10-05 11:59 Mike Pagano
2022-09-28 9:18 Mike Pagano
2022-09-20 12:03 Mike Pagano
2022-09-15 11:09 Mike Pagano
2022-09-05 12:06 Mike Pagano
2022-08-25 10:35 Mike Pagano
2022-08-11 12:36 Mike Pagano
2022-07-29 15:28 Mike Pagano
2022-07-21 20:12 Mike Pagano
2022-07-12 16:01 Mike Pagano
2022-07-07 16:18 Mike Pagano
2022-07-02 16:07 Mike Pagano
2022-06-25 10:22 Mike Pagano
2022-06-16 11:40 Mike Pagano
2022-06-14 16:02 Mike Pagano
2022-06-06 11:05 Mike Pagano
2022-05-27 12:24 Mike Pagano
2022-05-25 11:55 Mike Pagano
2022-05-18 9:50 Mike Pagano
2022-05-15 22:12 Mike Pagano
2022-05-12 11:30 Mike Pagano
2022-05-01 17:04 Mike Pagano
2022-04-27 12:03 Mike Pagano
2022-04-20 12:09 Mike Pagano
2022-04-15 13:11 Mike Pagano
2022-04-12 19:24 Mike Pagano
2022-03-28 10:59 Mike Pagano
2022-03-23 11:57 Mike Pagano
2022-03-16 13:27 Mike Pagano
2022-03-11 10:56 Mike Pagano
2022-03-08 18:30 Mike Pagano
2022-03-02 13:08 Mike Pagano
2022-02-26 21:14 Mike Pagano
2022-02-23 12:39 Mike Pagano
2022-02-16 12:47 Mike Pagano
2022-02-11 12:53 Mike Pagano
2022-02-11 12:46 Mike Pagano
2022-02-11 12:45 Mike Pagano
2022-02-11 12:37 Mike Pagano
2022-02-08 17:56 Mike Pagano
2022-01-29 17:45 Mike Pagano
2022-01-27 11:39 Mike Pagano
2022-01-11 13:14 Mike Pagano
2022-01-05 12:55 Mike Pagano
2021-12-29 13:11 Mike Pagano
2021-12-22 14:07 Mike Pagano
2021-12-14 10:36 Mike Pagano
2021-12-08 12:55 Mike Pagano
2021-12-01 12:51 Mike Pagano
2021-11-26 11:59 Mike Pagano
2021-11-12 14:16 Mike Pagano
2021-11-06 13:26 Mike Pagano
2021-11-02 19:32 Mike Pagano
2021-10-27 11:59 Mike Pagano
2021-10-20 13:26 Mike Pagano
2021-10-17 13:12 Mike Pagano
2021-10-13 15:00 Alice Ferrazzi
2021-10-09 21:33 Mike Pagano
2021-10-06 14:06 Mike Pagano
2021-09-26 14:13 Mike Pagano
2021-09-22 11:40 Mike Pagano
2021-09-20 22:05 Mike Pagano
2021-09-03 11:22 Mike Pagano
2021-09-03 10:08 Alice Ferrazzi
2021-08-26 14:06 Mike Pagano
2021-08-25 22:45 Mike Pagano
2021-08-25 20:41 Mike Pagano
2021-08-15 20:07 Mike Pagano
2021-08-12 11:51 Mike Pagano
2021-08-08 13:39 Mike Pagano
2021-08-04 11:54 Mike Pagano
2021-08-03 12:26 Mike Pagano
2021-07-31 10:34 Alice Ferrazzi
2021-07-28 12:37 Mike Pagano
2021-07-20 15:35 Alice Ferrazzi
2021-07-13 12:38 Mike Pagano
2021-07-11 14:45 Mike Pagano
2021-06-30 14:25 Mike Pagano
2021-06-16 12:22 Mike Pagano
2021-06-10 11:46 Mike Pagano
2021-06-03 10:32 Alice Ferrazzi
2021-05-26 12:05 Mike Pagano
2021-05-22 10:03 Mike Pagano
2021-05-07 11:40 Alice Ferrazzi
2021-04-30 19:02 Mike Pagano
2021-04-28 18:31 Mike Pagano
2021-04-28 11:44 Alice Ferrazzi
2021-04-16 11:15 Alice Ferrazzi
2021-04-14 11:22 Alice Ferrazzi
2021-04-10 13:24 Mike Pagano
2021-04-07 12:21 Mike Pagano
2021-03-30 14:17 Mike Pagano
2021-03-24 12:08 Mike Pagano
2021-03-22 15:50 Mike Pagano
2021-03-20 14:26 Mike Pagano
2021-03-17 16:21 Mike Pagano
2021-03-11 14:05 Mike Pagano
2021-03-07 15:15 Mike Pagano
2021-03-04 12:08 Mike Pagano
2021-02-23 14:31 Alice Ferrazzi
2021-02-13 15:28 Alice Ferrazzi
2021-02-10 10:03 Alice Ferrazzi
2021-02-07 14:40 Alice Ferrazzi
2021-02-03 23:43 Mike Pagano
2021-01-30 13:34 Alice Ferrazzi
2021-01-27 11:15 Mike Pagano
2021-01-23 16:36 Mike Pagano
2021-01-19 20:34 Mike Pagano
2021-01-17 16:20 Mike Pagano
2021-01-12 20:06 Mike Pagano
2021-01-09 12:57 Mike Pagano
2021-01-06 14:15 Mike Pagano
2020-12-30 12:52 Mike Pagano
2020-12-11 12:56 Mike Pagano
2020-12-08 12:06 Mike Pagano
2020-12-02 12:49 Mike Pagano
2020-11-24 14:40 Mike Pagano
2020-11-22 19:26 Mike Pagano
2020-11-18 19:56 Mike Pagano
2020-11-11 15:43 Mike Pagano
2020-11-10 13:56 Mike Pagano
2020-11-05 12:35 Mike Pagano
2020-11-01 20:29 Mike Pagano
2020-10-29 11:18 Mike Pagano
2020-10-17 10:17 Mike Pagano
2020-10-14 20:36 Mike Pagano
2020-10-07 12:50 Mike Pagano
2020-10-01 12:45 Mike Pagano
2020-09-26 22:07 Mike Pagano
2020-09-26 22:00 Mike Pagano
2020-09-24 15:58 Mike Pagano
2020-09-23 12:07 Mike Pagano
2020-09-17 15:01 Mike Pagano
2020-09-17 14:55 Mike Pagano
2020-09-12 17:59 Mike Pagano
2020-09-09 17:59 Mike Pagano
2020-09-03 11:37 Mike Pagano
2020-08-26 11:15 Mike Pagano
2020-08-21 10:49 Alice Ferrazzi
2020-08-19 9:36 Alice Ferrazzi
2020-08-12 23:36 Alice Ferrazzi
2020-08-07 19:16 Mike Pagano
2020-08-05 14:51 Thomas Deutschmann
2020-07-31 18:00 Mike Pagano
2020-07-29 12:33 Mike Pagano
2020-07-22 12:42 Mike Pagano
2020-07-16 11:17 Mike Pagano
2020-07-09 12:12 Mike Pagano
2020-07-01 12:14 Mike Pagano
2020-06-29 17:41 Mike Pagano
2020-06-25 15:07 Mike Pagano
2020-06-22 14:47 Mike Pagano
2020-06-10 21:27 Mike Pagano
2020-06-07 21:52 Mike Pagano
2020-06-03 11:41 Mike Pagano
2020-05-27 16:25 Mike Pagano
2020-05-20 11:30 Mike Pagano
2020-05-20 11:27 Mike Pagano
2020-05-14 11:30 Mike Pagano
2020-05-13 12:33 Mike Pagano
2020-05-11 22:50 Mike Pagano
2020-05-09 22:20 Mike Pagano
2020-05-06 11:46 Mike Pagano
2020-05-02 19:24 Mike Pagano
2020-04-29 17:57 Mike Pagano
2020-04-23 11:44 Mike Pagano
2020-04-21 11:15 Mike Pagano
2020-04-17 11:45 Mike Pagano
2020-04-15 17:09 Mike Pagano
2020-04-13 11:34 Mike Pagano
2020-04-02 15:24 Mike Pagano
2020-03-25 14:58 Mike Pagano
2020-03-20 11:57 Mike Pagano
2020-03-18 14:21 Mike Pagano
2020-03-16 12:23 Mike Pagano
2020-03-11 17:20 Mike Pagano
2020-03-05 16:23 Mike Pagano
2020-02-28 16:38 Mike Pagano
2020-02-24 11:06 Mike Pagano
2020-02-19 23:45 Mike Pagano
2020-02-14 23:52 Mike Pagano
2020-02-11 16:20 Mike Pagano
2020-02-05 17:05 Mike Pagano
2020-02-01 10:37 Mike Pagano
2020-02-01 10:30 Mike Pagano
2020-01-29 16:16 Mike Pagano
2020-01-27 14:25 Mike Pagano
2020-01-23 11:07 Mike Pagano
2020-01-17 19:56 Mike Pagano
2020-01-14 22:30 Mike Pagano
2020-01-12 15:00 Mike Pagano
2020-01-09 11:15 Mike Pagano
2020-01-04 19:50 Mike Pagano
2019-12-31 17:46 Mike Pagano
2019-12-21 15:03 Mike Pagano
2019-12-17 21:56 Mike Pagano
2019-12-13 12:35 Mike Pagano
2019-12-05 12:03 Alice Ferrazzi
2019-12-01 14:06 Thomas Deutschmann
2019-11-24 15:44 Mike Pagano
2019-11-20 19:36 Mike Pagano
2019-11-12 21:00 Mike Pagano
2019-11-10 16:20 Mike Pagano
2019-11-06 14:26 Mike Pagano
2019-10-29 12:04 Mike Pagano
2019-10-17 22:27 Mike Pagano
2019-10-11 17:04 Mike Pagano
2019-10-07 17:42 Mike Pagano
2019-10-05 11:42 Mike Pagano
2019-10-01 10:10 Mike Pagano
2019-09-21 17:11 Mike Pagano
2019-09-19 12:34 Mike Pagano
2019-09-19 10:04 Mike Pagano
2019-09-16 12:26 Mike Pagano
2019-09-10 11:12 Mike Pagano
2019-09-06 17:25 Mike Pagano
2019-08-29 14:15 Mike Pagano
2019-08-25 17:37 Mike Pagano
2019-08-23 22:18 Mike Pagano
2019-08-16 12:26 Mike Pagano
2019-08-16 12:13 Mike Pagano
2019-08-09 17:45 Mike Pagano
2019-08-06 19:19 Mike Pagano
2019-08-04 16:15 Mike Pagano
2019-07-31 15:09 Mike Pagano
2019-07-31 10:22 Mike Pagano
2019-07-28 16:27 Mike Pagano
2019-07-26 11:35 Mike Pagano
2019-07-21 14:41 Mike Pagano
2019-07-14 15:44 Mike Pagano
2019-07-10 11:05 Mike Pagano
2019-07-03 11:34 Mike Pagano
2019-06-25 10:53 Mike Pagano
2019-06-22 19:06 Mike Pagano
2019-06-19 17:17 Thomas Deutschmann
2019-06-17 19:22 Mike Pagano
2019-06-15 15:07 Mike Pagano
2019-06-11 12:42 Mike Pagano
2019-06-10 19:43 Mike Pagano
2019-06-09 16:19 Mike Pagano
2019-06-04 11:11 Mike Pagano
2019-05-31 15:02 Mike Pagano
2019-05-26 17:10 Mike Pagano
2019-05-22 11:02 Mike Pagano
2019-05-16 23:03 Mike Pagano
2019-05-14 21:00 Mike Pagano
2019-05-10 19:40 Mike Pagano
2019-05-08 10:06 Mike Pagano
2019-05-05 13:42 Mike Pagano
2019-05-04 18:28 Mike Pagano
2019-05-02 10:13 Mike Pagano
2019-04-27 17:36 Mike Pagano
2019-04-20 11:09 Mike Pagano
2019-04-19 19:51 Mike Pagano
2019-04-05 21:46 Mike Pagano
2019-04-03 10:59 Mike Pagano
2019-03-27 10:22 Mike Pagano
2019-03-23 20:23 Mike Pagano
2019-03-19 16:58 Mike Pagano
2019-03-13 22:08 Mike Pagano
2019-03-10 14:15 Mike Pagano
2019-03-06 19:06 Mike Pagano
2019-03-05 18:04 Mike Pagano
2019-02-27 11:23 Mike Pagano
2019-02-23 11:35 Mike Pagano
2019-02-23 0:46 Mike Pagano
2019-02-20 11:19 Mike Pagano
2019-02-16 0:42 Mike Pagano
2019-02-15 12:39 Mike Pagano
2019-02-12 20:53 Mike Pagano
2019-02-06 17:08 Mike Pagano
2019-01-31 11:28 Mike Pagano
2019-01-26 15:09 Mike Pagano
2019-01-22 23:06 Mike Pagano
2019-01-16 23:32 Mike Pagano
2019-01-13 19:29 Mike Pagano
2019-01-09 17:54 Mike Pagano
2018-12-29 18:55 Mike Pagano
2018-12-29 1:08 Mike Pagano
2018-12-21 14:58 Mike Pagano
2018-12-19 19:09 Mike Pagano
2018-12-17 11:42 Mike Pagano
2018-12-13 11:40 Mike Pagano
2018-12-08 13:17 Mike Pagano
2018-12-08 13:17 Mike Pagano
2018-12-05 20:16 Mike Pagano
2018-11-27 16:16 Mike Pagano
2018-11-23 12:42 Mike Pagano
2018-11-21 12:30 Mike Pagano
2018-11-14 0:47 Mike Pagano
2018-11-14 0:47 Mike Pagano
2018-11-13 20:44 Mike Pagano
2018-11-04 16:22 Alice Ferrazzi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1543676871.3c846c91f5b30fcc7c4adbb519f42d972fd9cfd4.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox